CN104581710B - A method and system for securely transmitting LTE user IMSI on an air interface - Google Patents

Abstract

The invention discloses a method and a system for safely transmitting L TE user IMSI on an air interface, wherein the method comprises the steps of 1) respectively configuring IMSI safety transmission capacities of a base station and a terminal, broadcasting the configured safety transmission capacity information by the base station, 2) analyzing broadcast information by the terminal and carrying out IMSI safety transmission negotiation with the base station, selecting a key extraction method and an encryption and decryption algorithm between the terminal and the base station, 3) extracting an encryption key from physical layer information of a set downlink subframe by the terminal according to the negotiated key extraction method and sending an uplink signal to the base station in an uplink time slot, 4) extracting a decryption key from the uplink signal by the base station according to the key extraction method, 5) encrypting an attachment request message and IMSI in an identification response message of an initial attachment process by the terminal and then sending the encrypted IMSI to the base station, and decrypting the IMSI from the received message by the base station by using the decryption key and the selected decryption algorithm.

Description

A method and system for securely transmitting LTE user IMSI on an air interface

technical field

The invention relates to the field of wireless communication physical layers, in particular to an LTE wireless communication system, and proposes a method and system for securely transmitting an LTE user IMSI on an air interface.

Background technique

The International Mobile Subscriber Identity (IMSI) belongs to the privacy of mobile users. Especially for sensitive and important users, the leakage of their IMSI may lead to important security incidents. Therefore, transmission of IMSI in clear text over the air interface should be avoided. . However, in the current public land mobile network, some service processes still need to transmit the IMSI over the air interface in plain text. Although there are many improvement methods, it is still impossible to completely avoid transmitting the IMSI over the air interface in plain text. For an LTE network, during the initial attachment process or when the network fails, the terminal needs to report the user's IMSI to the network in the Non-Access Stratum Signaling (NAS) message, otherwise, the network cannot determine the user corresponding to the terminal . At the same time, in the current LTE network security architecture, since the network does not know which user the message comes from at this stage, and the security association has not been established, the terminal side cannot encrypt the signaling, and the network side cannot decrypt it. In the LTE network, there are two NAS messages that transmit the IMSI over the air interface in plain text: the Attach Request message (AttachRequest) during the initial attach process and the Identity Response message (IdentityResponse), where the former is encapsulated in the RRC connection establishment during the initial attach process Complete (RRCConnectionComplete) message. An attacker can easily make the terminal reinitiate the initial attach process and obtain the user's IMSI from the air interface before two-way authentication; the attacker can also use the AttachRequest message or IdentityResponse message in the normal process to obtain the user's IMSI from the air interface.

In addition, many broadband private networks are built on the basis of LTE and Evolved Packet Core Network (EPC). It is also necessary to transmit the IMSI in clear text on the air interface in the AttachRequest message and the IdentityResponse message during the initial attachment process. is an important security risk.

Contents of the invention

The present invention proposes a method and system for securely transmitting an LTE user IMSI over an air interface. To transmit IMSI, it is also necessary to adapt to the different support capabilities of different base stations and different terminals for IMSI secure transmission, and to ensure compatibility with network devices and terminals that do not support IMSI secure transmission.

The wireless physical layer security technology can utilize the uniqueness and reciprocity characteristics of the wireless channel to realize key agreement and encrypted transmission. Therefore, the present invention integrates the physical layer security technology into the LTE physical layer processing, and according to the current LTE signal Order and message flow, and design a set of method and device for securely transmitting LTE user IMSI on the air interface, so as to completely avoid transmitting the IMSI in clear text on the air interface.

In the current LTE network, only the AttachRequest message and the IdentityResponse message in the initial attachment process will transmit the IMSI on the air interface in plain text. In order to avoid transmitting the IMSI on the air interface in plain text, it is necessary to complete the IMSI secure transmission negotiation and key negotiation when the AttachRequest is sent during the initial attach process.

A method for safely transmitting the LTE user IMSI on the air interface proposed by the present invention, its implementation steps are as follows:

1. IMSI security transmission configuration of the base station. Configure various parameters of the base station's IMSI secure transmission capability, such as: whether to support IMSI secure transmission, which key extraction methods and encryption and decryption algorithms are supported, etc.

2. IMSI security transmission configuration of the terminal. Configure the parameters of the terminal's IMSI secure transmission capability, such as: whether to support IMSI secure transmission, which key extraction methods and encryption and decryption algorithms are supported.

3. Broadcasting of IMSI security transmission capability parameters of the base station. The base station broadcasts its IMSI security transmission capability parameters in the cell through the broadcast channel in the form of system information.

4. The terminal receives and analyzes the IMSI security transmission capability parameter of the base station. During the cell search process, the terminal parses and saves the base station IMSI secure transmission capability information in the cell system information of the base station, and preferentially selects the base station with the IMSI secure transmission function during the cell selection process.

5. IMSI secure transmission negotiation. The terminal and the base station use and extend the RRC Connection Establishment Request (RRCConnectionRequest) and RRCConnectionSetup (RRCConnectionSetup) messages of the Radio Resource Control (RRC) connection establishment process to complete the IMSI secure transmission negotiation; the terminal selects according to the IMSI secure transmission capabilities of itself and the base station Whether to enable the IMSI secure transmission function, as well as the key extraction method and encryption and decryption algorithm, are confirmed by the base station; when the terminal receives the RRCConnectionSetup message, it parses the IMSI secure transmission negotiation feedback information.

6. Negotiation of encryption and decryption keys.

a) The terminal extracts the encryption key from the physical layer information of the downlink subframe that receives the RRCConnectionSetup message and the following downlink subframes according to the negotiated key extraction method; the terminal uses the cell-specific reference signal (CRS), and the base station uses Uplink demodulation reference signal (DMRS) or sounding reference signal (SRS), analyze wireless channel characteristics, extract encryption and decryption keys; and the time slots of the used CRS and DMRS (or SRS) signals are as close as possible in time.

b) The terminal sends an RRC connection establishment complete (RRCConnectionComplete) message to the base station in the uplink time slot specified by the scheduling;

c) After receiving the RRCConnectionComplete message, the base station uses the selected key extraction algorithm to extract the decryption key from the uplink signal and store it in the IMSI secure transmission association database on the base station.

7. IMSI encryption and decryption in the AttachRequest message during the initial attachment process.

a) The terminal uses the encryption key and the selected encryption algorithm to encrypt the IMSI in the AttachRequest message during the initial attach process;

b) The terminal encapsulates the AttachRequest message containing the encrypted IMSI in the RRCConnectionComplete message, and then sends the RRCConnectionComplete message to the base station in the scheduled uplink time slot;

c) The base station decrypts the encrypted IMSI in the AttachRequest message by using the negotiated decryption key and decryption algorithm, and then sends the AttachRequest message to the Mobility Management Entity (MME).

8. IMSI encryption and decryption in the IdentityResponse message. When the terminal needs to send an IdentityResponse message to the core network, it encrypts the IMSI in the IdentityResponse with the saved encryption key; when the base station receives the IdentityResponse message, it decrypts the IMSI in the IdentityResponse message with the saved decryption key, and then sends the IdentityResponse message to the core network.

A system for safely transmitting an LTE user IMSI on an air interface proposed by the present invention includes: a device for securely transmitting IMSI on a base station and a device for securely transmitting IMSI on a terminal.

The IMSI secure transmission device on the base station proposed by the present invention includes: a base station IMSI secure transmission capability configuration module, which is used to configure and store the IMSI secure transmission capability parameters of the base station; a base station IMSI secure transmission capability broadcast module, which is used to send system information to The terminal in the cell broadcasts the IMSI security transmission capability parameters of the base station; the IMSI security transmission association database on the base station is used to store the IMSI security transmission association information with the terminal; the IMSI security transmission negotiation module on the base station is used to negotiate with the terminal whether to enable IMSI security Transmission function, key extraction method and encryption and decryption algorithm; the encryption and decryption key negotiation module on the base station is used to extract the decryption key from the uplink physical signal; the decryption module on the base station is used to encrypt the encrypted IMSI in the AttachRequest and IdentityResponse messages decrypt.

The IMSI secure transmission device on the terminal proposed by the present invention includes: a terminal IMSI secure transmission capability configuration module, which is used to configure and store the IMSI secure transmission capability parameters of the terminal; a terminal IMSI secure transmission capability receiving module, which is used to receive and analyze the base station IMSI security Transmission capability parameters; the IMSI secure transmission association database on the terminal is used to store the IMSI secure transmission association information with the base station; the IMSI secure transmission negotiation module on the terminal is used to negotiate with the base station whether to enable the IMSI secure transmission function, key extraction method and An encryption and decryption algorithm; an encryption and decryption key negotiation module on the terminal, which is used to extract the encryption key from the downlink physical signal; an encryption module on the terminal, which is used to encrypt the IMSI in the AttachRequest and IdentityResponse messages.

The method described in the present invention is not only applicable to the LTE system, but also applicable to the LTE-A system.

Compared with prior art, positive effect of the present invention is:

The present invention completely avoids the transmission of IMSI in clear text on the air interface without changing the LTE network architecture and security architecture and minimizes the impact on the LTE network, and has strong adaptability, and at the same time can ensure the network that does not support IMSI secure transmission Device and terminal compatible.

Description of drawings

Figure 1 is a functional model of an LTE base station and a terminal;

(a) LTE base station function model, (b) LTE terminal function model;

Fig. 2 is the IMSI secure transmission device on the base station;

FIG. 3 is an IMSI secure transmission device on a terminal;

Fig. 4 is the flow that realizes the IMSI secure transmission method on the air interface;

Fig. 5 is a message flow of implementing the IMSI secure transmission method on the air interface.

Detailed ways

The implementation of the present invention will be described in detail below in conjunction with the accompanying drawings and examples. The implementation cases are implemented on the premise of the technical solution of the present invention, and the detailed implementation and specific operation process are given. It should be noted that, as long as there is no conflict, each embodiment and each feature in each embodiment of the present invention can be combined with each other, and the formed technical solutions are all within the protection scope of the present invention.

Example:

This embodiment describes in detail the method for securely transmitting an LTE user IMSI over an air interface proposed by the present invention in combination with a TD-LTE system. Figure 1 is the current LTE base station and LTE terminal models.

The current LTE base station includes radio frequency transceiver, physical layer processing, medium access control (MAC) layer processing, radio link control (RLC) layer processing, packet data convergence protocol (PDCP) layer processing, radio resource control (RRC) processing, Non-access stratum signaling (NAS) forwarding, base station management and other functional modules, LTE terminals include RF transceiver, physical layer processing, MAC layer processing, RLC layer processing, PDCP layer processing, RRC processing, NAS processing, interface and management functions module.

FIG. 2 is a block diagram of an IMSI secure transmission device 200 on a base station. The device 200 is used to securely transmit LTE user IMSI over the air interface, including a base station IMSI secure transmission capability configuration module 201, a base station IMSI secure transmission capability broadcast module 202, a base station IMSI secure transmission association database 203, a base station IMSI secure transmission negotiation module 204, and a base station An encryption and decryption key negotiation module 205 and a decryption module 206 on the base station.

1) The base station IMSI security transmission capability configuration module 201 is used to configure and store the IMSI security transmission capability parameters of the base station. This module is related to the base station management module 118 and can be used as an enhanced function of "base station management".

2) The base station IMSI security transmission capability broadcasting module 202 is used to broadcast the IMSI security transmission capability parameters of the base station to the terminals in the cell in the form of system information. This module is related to the RRC processing module 116 on the base station and can be used as "RRC processing on the base station" enhancements.

3) The IMSI secure transmission association database 203 on the base station is used to store the IMSI secure transmission association information with the terminal, mainly including the results of IMSI secure transmission negotiation and encryption/decryption key negotiation, and provides the decryption key to the decryption module 206 on the base station. key is a newly added function.

4) The IMSI secure transmission negotiation module 204 on the base station is used to negotiate with the terminal whether to enable the IMSI secure transmission function, the key extraction method and the encryption and decryption algorithm. It needs to use the RRC processing module 116 on the base station, which can be used as the "RRC processing on the base station" Enhanced functionality.

5) The encryption and decryption key negotiation module 205 on the base station is used to extract the decryption key from the uplink physical signal, which is related to the physical layer processing 112 on the base station and can be used as an enhanced function of "physical layer processing on the base station".

6) The decryption module 206 on the base station is used to decrypt the encrypted IMSI in the AttachRequest and IdentityResponse messages, and then the NAS forwarding 117 on the base station sends the AttachRequest and IdentityResponse messages carrying the decrypted IMSI to the MME, and the decryption module 206 on the base station communicates with the The encryption and decryption functions in the PDCP layer processing module 115 are related, and can be used as an enhanced function of "PDCP layer processing on the base station".

Fig. 3 is a block diagram of an apparatus 300 for IMSI secure transmission on a terminal. The device 300 is used to securely transmit the LTE user IMSI on the air interface, including a terminal IMSI secure transmission capability configuration module 301, a terminal on the base station IMSI secure transmission capability receiving module 302, a terminal on the IMSI secure transmission association database 303, and a terminal on the IMSI secure transmission negotiation module 304. An encryption and decryption key negotiating module 305 on the terminal, and an encryption module 306 on the terminal.

1) The terminal IMSI security transmission capability configuration module 301 is used to configure and store the IMSI security transmission capability parameters of the terminal. This module is related to the interface and management module 128 and can be used as an enhanced function of "interface and management".

2) The base station IMSI security transmission capability receiving module 302 on the terminal is used to receive and analyze the base station IMSI security transmission capability parameter. This module is related to the RRC processing module 126 on the terminal and can be used as an enhanced function of "RRC processing on the terminal".

3) The IMSI secure transmission association database 303 on the terminal is used to store the IMSI secure transmission association information with the base station, mainly including the results of IMSI secure transmission negotiation and encryption/decryption key negotiation, and provide the encryption key to the encryption module 306 on the terminal. key is a newly added function. The key is stored in an encrypted manner and can be placed in the USIM.

4) The IMSI secure transmission negotiation module 304 on the terminal is used to negotiate with the base station whether to enable the IMSI secure transmission function, the key extraction method and the encryption and decryption algorithm. It needs to use the RRC processing module 126 on the terminal, which can be used as the "RRC processing on the terminal" Enhanced functionality.

5) The encryption and decryption key negotiation module 305 on the terminal is used to extract the encryption key from the uplink physical signal, which is related to the physical layer processing 122 on the terminal and can be used as an enhanced function of "physical layer processing on the terminal".

6) The encryption module 306 on the terminal is used to encrypt the IMSI in the AttachRequest and IdentityResponse messages, which is related to the PDCP layer processing module 125 on the terminal, and can be used as an enhanced function of "PDCP layer processing on the terminal".

Fig. 4 is a flowchart of a method for securely transmitting an LTE user IMSI over an air interface according to an embodiment of the present invention, and Fig. 5 is a corresponding message flow. This method is described in detail based on this embodiment.

IMSI security transmission configuration of the base station (step 401). Only a base station equipped with an IMSI secure transmission device needs to perform step 401 . Configure the parameters of the IMSI secure transmission capability of the base station through the base station IMSI secure transmission capability configuration module (201), including: whether to support IMSI secure transmission, which key extraction methods and encryption and decryption algorithms are supported; and then, create an IMSI secure transmission association on the base station database (203).

IMSI security transmission configuration of the terminal (step 402). Only a terminal equipped with an IMSI secure transmission device needs to perform step 402 . Configure IMSI secure transmission capability parameters for the terminal through the terminal IMSI secure transmission capability configuration module (301), including: whether to support IMSI secure transmission, supported key extraction methods and encryption and decryption algorithms, etc.; then, create an associated database for IMSI secure transmission on the terminal (303).

The IMSI security transmission capability parameter of the base station is broadcast (step 403). Only the base station equipped with the IMSI secure transmission device needs to perform step 403 . The base station IMSI security transmission capability broadcast module (202) broadcasts the IMSI security transmission capability parameter of the base station in the form of system information (501) through the RRC processing module (116) on the base station.

The terminal receives and analyzes the IMSI security transmission capability parameter of the base station (step 404). Only a terminal equipped with an IMSI security transmission device needs to perform step 404 . During the cell search process of the terminal, the base station IMSI secure transmission capability receiving module (302) on the terminal parses the "IMSI secure transmission capability of the base station" information in the SIB, and stores this information together with the cell ID in the IMSI secure transmission association database on the terminal ( 303); if the "IMSI secure transmission capability of the base station" information is not found, then it is considered that the base station is not configured with the IMSI secure transmission device (200); the terminal preferentially selects the base station equipped with the IMSI secure transmission device (300) in the cell selection process.

IMSI security transport negotiation (step 405). When the terminal equipped with the IMSI secure transmission device (300) finds that the base station is also equipped with the IMSI secure transmission device (200), step 405 is performed.

1) In step 405, the IMSI secure transmission negotiation module (304) on the terminal selects whether to enable the IMSI secure transmission function, key extraction method and encryption and decryption algorithm according to the IMSI secure transmission capabilities of the terminal and the base station; then, put these information in In the RRCConnectionRequest message (502), it is sent to the base station through the RRC processing module (126) on the terminal, and stored in the IMSI security transmission association database (303) on the terminal.

2) In step 405, after receiving the RRCConnectionRequest message (502) from the terminal, the IMSI security transmission negotiation module (204) on the base station will analyze the IMSI security transmission negotiation information therein, and combine these information and the terminal identity (UE- Identity) are stored together in the IMSI secure transmission association database (203) on the base station; then, the module 204 will put the "negotiation confirmation" negotiated with the key extraction method and the encryption and decryption algorithm as the negotiation feedback information in the RRCConnectionSetup message (503) and pass the base station The upper RRC processing module (116) sends it to the terminal.

3) In step 405, after receiving the RRCConnectionSetup message (503), if the IMSI secure transmission negotiation module (304) on the terminal resolves to the "negotiation confirmation" negotiated between the key extraction method and the encryption and decryption algorithm, the terminal IMSI secure transmission association Set in the database (303) that the negotiation of "key extraction method and encryption and decryption algorithm" is successful; otherwise, the terminal selects other cells equipped with the IMSI security transmission device (200), and when there is no cell with the device 200, the terminal will not enable the IMSI security transmission device (200). transfer function.

Negotiation of encryption and decryption keys (step 406). Step 406 is executed only when the terminal and the base station execute step 405 and enable the IMSI secure transmission function.

1) In step 406, after receiving the RRCConnectionSetup message (503), the IMSI secure transmission negotiation module (304) on the terminal parses the IMSI secure transmission negotiation feedback information therein, and the encryption and decryption key negotiation module (305) on the terminal follows the negotiation The key extraction method extracts the encryption key from the physical layer information of this downlink subframe and the following downlink subframes; then, the RRC processing module (126) on the terminal sends the RRCConnectionComplete message (504).

2) In step 406, after receiving the RRCConnectionComplete message (504), the encryption and decryption key negotiation module (205) on the base station uses the selected key extraction algorithm to extract the decryption key from the uplink signal and save it in the IMSI key on the base station. In the secure transmission association database (203).

3) In step 406, the encryption and decryption key negotiation module (305) on the terminal uses the cell-specific reference signal (CRS) to analyze the wireless channel characteristics and extract the encryption key; the encryption and decryption key negotiation module (205) on the base station uses the uplink The demodulation reference signal (DMRS) or sounding reference signal (SRS) analyzes the characteristics of the wireless channel and extracts the decryption key.

IMSI encryption and decryption in the AttachRequest in the initial attach process (step 407). Step 407 is performed only when the terminal and the base station perform step 406 .

1) In step 407, before the RRC processing module (126) on the terminal sends the RRCConnectionComplete message (504) to the base station in the uplink time slot specified by the scheduling, the terminal encryption module (306) uses the encryption key and the selected encryption algorithm to encrypt the initial The IMSI in the AttachRequest in the attachment process is encrypted, and the NAS processing module (127) on the terminal encapsulates the AttachRequest message (505) containing the encrypted IMSI in the RRCConnectionComplete message (504);

2) In step 407, the decryption module (206) on the base station uses the negotiated decryption key and decryption algorithm to decrypt the encrypted IMSI in the AttachRequest message (505), and then the NAS forwarding module (117) on the base station will contain The IMSI plaintext AttachRequest message (506) is sent to the MME.

IMSI encryption and decryption in Identity Response (step 408). Step 408 is executed only after the terminal and the base station execute step 406 .

1) In step 408, when the terminal needs to send the IdentityResponse message to the core network, the terminal encryption module (306) utilizes the encryption key stored in the IMSI secure transmission association database (303) on the terminal to encrypt the IMSI in the IdentityResponse message; then The NAS processing module (127) on the terminal sends the IdentityResponse message (509) containing the encrypted IMSI to the base station.

2) In step 408, when the base station receives the IdentityResponse message (509), the decryption module (206) on the base station uses the decryption key stored in the IMSI secure transmission association database (203) on the base station to pair the identityResponse message (509) The IMSI is decrypted, and then the NAS forwarding module (117) on the base station sends the IdentityResponse message (510) to the core network.

To sum up, the present invention discloses a method and system for securely transmitting an LTE user IMSI over an air interface. The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the invention in the form disclosed. Apparently, those skilled in the art can make various changes and modifications to the examples of the present invention without departing from the spirit and principle of the present invention. The embodiment was chosen and described in order to better explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention and design various embodiments with various modifications as are suited to the particular use.

Claims (5)

1. a kind of in the method for upper safe transmission LTE user IMSI of eating dishes without rice or wine, step is：

1) the IMSI safe transmission ability of base station and the IMSI safe transmission ability of terminal is respectively configured；The IMSI safe transmission Ability includes whether to support the key extraction method and enciphering and deciphering algorithm of IMSI safe transmission, support；

2) the safe transmission ability information that base station broadcast base station in its cell is configured；

3) terminal receives and parses through the broadcast message of base station transmission, and choosing, there is the base station of IMSI safe transmission function to carry out IMSI safe transmission is negotiated, and key extraction method and enciphering and deciphering algorithm between terminal and base station are chosen；Wherein, the progress IMSI safe transmission negotiate method be：Whether the terminal will enable IMSI safe transmission function, key extraction method and add Decipherment algorithm, which is placed in RRCConnectionRequest message, is sent to the base station；The base station receives this After RRCConnectionRequest message, IMSI safe transmission negotiation information therein is parsed, and these information and terminal Mark UE-Identity is stored together in the IMSI safe transmission linked database of base station；Then by determining cipher key-extraction side Method and enciphering and deciphering algorithm are placed in RRCConnectionSetup message as consultation and feedback information issues the terminal；

4) it is close to extract encryption according to the key extraction method negotiated from the physical layer information of setting downlink subframe for the terminal Key, and uplink signal is sent to the base station in the ascending time slot of setting；

5) decruption key is extracted according to the key extraction method negotiated in the base station from uplink signal, and is stored in base station In IMSI safe transmission linked database；

6) terminal utilizes the encryption key and selected Encryption Algorithm, in initial attaching process IMSI encryption in AttachRequest message；Then the AttachRequest message containing IMSI ciphertext is encapsulated in The base station is sent in RRCConnectionComplete message；

7) base station is decrypted from the AttachRequest message using the decruption key and selected decipherment algorithm IMSI。

2. the method as described in claim 1, which is characterized in that after the step 5), the terminal needs to send out to core net When sending IdentityResponse message, after the terminal encrypts the IMSI in IdentityResponse with the encryption key It is sent to the base station；When the base station receives the IdentityResponse message, with the decruption key of preservation to this IMSI decryption in IdentityResponse message, is then sent to core net for the IdentityResponse message.

3. method according to claim 1 or 2, which is characterized in that the base station is to being stored in IMSI safe transmission incidence number It is cryptographically stored according to the key in library.

4. a kind of in the system of upper safe transmission LTE user IMSI of eating dishes without rice or wine, including base station and terminal, which is characterized in that the base It stands and is equipped with IMSI safe transmission device, and including with lower component：

IMSI safe transmission ability configuration module, for configuring and storing the IMSI safe transmission ability of base station；The IMSI peace Full transmittability includes whether to support the key extraction method and enciphering and deciphering algorithm of IMSI safe transmission, support；

Base station IMSI safe transmission ability broadcast module, the IMSI safe transmission ability letter for the terminal broadcast base station into cell Breath；

IMSI safe transmission linked database, for storing and the IMSI safe transmission related information of terminal room；

IMSI safe transmission negotiation module carries out whether the negotiation of IMSI safe transmission enables IMSI biography safely for negotiating with terminal Transmission function, key extraction method and enciphering and deciphering algorithm；

It is close to extract decryption for the key extraction method according to negotiation from ascending physical signal signal for the negotiation module of encryption and decryption key Key；

Deciphering module, for being decrypted to the encryption IMSI information in AttachRequest or IdentityResponse message；

The terminal is equipped with IMSI safe transmission device, and including with lower component：

IMSI safe transmission ability configuration module, for configuring and storing the IMSI safe transmission ability of terminal；The IMSI peace Full transmittability includes whether to support the key extraction method and enciphering and deciphering algorithm of IMSI safe transmission, support；

IMSI safe transmission ability receiving module, for receiving and parsing base station IMSI safe transmission ability information；

IMSI safe transmission linked database, for the IMSI safe transmission related information between storage and base station；

IMSI safe transmission negotiation module carries out whether the negotiation of IMSI safe transmission enables IMSI biography safely for negotiating with base station Transmission function, key extraction method and enciphering and deciphering algorithm；

It is close to extract encryption for the key extraction method according to negotiation from downlink physical signal for the negotiation module of encryption and decryption key Key；

Encrypting module, for being encrypted to the IMSI in AttachRequest or IdentityResponse message；

Wherein, the method for carrying out the negotiation of IMSI safe transmission is：The terminal whether will enable IMSI safe transmission function, Key extraction method and enciphering and deciphering algorithm, which are placed in RRCConnectionRequest message, is sent to the base station；The base station After receiving the RRCConnectionRequest message, IMSI safe transmission negotiation information therein is parsed, and these information It is stored in the IMSI safe transmission linked database of base station together with terminal iidentification UE-Identity；Then by determining key Extracting method and enciphering and deciphering algorithm are placed in RRCConnectionSetup message as consultation and feedback information issues the terminal.

5. system as claimed in claim 4, which is characterized in that the base station is to being stored in IMSI safe transmission linked database In key cryptographically store.