Negotiating security capabilities during movement of UE
A method for negotiating security capabilities during movement of a User Equipment (UE) includes the following steps: a target network entity receives a Routing Area Update (RAU) Request from the UE; the entity obtains Authentication Vector (AV)-related keys deduced according to a root key, and sends the selected security algorithm to the UE; and the UE deduces the AV-related keys according to the root key of the UE. A system, SGSN, and MME for negotiating security capabilities during movement of a UE are also disclosed. The present invention is applicable to security capability negotiation between the UE and the network.
1. In a mobility management entity (MME) of a long term evolution (LTE) network, a method for negotiating security keys comprising:
receiving a context request for requesting a mobility management context sent by a serving GPRS support node (SGSN) in a second or third generation (2G/3G) network, according to a routing area update (RAU) request from a user equipment (UE) in an idle mode; and
sending the mobility management context to the SGSN, wherein the mobility management context comprises information for determining security capacities supported by the UE and authentication vector (AV)-related keys that are deduced according to a root key of the MME, wherein the AV-related keys comprise an Integrity Protection Key (IK) and a Ciphering Key (CK), or comprise values derived from the IK and the CK through an unidirectional transformation.
2. A mobility management entity (MME) of a long term evolution (LTE) network for negotiating security keys, comprising:
a receiver configured to receive a context request for requesting a mobility management context sent by a serving GPRS support node (SGSN) in a second or third generation (2G/3G) network according to a routing area update (RAU) request from a user equipment (UE) in an idle mode;
a processor configured to deduce authentication vector (AV)-related keys according to a root key of the MME, wherein the AV-related keys comprise an Integrity Protection Key (IK) and a Ciphering Key (CK), or comprise values derived from the IK and the CK through an unidirectional transformation; and
a transmitter configured to send the mobility management context to the SGSN, wherein the mobility management context comprises information for determining security capacities supported by the UE and the AV-related keys.
3. A system for negotiating security keys, comprising:
a serving GPRS support node (SGSN) in a second or third generation (2G/3G) network, configured to receive a routing area update (RAU) request from a user equipment (UE) when the UE is in an idle mode and moves from a long term evolution (LTE) network to the 2G/3G network, and to send a context request to a mobility management entity (MME) in the LTE network to request a mobility management context according to the RAU request; and
the MME configured to receive the context request, and send the mobility management context to the SGSN, wherein the mobility management context comprises information for determining security capacities supported by the UE and authentication vector (AV)-related keys that are deduced according to a root key of the MME, wherein the AV-related keys comprise an Integrity Protection Key (IK) and a Ciphering Key (CK);
wherein the SGSN is further configured to send the AV-related keys to a radio network controller (RNC).