CN101056169B - Method and system for improving the multicast service security of the radio communication system - Google Patents

Abstract

The invention relates to a method and system for improving the safety of multicast services in a wireless communication system. The present invention mainly includes: firstly, in the wireless communication system, the key manager sends the key material information generated by the key manager to the base station; after that, the base station receives the key material information and performing encryption processing on the air interface multicast service interacted between the base station and the user terminal according to the key material. The realization of the present invention enables the base station to obtain the key material information required for air interface service transmission in wireless communication systems such as WiMAX, thereby effectively ensuring the security of the air interface service, such as ensuring the location information of the user terminal, session information, etc. Safety.

Description

Method and system for improving security of multicast service in wireless communication system

technical field

The invention relates to the technical field of wireless communication, in particular to a multicast key management technology.

Background technique

In the communication system, in order to ensure the security of the communication service, it is necessary to apply the corresponding key in the service interaction information. For example, in the wireless communication system, it is necessary to use the corresponding multicast key for the multicast service carried out .

The management and application of the multicast key will be described below by taking the multicast service as an example.

During the development of multicast services, the multicast keys to be used are mainly divided into two categories:

(1) Data encryption key for directly protecting multicast service data;

(2) Protect the data encryption key and distribute the key encryption key to the data receiving end.

The above two types of keys are commonly used in multicast services, among which:

The data encryption key is directly used to encrypt and decrypt data. Since the key is usually distributed using a broadcast channel, and the storage method of the data encryption key is also easily known by the terminal user, therefore, in order to further ensure To ensure the security of the communication process, the corresponding data encryption key needs to be updated relatively frequently.

The key encryption key is usually distributed through a unicast channel, and since the key encryption key does not need to be used to directly encrypt data, it can be stored in a place with higher security, for example, Store it in a SIM (Subscriber Identity Module) card, etc.

In existing wireless communication systems such as 3GPP and 3GPP2, the above two types of keys are directly encrypted at the data high-level control point, so that the information exchanged between the terminal and the high-level control point can be correspondingly encrypted using the above two types of keys protection to ensure the security of the exchanged information.

In the existing wireless communication system, the encryption operation is only performed at the high-level control point, so the security of the information exchanged between the access network and the terminal cannot be well guaranteed, for example, the session information exchanged over the air interface cannot be guaranteed , terminal location information and other content security.

Contents of the invention

The purpose of the present invention is to provide a method and system for improving the security of multicast services in a wireless communication system, thereby effectively ensuring the security of multicast services interacted between base stations and user terminals.

The purpose of the present invention is achieved through the following technical solutions:

The invention provides a method for improving the security of multicast services in a wireless communication system, including:

A. In the wireless communication system, the key manager sends the key material information generated by it to the base station for multicast services;

B. After receiving the key material information, the base station encrypts the air interface multicast service exchanged between the base station and the user terminal according to the key material.

Said key material includes:

Authorization key MAK and its related parameters, multicast group communication encryption key MGTEK and its related parameters, multicast key encryption key GKEK and its related parameters, multicast group security suite MBSGSA and/or multicast communication key MTK and its related parameters.

The MAK and its related parameters include: the MAK, the remaining life time of the MAK and/or the serial number of the MAK.

The GKEK and its related parameters include: GKEK, GKEK serial number, GKEK identifier, GKEK remaining life time, ciphertext-based multicast key update message authentication code key CMAC_KEY_G and/or ciphertext-based multicast key Key Update Message Authentication Code Packet Sequence Number CMAC_PN_G.

The MGTEK and its related parameters include: MGTEK, MGTEK remaining life time and/or MGTEK serial number.

The MBSGSA and related parameters include: the identifier of the MBSGSA, the type of the MBSGSA, the encryption suite of the MBSGSA, the service type of the MBSGSA, the sequence number of the downlink packet sent by the base station, the sequence number of the downlink packet received by the terminal, Old MGTEK parameters and/or new MGTEK parameters.

Described step A comprises:

A1. The key manager generates key material including MAK and its related parameters, MGTEK and its related parameters, GKEK and its parameters, and MBSGSA;

or,

A2. The key manager generates key material including MAK and its related parameters, MGTEK and its related parameters, GKEK and its parameters, MBSGSA and MTK and its related parameters.

In the present invention, when performing the step A1, the step B also includes:

After receiving the key material sent by the key manager, the base station generates MTK and its related parameters according to the key material, and uses the generated MTK and its related parameters together with the received key material as a key for air interface services. The transmitted key material.

The method further includes: updating the key material generated by the key manager.

The method further includes: updating the key material may be triggered before the remaining life time of the key expires.

The present invention also provides an implementation system for improving the security performance of multicast services in a wireless communication system, including:

The key material sending unit is arranged in the key manager of the wireless communication system, and is used to send the key material information generated by the key manager required to carry out the multicast service to the base station;

The security processing unit is arranged in the base station of the wireless communication system, and is used for encrypting the air interface multicast service exchanged between the base station and the user terminal according to the received key material information.

Said key material includes:

MAK and its related parameters, MGTEK and its related parameters, GKEK and its related parameters, MBSGSA and/or MTK and its related parameters.

In the present invention, when the key material generated by the key manager is part of the key material, the system further includes:

The key information generation unit is set in the base station of the wireless communication system, and is used to generate the remaining key material included in the complete key material according to the part of the key material received by the base station, and provide it to the security processing unit.

The key information generation unit includes:

The MTK information generation unit is used to generate MTK and related parameter information according to the received part of the key material, and provide them to the security processing unit.

It can be seen from the above-mentioned technical solution provided by the present invention that the implementation of the present invention enables the base station to obtain various key material information required for air interface service transmission in wireless communication systems such as WiMAX, thereby effectively ensuring the security of the air interface service, for example , which can ensure the security of the location information and session information of the user terminal. Therefore, the realization of the present invention can effectively guarantee the security of the air interface multicast service in the wireless communication system.

Description of drawings

Fig. 1 is a schematic diagram of a specific realization flow chart of the method of the present invention;

Fig. 2 is the concrete realization flow chart diagram two of the method described in the present invention

FIG. 3 is a schematic structural diagram of a specific implementation of the system of the present invention.

Detailed ways

The core of the multicast key management method in the wireless network provided by the present invention is that when the key material is initially generated and updated, the key manager generates the key material required for the multicast service, and the key manager sends the key material to the The base station sends the key material; in this way, after the base station receives the key material, it can encrypt the multicast service of air interface interaction according to the key material. The key manager is an entity responsible for generating, distributing, updating and maintaining key materials in a wireless communication system.

Taking a WiMAX network as an example, the key material includes at least one of the following:

(1) MAK (Authorization Key) and its related parameters

It is used together with MGTEK (multicast group communication encryption key) to generate MTK (multicast communication key), which is provided by the high-level multicast service provider to users authorized for this service;

Specifically include: MAK, remaining life time of MAK and serial number of MAK;

(2) MGTEK and its related parameters

Used to generate MTK together with MAK, which is provided by the operator's network to users or devices authorized to access the network, including:

MGTEK, MGTEK remaining life time and MGTEK serial number;

(3) GKEK (multicast key encryption key) and its parameters

The role of GKEK is to protect MGTEK, encrypt it, and transmit it to the terminal, including:

GKEK, GKEK serial number, GKEK identifier, GKEK remaining life time, CMAC_KEY_G (ciphertext-based multicast key update message authentication code key) and CMAC_PN_G (ciphertext-based multicast key update message authentication code package sequence number );

(4) MBSGSA (Multicast Group Security Suite) and its related parameters

In the WiMAX network, it is used to provide multicast keys and data encryption for MBS (Multicast Multicast Service) to provide specified algorithms and encryption modes, including:

MBSGSA identifier, MBSGSA type, MBSGSA cipher suite, MBSGSA service type, sequence number of downlink packets sent by the base station, sequence number of downlink packets received by the terminal, old MGTEK parameters, new MGTEK parameters;

(5) MTK and its related parameters

It is used for encrypted transmission of multicast data on the air interface.

In the present invention, the process of initial key material generation and distribution includes the following two methods:

(1) The first implementation method is as follows:

First, the key manager generates the key material required by the multicast service; the key material generated on the key manager includes: the multicast service authorization key and its related parameters, the multicast service key encryption key and Its related parameters, multicast service communication encryption key and its parameters, security suite indicating encryption algorithm and encryption mode.

Afterwards, the key manager sends the key material to the base station; the key material includes: the multicast service authorization key and its related parameters, the multicast service key encryption key and its related parameters, the multicast service Communication encryption key and its parameters, security suite specifying encryption algorithm and encryption mode.

Finally, after receiving the key material, the base station generates the rest of the key material needed to carry out the multicast service according to the key material, such as MTK and its related parameters.

(2) The second implementation method is as follows:

That is, the corresponding initial key material generation and distribution process may also include:

First, the key manager generates the key material required by the multicast service; the key material generated on the key manager includes: the multicast service authorization key and its related parameters, the multicast service key encryption key and Its related parameters, multicast service communication encryption key and its parameters, security suite specifying the encryption algorithm and encryption mode, MTK and its related parameters; that is, all keys required for the development of multicast services are generated in the key manager Material.

Afterwards, the key manager sends the key material to the base station. The key material includes: the multicast service key encryption key and its related parameters, the multicast service communication encryption key and its parameters, and the specified encryption algorithm and encryption mode security suite, MTK and related parameters; since the base station can already obtain all the key materials needed to carry out multicast services in this way, there is no need to generate key materials on the base station. The key material sent by the key manager can be encrypted for the air interface multicast service to ensure the security of the multicast service.

In the present invention, in order to ensure the reliability of air interface multicast service encryption, it is also necessary to update the key material, and the trigger condition for the corresponding update can be before the remaining life time of the key expires, or it can also be at Triggered under other set conditions.

The update processing process of the key material is the same as that of the initial key material generation material, that is, the key manager still generates the key material required for the multicast service and sends it to the base station. After the base station receives it, it The original key material can be updated to use the corresponding key material, and other required key material, such as MTK and its related parameters, can also be generated on the base station, and then the corresponding key material information can be updated.

In order to facilitate the understanding of the present invention, a specific implementation manner of the present invention applied to a WiMAX network will be described below with reference to the accompanying drawings.

Embodiment one

In this embodiment, a corresponding process for initially generating key material is provided, and MTK is generated in the key manager, as shown in Figure 1, specifically including:

Step 11: the key manager generates the key material required for the multicast service;

The key material includes: MAK and its related parameters, MGTEK and its related parameters, GKEK and its parameters, MBSGSA and/or MTK and its related parameters, wherein:

The MAK and its related parameters include: MAK, MAK remaining life time, MAK serial number;

The MGTEK and its related parameters include: MGTEK, MGTEK remaining life time, MGTEK serial number;

The GKEK and its related parameters include: GKEK, GKEK serial number, GKEK identifier, GKEK remaining life time, CMAC_KEY_G and CMAC_PN_G;

The MBSGSA and related parameters include: the identifier of the MBSGSA, the type of the MBSGSA, the encryption suite of the MBSGSA, the service type of the MBSGSA, the sequence number of the downlink packet sent by the base station, the sequence number of the downlink packet received by the terminal, Old MGTEK parameters and new MGTEK parameters;

The MTK and its related parameters include: MTK jointly generated by MGTEK and MAK, remaining life time of MTK, MTK serial number, encryption method and mode-related initial vector and associated GKEK serial number;

Step 12: The key manager sends the key material generated by it to the base station;

Wherein, the key material includes: at least one of MGTEK and its related parameters, MGKEK and its parameters, MBSGSA, MTK and its related parameters;

In this way, the base station can use the key material sent by the key manager to encrypt the air interface multicast service.

Embodiment two

In this embodiment, the present invention provides a process for initially generating key material, and MTK is generated on the base station, as shown in Figure 2, specifically including:

Step 21: the key manager generates the key material required for the multicast service;

The key material includes: MAK and its related parameters, MGTEK and its related parameters, GKEK and its parameters, MBSGSA and MTK and its related parameters;

Wherein, for the specific information contained in each key material, refer to Embodiment 1, which will not be described in detail here;

Step 22: the key manager sends the key material to the base station;

Wherein, the key material includes: MGTEK and its related parameters, MAK and its related parameters, MGKEK and its parameters, and MBSGSA;

Step 23: The base station receives the key material, and generates MTK and related parameter information according to the key material;

Specifically: generate the corresponding MTK and its related parameter information according to MGTEK and MAK, including: MTK, remaining life time of MTK, MTK serial number, encryption method and mode-related initial vector, and associated GKEK serial number;

In this way, although the key material generated by the key manager does not include MTK and its related parameters, it can be generated on the base station. Therefore, the base station can still obtain the complete key material needed to carry out the multicast service, so that the air interface group Encryption operations for broadcasting services.

The present invention also provides an implementation system for improving the security performance of multicast services in a wireless communication system. The specific implementation of the system is shown in Figure 3, and specifically includes the following functional units:

(1) Key material sending unit

This unit is set in the key manager of the wireless communication system, and is used to send the key material information generated by the key manager required to carry out multicast services to the base station, that is, the keys required for air interface multicast encryption material information;

The key material includes at least one of MAK and its related parameters, MGTEK and its related parameters, GKEK and its related parameters, MBSGSA, MTK and its related parameters.

(2) Security processing unit

This unit is set in the base station of the wireless communication system, and is used to encrypt the air interface multicast service exchanged between the base station and the user terminal according to the received key material information, that is, use the key material to encrypt the air interface multicast service. The transmitted multicast service is encrypted to ensure the transmission security of the air interface multicast service.

It should be noted that the key material required for carrying out the multicast service can be completely generated by the key manager and sent to the base station, or a part of the key material can be generated by the key manager, and then the base station can Part of the key material sent by the manager generates the rest of the key material, so that the base station can obtain the complete key material;

When the key material generated by the key manager is part of the key material, such as MTK and related parameters are not included, the system also includes:

(3) Key information generation unit

This unit is set in the base station of the wireless communication system, and is used to generate the complete key material and the rest of the key material information included in the key material in the base station according to the key material received by the base station, and provide it to the security processing unit, so that the security The processing unit can obtain the complete key material, so as to use the complete key material to ensure the security of the air interface information;

For example, the key information generating unit may include an MTK information generating unit, configured to generate MTK and related parameters not generated in the key manager, and provide them to the security processing unit.

To sum up, in wireless communication systems such as WiMAX, the base station can obtain the key material required for air interface service transmission, so as to effectively ensure the security of the air interface service, for example, the security of the location information and session information of the user terminal can be guaranteed , the invention is especially suitable for providing security guarantee for the air interface multicast service in the wireless communication system.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (12)

1. A method for improving multicast service security in a wireless communication system, characterized in that, comprising: A. In a wireless communication system, the key manager sends the key material information generated by the key manager to the base station. The key material includes the authorization key MAK and its related parameters, and the multicast group At least one of the communication encryption key MGTEK and its related parameters, the multicast key encryption key GKEK and its related parameters, the multicast group security suite MBSGSA or the multicast communication key MTK and its related parameters; B. After receiving the key material information, the base station encrypts the air interface multicast service interacted between the base station and the user terminal according to the key material; Wherein, the MAK indicates that the user is authorized to obtain the corresponding MBS service, and is used to generate the MTK together with the MGTEK; the MGTEK is the key that will be obtained when the terminal establishes an MBS service connection with the network, and is used to generate it together with the MAK MTK; the GKEK is used to encrypt GTEK or MGTEK to ensure their safe transfer between devices; the MBSGSA contains various security information related to the MBS service; the MTK is used to encrypt the key of the MBS service transmitted over the air interface . 2. The method according to claim 1, wherein the MAK and its related parameters include: the MAK, the remaining life time of the MAK and/or the serial number of the MAK. 3. The method according to claim 1, wherein the GKEK and related parameters thereof include: GKEK, GKEK serial number, GKEK identifier, GKEK remaining life time, ciphertext-based multicast key update message The authentication code key CMAC_KEY_G and/or the ciphertext-based multicast key update message authentication code packet sequence number CMAC_PN_G. 4. The method according to claim 1, wherein the MGTEK and its related parameters include: MGTEK, MGTEK remaining life time and/or MGTEK serial number. 5. The method according to claim 1, wherein the MBSGSA and its related parameters include: MBSGSA identifier, MBSGSA type, MBSGSA cipher suite, MBSGSA service type, downlink sent by the base station record The packet sequence number, the sequence number of the received downlink packet recorded by the terminal, the old MGTEK parameter and/or the new MGTEK parameter. 6. The method according to any one of claims 1 to 5, wherein said step A comprises: A1. The key manager generates at least one of the key materials including MAK and its related parameters, MGTEK and its related parameters, GKEK and its parameters, and MBSGSA; or, A2. The key manager generates at least one item of key material including MAK and its related parameters, MGTEK and its related parameters, GKEK and its parameters, MBSGSA and MTK and its related parameters. 7. The method according to claim 6, wherein, when performing the step A1, the step B further comprises: After receiving the key material sent by the key manager, the base station generates MTK and its related parameters according to the key material, and uses the generated MTK and its related parameters together with the received key material as a key for air interface services. The transmitted key material. 8. The method according to any one of claims 1 to 5, further comprising: updating the key material generated by the key manager. 9. The method according to claim 8, characterized in that the method comprises: triggering an update of the key material before the remaining life time of the key expires. 10. An implementation system for improving multicast service security performance in a wireless communication system, characterized in that it comprises: The key material sending unit is set in the key manager of the wireless communication system, and is used to send the key material information generated by the key manager to the base station for carrying out the multicast service, and the key material includes the authorization key Key MAK and its related parameters, multicast group communication encryption key MGTEK and its related parameters, multicast key encryption key GKEK and its related parameters, multicast group security suite MBSGSA or multicast communication key MTK and its related parameters at least one of the The security processing unit is arranged in the base station of the wireless communication system, and is used for encrypting the air interface multicast service interacted between the base station and the user terminal according to the received key material information; Wherein, the MAK indicates that the user is authorized to obtain the corresponding MBS service, and is used to generate the MTK together with the MGTEK; the MGTEK is the key that will be obtained when the terminal establishes an MBS service connection with the network, and is used to generate it together with the MAK MTK; the GKEK is used to encrypt GTEK or MGTEK to ensure their safe transfer between devices; the MBSGSA contains various security information related to the MBS service; the MTK is used to encrypt the key of the MBS service transmitted over the air interface . 11. The system according to claim 10, wherein when the key material generated by the key manager is part of the key material, the system further comprises: The key information generation unit is set in the base station of the wireless communication system, and is used to generate the remaining key material included in the complete key material according to the part of the key material received by the base station, and provide it to the security processing unit. 12. The system according to claim 11, wherein the key information generation unit comprises: The MTK information generation unit is used to generate MTK and related parameter information according to the received part of the key material, and provide them to the security processing unit.

Images