Method and apparatus for security communication of carrier aggregation between base stations
This invention discloses a method for security communication of carrier aggregation between base stations, which method comprises receiving, by a user equipment, a first message to add a cell controlled by a secondary base station as a service cell sent by a primary base station; and creating, by the user equipment, a security key for communication with cells controlled by the secondary base station according to security context of the primary base station and the first message. This invention further discloses the corresponding user equipment and base stations. Implementation of the method and apparatus according to the present invention makes it possible to effectively protect security of data transmission of the air interface and to avoid attacks on air interface security.
1. A method for security communication of carrier aggregation between base stations, comprising:
receiving, by a user equipment, a first message sent by a primary base station, the first message indicating to add at least one cell controlled by a secondary base station as a service cell of the user equipment; and
creating, by the user equipment, a second security key of the secondary base station according to security context of the primary base station and the first message, when no cell currently serving for the user equipment is controlled by the secondary base station;
communicating according to the second security key of the secondary base station, by the user equipment, with the secondary base station while keeping in touch with the primary base station.
2. The method according to claim 1 , wherein a first security key of the primary base station according to which the user equipment keeps in touch with the primary base station is different from the second security key of the secondary base station.
3. The method according to claim 1 , wherein the first message is Radio Resource Control connection reconfiguration message comprising a security algorithm determined by the secondary base station according to safety capacity of the user equipment.
4. A method for security communication of carrier aggregation between base stations, comprising:
receiving, by a secondary base station, an indication message sent by a primary base station when no cell controlled by the secondary base station is a service cell currently serving for a user equipment wherein the indication message indicates to add at least one cell controlled by the secondary base station as the service cell of the user equipment, and the indication message comprises a second security key that corresponds to the secondary base station to which the service cell is subordinated; and
communicating, according to the second security key of the secondary base station, by the secondary base station, with the user equipment which synchronously keeps in touch with the primary base station.
5. The method according to claim 4 , further comprising:
forwarding, by the secondary base station, a first message via the primary base station to the user equipment, the first message indicating that the user equipment adds at least one cell controlled by the secondary base station as the service cell.
6. The method according to claim 5 , wherein
the first message comprises a first next hop chaining counter (NCC) and a second NCC from the primary base station, wherein the first NCC or the second NCC is used for creating the security key of the secondary base station, the first NCC is an updated NCC of the primary base station, and the second NCC is an NCC that corresponds to the current security key of the primary base station.
7. The method according to claim 4 , wherein the second security key of the secondary base station is different from a first security key of the primary base station according to which the user equipment synchronously keeps in touch with the primary base station.
8. The method according to claim 4 , further comprising:
transmitting to the user equipment via the primary base station, by the secondary base station, a security algorithm determined according to safety capacity of the user equipment, wherein the safety capacity of the user equipment is received from the primary base station.
9. A user equipment, comprising a processor and a non-transitory processor-readable medium having processor-executable instructions stored thereon, the processor-executable instructions are executed by the processor to perform:
receiving a first message sent by a primary base station, the first message indicating to add at least one cell controlled by a secondary base station as a service cell of the user equipment; and
creating a second security key of the secondary base station according to security context of the primary base station and the first message, when no cell currently serving for the user equipment is controlled by the secondary base station;
communicating according to the second security key of the secondary base station, by the user equipment, with the secondary base station while keeping in touch with the primary base station.
10. The user equipment according to claim 9 , wherein a first security key of the primary base station according to which the user equipment keeps in touch with the primary base station is different from the second security key of the secondary base station.
11. The user equipment according to claim 9 , wherein the first message is Radio Resource Control connection reconfiguration message comprising a security algorithm determined by the secondary base station according to safety capacity of the user equipment.
12. A base station, comprising a processor and a non-transitory processor-readable medium having processor-executable instructions stored thereon, the processor-executable instructions are executed by the processor to perform:
receiving an indication message sent by a primary base station when no cell controlled by the base station is a service cell of a user equipment, wherein the indication message indicates to add at least one cell controlled by the base station as the service cell of the user equipment, and the indication message comprises a second security key that corresponds to the base station to which the service cell is subordinated; and
communicating, according to the second security key of the secondary base station, with the user equipment which synchronously keeps in touch with the primary base station.
13. The base station according to claim 12 , the processor-executable instructions are further executed by the processor to perform:
transmitting a first message to the primary base station to be forwarded via the primary base station to the user equipment, wherein the first message indicates to add the at least one cell controlled by the base station as the service cell.
14. The base station according to claim 13 , wherein the first message comprises a first next hop chaining counter (NCC) and a second NCC from the primary base station, wherein the first NCC or the second NCC is configured to create the security key of the base station, the first NCC is an updated NCC of the primary base station, and the second NCC is an NCC that corresponds to the current security key of the primary base station.
15. The base station according to claim 12 , wherein the second security key of the base station is different from a first security key of the primary base station according to which the user equipment synchronously keeps in touch with the primary base station.
16. The base station according to claim 12 , wherein the processor-executable instructions are further executed by the processor to perform:
transmitting a security algorithm determined according to safety capacity of the user equipment to the user equipment via the primary base station, wherein the safety capacity of the user equipment is received from the primary base station.