Huawei Technologies Co., Limited

Aiqin Zhang

Xiaohan Liu

Xiaoyu Bi

Qinghai Zeng

Jing Liu

Jing Lan Chen

Yanmei Yang

Jing Chen

Min Huang

Dongmei Zhang

Weisheng Jin

Long Luo

Lei Zhu

Yi Yang

Hui Ma

Yixian Xu

Jun Qin

Ke Wang

Lingyun Lei

Yongfeng Deng

Liming Zhang

Bo Lin

Marcus Wong

Dong Zhao

Method, device, and system for deriving keys are provided in the field of mobile communications technologies. The method for deriving keys may be used, for example, in a handover process of a User Equipment (UE) from an Evolved Universal Terrestrial Radio Access Network (EUTRAN) to a Universal Terrestrial Radio Access Network (UTRAN). If a failure occurred in a first handover, the method ensures that the key derived by a source Mobility Management Entity (MME) for a second handover process of the UE is different from the key derived for the first handover process of the UE. This is done by changing input parameters used in the key derivation, so as to prevent the situation in the prior art that once the key used on one Radio Network Controller (RNC) is obtained, the keys on other RNCs can be derived accordingly, thereby enhancing the network security.

Method, device, and system for deriving keys

Method, apparatus and systems are provided for key derivation. A target base station receives multiple keys derived by a source base station, where the keys correspond to cells of the target base station. The target base station selects a key corresponding to the target cell after obtaining information regarding a target cell that a user equipment (UE) is to access. An apparatus for key derivation and a communications system are also provided.

Method, apparatus and system for key derivation

This application discloses a policy control method, including: after a gateway is connected to a network, receiving a first gateway access identifier; selecting a PCRF entity for the gateway accordingly, and establishing a first session for the gateway to implement policy control on the gateway; when a mobile terminal or a fixed-line device is connected to the network through the gateway to perform service data flow access, receiving a second gateway access identifier; if the second gateway access identifier and the first gateway access identifier are the same, selecting, for a service data flow of the mobile terminal or the fixed-line device, a same PCRF entity, and establishing a second session to implement policy control on the service data flow of the mobile terminal or the fixed-line device. The foregoing manner is used to prevent incorrect policy control from causing an exception.

Policy control method and related apparatus and system

A method, network element, and mobile station (MS) are disclosed. The method includes: obtaining information that a plug-in card of the MS does not support a first encryption algorithm; deleting the first encryption algorithm from an encryption algorithm list permitted by a core network element according to the information that the plug-in card of the MS does not support the first encryption algorithm; sending the encryption algorithm list excluding the first encryption algorithm to an access network element, so that the access network element selects an encryption algorithm according to the encryption algorithm list excluding the first encryption algorithm and the MS capability information sent from the MS and sends the selected encryption algorithm to the MS. By using the method, network element, and MS, errors due to the fact that the plug-in card of the MS does not support an encryption algorithm may be avoided during the encryption process.

Method, network element, and mobile station for negotiating encryption algorithms

Embodiments of the present invention provide a method for ensuring uplink quality of service, a base station and a user equipment. The method for ensuring the uplink quality of service includes: receiving a downlink service data flow, where the downlink service data flow carries an uplink transmission control identifier; and controlling, based on the uplink transmission control identifier, a transmission of a service type's uplink data for which an uplink transmission control needs to be performed in an uplink radio bearer, so as to reduce a transmission rate of the service type's uplink data. Through the technical solution provided by embodiments of the present invention, data is recognized in a dedicated radio bearer and controlled when a centralized scheduling is adopted for uplink resources, thereby ensuring the uplink quality of service.

Method for ensuring uplink quality of service, base station and user equipment

A method, an apparatus and a system for key derivation are disclosed. The method includes the following steps: a target base station) receives multiple keys derived by a source base station, where the keys correspond to cells of the target base station; the target base station selects a key corresponding to the target cell after knowing a target cell that a user equipment (UE) wants to access. An apparatus for key derivation and a communications system are also provided.

A method, an apparatus and a system for marking a service data packet are provided. A traffic detection function TDF is requested to detect a data flow description or data flow starting or ending information corresponding to a service application type. The detected data flow description or a data flow starting or ending information report, transmitted by the TDF, is received. A data packet marking rule is generated according to the data flow description or the data flow starting or ending information report. A session modification message carrying the data packet marking rule is transmitted to a bearer binding function entity BBF for the BBF to map a data flow identified by the session modification message to a bearer according to the session modification message, and mark a GTP-U header according to the data packet marking rule.

Method, apparatus and system for marking service data packet

A method, an apparatus and a system for key derivation are disclosed. The method includes the following steps: a target base station) receives multiple keys derived by a source base station, where the keys correspond to cells under control of the target base station; the target base station selects a key corresponding to the target cell after knowing a target cell that a user equipment (UE) wants to access. An apparatus for key derivation and a communications system are also provided.

A method and an apparatus for authentication are disclosed. The method includes: deciding to release a connection or continue a current service according to native information and network policy after an AKA authentication procedure fails. When the EPS AKA authentication procedure fails, the connection is not released immediately in the present invention, but the connection is released or the current service is continued according to the native information and network policy, thus avoiding unnecessary release of connections and saving resources.

Method and apparatus for authentication

A method, a device, and a system for establishing a security mechanism for an air interface are provided in embodiments of the present invention. The method includes: performing security processing for a shared key of an access link according to a shared key between a relay node and a mobility management entity; and sending the shared key of the access link after the security processing to the relay node to enable the relay node to obtain the shared key of the access link based on the shared key between the relay node and the mobility management entity. The present invention reduces the possibility at which the air interface link is hacked, thereby improving the security of the air interface link.

Method and device for establishing a security mechanism for an air interface link

Embodiments of the present invention disclose a relay node authentication method, apparatus, and system. The method provided in an embodiment of the present invention includes: sending, by a relay node, an authentication request message to a peer node, where the authentication request message includes a certificate of the relay node, so that the peer node authenticates the relay node according to the certificate of the relay node, where the peer node is a network side node or a security gateway in a security domain where the network side node is located; and receiving, by the relay node, an authentication response message sent by the peer node, where the authentication response message includes a certificate of the peer node, and authenticating the peer node according to the certificate of the peer node.

Relay node authentication method, apparatus, and system

Embodiments of the present invention disclose a method and an apparatus for security algorithm selection processing, a network entity, and a communication system. The method includes: receiving a service request message sent by user equipment; and according to a security protection requirement of the service request message, selecting a security algorithm from a security algorithm list supported by both the user equipment and a network entity, where security algorithm lists supported by the user equipment and/or the network entity are set separately based on different security protection requirements, or security algorithm lists supported by the user equipment and the network entity are used for indicating security capability of the user equipment and the network entity respectively.

Method and apparatus for security algorithm selection processing, network entity, and communication system

A method and a device for obtaining a security key in a relay system are disclosed in the embodiment of the present invention. A node in the relay system obtains an initial key, according to the initial key, the node obtains a root key of an air interface protection key between the node and another node that is directly adjacent to the node, and according to the root key, the node obtains the air interface protection key between the node and said another node that is directly adjacent to the node. Therefore, according to the initial key, each lower-level node obtains a root key of an air interface protection key between each lower-level node, so that data of a UE on a Un interface link may be respectively protected, that is, each active UE has a set of security parameters on the Un interface link, and effective security protection is performed on data on each segment of an air interface.

Method and device for obtaining security key in relay system

A control-based method for processing media stream queues includes: a multimedia control entity processes the talk burst request queues corresponding to different media types when the conditions of triggering processing of different talk bursts are satisfied; and the multimedia control entity sends the assigned talk burst to the corresponding multimedia session terminal. The present invention also provides a corresponding apparatus. By processing the media stream queues, the present invention ensures talk bursts of multiple correlated media types to be assigned in a session.

Growing community of inventors

Shanghai, China

Aiqin Zhang