CN101394664B - Mobile node, method and system for implementing media irrelevant switching - Google Patents

Abstract

The present invention relates to a mobile node, a method and a system for realizing media-independent handover. The method includes: the mobile node obtains service information protected by a shared key from the network side; verifies the shared key; after passing the verification, the mobile node Send a handover preparation request message to the network side according to the service information, the handover preparation request message is protected by a first shared key; the network side receives the handover preparation request message, and verifies the first shared key , and connect the mobile node to the target service point to complete the handover. The security problem of media-independent switching is effectively solved, and the security of media-independent services and media-independent switching is guaranteed. The mobile node includes a service information acquisition module, a verification module, a request module and a message protection module; the system includes a message sending module, a system message protection module, a message receiving module, a system verification module and a switching module, which ensures the safety of media-independent switching.

Description

Mobile node, method and system for realizing media-independent handover

technical field

The invention relates to wireless communication technology, in particular to media-independent switching technology. the

Background technique

Media-independent switching means that by supporting switching between different media types, mobile users can automatically select the best network connection type and seamlessly switch voice channels when roaming between networks, so as to realize IEEE802.3/802.11/802.16/ Roaming handover between 3GPP/3GPP2 and other systems. the

At present, the media independent handover technology is mainly through the media independent handover function (Media Independent Handover Function, MIHF) module on the mobile node (Mobile Node, MN), the media independent handover service point (MIH Point) of the MN serving point of attachment (serving PoA). of Service (MIH PoS for short), MIH PoS of MN candidate PoA, MIH PoS excluding MN PoA, and MIH non-service point (Non-PoS) excluding MN PoA to realize mobile users’ communication in IEEE802.3/802.11/802.16/ Roaming handover between 3GPP/3GPP2 and other systems. Among them, the MIH PoS of the MN servingPoA refers to the MIH network entity that can directly exchange MIH messages with the MN with MIH function, that is, the PoS currently serving the MN, that is, the POS (ServingPoS) in the serving state; the MIH PoS of the MN candidate PoA refers to MIH network entities that can directly exchange MIH messages with MNs with MIH functions, that is, candidate POS; MIH PoS excluding PoA of MNs refers to MIH network entities that can directly exchange MIH messages with MNs with MIH functions, such as POS in wired networks Router with MIHF; MIH Non-PoS without MN PoA refers to MIH network entities that can directly exchange MIH messages with other MIH network entities, but this network entity cannot directly exchange MIH messages with MNs that have MIH functions. the

When switching specifically, first, Serving PoS provides MN with the MIH service determined in the MIH capability discovery process, including:

MIH Event Service (MIES): Provides event classification, event filtering, and events on dynamic changes in link characteristics, link status, and link quality. the

MIH Command Service (MICS): Provides upper layer management and control of link behaviors related to handover and mobility. the

MIH Information Service (MIIS): Provides detailed information on the characteristics and services of the serving network and surrounding networks, which are used for efficient system access and handover decisions. the

Secondly, after the MN determines whether the target network to be switched is allowed to access according to the provided MIH service, it initiates a query request to the Serving PoS on the network side, and sends a switching request to the PoS of the target network when the Serving PoS on the network side returns a switching command to switch. the

In the process of realizing the present invention, the inventor finds that the prior art has at least the following problems: in the process of PoS providing MIH service for MN and MN switching network, the information interaction between MN and each network entity lacks security protection, therefore, the media There are security issues with irrelevant switching. the

Contents of the invention

The first aspect of the embodiments of the present invention is to provide a method for implementing media-independent handover, so as to solve the security problem of media-independent handover. the

The second aspect of the embodiments of the present invention is to provide a mobile node, which enables the mobile node to perform secure media-independent handover. the

The third aspect of the embodiments of the present invention is to provide a system for realizing media-independent handover, so as to realize secure media-independent handover. the

The first aspect of the present invention provides the following technical solutions through some embodiments: a method for realizing media-independent switching, comprising:

The mobile node obtains the service information protected by the shared key from the network side;

verify said shared secret;

After passing the verification, the mobile node sends a handover preparation request message to the network side according to the service information, and the handover preparation request message is protected by the first shared key;

The network side receives the handover preparation request message, verifies the first shared key, connects the mobile node to the target service point, and completes the handover as follows:

The network side verifies the first shared key;

After the verification is passed, the network side returns a handover command or a handover preparation response message protected by the first shared key to the mobile node according to the handover preparation request message;

The network side receives the handover execution request message protected by the first shared key sent by the mobile node, and verifies the first shared key;

After the verification is passed, the network side returns a handover execution response message protected by the first shared key to the mobile node according to the handover execution request message;

The network side receives the key generation request message protected by the fifth shared key sent by the mobile node, and verifies the fifth shared key;

After the verification is passed, the network side returns a key generation response message protected by the sixth shared key to the mobile node;

The mobile node verifies the sixth shared key, and completes the handover after the verification is passed;

or specifically:

The network side verifies the first shared key;

After the verification is passed, the network side returns a handover command or a handover preparation response message protected by the first shared key to the mobile node according to the handover preparation request message;

The network side receives the key generation request message protected by the fifth shared key sent by the mobile node, and verifies the fifth shared key;

After the verification is passed, the network side returns a key generation response message protected by the sixth shared key to the mobile node according to the key generation request message;

The network side receives the handover execution request message protected by the first shared key sent by the mobile node, and verifies the first shared key;

After the verification is passed, the network side returns a handover execution response message protected by the first shared key to the mobile node;

The mobile node verifies the first shared key, and completes the handover after the verification is passed. the

The message in the service process and switching process is protected by the shared key, so that a third party who maliciously intercepts the message cannot obtain the content in the process of media-independent switching, thus effectively solving the security problem of media-independent switching and ensuring media-independent services Security for media-independent switching. the

The second aspect of the present invention provides the following technical solutions through some embodiments: a mobile node, comprising:

A service information acquisition module, configured to obtain service information protected by a shared key from the network side, and also configured to receive a handover command or a handover preparation response message and a handover execution response message sent by the network side and protected by a first shared key , Handover execution response message, and key generation response message protected by the sixth shared key;

A verification module, used to verify the shared key, and also used to verify the sixth shared key;

A requesting module, configured to send a handover preparation request message to the network side according to the service information when the verification module verifies that the shared key passes, and to send a handover preparation request message to the network side according to the handover command or handover preparation response message Sending a handover execution request message protected by the first shared key to the network side; sending a key generation request message to the network side;

A message protection module, configured to protect the handover preparation request message with a first shared key, protect the handover execution request message with the first shared key, and protect the key with a fifth shared key Generate a request message. the

This solution effectively ensures the security of sending and receiving messages by the mobile node through the message protection module and verification module, so that the mobile node can interact with the network-side media-independent handover system with security protection functions, thus ensuring the safe receiving and sending of the mobile node Information, to achieve a secure media-independent handover of the mobile node. the

The third aspect of the present invention provides the following technical solutions through some embodiments: a system for realizing media-independent switching, comprising:

The message sending module is used to send service information to the mobile node;

A system message protection module, configured to protect the service information with a shared key;

A message receiving module, configured to receive a handover preparation request message protected by the first shared key sent by the mobile node;

A system verification module, configured to verify the first shared key;

A handover module, configured to connect the mobile node to a target service point according to the handover preparation request message to complete handover. the

This solution effectively protects various messages during the process of switching to the mobile node service network through the message protection module and verification module, avoiding the third party who maliciously intercepts the message from obtaining the message content during the switching process, and solves the problem of media irrelevance. The security problem in switching ensures the security of services and switching in media-independent switching. the

The technical solutions of the present invention will be described in further detail below with reference to the accompanying drawings and embodiments. the

Description of drawings

Fig. 1 is a schematic diagram of a default security architecture in a method embodiment of media-independent handover of the present invention;

Fig. 2 is a schematic diagram of a direct security architecture in a method embodiment of a media-independent handover of the present invention;

Fig. 3 is the signaling flowchart of the first embodiment of the method for realizing media-independent handover in the present invention;

Fig. 4 is the signaling flowchart of the second embodiment of the method for realizing media-independent handover in the present invention;

Fig. 5 is a schematic structural diagram of a mobile node embodiment of the present invention;

FIG. 6 is a schematic structural diagram of an embodiment of a media-independent handover system according to the present invention. the

Detailed ways

In the embodiment of the method for realizing media-independent handover in the present invention, both the MN and each network entity have the MIH function, and the security of the MIH is formed by establishing a security association (Security Association, SA) between the MN and each network entity and between each network entity. architecture. Wherein, the establishment of the SA is realized through a shared key between the MN and each network entity or between each network entity. For ease of description, in the embodiments of the present invention, the shared key between the MN and the network side Serving PoS is referred to as the first shared key (Kms), which needs to be generated before the MN obtains service information; the Serving PoS The shared key between the MN and the information server is called the second shared key (Kns), which can be dynamically generated or statically configured, depending on actual needs; the key between the MN and the information server is called It is the third shared key (Kmn), which needs to be dynamically generated; the shared key between Serving PoS and each candidate PoS is called the fourth shared key (Kcs); The shared key between the servers (AAA Server) is called the fifth shared key (Kma); the shared key between the MN and the target PoS is called the sixth shared key (Kmc); and, according to MN Whether MIHF needs to specify the new communication peer of MIH, and divide the security architecture into default security architecture and direct security architecture. the

Under the default security architecture, the MIHF of the MN only needs to know whether the MIHF of the MIH of the Serving PoA and the MIHF of the PoS exist, and other MIHFs in the network are invisible to the MN. For the MIHF of the MN, it only needs to establish the SA with the MIHF of the MIH of the Serving PoA and the MIHF of the PoS, and request all services from it. The default security architecture is shown in Figure 1. The solid line indicates a direct connection, the dotted line indicates a non-direct connection, and the thick line indicates a connection with security protection related to the MN's MIHF. Security associations may exist for other connections but are not related to the MN's MIHF. the

Under the direct security framework, the MIHF of the MN needs to know the existence of the MIHF of the MIH of the Serving PoA and the MIHF of the PoS, and also needs to know the existence of other MIHFs in the network. For the MIHF of the MN, it needs to establish security associations with all MIHFs that need to interact with it, and request corresponding services from them respectively. Its architecture can be shown in Figure 2, where the solid line indicates direct connection, the dotted line indicates no direct connection, and the thick line indicates the connection with security protection related to the MN's MIHF. Security associations may exist for other connections but are not related to the MN's MIHF. It should be noted that the thick dotted line also indicates that there is a security association between them, although they cannot be directly connected. In Figure 1 and Figure 2, MIH PoS is a functional module that does not include the PoA of the MN on the network side, and can directly interact with MNs with MIH functions, such as routers with MIH functions in wired networks. the

Method embodiment one

Figure 3 is a signaling flow chart of the first embodiment of the method for realizing media-independent handover according to the present invention. This embodiment takes the default security architecture as an example, and the handover process is specifically as follows:

Step 101: MN sends a Kms-protected service request message "[MIH_Service-REQ]Kms" to Serving PoS, which ensures the security between MN and Serving PoS; "[MIH_Service-REQ]Kms" means "MIH_Service-REQ" message After Kms protection, the following situations are similar. the

Step 102: Serving PoS receives the "[MIH_Service-REQ]Kms" message and verifies the Kms to ensure the reliability of the message. the

After the verification is passed, the Serving PoS sends the Kms-protected service response message "[MIH_Service-RSP]Kms" to the MN, and the "[MIH_Service-RSP]Kms" message contains the service information requested by the MN;

Step 103: The MN receives "[MIH_Service-RSP]Kms" and verifies the Kms. After passing the verification, the MN securely and effectively obtains service information such as surrounding network information. the

After the verification is passed, the MN selects the target network according to the service information, and sends a Kms-protected handover preparation request message "[MIH_Prepare-REQ]Kms" to the Serving PoS to query whether the target network allows itself to access, "[MIH_Prepare-REQ] Kms" can carry the PoS information that the MN is about to query;

Step 104: Serving PoS receives "[MIH_Prepare-REQ]Kms" and verifies the Kms;

After the verification is passed, the Serving PoS sends the Kcs-protected resource query request message “[MIH_Query-REQ]Kcs” to each candidate PoS;

Step 105: Each candidate PoS receives "[MIH_Query-REQ]Kcs" and verifies Kcs;

After the verification is passed, each candidate PoS judges whether the service point can access the MN, and returns the Kcs-protected resource query response message "[MIH_Query-RSP]Kcs" to the Serving PoS, and "[MIH_Query-RSP]Kcs" contains the judgment result; In addition, if it is determined that the access is available, resources may also be reserved for the MN. the

Step 106: Serving PoS receives "[MIH_Query-RSP]Kcs" and verifies Kcs;

After the verification is passed, the Serving PoS selects the target service point for the MN to access according to the judgment result, and sends a switch command protected by Kms to the MN, and the switch command contains the target PoS information; or Serving PoS sends a switch protected by Kms to the MN Prepare the response message “[MIH_Prepare-RSP]Kms”, “[MIH_Prepare-RSP]Kms” contains the judgment result; Serving PoS can send it to MN immediately after receiving “[MIH_Prepare-RSP]Kms”, or wait All candidate PoS will return the result and send it to MN. the

Step 107: The MN receives the handover command or "[MIH_Prepare-RSP]Kms" and verifies the Kms;

After the verification is passed, the MN sends the Kms-protected handover execution request message “[MIH_Commit-REQ]Kms” to the Serving PoS according to the handover command; or the MN obtains the judgment result from “[MIH_Prepare-RSP]Kms”, and sends the Serving PoS sends "[MIH_Commit-REQ]Kms" protected by Kms; "[MIH_Commit-REQ]Kms" contains target PoS information, such as the IP address of the target PoS, Network Access Identifier (NAI) or MIHF Identifiers (ID) and other identifiers;

Step 108: Serving PoS receives "[MIH_Commit-REQ]Kms" and verifies the Kms;

After the verification is passed, the Serving PoS uses Kcs to protect the "MIH_Commit-REQ" message, obtains "[MIH_Commit-REQ]Kcs", and sends "[MIH_Commit-REQ]Kcs" to the target PoS according to the target PoS information;

Step 109: Target PoS receives "[MIH_Commit-REQ] Kcs" and verifies Kcs;

After the verification is passed, the target PoS returns the Kcs-protected switching execution response message “[MIH_Commit-RSP]Kcs” to the Serving PoS;

Step 110: Serving PoS receives "[MIH_Commit-RSP]Kcs" and verifies Kcs;

After the verification is passed, Serving PoS protects the "MIH_Commit-RSP" message with Kms to get "[MIH_Commit-RSP]Kms" and sends it to the MN;

Step 111: MN receives "[MIH_Commit-RSP]Kms" and verifies Kms;

After the verification is passed, the MN sends the Kma-protected key generation request message “[MIH_Key-REQ]Kma” to the AAA server through the target PoS;

Step 112: The target PoS forwards "[MIH_Key-REQ]Kma" to the AAA server through the "AAA REQ" message;

Step 113: The AAA server receives "AAA REQ", and after obtaining "[MIH_Key-REQ]Kma", verifies Kma;

After the verification is passed, the AAA server generates Kmc, sends "AAA RSP" to the target PoS, and returns the verification result and Kmc;

Step 114: The target PoS returns the key generation response message “[MIH_Key-RSP]Kmc” protected by Kmc to the MN;

Step 115: The MN receives “[MIH_Key-RSP]Kmc” and verifies the Kmc; after passing the verification, the handover is completed. Afterwards, the MN can also send a handover completion message “[MIH_Complete-REQ]Kmc” to the target PoS, and wait for the target PoS to return a response message “[MIH_Complete-RSP]Kmc” to confirm the handover completion. the

In this embodiment, after the Serving PoS receives the "[MIH_Service-REQ]Kms" message, it can further judge whether it stores the information requested by the MN if the Kms verification is passed. If so, execute: Serving PoS sends the message to the MN The service response message “[MIH_Service-RSP]Kms” protected by Kms; otherwise, Serving PoS sends “[MIH_Service-REQ]Kns” to the information server, and the information server receives the “[MIH_Service-REQ]Kns” message, after verifying that Kns passes , return the "[MIH_Service-RSP]Kns" message containing the service information requested by the MN to the Serving PoS; the Serving PoS receives the "[MIH_Service-RSP]Kns" message, obtains the information after verifying the Kns, and then executes: Serving PoS sends to the MN Kms-protected service response message "[MIH_Service-RSP]Kms". In the case that Kms fails to pass the verification, Serving PoS returns a failure message to the MN. the

The process for the MN to obtain service information can also be replaced by the following process:

The information server broadcasts the "[MIH_Service]Kns" message to each PoS, where Kns can vary from PoS; 

After receiving the "[MIH_Service]Kns" message, the Serving PoS verifies the Kns, and if the verification is passed, it broadcasts the obtained service information to all MNs through the "[MIH_Service]Kms" message, where Kms can also be changed by the MN different;

The MN receives the "[MIH_Service]Kms" message, and obtains the service information after verifying the Kms. the

In the media-independent handover process of this embodiment, the SA is established between the MN and the Serving PoS, that is, the shared key is used to ensure that the MN securely obtains service information; between the MN and the Serving PoS, candidate PoS, AAA server, and between Establishing an SA between them ensures the security of network switching, thus ensuring the security of media-independent switching as a whole. the

Moreover, since the default interaction object of the MN is Serving PoS, no identification can be introduced during MIH interaction, which reduces signaling overhead and facilitates wireless transmission. the

For simple IP and mobile IP networks, since the MN in these two networks does not need to know the information of other routers in the access network, it only needs to know its access router (AR). This situation is different from the situation without cross-PoS access Similar, so AR and PoS have similar roles, and the network can easily upgrade AR to obtain MIH function without cross-PoS access. This solution can be easily applied to simple IP and mobile IP networks. the

Method embodiment two

FIG. 4 is a signaling flow chart of the second embodiment of the method for implementing media-independent handover according to the present invention. This embodiment takes the direct security architecture as an example, and the switching process is as follows:

Step 201: MN sends the service request message “[MIH_Service-REQ]Kmn” protected by Kmn;

Serving PoS judges whether the service point is the message sending target of the MN according to the sending target information in the service request message “[MIH_Service-REQ]Kmn”. If so, the shared key for protecting the message should be the first shared key. Serving PoS It can be verified. After the verification is passed, the Serving PoS returns the service information to the MN. Similar to the method in Embodiment 1: the Serving PoS receives the "[MIH_Service-REQ] Kms" message and verifies the Kms; after the verification is passed, the Serving PoS sends the message to the MN. Kms-protected service response message "[MIH_Service-RSP]Kms";

Step 202: When the Serving PoS judges that the service point is not the message sending target of the MN, the information server receives "[MIH_Service-REQ]Kmn" and verifies the Kmn;

After the verification is passed, the information server sends the service response message "[MIH_Service-REQ]Kmn" protected by the MN to the MN, and "[MIH_Service-REQ]Kmn" contains the service information requested by the MN;

Step 203: The MN receives the "[MIH_Service-REQ]Kmn" message, and verifies the Kmn; after passing the verification, the MN obtains the service information. the

The MN selects the target PoS according to the service information, and initiates the Kms-protected "[MIH_Prepare-REQ]Kms" to the Serving PoS;

Step 204: Serving PoS receives "[MIH_Prepare-REQ]Kms" and verifies Kms;

After the verification is passed, the Serving PoS sends the Kcs-protected "[MIH_Query-REQ]Kcs" to each candidate PoS on the network side;

Step 205: Each candidate PoS receives "[MIH_Query-REQ]Kcs" and verifies Kcs;

After the verification is passed, each candidate PoS judges whether the service point can access the MN, and returns the Kcs-protected "[MIH_Query-RSP]Kcs" to the ServingPoS, and "[MIH_Query-RSP]Kcs" contains the judgment result; and, if judged If access is available, resources can also be reserved for the MN. the

Step 206: Serving PoS receives "[MIH_Query-RSP]Kcs" and verifies Kcs;

After the verification is passed, the Serving PoS sends the Kms-protected "[MIH_Prepare-RSP]Kms" message to the MN, and "[MIH_Prepare-RSP]Kms" contains the judgment result;

Step 207: MN receives "[MIH_Prepare-RSP]Kms" and verifies Kms;

After the verification is passed, the MN sends the Kma-protected "[MIH_Key-REQ]Kma" to the accessible candidate PoS according to the judgment result;

Step 208: The accessible candidate PoS forwards "[MIH_Key-REQ]Kma" to the AAA server through "AAAREQ";

Step 209: The AAA server receives "[MIH_Key-REQ]Kma" and verifies Kma;

After the verification is passed, the AAA server generates Kmc, and returns the verification result and Kmc to the accessible PoS through "AAA RSP";

Step 210: The accessible PoS receives the verification result and Kmc, and sends "[MIH_Key-RSP]Kmc" protected by Kmc to the MN;

Step 211: MN receives "[MIH_Key-RSP]Kmc" and verifies Kmc;

After the verification is passed, the MN selects the target PoS to be accessed from the accessible candidate PoS, and sends the Kms-protected "[MIH_Commit-REQ]Kms" to the Serving PoS;

Step 212: Serving PoS receives "[MIH_Commit-REQ]Kms" and verifies Kms;

After the verification is passed, Serving PoS protects "[MIH_Commit-REQ]Kcs" with Kcs and sends it to the target PoS;

Step 213: The target PoS receives "[MIH_Commit-REQ]Kcs" and verifies Kcs;

After the verification is passed, the target PoS sends the Kcs-protected "[MIH_Commit-RSP]Kcs" to the Serving PoS;

Step 214: Serving PoS receives "[MIH_Commit-RSP]Kcs" and verifies Kcs;

After the verification is passed, the Serving PoS sends the Kms-protected "[MIH_Commit-RSP]Kms" to the MN;

Step 215: The MN receives "[MIH_Commit-RSP] Kms", and verifies the Kms, and completes the handover. Afterwards, the MN can also send a handover completion message “[MIH_Complete-REQ]Kmc” to the target PoS, and wait for the target PoS to return a response message “[MIH_Complete-RSP]Kmc” to confirm the handover completion. the

In the media-independent handover process of this embodiment, the SA is established between the MN and each PoS and between each PoS, that is, the shared key is used to ensure that the MN securely obtains service information and the security of the network handover process, thereby solving the media problem as a whole. Security issues unrelated to switching. the

In this embodiment, after the information server receives "[MIH_Service-REQ]Kmn", it can further judge whether the service point is based on the sending purpose information in "[MIH_Service-REQ]Kmn", and verify the Kmn; and, this The method for obtaining the service information in the embodiment can be replaced by the method for obtaining the service information in the method embodiment 1. The service information can also be obtained by the MN through the Serving PoS broadcast service message "[MIH_Service]Kms", and the information server can also send the service information to the MN. The "[MIH_Service]Kmn" message is directly broadcast to the MN to obtain service information; the process of switching networks after obtaining the service information in this embodiment can also be replaced by the process after obtaining the service information in method embodiment 1, so as to safely realize the network switching of the MN. the

Under the direct security architecture, the MN can distinguish the object of the key request and establish an SA between it and the target network in the original network. Therefore, the SA can be established after the handover, reducing the handover delay. In this embodiment, after receiving the "[MIH_Prepare-RSP]Kms" message, the MN first establishes SAs with all accessible candidate PoSs, that is, generates shared keys between the MN and all accessible candidate PoSs , and then initiate a handover execution request message to the target PoS, which avoids the establishment of SA during the handover execution process or the inability to access the handover because it cannot be established, saves handover execution time, and speeds up the network handover speed. If the MN needs to access an information server located in the home network, the Serving PoS of the visited network where he is located may not have a security association with the information server, so the SA can be established first, and then the access switch is performed, thereby saving the access switch time. the

In the above embodiment, the message is protected by using the shared key, which can be either encryption or integrity protection, and which method is used is determined by a specific protocol. the

Example of a mobile node

FIG. 5 is a schematic structural diagram of a mobile node embodiment of the present invention. The mobile node 10 includes: a service information acquisition module 11, a verification module 12, a request module 13, and a message protection module 14; wherein, the service information acquisition module 11 is used to obtain from the network side Service information protected by a shared key; the verification module 12 is used to verify the shared key, such as Kms, Kmn, Kmc; the request module 13 is used to verify that the shared key is passed by the verification module, according to The service information initiates a handover preparation request message to the network side; or sends a service request message for obtaining the service information to the network side; the message protection module 14 protects the handover preparation request message and the service request message with Kms; Or protect service request messages with Kmn. the

In this embodiment, the service information acquisition module is further configured to receive a Kms-protected handover command or a handover preparation response message and a handover execution response message sent by the network side, wherein the handover preparation response message includes the judgment result; the The request module is further configured to send a Kms-protected handover execution request message to the service point according to the handover command; or obtain the judgment result from the handover preparation response message, and send the judgment result to the service point according to the judgment result Send the switching execution request message protected by Kms; The switching execution request message contains target service point information; The request module is also used to send the key generation request message protected by Kma to the AAA server on the network side; Message protection The module is also used to protect the key generation request message with Kma; the service information acquisition module is also used to receive the key generation response message protected by Kmc sent by the network side; the verification module is also used to verify Kmc. the

The foregoing embodiments of the mobile node enable the mobile node to safely perform media-independent handover through the authentication and protection modules. the

System embodiment

6 is a schematic structural diagram of an embodiment of the media-independent switching system of the present invention. The system 20 includes a message sending module 21, a system message protection module 22, a message receiving module 23, a system verification module 24, and a switching module 25. The system message protection module 22 is used for The service information is protected with a shared key; then the message sending module 21 sends the protected service information to the MN; the message receiving module 23 is used to receive the Kms-protected handover preparation request message sent by the MN; the system verification module 24 is used to verify the Kms ; The handover module 25 is used to connect the MN to the target service point according to the handover preparation request message to complete the handover. the

In this embodiment, the message receiving module can also be used to receive the Kms-protected service request message sent by the MN; the message sending module can also be used to send a service response message containing service information to the MN; the system message protection module can also use Kms to protect the message. Service response message. the

The switching module may include a first receiving module, a first verification module, a first protection module, a first sending module, a second receiving module, a second verification module, a second protection module, a second sending module, a third receiving module, a second Three verification modules, a key generation module, and a third sending module; wherein, the first verification module, the first protection module, and the first sending module are set in Serving PoS, and after the system verification module verifies that Kms passes, the first protection module uses Kcs The protection resource query request message is sent to the candidate PoS by the first sending module; the second receiving module, the second verification module, the second protection module, and the second sending module are set at the candidate PoS or the target PoS, and the second receiving module receives the first The resource query request message sent by the sending module, the second verification module verifies and protects the Kcs of the resource query request message, after the verification is passed, the candidate PoS generates a resource query response message, after the second protection module uses Kcs to protect, the second sending module Send to Serving PoS; the first receiving module receives the resource query response message, and the first verification module verifies Kcs; after the first protection module prepares the response message with Kms protection switching, it is sent to the MN by the first sending module; the first receiving module receives the MN After the Kms-protected handover execution request message is sent, the first verification module verifies the Kms. After the verification is passed, the first protection module uses the Kcs protection handover execution request message, and the first sending module sends the Kcs-protected handover execution request message to the second Two receiving modules, after the second receiving module receives it, the second verification module verifies Kcs. After the verification is passed, the target PoS generates a switching execution response message, the second protection module uses Kcs to protect the switching execution response message, and the second sending module sends the protected The handover execution response message is sent to the MN; the second receiving module receives the Kma-protected key generation request message sent by the MN, and the second sending module sends the Kma-protected key generation request message to the third receiving module; the third receiving module , the third verification module, the key generation module and the third sending module are arranged in the AAA server, the third receiving module receives the key generation request message, and the third verification module verifies Kma; after the verification is passed, the key generation module generates Kmc, The third sending module sends the verification result and Kcs of the third verification module to the second receiving module; the second receiving module receives, and the target PoS generates a key generation response message, and the second protection module generates a response message with the Kmc protection key, The second sending module sends the protected key generation response message to the MN; the second receiving module receives the Kmc-protected switching completion request message sent by the MN, and the second verification module verifies Kmc. After the verification is passed, the target PoS generation switching is completed In response to the message, the second protection module uses Kmc for protection, and the second sending module sends the protected handover completion response message to the MN. the

In the above-mentioned system embodiment, the media-independent switching system may also include a judging module, the judging module is set in the Serving PoS, and is used to judge whether the PoS is the sending target of the service request message, or judge whether the information requested by the MN is stored in itself; If this PoS is the sending target of the service request message, the Serving PoS performs corresponding operations, such as verifying Kms; if it judges that it stores the information requested by the MN, the first sending module sends the information requested by the MN to the MN. the

The media-independent switching system can also include a creation module, the creation module is located in the Serving PoS, if the judging module judges that the Serving PoS does not store the information requested by the MN, then create a new service request message and send it to the information server. the

In the above system embodiment, the security of the media-independent handover is guaranteed through the system protection module, the system verification module and the key generation module. the

Those of ordinary skill in the art can understand that all or part of the steps for realizing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes. the

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention. the

Claims (19)

1. A method for realizing media-independent switching, comprising: The mobile node obtains the service information protected by the shared key from the network side; verifying said shared secret; After passing the verification, the mobile node sends a handover preparation request message to the network side according to the service information, and the handover preparation request message is protected by a first shared key; The network side receives the handover preparation request message, verifies the first shared key, connects the mobile node to a target service point, and completes handover; The network side receives the handover preparation request message, verifies the first shared key, and connects the mobile node to a target service point, and completing the handover includes: The network side verifies the first shared key; after the verification is passed, the network side returns a handover command or handover preparation protected by the first shared key to the mobile node according to the handover preparation request message. Response message; the network side receives the handover execution request message protected by the first shared key sent by the mobile node, and verifies the first shared key; after the verification is passed, the network side according to the The handover execution request message returns a handover execution response message protected by the first shared key to the mobile node; the network side receives the key generation request message sent by the mobile node and protected by the fifth shared key, And verify the fifth shared key; after the verification is passed, the network side returns a key generation response message protected by the sixth shared key to the mobile node; the mobile node verifies the sixth shared key , after the verification is passed, the switching is completed; or, The network side verifies the first shared key; after the verification is passed, the network side returns a handover command or handover preparation protected by the first shared key to the mobile node according to the handover preparation request message. Response message; the network side receives the key generation request message protected by the fifth shared key sent by the mobile node, and verifies the fifth shared key; after the verification is passed, the network side The key generation request message returns a key generation response message protected by the sixth shared key to the mobile node; the network side receives the handover execution request message sent by the mobile node and protected by the first shared key, And verify the first shared key; after the verification is passed, the network side returns a handover execution response message protected by the first shared key to the mobile node; the mobile node verifies the first shared key key, after the verification is passed, the switching is completed. 2. The method according to claim 1, wherein the mobile node obtains the service information protected by the shared key from the network side as follows: The mobile node sends a service request message protected by a shared key to the network side; The network side receives the service request message, and verifies the shared key; After the verification is passed, the network side sends a service response message protected by the shared key to the mobile node, and the service response message includes the service information requested by the mobile node; The mobile node receives the service response message, and verifies the shared key, and obtains the service information after passing the verification. 3. The method according to claim 2, wherein the process of receiving the service request message at the network side and verifying the shared key further includes: The service point receiving the service request message on the network side judges whether the service point is the sending target of the service request message, If the service point is not the sending target of the service request message, forward the service request message to the sending target of the service request message; after receiving the service request message, the sending target returns to the network side A service response message of the service request, the service response message includes the service information requested by the mobile node; the network side receives the service response message. 4. The method according to claim 2, wherein before the network side sends the service response message protected by the shared key to the mobile node, it further comprises: The service point in the service state on the network side judges whether the service point stores the service information requested by the mobile node when the shared key is verified; If not, the service point in the service state creates a new service request message, and protects it with a second shared key, and then sends it to the information server in the network side; the information server receives the new service request message , and verify the second shared key; after the verification is passed, the information server returns a new service response message protected by the second shared key to the service point, and the new service response message contains the The service information requested by the mobile node; the service point receives the new service response message, and verifies the second shared key; after passing the verification, the service point obtains the service information. 5. The method according to claim 1, wherein the mobile node obtains the service information protected by the shared key from the network side as follows: The information server on the network side broadcasts the service information to each service point on the network side, and the service information is protected by a second shared key; The service point in the service state on the network side receives the service information, and verifies the second shared key; After passing the verification, the service point in the service state broadcasts a service message protected by the shared key, and the service message includes the service information; The mobile node receives the service message and verifies the shared key; After passing the verification, the mobile node obtains the service information. 6. The method according to claim 1, wherein the mobile node obtains the service information protected by the shared key from the network side as follows: The network side broadcasts the service message protected by the first shared key or the third shared key, or the network side unicasts the service message protected by the first shared key to the mobile node, and the service message includes all service information; The mobile node receives the service message, and verifies the first shared key or the third shared key; After passing the verification, the mobile node obtains the service information. 7. The method according to claim 1, wherein the network side further comprises: before receiving the handover execution request message protected by the first shared key and sent by the mobile node: The mobile node receives the handover command or handover preparation response message, and verifies the first shared key; After the verification is passed, the mobile node sends a handover execution request message protected by the first shared key to the service point in the service state on the network side according to the handover command; or the mobile node responds from the handover preparation The message obtains the judgment result, and sends a handover execution request message protected by the first shared key to the service point in the service state on the network side according to the judgment result; the handover execution request message contains target service point information . 8. The method according to claim 1, wherein, before the network side receives the key generation request message protected by the fifth shared key sent by the mobile node, it further comprises: The mobile node receives the handover execution response message, and verifies the first shared key; After passing the verification, the mobile node sends a key generation request message protected by the fifth shared key to the network side. 9. The method according to claim 1, wherein before the network side receives the key generation request message protected by the fifth shared key sent by the mobile node, it further comprises: The mobile node receives the handover preparation response message, and verifies the first shared key; After passing the verification, the mobile node sends a key generation request message protected by the fifth shared key to the network side according to the judgment result. 10. The method according to claim 1, wherein the network side further comprises before receiving the handover execution request message protected by the first shared key sent by the mobile node: The mobile node receives the key generation response message, and verifies the sixth shared key; After passing the verification, the mobile node sends a handover execution request message protected by the first shared key to the network side. 11. The method according to any one of claims 1-10, wherein the network side returns the handover information protected by the first shared key to the mobile node according to the handover preparation request message. The command or handover preparation response message is specifically: The service point in the service state on the network side sends a resource query request message protected by the fourth shared key to each candidate service point on the network side; Each of the candidate service points receives the resource query request message, and verifies the fourth shared key; After passing the verification, each candidate service point judges whether the service point can access the mobile node, and returns a resource query response message protected by the fourth shared key to the service point in service state, so The resource query response message includes a judgment result; The service point in the service state receives the resource query response message, and verifies the fourth shared key; After the verification is passed, the service point in the service state selects a target service point for the mobile node to access according to the judgment result, and sends a handover command protected by the first shared key to the mobile node, The handover command includes the target service point information; or the service point in service state sends a handover preparation response message protected by the first shared key to the mobile node, and the handover preparation response message includes There are said judgment results. 12. The method according to any one of claims 1-10, wherein the network side returns the handover execution request protected by the first shared key to the mobile node according to the handover execution request message The response message is specifically: The service point in the service state on the network side protects the handover execution request message with a fourth shared key, and sends the handover execution request message to the target service point according to the target service point information; The target service point receives the handover execution request message, and verifies the fourth shared key; After passing the verification, the target service point returns a handover execution response message protected by the fourth shared key to the service point in service state; The service point in the service state receives the handover execution response message, and verifies the fourth shared key; After passing the verification, the service point in service state uses the first shared key to protect the handover execution response message, and sends it to the mobile node. 13. The method according to any one of claims 1-8, wherein the network returns to the mobile node the key generation response message protected by the sixth shared key as follows: The target service point on the network side sends a key generation request message protected by the fifth shared key to the authentication, authorization and accounting server on the network side; The authentication, authorization and accounting server receives the key generation request message, and verifies the fifth shared key; After the verification is passed, the authentication, authorization and accounting server generates a sixth shared key, and returns the verification result and the sixth shared key to the target service point; The target service point returns a key generation response message protected by the sixth shared key to the mobile node. 14. The method according to claim 1, 9 or 10, wherein the network side returns a key generation response message protected by the sixth shared key to the mobile node according to the key generation request message Specifically: The accessible candidate service point on the network side forwards the key generation request message to the authentication, authorization and accounting server on the network side; The authentication, authorization and accounting server receives the key generation request message, and verifies the fifth shared key; After the verification is passed, the authentication, authorization and accounting server generates a sixth shared key, and returns the verification result and the sixth shared key to the accessible service point; The accessible service point receives the verification result and the sixth shared key, and sends a key generation response message protected by the sixth shared key to the mobile node. 15. A mobile node, comprising: A service information acquisition module, configured to obtain service information protected by a shared key from the network side, and also configured to receive a handover command or a handover preparation response message and a handover execution response message sent by the network side and protected by a first shared key , a handover execution response message, and a key generation response message protected by the sixth shared key; A verification module, configured to verify the shared key, and also used to verify the sixth shared key; A requesting module, configured to send a handover preparation request message to the network side according to the service information when the verification module verifies that the shared key passes, and to send a handover preparation request message to the network side according to the handover command or handover preparation response message Sending a handover execution request message protected by the first shared key to the network side; sending a key generation request message to the network side; A message protection module, configured to protect the handover preparation request message with a first shared key, protect the handover execution request message with the first shared key, and protect the key with a fifth shared key Generate a request message. 16. The mobile node according to claim 15, wherein the request module is further configured to send a service request message for obtaining the service information to the network side; the message protection module is also configured to use the The first shared key protects the service request message; the service information obtaining module is further configured to receive a service response message containing the service information sent by the network side. 17. The mobile node according to claim 15, wherein the service information acquisition module is further configured to receive a service message broadcast by the network side protected by the first shared key or the third shared key, the service The message contains the service information. 18. The mobile node according to claim 15, wherein the request module is further configured to send a service request message for obtaining the service information to the network side; the message protection module is also configured to use a third The shared key protects the service request message; the service information acquisition module is also used to receive a service response message containing the service information sent by the network side; the verification module is also used to verify and protect the first part of the service response message Three shared keys. 19. The mobile node according to claim 15, wherein the service information acquisition module is further configured to receive a network-side unicast service message protected by the first shared key, the service message including the Service Information.

Images