Data transmission method, device, and system

• US 10,673,611 B2
• Filed: 08/24/2018
• Issued: 06/02/2020
• Est. Priority Date: 03/01/2016
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Shi, Xiaoli, Zhang, Hongzhuo, Luo, Haiyan, Peng, Wenjie
• Primary Examiner(s): Ho, Dao Q
• Application Number:
  US16/112,416
• Publication Number:
  US 20180367292A1
• Time in Patent Office: 648 Days
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0656 Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04W 12/037 of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 76/10 Connection setup

Abstract

The present disclosure discloses a data transmission method, device, and system, and belongs to the field of communications technologies. The method includes: receiving a data packet sent by user equipment, where the data packet carries indication information used to instruct a base station to establish a specified data connection to the user equipment; generating a first key of the user equipment based on the indication information and a public key of the base station; and performing data transmission with the user equipment based on the first key of the user equipment. According to the data transmission method, the transmitted data can be encrypted and decrypted when there is no radio resource control connection between the base station and the user equipment, thereby improving data transmission security while ensuring data transmission efficiency.

Claims

1. A method for data transmission, comprising:

receiving a data packet sent by user equipment, wherein the data packet carries indication information used to instruct a target base station to establish a specified data connection to the user equipment;

generating a first key of the user equipment based on the indication information and a public key of the target base station to establish the specified data connection to the user equipment;

sending a key information request to a source base station of the user equipment, wherein the key information request is at least used to request to obtain an encryption algorithm used by the source base station;

receiving a key information response sent by the source base station, wherein the key information response comprises identification information of the encryption algorithm;

generating a second key based on a source base station identifier of the source base station, the encryption algorithm, and the indication information; and

performing data transmission with the user equipment based on the second key.

2. The method according to claim 1, wherein the indication information is a random number generated by the user equipment.

3. The method according to claim 1, further comprising:

before receiving the data packet sent by the user equipment,

generating the public key of the target base station based on an encryption algorithm and a base station identifier of the target base station, wherein the encryption algorithm is determined by the target base station.

4. The method according to claim 3, further comprising:

before receiving the data packet sent by the user equipment,

sending identification information of the encryption algorithm of the target base station to the user equipment, wherein the identification information of the encryption algorithm is used by the user equipment to obtain the encryption algorithm of the target base station.

5. The method according to claim 1, wherein sending the key information request to the source base station comprises:

sending a configuration update request message to the source base station, wherein the configuration update request message carries the key information request.

6. A target base station comprising a receiver, a transmitter and a processor, wherein the processor is configured to:

receive, through the receiver, a data packet sent by user equipment, wherein the data packet carries indication information used to instruct the target base station to establish a specified data connection to the user equipment;

generate a first key of the user equipment based on the indication information and a public key of the target base station to establish the specified data connection to the user equipment;

send, through the transmitter, a key information request to a source base station of the user equipment, wherein the key information request is used to request to obtain an encryption algorithm used by the source base station;

receive, through the receiver, a key information response sent by the source base station, wherein the key information response comprises identification information of the encryption algorithm;

generate a second key based on a base station identifier of the source base station, the encryption algorithm, and the indication information; and

perform, through the receiver and the transmitter, data transmission with the user equipment based on the second key.

7. The target base station according to claim 6, wherein the indication information is a random number generated by the user equipment.

8. The target base station according to claim 6, wherein the processor is further configured to generate the public key of target the base station based on an encryption algorithm and a base station identifier of the target base station, wherein the encryption algorithm is determined by the target base station.

9. The target base station according to claim 8, wherein the processor is further configured to send, through the transmitter, identification information of the encryption algorithm of the target base station to the user equipment, wherein the identification information of the encryption algorithm is used by the user equipment to obtain the encryption algorithm of the target base station.