METHOD FOR IMPLEMENTING LOCAL ROUTING OF TRAFFIC, BASE STATION AND SYSTEM

• US 20120163597A1
• Filed: 12/20/2011
• Published: 06/28/2012
• Est. Priority Date: 12/24/2010
• Status: Active Grant

• Current Assignee: Honor Device Company Limited
• Original Assignee: Huawei Device Company Limited (Huawei Investment & Holding Co., Ltd.)
• Inventors: Ding, Zhiming, Shu, Guiming, Zhang, Zhiyong, Chen, Guoqiao, Pan, Su
• Granted Patent: US 9,215,221 B2
• Time in Patent Office: Days
• US Class Current: 380/255
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

Embodiments of the present invention provide a method for implementing local routing of traffic, a base station and a system are provided, which relate to the field of communications technologies. The method for implementing local routing of traffic includes: judging whether local routing processing is performed on an uplink traffic flow of a first terminal that serves as a sending end; if it is judged as yes, updating a key of the uplink traffic flow of the first terminal and/or a key of a downlink traffic flow of a second terminal that serves as a receiving end to a public key; forwarding an encrypted data packet of the uplink traffic flow of the first terminal to the second terminal through the downlink traffic flow of the second terminal, where an encryption and decryption operation is not performed on the encrypted data packet before the forwarding or during the forwarding.

Claims

1. A method for implementing local routing of traffic, comprising:

judging whether local routing processing is performed on an uplink traffic flow of a first terminal that serves as a sending end;

if it is judged as yes, updating a key of the uplink traffic flow of the first terminal and/or a key of a downlink traffic flow of a second terminal that serves as a receiving end to a public key; and

forwarding an encrypted data packet of the uplink traffic flow of the first terminal to the second terminal through the downlink traffic flow of the second terminal, wherein an encryption and decryption operation is not performed on the encrypted data packet before the forwarding or during the forwarding.

2. The method for implementing local routing of traffic according to claim 1, wherein the judging whether the local routing processing is performed on the uplink traffic flow of the first terminal that serves as the sending end comprises:

judging whether the local routing processing is performed on the uplink traffic flow when a first packet of the uplink traffic flow of the first terminal that serves as the sending end is received;

or

judging whether the local routing processing is performed on the uplink traffic flow when the uplink traffic flow of the first terminal that serves as the sending end is created.

3. The method for implementing local routing of traffic according to claim 1, wherein the updating the key of the uplink traffic flow of the first terminal and/or the key of the downlink traffic flow of the second terminal that serves as the receiving end to the public key comprises:

judging whether an encryption and decryption algorithm adopted by the uplink traffic flow of the first terminal and the downlink traffic flow of the second terminal each is the same; and

if it is judged as yes, updating the key of the uplink traffic flow of the first terminal and/or the key of the downlink traffic flow of the second terminal to the public key.

4. The method for implementing local routing of traffic according to claim 1, wherein the updating the key of the uplink traffic flow of the first terminal and/or the key of the downlink traffic flow of the second terminal that serves as the receiving end to the public key comprises:

judging whether an encryption and decryption algorithm adopted by the uplink traffic flow of the first terminal and the downlink traffic flow of the second terminal each is the same; and

if it is judged as no, updating an encryption and decryption algorithm of the uplink traffic flow of the first terminal and/or an encryption and decryption algorithm of the downlink traffic flow of the second terminal, so that the encryption and decryption algorithms adopted by the uplink traffic flow of the first terminal and the downlink traffic flow of the second terminal are the same, and updating the key of the uplink traffic flow of the first terminal and/or the key of the downlink traffic flow of the second terminal to the public key.

5. The method for implementing local routing of traffic according to claim 1, wherein the forwarding the encrypted data packet of the uplink traffic flow of the first terminal to the second terminal through the downlink traffic flow of the second terminal, wherein the encryption and decryption operation is not performed on the encrypted data packet before the forwarding or during the forwarding, comprises:

judging, according to a key identifier carried in the encrypted data packet of the uplink traffic flow of the first terminal, whether a key adopted by the encrypted data packet is the public key; and

if it is judged as yes, forwarding the encrypted data packet to the second terminal through the downlink traffic flow of the second terminal, wherein the encryption and decryption operation is not performed before the forwarding or during the forwarding.

6. A base station, comprising:

a judging module, configured to judge whether local routing processing is performed on an uplink traffic flow of a first terminal that serves as a sending end;

an updating module, configured to update a key of the uplink traffic flow of the first terminal and/or a key of a downlink traffic flow of a second terminal that serves as a receiving end to a public key when an output result of the judging module is yes; and

a forwarding module, configured to forward an encrypted data packet of the uplink traffic flow of the first terminal to the second terminal through the downlink traffic flow of the second terminal after the updating module finishes updating the key, wherein an encryption and decryption operation is not performed on the encrypted data packet before the forwarding or during the forwarding.

7. The base station according to claim 6, wherein the judging module at least comprises one of the following modules:

a first judging module, configured to judge whether local routing processing is performed on the uplink traffic flow when a first packet of the uplink traffic flow of the first terminal is received; and

a second judging module, configured to judge whether local routing processing is performed on the uplink traffic flow when the uplink traffic flow of the first terminal is created.

8. The base station according to claim 6, wherein the updating module comprises:

an algorithm judging module, configured to judge whether an encryption and decryption algorithm adopted by the uplink traffic flow of the first terminal and the downlink traffic flow of the second terminal each is the same;

a first updating module, configured to update the key of the uplink traffic flow of the first terminal and/or the key of the downlink traffic flow of the second terminal to the public key when an output result of the algorithm judging module is yes; and

a second updating module, configured to update an encryption and decryption algorithm of the uplink traffic flow of the first terminal and/or an encryption and decryption algorithm of the downlink traffic flow of the second terminal when the output result of the algorithm judging module is no, so that the encryption and decryption algorithms adopted by the uplink traffic flow of the first terminal and the downlink traffic flow of the second terminal are the same, and update the key of the uplink traffic flow of the first terminal and/or the key of the downlink traffic flow of the second terminal to the public key.

9. The base station according to claim 8, wherein the forwarding module comprises:

a key judging module, configured to judge, according to a key identifier carried in the encrypted data packet of the uplink traffic flow of the first terminal, whether a key adopted by the encrypted data packet is the public key; and

a processing module, configured to forward the encrypted data packet to the second terminal through the downlink traffic flow of the second terminal when an output result of the key judging module is yes, wherein the encryption and decryption operation is not performed on the encrypted data packet before the forwarding or during the forwarding.

10. A communication system, comprising:

a first terminal that serves as a sending end, a second terminal that serves as a receiving end, and a base station, wherein

the base station is configured to judge whether local routing processing is performed on an uplink traffic flow of the first terminal, and update a key of the uplink traffic flow of the first terminal and/or a key of a downlink traffic flow of the second terminal to a public key if a judgment result is yes;

forward an encrypted data packet of the uplink traffic flow of the first terminal to the second terminal through the downlink traffic flow of the second terminal, wherein an encryption and decryption operation is not performed on the encrypted data packet before the forwarding or during the forwarding.