Method, apparatus, and system for performing an establishment of a security context between user equipment and an access node by a base station

1. A method for establishing a security context in a network in which a user equipment (UE) is simultaneously connected to a core network by a first air interface through a base station and by a second air interface through an access node, the method comprising:

sending, by the base station, a root key to the access node;

acquiring, by the base station, an encryption algorithm used by the access node;

sending, by the base station, the encryption algorithm of the access node to the UE; and

instructing, by the base station, the access node to start downlink encryption and uplink decryption following base station receipt of signaling from the UE notifying the base station that the UE has derived an encryption key according to the root key and the encryption algorithm.

2. The method according to claim 1 , further comprising:

sending, by the base station, the security capability of the UE to the access node.

3. A method for establishing a security context, a user equipment (UE) being connected to a core network by a first air interface through a base station and by a second air interface through an access node simultaneously, the method comprising:

receiving, by the access node, a root key sent by the base station;

selecting, by the access node, an encryption algorithm according a security capability of the access node, a security policy of the access node, and a security capability of the UE;

deriving, by the access node, an encryption key according to the root key and the encryption algorithm;

sending, by the access node, the encryption algorithm to the base station; and

starting, by the access node, downlink encryption and uplink decryption according to a startup indication of the base station following base station receipt of signaling from the UE notifying the base station that the UE has derived an encryption key according to the root key and the encryption algorithm.

4. The method according to claim 3 , further comprising:

receiving, by the access node, the security capability of the UE sent by the base station.

5. A method for establishing a security context in a network in which a user equipment (UE) is connected to a core network by a first air interface through a base station and by a second air interface through an access node simultaneously, and the first air interface between the UE and the base station is under security protection, the method comprising:

receiving, by the UE, an encryption algorithm of the access node sent by the base station;

deriving, by the UE, an encryption key of the UE according to a root key and the encryption algorithm;

sending, by the UE to the base station, signaling notifying the base station that the UE has derived the encryption key according to the root key and the encryption algorithm; and

starting, by the UE, downlink decryption and uplink encryption over the second air interface between the UE and the access node.

6. A base station of a network in which a user equipment (UE) is connected to a core network by a first air interface through the base station and by a second air interface through an access node simultaneously, comprising:

a transmitter, configured to send a root key to an access node;

a processor, configured to acquire an encryption algorithm used by the access node;

the transmitter being connected to the processor and configured to send the acquired encryption algorithm to a UE,

the processor being configured to instruct the access node to start downlink encryption and uplink decryption following base station receipt of signaling from the UE notifying the base station that the UE has derived an encryption key according to the root key and the encryption algorithm.

7. The base station according to claim 6 , the transmitter being further configured to send the security capability of the UE to the access node.

8. An access node of a network in which a user equipment (UE) is connected to a core network by a first air interface through a base station and by a second air interface through the access node simultaneously, comprising:

a receiver, configured to receive a root key sent by a base station;

a processor, configured to select an encryption algorithm according to a security capability of the access node, a security policy of the access node, and a security capability of a UE,

wherein the processor is connected to the receiver and configured to derive an encryption key according to the root key received by the receiver and the encryption algorithm; and

a transmitter, connected to the processor and configured to send the encryption algorithm selected by the processor to the base station,

wherein the processor is configured to start downlink encryption and uplink decryption according to a startup indication of the base station following base station receipt of signaling from the UE notifying the base station that the UE has derived an encryption key according to the root key and the encryption algorithm.

9. The access node according to claim 8 , wherein the receiver is further configured to receive the security capability of the UE sent by the base station, wherein the security capability of the UE is used by the processor to select the encryption algorithm.

10. A user equipment (UE) being connected to a core network by a first air interface through a base station and by a second air interface through an access node simultaneously, and the first air interface between the UE and the base station is under security protection, comprising:

a receiver, configured to receive an encryption algorithm of an access node sent by a base station;

a processor, connected to the receiver and configured to derive, according to a root key and the encryption algorithm received by the receiver, an encryption key of a user equipment (UE); and

a transmitter, configured to send to the base station signaling notifying the base station that the UE has derived the encryption key according to the root key and the encryption algorithm,

wherein the processor is further configured to start downlink decryption and uplink encryption over the second air interface between the UE and the access node.

11. A system for establishing a security context, comprising:

A base station; and an access node,

the base station being configured to:

connect a user equipment (UE) to a core network by a first air interface;

send a root key to the access node;

acquire an encryption algorithm used by the access node;

send the encryption algorithm of the access node to the UE; and

instruct the access node to start downlink encryption and uplink decryption following base station receipt of signaling from the UE notifying the base station that the UE has derived an encryption key according to the root key and the encryption algorithm;

the access node being configured to:

connect the UE to the core network by a second air interface simultaneously with a connection between the base station and the UE;

receive the root key sent by the base station; select the encryption algorithm according to the security capability of the access node, the security policy of the access node, and the security capability of the UE;

derive the encryption key according to the root key and the encryption algorithm; send the encryption algorithm to the base station; and

start downlink encryption and uplink decryption according to a startup indication of the base station.

12. A method for establishing a security context in a network, the method comprising:

connecting a user equipment (UE) to a core network by a first air interface through a base station and by a second air interface through an access node simultaneously;

sending, by the base station, a root key to the access node;

acquiring, by the base station, an encryption algorithm used by the access node;

sending, by the base station, the encryption algorithm of the access node to the UE;

instructing, by the base station, the access node to start downlink encryption and uplink decryption following base station receipt of signaling from the UE notifying the base station that the UE has derived an encryption key according to the root key and the encryption algorithm; and

sending, by the base station, the security capability of the UE to the access node.