A method, device and storage medium for improving the security of a wireless communication system

Abstract

This article discloses a method, device and storage medium for improving the security of a wireless communication system. The method includes: an access network device establishes a bearer; the access network device determines whether the value of the bearer identifier of the bearer satisfies a rollover condition; if the value of the bearer identifier satisfies the rollover condition, the access network device initiates a cell internal handover to the terminal device.

Description

Technical Field

[0001] The present application relates to a wireless communication network, for example, to a method, device and storage medium for improving the security of a wireless communication system. Background Art

[0002] With the continuous development of wireless communication networks, wireless communication has played an increasingly important role in people's lives. The security of wireless communication networks not only ensures the safe and normal operation of network systems, but also ensures the security of users' personal information. However, there is currently no perfect method to ensure the security of air interface data. Summary of the invention

[0003] The present application provides a method, device and storage medium for improving the security of a wireless communication system, which can avoid the reuse of key streams and improve the security of the wireless communication system.

[0004] The present invention provides a method for improving the security of a wireless communication system, including:

[0005] Access network equipment establishes bearer;

[0006] The access network device determines whether the value of the bearer identifier of the bearer satisfies the rollover condition;

[0007] If the value of the bearer identifier meets the rollover condition, the access network device initiates an internal cell handover to the terminal device.

[0008] The present invention provides a method for improving the security of a wireless communication system, including:

[0009] When the terminal device accesses the first cell, the terminal device receives an internal cell handover initiated by the access network device;

[0010] The terminal device re-accesses the first cell.

[0011] An embodiment of the present application provides an access network device, including: a processor, and the processor is used to implement the method of any of the above embodiments when executing a computer program.

[0012] An embodiment of the present application provides a terminal device, including: a processor, the processor being configured to implement the method of any of the above embodiments when executing a computer program.

[0013] An embodiment of the present application further provides a computer-readable storage medium storing a computer program, which implements the method of any of the above embodiments when the computer program is executed by a processor.

[0014] With regard to the above embodiments and other aspects of the present application and their implementation, further description is provided in the accompanying drawings, detailed description and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A schematic diagram of encrypting / decrypting a message at a PDCP layer provided by an embodiment;

[0016] Figure 2 A schematic flow chart of a method for improving the security of a wireless communication system provided by an embodiment;

[0017] Figure 3 A schematic flow chart of another method for improving the security of a wireless communication system provided by an embodiment;

[0018] Figure 4 An interactive schematic diagram of a method for improving the security of a wireless communication system provided by an embodiment;

[0019] Figure 5 A schematic diagram of a process for allocating bearer identifiers for different services by a core network device provided in an embodiment;

[0020] Figure 6 A schematic diagram of a device structure for improving the security of a wireless communication system provided by an embodiment;

[0021] Figure 7 A schematic diagram of another device structure for improving the security of a wireless communication system provided by an embodiment;

[0022] Figure 8 A schematic diagram of the structure of another device for improving the security of a wireless communication system provided by an embodiment;

[0023] Fig. 9 A schematic diagram of the structure of a base station provided by an embodiment;

[0024] Fig.10 A schematic diagram of the structure of a UE provided by an embodiment. DETAILED DESCRIPTION

[0025] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0026] With the continuous development of wireless communication networks, wireless communication has played an increasingly important role in people's lives. The deployment of the 4th generation mobile communication technology (4G) has spread all over the world, and tens of thousands of users use the wireless mobile services, digital services, voice services, etc. provided by the Long Term Evolution (LTE) network; and the 5th generation mobile communication technology (5G) network, which is about to be commercially deployed, will also affect people's lifestyles in various aspects (such as economy and society). The security of wireless communication networks not only ensures the safe and normal operation of network systems, but also ensures the security of users' personal information. To this end, wireless communication networks have adopted various security measures, among which air interface security uses industry-recognized encryption algorithms to encrypt messages transmitted on the air interface. For example, 4G and the soon-to-be-commercialized 5G networks use air interface symmetric encryption algorithms (such as the Advanced Encryption Standard (AES), SNOW3G, and Zu Chongzhi Algorithm Set (ZUC)) to encrypt / decrypt messages at the Packet Data Convergence Protocol (PDCP) layer to protect air interface data from being eavesdropped.

[0027] For example, Figure 1 A schematic diagram of encrypting / decrypting a message at the PDCP layer provided by an embodiment is shown.

[0028] The process of encrypting messages at the PDCP layer is as follows:

[0029] 1. The sender inputs the 128-bit encryption key KEY, the 32-bit PDCP COUNT (PDCP sequence number and PDCP superframe count) value, the 5-bit bearer ID BEARER ID, the transmission direction DIRECTION, and the key stream length LENGTH into the encryption algorithm (EEA) to generate the key stream KEYSTREAM.

[0030] 2. The sender performs XOR calculation on the plaintext PLAINTEXT and the key stream KEYSTREAM, and outputs the ciphertext CIPHERTEXT.

[0031] Accordingly, the process of decrypting the message at the PDCP layer is as follows:

[0032] 3. The receiving end inputs the 128-bit decryption key KEY, the 32-bit PDCP COUNT value, the 5-bit bearer identifier BEARER ID, the transmission direction DIRECTION, and the key stream length LENGTH into the decryption algorithm (EEA) to generate the key stream KEYSTREAM.

[0033] 4. The receiving end performs XOR calculation on the ciphertext CIPHERTEXT and the key stream KEYSTREAM, and outputs the plaintext PLAINTEXT.

[0034] Among them, the encryption key of the sender is the same as the decryption key of the receiver, and the encryption algorithm of the sender is the same as the decryption algorithm of the receiver. That is to say, the receiver can generate the same key stream KEYSTREAM as the sender by inputting the same parameters (KEY, PDCP COUNT, BEARER ID, DIRECTION and LENGTH) to the same encryption (decryption) algorithm; the ciphertext can be restored to plaintext by XORing the ciphertext with the key stream KEYSTREAM.

[0035] However, the problem with the above method is that an attacker can obtain the encrypted message of the PDCP layer through the air interface. Although the plaintext cannot be decrypted without the key, the attacker can decrypt the plaintext once he obtains the same key stream KEYSTREAM.

[0036] According to the above description, the same input parameters (KEY, PDCP COUNT, BEARER ID, DIRECTION and LENGTH) are input into the encryption algorithm to generate the same KEYSTREAM.

[0037] In the case of the same Bearer ID and the same KEY, if the data traffic is large and exceeds the maximum value of the PDCP COUNT value, the PDCP COUNT value will roll over, that is, the PDCP COUNT count starts from 0. In this way, the same PDCP COUNT value will generate the same KEYSTREAM. To avoid the reuse of KEYSTREAM, the 3rd Generation Partnership Project (3GPP) protocol clearly stipulates that the old radio bearer (RB) can be released to establish a new RB, using a different bearer identifier (Bearer ID, also known as Radio Bear ID).

[0038] However, under the same Radio Resource Control (RRC) connection, if RBs are frequently released and established, the RB ID will soon be used up because it has only 5 bits (the value range is 0-31). At this time, the RB ID will be flipped and reused. Once the RB ID used this time is the same as the RB ID used before, after the RB is newly created, the PDCP COUNT value starts from 0 and the KEY remains unchanged. Then a problem similar to the PDCP COUNT value flipping will occur, and the KEYSTREAM will still be reused.

[0039] To solve the above problems, an embodiment of the present application provides a mobile communication network (including but not limited to the fifth-generation mobile communication network (5th-Generation, 5G)), the network architecture of which may include core network equipment, access network equipment and terminal equipment. The terminal equipment is connected to the access network equipment wirelessly, and the access network equipment is connected to the core network equipment wirelessly or by wire. The core network equipment and the access network equipment may be independent and different physical devices, or the functions of the core network equipment and the logical functions of the access network equipment may be integrated on the same physical device, or the functions of some core network equipment and some access network equipment may be integrated on one physical device. The terminal device may be fixed or movable. In an embodiment of the present application, a method, an apparatus and a storage medium for improving the security of a wireless communication system that can be run on the above-mentioned network architecture are provided, which can avoid the reuse of key streams and improve the security of wireless communication systems.

[0040] The access network device is an access device that the terminal device accesses to the mobile communication system by wireless means. It can be a base station, an evolved NodeB (eNodeB), a transmission reception point (TRP), a next generation NodeB (gNB) in a 5G mobile communication system, a base station in a future mobile communication system, or an access node in a WiFi system, etc.; it can also be a module or unit that completes part of the functions of a base station, for example, it can be a centralized unit (CU) or a distributed unit (DU). The embodiments of the present application do not limit the specific technology and specific device form adopted by the access network device. In the present application, the access network device can be referred to as the network device. If there is no special explanation, the network device refers to the access network device.

[0041] The terminal device may also be referred to as a terminal, user equipment (UE), a mobile station, a mobile terminal, etc. The terminal device may be a mobile phone, a tablet computer, a computer with wireless transceiver function, a virtual reality terminal device, an augmented reality terminal device, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a wireless terminal in remote surgery, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc. The embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal device.

[0042] The following describes a method, an apparatus, and technical effects for improving the security of a wireless communication system.

[0043] Figure 2 A schematic diagram of a method for improving the security of a wireless communication system provided by an embodiment is shown. Figure 2 As shown, the method provided in this embodiment is applicable to an access network device, and the method includes the following steps.

[0044] S110. The access network device establishes a bearer.

[0045] In one embodiment, the method for establishing a bearer by an access network device may include the following five steps:

[0046] Step 1: The access network device receives a bearer establishment request message sent by the core network device, where the bearer establishment request message is used to request the establishment of a bearer.

[0047] Step 2: The access network device allocates a bearer identifier for the bearer, and the value of the bearer identifier increases by a step of x compared with the value of the bearer identifier allocated last time, where x is an integer and x≥1.

[0048] The value range of the bearer identifier is [0, 2 a -1], where a is the number of bits occupied by the bearer identifier. Usually, the bearer identifier occupies 5 bits, that is, the value range of the bearer identifier is [0, 31].

[0049] In one embodiment, the value of x is 1. That is, the value of the bearer identifier allocated by the access network device to the bearer is 1 greater than the value of the bearer identifier allocated last time.

[0050] Step 3: The access network device sends radio resource control RRC connection reconfiguration information to the terminal device.

[0051] Step 4: The access network device receives the RRC connection reconfiguration completion information sent by the terminal device.

[0052] Step 5: The access network device sends a bearer establishment completion message to the core network device.

[0053] S120: The access network device determines whether the value of the bearer identifier of the bearer satisfies a rollover condition.

[0054] S130: If the value of the bearer identifier satisfies the rollover condition, the access network device initiates an internal cell handover to the terminal device.

[0055] In one embodiment, the method by which the access network device determines whether the value of the bearer identifier of the bearer satisfies the rollover condition is as follows: the access network device determines whether the value of the bearer identifier of the bearer is equal to the maximum value that the bearer identifier of the bearer can take.

[0056] If the value of the bearer identifier of the bearer is equal to the maximum value that the bearer identifier of the bearer can take, the access network device considers that the value of the bearer identifier meets the rollover condition, and the access network device initiates an internal cell switching to the terminal device; if the value of the bearer identifier of the bearer is not equal to the maximum value that the bearer identifier of the bearer can take, the access network device considers that the value of the bearer identifier does not meet the rollover condition, and the access network device continues to perform service transmission.

[0057] On the basis of the above embodiment, after the access network device initiates an intra-cell handover to the terminal device, the method further includes:

[0058] S140. The access network device updates the key.

[0059] It should be noted that the time when the access network device updates the key is the same as the time when the terminal device updates the key, that is, the access network device and the terminal device update the key together to ensure that the key of the access network device is the same as the key of the terminal device.

[0060] In the method provided in the present application, when the value of the bearer identifier meets the rollover condition, the access network device triggers internal switching of the cell, so that the access network device and the terminal device update the key together, avoiding the reuse of the key stream (KEYSTREAM), thereby preventing the key stream on the access network device side from being exploited by attackers, thereby improving the security of the wireless communication system.

[0061] Figure 3 A schematic diagram of another method for improving the security of a wireless communication system provided by an embodiment is shown. Figure 3 As shown, the method provided in this embodiment is applicable to a terminal device, and the method includes the following steps.

[0062] S210. When the terminal device accesses the first cell, the terminal device receives an internal cell handover initiated by the access network device.

[0063] Specifically, the intra-cell handover initiated by the access network device is triggered when the access network device determines that the value of the bearer identifier of the bearer satisfies the rollover condition.

[0064] Intra-cell switching can also be called intra-cell switching, which means to obtain better connection quality in the case of temporary interference. When the signal strength is high, whether it is the uplink or downlink, when the quality measured at the same time is poor, it can be determined that its interference is serious, and the interference only exists on the currently occupied traffic channel (Traffic Channel, TCH) or stand-alone dedicated control channel (Stand-Alone Dedicated Control Channel, SDCCH). In this case, it is easier to find another better channel to occupy in the cell, so the intra-cell switching function can be activated to solve the temporary quality problem. That is, when the terminal device accesses the first cell, the terminal device re-accesses the cell.

[0065] S220. The terminal device re-accesses the first cell.

[0066] S230: The terminal device updates the key.

[0067] It should be noted that the time when the terminal device updates the key is the same as the time when the access network device updates the key, that is, the access network device and the terminal device update the key together to ensure that the key of the access network device is the same as the key of the terminal device.

[0068] Some exemplary implementations are listed below to illustrate the method for improving the security of a wireless communication system provided in an embodiment of the present application. The following exemplary implementations may be performed individually or in combination.

[0069] In a first exemplary embodiment, Figure 4 An interactive schematic diagram of a method for improving the security of a wireless communication system provided by an embodiment is shown, such as Figure 4 As shown, the method includes the following steps.

[0070] S300. The core network device sends a bearer establishment request message to the access network device. The bearer establishment request message is used to request to establish a bearer.

[0071] S301. An access network device receives bearer establishment request information sent by a core network device.

[0072] S302: The access network device allocates a bearer identifier for the bearer, where the value of the bearer identifier increases by a step of x compared to the value of the bearer identifier allocated last time, where x is an integer and x≥1.

[0073] The value range of the bearer identifier is [0, 2 a -1], where a is the number of bits occupied by the bearer identifier. Usually, the bearer identifier occupies 5 bits, that is, the value range of the bearer identifier is [0, 31].

[0074] In one embodiment, the value of x is 1. That is, the value of the bearer identifier allocated by the access network device to the bearer is 1 greater than the value of the bearer identifier allocated last time.

[0075] S303. The access network device sends radio resource control RRC connection reconfiguration information to the terminal device.

[0076] S304. The terminal device receives the radio resource control RRC connection reconfiguration information sent by the access network device.

[0077] S305. The terminal device sends RRC connection reconfiguration completion information to the access network device.

[0078] S306. The access network device receives the RRC connection reconfiguration completion information sent by the terminal device.

[0079] S307: The access network device sends bearer establishment completion information to the core network device.

[0080] S308. The core network device receives the bearer establishment completion information sent by the access network device.

[0081] S309: The access network device determines whether the value of the bearer identifier of the bearer satisfies the rollover condition.

[0082] S310: If the value of the bearer identifier satisfies the rollover condition, the access network device initiates an internal cell handover to the terminal device.

[0083] S311. When the terminal device accesses the first cell, the terminal device receives an internal cell handover initiated by the access network device.

[0084] S312. The terminal device re-accesses the first cell.

[0085] S313. The access network device and the terminal device update keys.

[0086] In one embodiment, the method by which the access network device determines whether the value of the bearer identifier of the bearer satisfies the rollover condition is as follows: the access network device determines whether the value of the bearer identifier of the bearer is equal to the maximum value that the bearer identifier of the bearer can take.

[0087] If the value of the bearer identifier of the bearer is equal to the maximum value that the bearer identifier of the bearer can take, the access network device considers that the value of the bearer identifier satisfies the flipping condition, and the access network device initiates an internal cell switching to the terminal device so that the terminal device re-accesses the first cell. The access network device and the terminal device update the key to ensure that the key of the access network device is the same as the key of the terminal device.

[0088] S314: If the value of the bearer identifier does not satisfy the rollover condition, the access network device continues to perform service transmission.

[0089] If the value of the bearer identifier of the bearer is not equal to the maximum value that the bearer identifier of the bearer can take, the access network device considers that the value of the bearer identifier does not meet the rollover condition, and the access network device continues to perform service transmission.

[0090] In a second exemplary implementation, if different services correspond to different intervals of the bearer identifier value, then when the bearer identifier value flips, different services trigger different intra-cell handover trigger points. Assuming that the services are divided into a first service (such as a data service, which is not very sensitive to delay) and a second service (such as a voice service, which is highly sensitive to delay), Figure 5 A schematic diagram of a process of allocating bearer identifiers for different services provided by a core network device according to an embodiment is shown. Figure 5 As shown, the method includes the following steps.

[0091] S401. An access network device receives a bearer establishment request message sent by a core network device.

[0092] In one embodiment, the bearer establishment request information at least includes quality of service (QoS) information.

[0093] S402: The access network device confirms the corresponding service to be carried according to the QoS information.

[0094] The services include a first service and a second service, and a delay requirement of the first service is lower than a delay requirement of the second service.

[0095] The bearer identifier value range of the bearer corresponding to the first service is [1, m]; the bearer identifier value range of the bearer corresponding to the second service is [m+1, n], where m and n are integers and 1≤m<n, and n is the maximum possible value of the bearer identifier.

[0096] It can be understood that the bearer identifier value range of the bearer corresponding to the first service and the second service can be set according to actual needs. For example, the bearer identifier value range of the bearer corresponding to the first service is [m+1, n]; the bearer identifier value range of the bearer corresponding to the second service is [1, m], where m and n are integers and 1≤m<n, and n is the maximum possible value of the bearer identifier. The following embodiments of the present application are described by taking the bearer identifier value range of the bearer corresponding to the first service as [1, m]; the bearer identifier value range of the bearer corresponding to the second service as [m+1, n] as an example.

[0097] S403: If the service corresponding to the bearer is the first service, the access network device allocates a bearer identifier for the first service.

[0098] The value of the bearer identifier increases by a step of x compared to the value of the bearer identifier of the first service allocated last time, where x is an integer and x≥1.

[0099] S404: If the service corresponding to the bearer is a second service, the access network device allocates a bearer identifier for the second service.

[0100] The value of the bearer identifier increases by a step of y compared to the value of the bearer identifier of the second service allocated last time, where y is an integer and x≥1.

[0101] The values ​​of x and y can be the same or different.

[0102] S405: The access network device completes the establishment of the bearer.

[0103] Specifically, the access network device completing the establishment of the bearer may include: the access network device sending wireless resource control RRC connection reconfiguration information to the terminal device; the terminal device receiving the wireless resource control RRC connection reconfiguration information sent by the access network device; the terminal device sending RRC connection reconfiguration completion information to the access network device; the access network device receiving the RRC connection reconfiguration completion information sent by the terminal device; the access network device sending bearer establishment completion information to the core network device; the core network device receiving the bearer establishment completion information sent by the access network device.

[0104] It should be noted that the following steps S406-S410 correspond to the above step S403, and steps S411-S415 correspond to the above step S404.

[0105] S406: If the service corresponding to the bearer is the first service, the access network device determines whether the value of the bearer identifier is equal to m.

[0106] S407: If the value of the bearer identifier is equal to m, the access network device initiates an internal cell handover to the terminal device so that the terminal device re-accesses the first cell.

[0107] S408. The access network device and the terminal device jointly update the key.

[0108] S409: The access network device performs transmission of the first service.

[0109] S410: If the value of the bearer identifier is not equal to m, the access network device continues to transmit the first service.

[0110] S411: If the service corresponding to the bearer is the second service, the access network device releases the bearer after the second service is executed.

[0111] Since the second service is highly sensitive to delay, the access network device needs to first execute the transmission of the second service, and then determine whether the value of the bearer identifier meets the rollover condition after the second service is executed.

[0112] S412: The access network device determines whether the value of the bearer identifier is equal to n.

[0113] S413: If the value of the bearer identifier is equal to n, the access network device initiates an internal cell handover to the terminal device so that the terminal device re-accesses the first cell.

[0114] S414. The access network device and the terminal device jointly update the key.

[0115] S415: If the value of the bearer identifier is not equal to n, then end this process.

[0116] Figure 6 A schematic diagram of a device structure for improving the security of a wireless communication system provided by an embodiment, the device can be configured in an access network device, such as Figure 6 As shown, it includes: a processing module 10 and a communication module 11.

[0117] Processing module 10 is configured to establish a bearer; and determine whether the value of the bearer identifier of the bearer satisfies a rollover condition;

[0118] The communication module 11 is configured to initiate an internal cell handover to the terminal device if the value of the bearer identifier meets the rollover condition.

[0119] The device for improving the security of a wireless communication system provided in this embodiment is to achieve Figure 2 The method for improving the security of a wireless communication system in the illustrated embodiment and the implementation principle and technical effect of the device for improving the security of a wireless communication system provided in this embodiment are similar to those in the above embodiment and will not be described in detail here.

[0120] In one embodiment, the processing module 10 is further configured to update the key.

[0121] In one embodiment, the communication module 11 is configured to receive a bearer establishment request message sent by a core network device, where the bearer establishment request message is used to request the establishment of a bearer;

[0122] The processing module 10 is configured to allocate a bearer identifier for a bearer, wherein the value of the bearer identifier increases by a step of x compared with the value of the bearer identifier allocated last time, wherein x is an integer and x≥1;

[0123] The communication module 11 is configured to send radio resource control RRC connection reconfiguration information to the terminal device; receive RRC connection reconfiguration completion information sent by the terminal device; and send bearer establishment completion information to the core network device.

[0124] In one embodiment, the bearer establishment request information includes at least service quality QoS information; the processing module 10 is also configured to confirm the service corresponding to the bearer based on the QoS information, the service including the first service and the second service, and the delay requirement of the first service is lower than the delay requirement of the second service.

[0125] In one embodiment, if the service is the second service, the processing module 10 is further configured to release the bearer after the second service is executed before confirming that the value of the bearer identifier of the bearer satisfies the rollover condition.

[0126] In one embodiment, the bearer identifier of the bearer corresponding to the first service has a value range of [1, m]; the bearer identifier of the bearer corresponding to the second service has a value range of [m+1, n];

[0127] Wherein, m and n are integers and 1≤m<n, and n is the maximum possible value of the bearer identifier.

[0128] In one embodiment, if the service is the first service, the processing module 10 is configured to determine whether the value of the bearer identifier is equal to m.

[0129] In one embodiment, if the service is the second service, the processing module 10 is configured to determine whether the value of the bearer identifier is equal to n.

[0130] Figure 7 A schematic diagram of another device structure for improving the security of a wireless communication system provided by an embodiment, the device can be configured in a terminal device, such as Figure 7 As shown, it includes: a communication module 20.

[0131] The communication module 20 is configured to receive an internal cell handover initiated by an access network device when accessing the first cell; and re-access the first cell.

[0132] The device for improving the security of a wireless communication system provided in this embodiment is to achieve Figure 3 The method for improving the security of a wireless communication system in the illustrated embodiment and the implementation principle and technical effect of the device for improving the security of a wireless communication system provided in this embodiment are similar to those in the above embodiment and will not be described in detail here.

[0133] In one embodiment, in combination Figure 7 , Figure 8 A schematic diagram of a structure of another device for improving the security of a wireless communication system provided by an embodiment further includes: a processing module 21;

[0134] The processing module 21 is configured to update the key.

[0135] In one embodiment, the communication module 20 is further configured to receive radio resource control RRC connection reconfiguration information sent by the access network device; and send RRC connection reconfiguration completion information to the access network device.

[0136] The embodiment of the present application also provides a device for improving the security of a wireless communication system, including: a processor, the processor is used to implement the method provided in any embodiment of the present application when executing a computer program. Specifically, the device for improving the security of a wireless communication system can be an access point device provided in any embodiment of the present application, or can be a terminal device provided in any embodiment of the present application, and the present application does not make specific restrictions on this.

[0137] Illustratively, the following embodiment provides a schematic diagram of the structure of a base station and a UE as an apparatus for improving the security of a wireless communication system.

[0138] Fig. 9 A schematic diagram of the structure of a base station provided by an embodiment is shown. Fig. 9 As shown, the base station includes a processor 60, a memory 61 and a communication interface 62; the number of processors 60 in the base station can be one or more. Fig. 9 A processor 60 is taken as an example; the processor 60, the memory 61, and the communication interface 62 in the base station can be connected by a bus or other means. Fig. 9 In the example of connecting via a bus, a bus refers to one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus structures.

[0139] The memory 61, as a computer-readable storage medium, can be configured to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the method in the embodiment of the present application. The processor 60 executes at least one functional application and data processing of the base station by running the software programs, instructions and modules stored in the memory 61, that is, implements the above-mentioned method for improving the security of the wireless communication system.

[0140] The memory 61 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 61 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 61 may include a memory remotely arranged relative to the processor 60, and these remote memories may be connected to the base station via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a network, a mobile communication network, and combinations thereof.

[0141] The communication interface 62 may be configured to receive and send data.

[0142] Fig.10 A structural schematic diagram of a UE provided by an embodiment is shown. The UE can be implemented in various forms. The UE in the present application can include but is not limited to mobile terminal devices such as mobile phones, smart phones, laptops, digital broadcast receivers, personal digital assistants (PDA), tablet computers (Portable Device, PAD), portable multimedia players (Portable Media Player, PMP), navigation devices, vehicle-mounted terminal equipment, vehicle-mounted display terminals, vehicle-mounted electronic rearview mirrors, etc., and fixed terminal devices such as digital televisions (TV), desktop computers, etc.

[0143] like Fig.10 As shown, UE 50 may include a wireless communication unit 51, an audio / video (A / V) input unit 52, a user input unit 53, a sensing unit 54, an output unit 55, a memory 56, an interface unit 57, a processor 58, a power supply unit 59, and the like. Fig.10 A UE is shown including various components, but it should be understood that implementing all of the components shown is not a requirement. More or fewer components may alternatively be implemented.

[0144] In this embodiment, the wireless communication unit 51 allows radio communication between the UE 50 and a base station or a network. The A / V input unit 52 is configured to receive audio or video signals. The user input unit 53 can generate key input data to control various operations of the UE 50 according to commands input by the user. The sensing unit 54 detects the current state of the UE 50, the position of the UE 50, the presence or absence of a user's touch input to the UE 50, the orientation of the UE 50, the acceleration or deceleration movement and direction of the UE 50, etc., and generates commands or signals for controlling the operation of the UE 50. The interface unit 57 serves as an interface through which at least one external device can be connected to the UE 50. The output unit 55 is configured to provide output signals in a visual, audio and / or tactile manner. The memory 56 can store software programs for processing and control operations performed by the processor 58, etc., or can temporarily store data that has been output or is to be output. The memory 56 can include at least one type of storage medium. Moreover, the UE 50 can cooperate with a network storage device that performs the storage function of the memory 56 through a network connection. The processor 58 generally controls the overall operation of the UE 50. The power supply unit 59 receives external power or internal power under the control of the processor 58 and provides appropriate power required to operate various elements and components.

[0145] The processor 58 executes at least one functional application and data processing by running the program stored in the memory 56, such as implementing the method provided in the embodiment of the present application.

[0146] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method provided in any embodiment of the present application is implemented.

[0147] The computer storage medium of the embodiment of the present application may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. The computer-readable storage medium includes (a non-exhaustive list): an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it.

[0148] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, the data signal carrying a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0149] The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wire, optical cable, Radio Frequency (RF), etc., or any suitable combination of the foregoing.

[0150] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination of multiple programming languages, including object-oriented programming languages ​​such as Java, Smalltalk, C++, Ruby, Go, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0151] It will be appreciated by those skilled in the art that the term user terminal covers any suitable type of wireless user equipment, such as a mobile phone, a portable data processing device, a portable web browser or a vehicle-mounted mobile station.

[0152] In general, various embodiments of the present application can be implemented in hardware or dedicated circuits, software, logic or any combination thereof. For example, some aspects can be implemented in hardware, while other aspects can be implemented in firmware or software that can be executed by a controller, microprocessor or other computing device, although the present application is not limited thereto.

[0153] Embodiments of the present application may be implemented by executing computer program instructions by a data processor of a mobile device, for example in a processor entity, or by hardware, or by a combination of software and hardware. The computer program instructions may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages.

[0154] The block diagram of any logic flow in the drawings of the present application may represent program steps, or may represent interconnected logic circuits, modules and functions, or may represent a combination of program steps and logic circuits, modules and functions. The computer program may be stored in a memory. The memory may be of any type suitable for the local technical environment and may be implemented using any suitable data storage technology, such as but not limited to read-only memory (ROM), random access memory (RAM), optical memory devices and systems (digital versatile discs DVD or CD discs), etc. Computer-readable media may include non-transient storage media. The data processor may be of any type suitable for the local technical environment, such as but not limited to a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (Digital Signal Processing, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a programmable logic device (Field-Programmable Gate Array, FGPA) and a processor based on a multi-core processor architecture.

Claims

1. A method for improving the security of a wireless communication system, characterized in that: include: The access network device establishes a bearer, wherein the service corresponding to the bearer includes a first service and a second service, and a delay requirement of the first service is lower than a delay requirement of the second service; When the service is the first service, the access network device determines whether the value of the bearer identifier of the bearer satisfies the rollover condition; when the service is the second service, the access network device performs transmission of the second service, and after the second service is executed, the access network device determines whether the value of the bearer identifier of the bearer satisfies the rollover condition; If the value of the bearer identifier satisfies the rollover condition, the access network device initiates an internal cell handover to the terminal device.

2. The method according to claim 1, characterized in that Also includes: The access network device updates the key.

3. The method according to claim 1, characterized in that The access network device establishes a bearer, including: The access network device receives bearer establishment request information sent by the core network device, where the bearer establishment request information is used to request establishment of the bearer; The access network device allocates a bearer identifier for the bearer, wherein the value of the bearer identifier increases by a step of x compared with the value of the bearer identifier allocated last time, where x is an integer and x≥1; The access network device sends radio resource control RRC connection reconfiguration information to the terminal device; The access network device receives RRC connection reconfiguration completion information sent by the terminal device; The access network device sends bearer establishment completion information to the core network device.

4. The method according to claim 3, characterized in that The bearer establishment request information at least includes quality of service QoS information; and also includes: The access network device confirms the service corresponding to the bearer according to the QoS information, where the service includes a first service and a second service, and a delay requirement of the first service is lower than a delay requirement of the second service.

5. The method according to claim 4, characterized in that If the service is the second service, before the access network device confirms that the value of the bearer identifier of the bearer satisfies the rollover condition, the method further includes: The access network device releases the bearer after the execution of the second service is completed.

6. The method according to claim 4, characterized in that The bearer identifier of the bearer corresponding to the first service has a value range of [1, m]; the bearer identifier of the bearer corresponding to the second service has a value range of [m+1, n]; Wherein, m and n are integers and 1≤m<n, and n is the maximum possible value of the bearer identifier.

7. The method according to claim 6, characterized in that If the service is the first service, the access network device determines whether a value of the bearer identifier of the bearer satisfies a rollover condition, including: The access network device determines whether the value of the bearer identifier is equal to m.

8. The method according to claim 6, characterized in that If the service is the second service, the access network device determines whether a value of the bearer identifier of the bearer satisfies a rollover condition, including: The access network device determines whether the value of the bearer identifier is equal to n.

9. A method for improving the security of a wireless communication system, characterized in that: include: When the terminal device accesses the first cell, the terminal device receives an internal cell handover initiated by the access network device; The terminal device re-accesses the first cell; The conditions for the access network device to initiate intra-cell handover include: The access network device establishes a bearer, where the service corresponding to the bearer includes a first service and a second service, and a delay requirement of the first service is lower than a delay requirement of the second service; When the service is the first service, the access network device determines whether the value of the bearer identifier of the bearer satisfies the rollover condition; when the service is the second service, the access network device performs transmission of the second service, and after the second service is executed, the access network device determines whether the value of the bearer identifier of the bearer satisfies the rollover condition; If the value of the bearer identifier satisfies the rollover condition, the access network device initiates an internal cell handover to the terminal device.

10. The method according to claim 9, characterized in that Also includes: The terminal device updates the key.

11. The method according to claim 9, characterized in that Also includes: The terminal device receives the radio resource control RRC connection reconfiguration information sent by the access network device; The terminal device sends RRC connection reconfiguration completion information to the access network device.

12. An access network device, characterized in that: include: A processor, wherein the processor is configured to implement the method for improving the security of a wireless communication system as claimed in any one of claims 1 to 8 when executing a computer program.

13. A terminal device, characterized in that: include: A processor, wherein the processor is configured to implement the method for improving the security of a wireless communication system as described in any one of claims 9 to 11 when executing a computer program.

14. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for improving the security of a wireless communication system as described in any one of claims 1-8, or the method for improving the security of a wireless communication system as described in any one of claims 9-11 is implemented.

Images