METHOD FOR PROTECTING SECURITY OF DATA, NETWORK ENTITY AND COMMUNICATION TERMINAL

• US 20130305386A1
• Filed: 07/16/2013
• Published: 11/14/2013
• Est. Priority Date: 01/17/2011
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: CHEN, Jing, ZHANG, Lijia, XU, Yixian
• Granted Patent: US 9,189,632 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

The present invention relates to communication technologies and discloses a method and an apparatus for protecting security of data, so as to solve the problem of the prior art in which the security of data transmission between a communication terminal which has a characteristic of small data transmission and the network cannot be guaranteed. Information relevant to security context is stored if a communication terminal has a characteristic of small data transmission; current security context is obtained according to the information relevant to security context; and security protection of communication data is performed by employing the current security context. The embodiments of the present invention may be applied to a communication system having a characteristic of small data transmission, such as an MTC and the like.

Claims

1. A method for protecting security of data, which is applied to a machine type communication, comprising:

storing, by a network side entity, information relevant to security context if a communication terminal which communicates with the network side entity has a characteristic of small data transmission;

obtaining, by the network side entity, current security context according to the information relevant to security context; and

protecting, by the network side entity, security of communication data by employing the current security context.

2. The method of claim 1, before storing the information relevant to security context, further comprising:

querying, by the network side entity, a home subscribe server (HSS) about a machine type communication (MTC) characteristic information of the communication terminal;

determining, by the network side entity, whether the communication terminal has the characteristic of small data transmission according to the MTC characteristic information.

3. The method of claim 1, wherein the information relevant to security context comprises:

security context, or

an algorithm and an authentication vector (AV), or

an algorithm and a root key Kasme.

4. The method of claim 3, further comprising:

sending, by the network side entity, a detach request message or a detach accept message to the communication terminal, wherein the detach request message or the detach accept message comprises a random number RAND and an authentication token (AUTN) in the authentication vector (AV).

5. The method of claim 3, wherein when the information relevant to security context comprises the algorithm and the authentication vector (AV), the obtaining, by the network side entity, current security context according to the information relevant to security context, comprises:

generating, by the network side entity, the security context according to the algorithm and a Kasme in the AV comprised in the information relevant to security context.

6. The method of claim 3, wherein the obtaining, by the network side entity, current security context according to the information relevant to security context, comprises:

taking, by the by the network side entity, the security context comprised in the information relevant to security context as the current security context.

7. The method of claim 3, wherein the obtaining, by the network side entity, current security context according to the information relevant to security context, comprises:

receiving, by the network side entity, a random number generated by the communication terminal;

generating, by the network side entity, a new root key according to the random number generated by the communication terminal, a Count value stored by the network side entity and the root key Kasme comprised in the information relevant to security context; and

generating, by the network side entity, the current security context according to the new root key and the algorithm comprised in the information relevant to security context.

8. A method for protecting security of data, which is applied to a machine type communication, comprising:

storing, by a communication terminal, information relevant to security context if the communication terminal has a characteristic of small data transmission;

obtaining, by the communication terminal, current security context according to the information relevant to security context; and

protecting, by the communication terminal, security of communication data by employing the current security context.

9. The method of claim 8, before storing the information relevant to security context, further comprising:

obtaining, by the communication terminal, its own MTC characteristic information according to configuration information, and determining whether the communication terminal has the characteristic of small data transmission.

10. The method of claim 9, wherein the information relevant to security context comprises:

security context, or

an algorithm, a random number RAND and an authentication vector (AV), or

an algorithm and a root key Kasme.

11. The method of claim 10, wherein the storing, by a communication terminal, information relevant to security context, comprises:

receiving, by the communication terminal, a detach request message or a detach accept message sent by a network side entity; and

storing, by the communication terminal, the RAND and the AUTN in the detach request message or the detach accept message.

12. The method of claim 11, wherein the obtaining, by the communication terminal, current security context according to the information relevant to security context, comprises:

validating, by the communication terminal, the AUTN;

generating, by the communication terminal, a Kasme according to the RAND and the AUTN; and

generating, by the communication terminal, the current security context according to the generated Kasme and the algorithm in the information relevant to security context.

13. The method of claim 10, wherein the obtaining, by the communication terminal, current security context according to the information relevant to security context, comprises:

taking, by the communication terminal, the security context comprised in the information relevant to security context as the current security context.

14. The method of claim 10, wherein the obtaining, by the communication terminal, current security context according to the information relevant to security context, comprises:

obtaining, by the communication terminal, a Count value of the communication terminal and a random number generated by the communication terminal, wherein the Count value of the communication terminal is number of times the communication terminal and the network side entity perform fast authentication;

generating a new root key according to the random number generated by the communication terminal, the Count value of the communication terminal and the root key Kasme comprised in the information relevant to security context; and

generating the current security context according to the new root key and the algorithm comprised in the information relevant to security context.

15. A communication terminal, which is applied to a machine type communication, comprising:

a storing module, configured to store information relevant to security context if the communication terminal has a characteristic of small data transmission;

a first obtaining module, configured to obtain current security context according to the information relevant to security context; and

a security protecting module, configured to protect security of communication data by employing the current security context.

16. The communication terminal of claim 15, wherein the storing module further comprises:

a determining module, configured to obtain its own MTC characteristic information according to configuration information, and determine whether the communication terminal has the characteristic of small data transmission.

17. The communication terminal of claim 15, wherein the first obtaining module further comprises:

a receiving sub-module, configured to receive a detach request message or a detach accept message sent by a network side entity;

a storing sub-module, configured to store an RAND and an AUTN in the detach request message or the detach accept message;

a first generating sub-module, configured to validate the AUTN, and generate a Kasme according to the RAND and the AUTN; and

a third generating sub-module, configured to generate the current security context according to the generated Kasme and an algorithm in the information relevant to security context.

18. The communication terminal of claim 15, wherein further comprising:

a second obtaining sub-module, configured to obtain a Count value of the communication terminal and a random number generated by the communication terminal, wherein the Count value of the communication terminal is number of times the communication terminal and the network side entity perform fast authentication;

a third generating sub-module, configured to generate a message authentication code (MAC) value according to the random number and the Count value obtained by the second obtaining sub-module, and a root key Kasme comprised in the information relevant to security context; and

a sending sub-module, configured to send the generated MAC value to the network side entity.

19. The communication terminal of claim 17, wherein the second obtaining sub-module is further configured to receive a Count value stored by the network side entity sent by a network side, and update the Count value of the communication terminal to the Count value stored by the network side entity if the Count value of the communication terminal is not consistent with the Count value stored by the network side entity.

20. The communication terminal of claim 17, further comprising:

an RES receiving module, configured to receive an RES sent by the network side entity;

an RES generating module, configured to generate an RES according to the new root key generated by the third generating sub-module and the random number obtained by the second obtaining sub-module; and

an RES authenticating module, configured to check whether the generated RES is consistent with the RES sent by the network side entity, and determine, if the generated RES is consistent with the RES sent by the network side entity, that the communication terminal authenticates the network side entity successfully.