Security key generation and management method for PDCP distributed structure supporting dual connections

Abstract

A method for communicating with a macrocell base station and a small cell base station through a user equipment in a communication system is provided, and the method includes the following steps: applying a first base station security key to a first communication link with the macrocell base station; generating a second base station security key to be used for a second communication link with the small cell base station based on the first base station security key; applying the second base station security key to the second communication link with the small cell base station; and communicating through at least one of the first communication link and the second communication link.

Description

[0001] This application is a divisional application of the invention patent with application date of August 7, 2014, application number 201480049729.6, and invention name "User equipment in a communication system and method for communicating therewith". Technical Field

[0002] The present disclosure relates to wireless communications, and more particularly, to a method and apparatus for generating and maintaining security keys for multiple base stations connected to one terminal in a wireless communication system supporting multiple wireless link connections to one terminal. Background Art

[0003] In order to respond to the surging mobile data traffic, research is being conducted on installing a plurality of small cells to increase the wireless network capacity of a macro cell.

[0004] Small cells with small cell coverage can reuse limited frequency resources, and because the small cell base station is relatively close to the user, it enables high data rate data transmission and transmission power saving. The nature of small cell base stations with small cell coverage may lead to frequent handovers and radio link failures. A solution that has attracted attention to solve this problem is dual connectivity, which allows a terminal to maintain a connection with a macro cell base station while receiving data at a high data rate through a small cell link.

[0005] It is speculated that small cell base stations may suffer from weak security compared to macro cell base stations. Such an assumption comes from the fact that while macro cell base stations are directly managed by communication network providers, small cell base stations dispersed indoors (or in homes) face difficulty in physical management for security maintenance.

[0006] Dual connectivity can allow a macrocell base station to act as an anchor point for controlling multiple small cell base stations. Therefore, if security information related to the macrocell base station is exposed through the small cell base station, personal information leakage, illegal billing or other security issues are more likely to occur.

[0007] Furthermore, assuming that tens or hundreds of small cells are to be installed to increase the network cell capacity, control overhead and latency issues may arise due to processes such as security key request and response that ensue when the corresponding security key of the small cell is received from a higher network (e.g., a mobility management entity (MME)).

[0008] Therefore, there is a need for a scheme and process for efficiently generating and managing independent security keys over a layered network having a macro cell and multiple small cells. Summary of the invention

[0009] Technical issues

[0010] According to another aspect of the present disclosure, a method for communicating with a macrocell base station and a small cell base station through a user equipment in a communication system is provided. The method includes: applying a first base station security key to a first communication link with the macrocell base station; generating a second base station security key to be used for a second communication link with the small cell base station based on the first base station security key; applying the second base station security key to the second communication link with the small cell base station; and communicating through at least one of the first communication link and the second communication link.

[0011] According to another aspect of the present disclosure, a method for communicating with a user equipment and a small cell base station through a macro cell base station in a communication system is provided. The method includes: determining a first base station security key for a first communication link with the user equipment; generating a second base station security key to be used for a second communication link between the small cell base station and the user equipment based on the first base station security key; and transmitting the generated second base station security key to the small cell base station.

[0012] According to another aspect of the present disclosure, a user equipment for communicating with a macrocell base station and a small cell base station in a communication system is provided. The user equipment includes: a controller configured to apply a first base station security key to a first communication link with the macrocell base station, generate a second base station security key to be used for a second communication link with the small cell base station based on the first base station security key, and apply the second base station security key to the second communication link with the small cell base station; and a transceiver configured to communicate through at least one of the first communication link and the second communication link.

[0013] According to another aspect of the present disclosure, a macrocell base station for communicating with a user equipment and a small cell base station in a communication system is provided. The macrocell base station includes: a controller configured to determine a first base station security key for a first communication link with the user equipment, and to generate a second base station security key to be used for a second communication link between the small cell base station and the user equipment based on the first base station security key; and a transceiver configured to transmit the generated second base station security key to the small cell base station.

[0014] In addition, the present disclosure provides a method and apparatus for generating and maintaining security keys for multiple base stations connected to a single terminal in a wireless communication system. Specifically, the disclosure under consideration provides the following method and apparatus: the method and apparatus are used to generate and maintain security keys in a wireless communication system in a dual-connection environment, that is, when a terminal is simultaneously connected to a macrocell base station and a small cell base station.

[0015] In addition, the present disclosure describes the following scheme: the scheme is used in which, in a network in which a terminal is simultaneously linked to a macro cell base station and a small cell base station coexisting within the coverage of a macro cell, if the macro cell and the small cell have a packet data convergence protocol (PDCP) layer, separate security keys for the corresponding PDCP layers of the macro cell and the small cell are applied and operated.

[0016] In addition, the present disclosure provides a method and apparatus for generating and managing independent security keys between macro cell and small cell hierarchical networks in a wireless communication system that simultaneously supports multiple transmission links.

[0017] In addition, the present disclosure provides the following apparatus and method: the apparatus and method are used to generate, remove or exchange security keys when connecting, releasing or switching base stations taking into account the network layers of the source base station and the target base station due to problems arising from differences in security capacity between per-layer base stations in a hierarchical network.

[0018] In addition, the present disclosure provides the following processing: the processing is used to generate a security key and transmit information related to the security key when a small cell is added to a macro cell base station and a data radio bearer (DRB) starts to be transmitted, when the small cell is changed (for example, another small cell is connected), or when the small cell is released so that the macro cell resumes serving the corresponding DRB.

[0019] In addition, the present disclosure provides the following apparatus and method: the apparatus and method are used to independently maintain the security keys of macro cells and small cells when security keys are independently generated from a higher network (mobility management entity (MME)), while selectively maintaining the independence of security keys between small cells, so as to solve control overhead and delay problems.

[0020] Furthermore, the present disclosure provides an apparatus and method for solving control overhead and delay problems in such a manner that a plurality of security keys are simultaneously generated when security keys are independently generated from a higher network (Mobility Management Entity (MME)).

[0021] In addition, the present disclosure provides the following apparatus and method: the apparatus and method are used to continuously maintain a count value as information for identifying user data forwarded between base stations when handover is performed through a radio resource control (RRC) reconfiguration process, and to prevent data loss using the same PDCP configuration when the connected base station is changed (added, released, or exchanged).

[0022] Technical Solution

[0023] According to one aspect of the present disclosure, a method for communication by a user equipment UE in a communication system is provided, which includes: receiving a radio resource control RRC connection reconfiguration message including a counter of a second base station from a first base station; generating a security key for communication with the second base station based on information related to the first base station and the counter; and applying the security key to the communication with the second base station.

[0024] According to another aspect of the present disclosure, a user equipment (UE) for communicating in a communication system is provided. The UE includes: a transceiver; and a controller configured to: receive a radio resource control RRC connection reconfiguration message including a counter of a second base station from a first base station; generate a security key for communication with the second base station based on information related to the first base station and the counter; and apply the security key to communication with the second base station.

[0025] According to another aspect of the present disclosure, a method for communicating by a second base station in a communication system is provided, the method comprising: receiving a security key to be used for communication with a user equipment UE from a first base station; and applying the security key to communication with the UE, wherein the security key is generated based on information related to the first base station and a first security key, and wherein the counter is included in a radio resource control (RRC) connection reconfiguration message.

[0026] According to another aspect of the present disclosure, a second base station for communicating in a communication system is provided, the second base station comprising: a transceiver; and a controller, configured to: receive a security key to be used for communication with a user equipment UE from a first base station; and apply the security key to the communication with the UE, wherein the security key is generated based on a counter and information related to the first base station, and wherein the counter is included in a radio resource control RRC connection reconfiguration message.

[0027] The present disclosure proposes a method for performing communication through a user terminal, which forms a communication link for data transmission with a macrocell base station and a small cell base station located in a communication system, the method comprising: applying a first base station security key to the communication link with the macrocell base station; generating a second base station security key to be used for the communication link with the small cell base station; applying the second base station security key to the communication link with the small cell base station; and conveying user data through the communication link to which the security key is applied.

[0028] In addition, the present disclosure proposes a method for performing communication through a macrocell base station, which forms a communication link with a user terminal in a communication system including a small cell base station and a user terminal, the method comprising: determining to add a small cell base station to form a communication link with the user terminal; sending a request for a next hop (NH) and a next hop chain counter (NCC) to a mobility management entity (MME) and receiving a response; using the NH included in the received response to generate a first base station security key to be used for the communication link between the added small cell base station and the user terminal; and transmitting the generated first base station security key to the added base station.

[0029] In addition, the present disclosure proposes a user terminal that forms a communication link for data transmission with a macrocell base station and a small cell base station located in a communication system, the user terminal including: a controller that applies a first base station security key to the communication link with the macrocell base station, generates a second base station security key to be used for the communication link with the small cell base station, and applies the second base station security key to the communication link with the small cell base station; and a transceiver that communicates user data through the communication link to which the security key is applied.

[0030] In addition, the present disclosure proposes a macrocell base station that forms a communication link with a user terminal in a communication system including a small cell base station and a user terminal, the macrocell base station including: a controller that determines to add a small cell base station to form a communication link with the user terminal, sends a request for a next hop (NH) and a next hop chain counter (NCC) to a mobility management entity (MME) and receives a response, and uses the received NH to generate a first base station security key to be used for the communication link between the added small cell base station and the user terminal; and a transceiver that transmits the generated first base station security key to the added base station.

[0031] Beneficial effects

[0032] According to an embodiment of the present disclosure, in a network where a small cell coexists within the coverage of a macro cell, a PDCP layer exists in each of the macro cell and the small cell, and a separate security key is applied and operated thereto, so that two or more links are simultaneously connected to a terminal. Therefore, even when a small cell base station having relatively weak security compared to a macro cell base station is used, the security of the macro cell base station can be maintained.

[0033] In addition, according to an embodiment of the present disclosure, the following method is provided: the method is used to generate a security key or transmit information related to a security key when a small cell is added to a macro cell base station so that a data radio bearer (DRB) begins to be transmitted or the small cell is released so that the macro cell restarts to serve the corresponding DRB. Therefore, while maintaining the security of the macro cell base station for the small cell base station, security keys for multiple small cells can be generated and control-related overhead issues can be resolved. That is, the embodiments of the present disclosure can minimize the overhead related to security key control while maintaining the security of the interface (X2) between the macro cell base station and the small cell base station having relatively weak security compared to the macro cell base station. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 is a diagram showing a case where a terminal establishes dual connectivity for a macro cell and a small cell that coexist in a wireless communication system,

[0035] Figure 2 is a diagram showing a network control plane and a user plane in a dual connectivity scenario in which a macro cell and a small cell are simultaneously connected to a terminal in a wireless communication system,

[0036] Figure 3 is a diagram showing an example of a protocol stack structure supporting dual connectivity according to an embodiment of the present disclosure,

[0037] Figure 4 is a diagram showing another example of a protocol stack structure supporting dual connectivity according to an embodiment of the present disclosure,

[0038] Figure 5 is a diagram showing another example of a protocol stack structure supporting dual connectivity according to an embodiment of the present disclosure,

[0039] Figure 6 is a diagram showing an example of communication between a macro cell base station, a small cell base station, and a user terminal in a protocol stack structure in which a macro cell and a small cell have independent PDCP layers according to an embodiment of the present disclosure,

[0040] Figure 7is a diagram showing a structure of a security key used in a 3GPP LTE system according to an embodiment of the present disclosure,

[0041] Figure 8 is a flowchart showing an example of generating a security key and transmitting related information when a handover occurs between base stations in a communication system according to an embodiment of the present disclosure,

[0042] Fig. 9 is a flowchart showing an example of generating a security key and transmitting related information for maintaining a separate security key when a small cell is added according to an embodiment of the present disclosure,

[0043] Fig.10 is a diagram showing a process of generating and transmitting a security key and an initial establishment process of a small cell link when a macro cell determines to add a small cell on a control plane according to an embodiment of the present disclosure,

[0044] Fig.11 is a diagram showing an exemplary process of discarding a security key when a macro cell determines to release a small cell on a control plane and an exemplary process of a terminal resuming communication with a macro cell base station according to an embodiment of the present disclosure,

[0045] Fig.12 is a diagram showing an exemplary process in which a base station obtains information for generating a security key from an MME according to an embodiment of the present disclosure,

[0046] Fig.13 is a diagram showing another exemplary process in which a base station obtains information for generating a security key from an MME according to an embodiment of the present disclosure,

[0047] Fig.14 is a view showing an exemplary process of generating security keys for a macro cell base station, a small cell base station, and a user terminal and applying the generated security keys when a macro cell base station determines to add a small cell according to an embodiment of the present disclosure,

[0048] Fig.15 is a view showing an exemplary process of generating security keys for a macro cell base station, a small cell base station, and a user terminal and applying the generated security keys when a macro cell base station determines to release or replace a small cell according to an embodiment of the present disclosure,

[0049] FIGS. 16a and 16b are views showing examples of generating and transmitting security keys when adding a small cell base station, when changing a small cell base station, and when releasing all linked small cells in a dual connectivity environment where a macro cell and a small cell use separate security keys according to an embodiment of the present disclosure.

[0050] FIGS. 17a and 17b are views showing examples of establishing a DRB path on a control plane and a user plane and generating and transmitting a security key when a small cell base station is added, when a small cell base station is changed, and when all linked small cells are released in a dual connectivity environment where a macro cell and a small cell use separate security keys according to an embodiment of the present disclosure.

[0051] Fig.18 is a diagram showing a configuration of a user terminal according to an embodiment of the present disclosure, and

[0052] Fig.19 is a view showing a configuration of a base station according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0053] Hereinafter, embodiments of the present disclosure are described in detail with reference to the accompanying drawings. When it is determined that the subject matter of the present disclosure is unclear, the details of known functions or configurations can be skipped. When used in this article, the terms are defined in consideration of the functions in the present disclosure, and can be replaced by other terms according to the intention or practice of the user or operator. Therefore, the terms should be defined based on the overall disclosure.

[0054] Indications such as "first," "second," "A," "B," "(a)," and "(b)" may be used to describe components of the present disclosure. These indications are provided merely to distinguish components from one another, and the substance of the components is not limited by the order or sequence of the indications. When a component is described as being "connected," "coupled," or "linked" to another component, the component may be directly connected to or linked to the other component, but it should also be appreciated that the other component may be "connected," "coupled," or "linked" between the components.

[0055] Before describing the present disclosure in detail, examples of meanings or indications applicable to some terms used in the present disclosure are proposed. However, it should be noted that the present disclosure is not limited thereto.

[0056] The present disclosure targets wireless communication networks. When a system (eg, a base station) responsible for the wireless communication network controls the network and transmits data, tasks performed via the wireless communication network can be completed, or tasks performed via the wireless communication network can be completed by a terminal coupled to the wireless network.

[0057] A wireless communication system includes at least one base station (BS). Each base station provides communication services within a specific geographical area (usually called a cell). A cell can be divided into multiple areas (called sectors).

[0058] A base station is an entity communicating with a terminal and may be referred to as, for example, a BS, a Base Transceiver System (BTS), a Node B (NB), an eNode B (eNB), or an Access Point (AP).

[0059] A cell should be comprehensively interpreted as indicating some area covered by a base station, and overall means a mega cell, a macro cell, a small cell, a micro cell, a pico cell, a femto cell, or other various coverage areas. It should be noted that, depending on the context of the present disclosure, the term "macro cell" may mean a base station of a macro cell, and the term "small cell" may mean a base station of a small cell.

[0060] A macro cell base station may also be referred to as a macro cell eNB, macro eNB, or MeNB.

[0061] A small cell is a cell having a smaller cell area than a macro cell, and may include a pico cell, a femto cell, or a micro cell. A small cell base station may also be indicated as a small cell eNB, a small eNB, or a SeNB.

[0062] A user equipment is a mobile or stationary entity communicating with a base station and may be indicated as a UE, mobile station (MS), mobile equipment (ME), device, wireless device, handheld device, terminal, mobile terminal (MT), user terminal (UT) or subscriber station (SS).

[0063] Downlink means communication from a base station to a terminal, and uplink means communication between a terminal and a base station. For downlink, a transmitter may be a part of a base station, and a receiver may be a part of a terminal. For uplink, a transmitter may be a part of a terminal, and a receiver may be a part of a base station.

[0064] Figure 1 is a diagram showing a case where a terminal establishes dual connectivity for a macro cell and a small cell coexisting in a wireless communication system.

[0065] Discussion is ongoing on a system for offloading the dramatically increased mobile service data by adding a small cell network to a wireless communication system (e.g., a macro cell network). As an example, the coverage of a macro cell served by a macro cell base station 100 is shown by a solid line, and the coverage of small cells 112 and 122 served by small cell base stations 110 and 120 are circled by a dotted line, as shown in FIG. Figure 1 shown.

[0066] The small cells 112 and 122 including at least one microcell, femtocell or microcell have a smaller coverage, but may have a plurality of small cell base stations installed therein, and therefore, the small cells may function to offload the increased mobile data. The small cells have a smaller transmission distance and a good channel environment, and therefore they may provide services to users at a higher data rate, and may easily reuse limited frequency resources (frequency bands), while saving power consumed by the terminal.

[0067] Due to the smaller coverage of the small cell, it may face frequent handoffs when supporting the mobility of the terminals 114 and 124. In order to support such frequent handoffs, the terminals need to be connected to the macro cell base station at the same time. In addition, one terminal can be served by multiple small cell base stations.

[0068] In the following, dual connectivity refers to a network structure in which a terminal is served by two or more base stations connected thereto. The terminal can be served by a base station through a control channel or a data channel, and can be provided with extended services by multiple base stations, without being limited to being provided by two cells (one macro cell and one small cell).

[0069] Figure 2 is a view showing a network control plane and a user plane in a dual connectivity scenario in which a macro cell and a small cell are simultaneously connected to a terminal in a wireless communication system.

[0070] refer to Figure 2 In the dual-connection scenario where the terminal is simultaneously connected to the macro cell and the small cell, the user terminal 200 is connected to the macro cell base station (macro cell eNB (MeNB)) 202 and the small cell base station (small cell eNB (SeNB)) 204 through the connection of the network control plane and the user plane. The macro cell base station 202 and the small cell base station 204 can be connected through, for example, an X2 interface 206.

[0071] In a dual connectivity scenario where a small cell is added to an existing macro cell (eg, a cellular network), the terminal is not controlled solely by the macro cell, that is, in a dual connectivity scenario, the terminal may also be controlled (eg, resource allocation) by one or more cell base stations.

[0072] refer to Figures 3 to 5 A protocol stack structure in which a small cell base station and a macro cell base station also have independent PDCPs to support dual connectivity according to an embodiment of the present disclosure is described.

[0073] Figure 3 is a diagram showing an example of a protocol stack structure supporting dual connectivity according to an embodiment of the present disclosure.

[0074] The macro cell base station 300 and the small cell base station 310 respectively and independently include a packet data convergence protocol (PDCP) layer 302 and 312 , a radio link control (RLC) layer 304 and 314 , a medium access control (MAC) layer 306 and 316 , and a physical (PHY) layer 308 and 318 .

[0075] Specifically, Figure 3 A structure is illustrated in which a user plane of the small cell base station 310 is directly connected to a core network (CN) via a separate S1 interface 320 distinguished from a user plane S1 interface 330 of the macro cell base station 300 .

[0076] The small cell base station 310 is directly connected to a core network (CN) via an S1 interface 320 , and the small cell base station 310 may transmit user plane data via a separate path without passing through a macro cell base station or an inter-base station connection (eg, an X2 interface).

[0077] Figure 4 is a diagram showing another example of a protocol stack structure supporting dual connectivity according to an embodiment of the present disclosure.

[0078] refer to Figure 4 , the macro cell base station 300 and the small cell base station 310 respectively and independently include PDCP layers 302 and 312 , RLC layers 304 and 314 , MAC layers 306 and 316 , and PHY layers 308 and 318 .

[0079] Specifically, Figure 4 The following structure is illustrated, in which the user plane of the small cell base station 310 is connected to the core network (CN) via the macro cell base station 300 through an Xn interface (for example, X2 interface) 420.

[0080] In this case, because all user plane data is transmitted via the macrocell base station through the inter-base station connection (X2), the transmission capacity may be limited by the delay and limited capacity of the backhaul. Figure 4 The connection structure shown in is a structure in which one DRB for a small cell is served by one base station (any one of a macro cell base station or a small cell base station), and DRB splitting does not occur for the small cell.

[0081] Figure 5 is a diagram showing another example of a protocol stack structure supporting dual connectivity according to an embodiment of the present disclosure.

[0082] exist Figure 5In the structure shown in , the macro cell base station 300 and the small cell base station 310 respectively and independently include PDCP layers 502 and 302 and 312, RLC layers 504 and 304 and 314, MAC layers 506 and 306 and 316, and PHY layers 508 and 308 and 318, and the user plane of the small cell base station 310 is connected from the CN to the small cell base station via the macro cell base station.

[0083] In this case, since all user plane data is transmitted via the macro cell base station through the inter-base station connection (X2 interface 520), the transmission capacity may be limited by the delay and limited capacity of the backhaul. Figure 5 The connection structure shown in is a structure in which DRB splitting for small cells occurs (split from S1 interface 500 to Xn interface 520), and one DRB is provided with services by multiple base stations (one macro cell base station and multiple small cell base stations).

[0084] A scheme for generating, managing and operating security keys when a macro cell and a small cell include independent PDCP layers, respectively, will now be described. Figures 3 to 5 as described.

[0085] Figure 6 is a diagram showing an example of communication between a macro cell base station, a small cell base station, and a user terminal in a protocol layer structure in which a macro cell and a small cell have independent PDCP layers according to an embodiment of the present disclosure.

[0086] exist Figure 6 In the embodiment of the present invention, the control plane data is transmitted through the macrocell base station 300 (link 600). In addition, the user plane data is served to the user terminal 630 through two DRBs, that is, one through the macrocell base station 300 (specifically, between the EPS bearer 1 and the PDCP 612 of the link 602) and the other through the small cell base station 310 (specifically, between the EPS bearer 2 and the PDCP 614 of the link 604).

[0087] The user terminal 630 forms links 600 and 602 with the macro cell base station 300 and link 604 with the small cell base station 310 , and communicates data via separate protocol layers (PHY, MAC, RLC, and PDCP layers).

[0088] PDCP layers 610, 612, and 614 exist independently in the macro cell, and the small cell is responsible for security. In this case, what is needed is a design as to whether the same security key is used or a separate and independent security key is used for a link 602 passing through the macro cell in the PDCP layer 612 of the macro cell and a link 604 passing through the small cell in the PDCP layer 614 of the small cell.

[0089] Figure 7 is a view showing a structure of a security key used in a 3GPP LTE system according to an embodiment of the present disclosure.

[0090] Lower level keys can be generated from higher level keys.

[0091] The top level key K (700) used to authenticate the user terminal exists in the Universal Subscriber Identity Module (USIM) or the Authentication Center (AuC).

[0092] The lower level keys CK, IK (702) that may be generated from the higher level key K (700) may be known only to the UE or the Home Subscriber Server (HSS). That is, the lower level keys CK, IK (702) exist in the UE or the HSS.

[0093] The MME may generate K based on the lower level keys CK, IK (702). ASME (704), K ASME (704) is the key of the Access Security Management Entity (ASME). The ASME is an entity that receives the top-level key of the access network from the HSS, and for the Evolved Universal Mobile Telecommunications System Terrestrial Radio Access Network (E-UTRAN), the MME may correspond to the ASME.

[0094] UE or base station can be based on K ASME (704) to generate the integrity key K for the non-access stratum (NAS) NASint (708) and encryption key K NASenc (706). In addition, the UE or the base station may generate K eNB 710,K eNB 710 is a basic key for the security key of each base station.

[0095] UE or base station can be based on K eNB (710) to generate K RRCint (716) and K UPenc (714), K RRCint (716) and K UPenc (714) is the security key used for the access layer (AS).

[0096] Subsequently, the generation and transmission of security keys are described with a focus on the authentication process.

[0097] As a mutual authentication between the UE and the network, UE-MME LTE mutual authentication is performed via an Evolved Packet System Authentication and Key Agreement (EPS AKA) procedure performed between the UE, MME, and HSS. In the EPS AKA procedure, the HSS transmits an authentication vector (AV) to the MME, and the MME and UE can perform mutual authentication using the authentication vector. As a result of the authentication, the UE and MME share K ASME (704), and from K ASME (704) Obtain the security key K for NAS NASint (708) and K NASenc (706) and K is the basic key of the base station eNB (710).

[0098] The MME receives K from the HSS ASME (704). ASME (704) cannot be transmitted to the UE via E-UTRAN, so K ASME (704) can be obtained through KSI ASME Identified, KSI ASME One-on-one with K ASME (704) corresponds to and replaces K ASME (704).

[0099] Integrity checking and encryption can be performed on NAS signaling messages, which are the control plane protocol between the UE and the MME. Integrity checking is a mandatory function, while encryption is an optional function. The basic key used for NAS security is K ASME (704), which is located in the UE and MME and is obtained through authentication between the subscriber and the network. The NAS security key is obtained from the K in the UE and MME. ASME (704) is obtained and comes in as the integrity key K NASint (708) and encryption key K NASenc (706)This type.

[0100] The control plane between the UE and the eNB performs integrity checking (mandatory) and encryption (optional) on RRC signaling, and the user plane performs encryption (optional) on IP packets. For access stratum (AS) security, the basic key is K eNB (710), and K eNB (710) is located in the UE and the eNB and is received from K ASME (704) obtains. eNB does not include K ASME(704). Therefore, MME obtains ASME (704) Generate K eNB (710), and transmit K to the eNB eNB (710).

[0101] The AS security key is obtained from the K in the UE and eNB eNB (710) obtain and obtain K RRCint (716), K RRCenc (714) and K UPenc (712) This type. RRCint (716) and K RRCenc (714) are used for integrity check and encryption of RRC signaling, respectively, and K UPenc (712) is used for encryption of user plane data (IP packets).

[0102] The base station (macro cell base station or small cell base station) may receive a next hop (NH) 718 and a next hop chain counter (NCC) 720 from the MEE. When the NCC 720 is transmitted to the terminal, the terminal may determine the NH 718 using the NCC 720. The terminal or the base station may use the NH 718 to generate a K which is a security key of the base station. eNB *(722), and the generated security key can be applied as the security key of the base station. eNB *(722) may be generated based on NH 718, or may be generated based on the previous security key 710 of the base station.

[0103] Figure 8 is a flowchart illustrating an example of generating a security key and transmitting related information when a handover occurs between base stations in a communication system according to an embodiment of the present disclosure.

[0104] If the user terminal 800 reports the result of channel measurement to the serving base station 810 (measurement report), the serving base station 810 or the MME 830 hands over the user terminal 800 to the target base station 820 based on the channel measurement result (801).

[0105] The serving base station 810 generates a base station security key KeNB*, which will be used in the new base station (target base station) 820 (802). That is, the process of generating (or regenerating) the base station security key KeNB* to be used in the target base station 820 can be initiated by the serving base station 810 or the MME 830.

[0106] The serving base station 810 forwards KeNB* and NCC to the target base station 820 (803).

[0107] The target base station 820 notifies the user terminal 800 of the NCC (804), and the user terminal 800 generates KeNB* based on the NCC (804).

[0108] The user terminal 800 and the target base station 820 perform data transmission by applying the new base station security key KeNB* (806).

[0109] Optionally, the target base station 820 may also receive a new NH-NCC pair (ie, {NH, NCC}) from the MME 830 to prepare for the next handover (807).

[0110] At the same time, a communication network including small cells can be installed so that within the coverage of the macro cell, the coverage of the small cell overlaps with the coverage of the macro cell, and the user terminal can simultaneously establish a link with each of the macro cell base station and the small cell base station (i.e., two or more links). Although handover occurs between equivalent base stations in the 3GPP LTE system, the small cell network according to an embodiment of the present disclosure overlaps with the macro cell, and therefore, a small cell link can be added to a link served only by the macro cell, a small cell link can be released, or a small cell link can be replaced by a link with a new small cell base station (by handover between small cells).

[0111] If the same security key as that used in the macro cell is used for the small cell that undergoes RRC control by the macro cell, the complexity of generating the security key can be reduced (because there is no calculation for generating the security key for the small cell), but if the security key of the small cell, which is relatively vulnerable to security attacks, is leaked, the security key of the macro cell will also be highly likely to be leaked. In contrast, if the macro cell and the small cell use separate independent security keys, they may have robust security, but may result in complex control and overhead in generating and managing security keys. Receiving security keys from a higher network (e.g., MME) every time a handover is made or when dozens or hundreds of small cells are installed to increase the network cell capacity will result in control overhead and delay issues.

[0112] Therefore, the present disclosure proposes a scheme for independently generating and managing each security key or sharing and managing a single security key according to a predetermined standard or condition in a network where macro cells and small cells coexist.

[0113] Furthermore, the present disclosure proposes a scheme for generating, transmitting, and managing a security key for a transmission link based on a security key corresponding to another transmission link, and a scheme in which a base station directly generates and manages a security key.

[0114] In other words, proposed are: a scheme for generating and managing security keys taking into account the layers between the macro cell and the small cell in generating and managing security keys for each network layer; a scheme for generating, sharing and using the same security key between the network layers of the macro cell link and the small cell link; a scheme for generating and managing separate security keys between the network layers of the macro cell link and the small cell link; a scheme for generating security keys for the small cell link based on the security keys of the macro cell link, transmitting the security keys for the small cell link to the small cell base station, and managing the security keys; and a scheme for generating security keys for the small cell link independently of the security keys of the macro cell link, transmitting the security keys to the small cell base station, and managing the security keys.

[0115] Fig. 9 is a flowchart illustrating an example of generating a security key when a small cell is added and transmitting related information for maintaining a separate security key according to an embodiment of the present disclosure.

[0116] If the user terminal 900 reports the result of channel measurement to the macro cell base station 910 (measurement report), the macro cell base station 910 determines whether to add the small cell base station 920 to the user terminal 900 based on the channel measurement result (901).

[0117] The macro cell base station 910 or the small cell base station 920 may generate a security key KeNB* (902) of the small cell base station 920. That is, the process of generating (or regenerating) a base station security key KeNB* to be used in the small cell base station 920 may be initiated by the macro cell base station 910 or the small cell base station 920. Alternatively, the process of generating (or regenerating) a base station security key KeNB* to be used in the small cell base station 920 may also be initiated by a process of changing (or regenerating) a base station security key used in the macro cell base station 910 (the change or generation of the macro cell base station security key may be initiated in the MME or the macro cell).

[0118] The security key of the small cell base station 920 may be used by the user terminal 900 for a new link connected with the small cell base station 920. Alternatively, the macro cell base station 910 may inquire from the MME 930 and obtain information necessary to generate a base station security key to be used for a new link.

[0119] The macrocell base station 910 generates K eNB * and NCC are forwarded to the added small cell base station 920 (903).

[0120] The macro cell base station 910 notifies the user terminal 900 of information related to the security key (eg, NCC) (904), and the user terminal 900 generates a base station security key KeNB* to be used for the link with the small cell base station based on the information related to the security key.

[0121] Thereafter, the user terminal 900 and the added small cell base station 920 may perform any DRB transmission by applying the security key KeNB* generated by themselves or received (905).

[0122] An embodiment of sharing security key information in consideration of the relationship between base stations forming a link with a user terminal is now described.

[0123] According to an embodiment of the present disclosure, the security key of the macro cell base station may be shared by the small cell base station.

[0124] In this case, the macro cell base station may generate and use the security key of the small cell base station using (based on) the shared (transmitted) security key of the macro cell base station.

[0125] In addition, the small cell base station may transmit the security key of the macro cell base station or the generated security key of the small cell base station to another small cell base station, so that the other small cell base station may generate and use its security key itself.

[0126] At the same time, the security keys of other small cell base stations can also be generated by the macro cell base station. That is, the security key of the small cell base station can be transmitted (shared) to the macro cell base station, and the macro cell base station receiving the security key of the small cell base station can use (based on) the security key of the small cell base station to generate the security key of the other small cell base station and transmit it to the other base station, so that the other small cell base station can use the security key.

[0127] According to another embodiment of the present disclosure, the security key of the macro cell base station cannot be shared by the small cell base station.

[0128] In this case, the small cell base station receives and uses the security key of the small cell base station (not the security key of the macro cell base station) generated and transmitted by the macro cell base station.

[0129] The security key of the small cell base station may be shared or not shared with the macro cell base station.

[0130] When the security key of the small cell base station is shared by the macro cell base station, the macro cell base station generates security keys of other small cell base stations using (based on) the shared security key of the small cell base station and transmits the generated security keys of other small cell base stations so that other small cells can use the security key.

[0131] Unless the security key of the small cell base station is shared by the macro cell base station, the small cell base station generates security keys for other small cell base stations and transmits the security keys to the other small cell base stations, or the macro cell base station generates a security key independent of the security key of the small cell base station and transmits the independent security key to the other small cell base stations so that the other small cell base stations can use the security key.

[0132] Fig.10 is a view showing a process of generating and transmitting a security key and an initial establishment process of a small cell link when a macro cell determines to add a small cell on a control plane according to an embodiment of the present disclosure.

[0133] If the user terminal 900 reports the result of the channel measurement (measurement report) to the macro cell base station 910 (1002), the macro cell base station 910 determines whether to additionally link the small cell base station to the user terminal 900 based on the channel measurement result, and generates a base station security key KeNB* to be used for a new link to be connected to the small cell base station 920 (1004).

[0134] The macro cell base station 910 includes KeNB* and / or NCC in a small cell addition request message (SCELL ADDITION REQUEST), and forwards the small cell addition request message to the small cell base station 920 (1006).

[0135] The added small cell base station 920 responds (1008) by transmitting a small cell addition confirmation message (SCELLADDITION ACK) to the macro cell base station 910. Alternatively, the small cell addition confirmation message may include an NCC value.

[0136] The macro cell base station 910 transmits a message for RRC reconfiguration (rrcConnectionReconfiguration) to the user terminal 900 ( 1010 ). Alternatively, the message for RRC reconfiguration may include an NCC value transmitted from the small cell base station 920 .

[0137] When receiving information related to the security key (eg, NCC) through the RRC reconfiguration message 1010 , the user terminal 900 may generate a base station security key KeNB* for a new link to be connected with the small cell base station 920 ( 1012 ).

[0138] The macrocell base station 910 receives a message (rrcConnectionReconfigurationCompletelet) corresponding to the RRC reconfiguration message from the user terminal 900 (1014).

[0139] The macrocell base station 910 transmits an RRC reconfiguration message to the user terminal 900 instead of sending out an RRC release message or an RRC reset message, so as to prevent the data transmitted to the user terminal 900 from being lost when being forwarded from the macrocell base station 910 to the small cell base station 920. That is, the use of the RRC release message or the RRC reset message may cause the COUNT value forwarded to identify the user data to be initialized, thereby causing data loss. Therefore, when the RRC is configured, the RRC reconfiguration process is performed to maintain the COUNT value. The COUNT value is a value recorded in the PDCP layer and is an indicator for identifying the data transmitted to the user terminal. For example, the COUNT value can be a value ranging from 0 to 500, and can be used for retransmission of data that may be lost when the data is forwarded.

[0140] Optionally, the macro cell base station 910 may perform a process 1016 of transferring the COUNT value from the previous transmission link (i.e., the macro cell base station) to the target transmission link (i.e., the small cell base station) through, for example, a sequence number status transfer (SN STATUS TRANSFER) message before forwarding the data to the small cell base station 920.

[0141] Subsequently, the macro cell base station 910 may forward the user data transmitted to the user terminal 900 to the small cell base station 920 (1018). Alternatively, during the process 1018 of forwarding data from the macro cell base station 910 to the small cell base station 920 by using the COUNT value included in the sequence number status transmission (SN STATUS TRANSFER) message 1016, the small cell base station 920 may perform management to detect or prevent data loss.

[0142] Then, the user terminal 900 may perform transmission of the DRB based on the newly generated security key KeNB* using the small cell base station 920. Optionally, the process of transmitting the DRB may include one or more of the following: random access of the user terminal 900 to the small cell base station 920 (1020), PDCP status report (1022), applying the newly generated security key KeNB* to the newly generated data radio bearer (labeled "DRB 2") (1024), and transmitting a physical downlink shared channel (PDSCH) and / or a physical uplink shared channel (PUSCH) for DRB 2 (1026).

[0143] Fig.11 is a diagram illustrating an exemplary process of discarding a security key when a macro cell determines to release a small cell on a control plane and an exemplary process of a terminal resuming communication with a macro cell base station according to an embodiment of the present disclosure.

[0144] If the user terminal 900 reports the channel measurement result (measurement report) to the macro cell base station (macro ENB) 910 (1102), the macro cell base station 910 determines whether to release the link to the small cell base station 920 connected to the user terminal 900 (i.e., the small cell link) based on the channel measurement result, and determines whether to apply the data radio bearer DRB 2 used for connecting to the small cell base station 920 back to itself (i.e., the macro cell base station 910) (1104).

[0145] The macro cell base station 910 transmits a SCELL RELEASE REQUEST message to the small cell base station 920 ( 1106 ), and the small cell base station 920 responds by transmitting a SCELL RELEASE ACK message to the macro cell base station 910 ( 1108 ).

[0146] Alternatively, when the small cell link is released, the small cell base station 920 may perform a process 1110 of transmitting a COUNT value for identifying user data to the macro cell base station 910 through a sequence number status transfer (SN STATUS TRANSFER) message before forwarding the data to the macro cell base station 910 .

[0147] Subsequently, the small cell base station 920 may forward the user data transmitted to the user terminal 900 to the macro cell base station 910 (1112). Alternatively, during the process 1112 of forwarding data from the small cell base station 920 to the macro cell base station 910 by using the COUNT value included in the sequence number status transmission (SN STATUS TRANSFER) message 1110, the small cell base station 920 may perform management to detect or prevent data loss.

[0148] The macrocell base station 910 transmits a message for RRC reconfiguration (rrcConnectionReconfiguration) to the user terminal 900 (1114), and receives an RRC reconfiguration complete message (rrcConnectionRecongfigurationComplete) from the user terminal 900 (1116). Optionally, the RRC reconfiguration message 1114 may include an NCC value.

[0149] For the RRC configuration, the macro cell base station 910 transmits an RRC reconfiguration message to the user terminal 900 instead of an RRC release message or an RRC reset message, so as to continuously maintain the COUNT value.

[0150] The user terminal 900 may discard the security key KeNB* generated for the small cell link and apply the security key KeNB of the macro cell base station to DRB 2 (1118), and may perform DRB 2 PDSCH and / or PUSCH transmission (1120).

[0151] When generating an independent security key, the macro cell base station or the small cell base station may receive a plurality of information items related to the security key from a higher network entity (eg, MME) in advance, and may use the information items when it is necessary to generate the security key.

[0152] At this time, the macro cell base station can access the MME and receive multiple information items (seeds) related to security keys to generate security keys and can transmit the security keys to the small cell link. In addition, the representative small cell base station can directly access the MME to receive multiple information items (seeds) related to security keys and forward them to the neighboring small cell base stations, or each small cell base station can directly access the MME to receive information related to security keys (e.g., seeds) to generate independent security keys.

[0153] The base station shall receive NH from the MME in order to generate new next-hop-based (NH) security keys that are not based on the security key KeNB of the macro cell base station. Fig.12 and Fig.13 The processing used for the above will be described.

[0154] Fig.12 is a diagram illustrating an exemplary process in which a base station obtains information for generating a security key from an MME according to an embodiment of the present disclosure.

[0155] exist Fig.12 In the illustrated embodiment, an NH / NCC REQUEST message is used as a new message for receiving NH / NCC from the MME.

[0156] If the macro cell base station 910 determines to generate a security key requesting a new NH-NCC pair (i.e., to generate a vertical key) (1202), the macro cell base station 910 transmits an NH / NCC REQUEST message (1204) to the MME 930. The MME 930 responds by sending an NH / NCC RESPONSE message to the macro cell base station 910 (1206).

[0157] Here, the NH / NCC response message 1206 may include an NH-NCC pair. Alternatively, the NH / NCC response message 1206 may include multiple NH-NCC pairs {NH, NCC}. Since the small cell base station has a small cell coverage, handover or the addition, release or change of the small cell may be frequent, and therefore, more NH-NCC pairs {NH, NCC} are required to generate security keys for the base station.

[0158] Although the macro cell base station is the entity that sends out the NH / NCC request message 1204 to request {NH, NCC}, for example, in some cases, the small cell base station may send a message to obtain {NH, NCC} from the MME.

[0159] Fig.13 is a diagram illustrating another exemplary process in which a base station obtains information for generating a security key from an MME according to an embodiment of the present disclosure.

[0160] The PATH SWITCH REQUEST message is information transmitted from the base station to the MME to change or switch the data transmission path (PATH) when a handover occurs between base stations. Fig.13 In the embodiment shown in , a PATH SWITCH REQUEST message is used to receive the NH / NCC from the MME.

[0161] If the macro cell base station 910 determines to generate a security key requesting a new NH-NCC pair (ie, to generate a vertical key) (1302), the macro cell base station 910 transmits a path switch request (PATH SWITCH REQUEST) to the MME 930 (1304).

[0162] In the case where a small cell base station is added, released or changed, the data transmission path to the small cell base station may change or not depend on the structure of the user plane.

[0163] As an example, since the data transmission path 320 of the small cell becomes Figure 3 In the situation shown in FIG. 3 , the data transmission path 330 of the macro cell is different, so a path switch occurs.

[0164] As another example, in Figure 4 and Figure 5 In the case shown in , although the small cell is added, the data transmission path does not change (the same path as before the small cell is added, the path through the macro cell). In this case, the path switch request message may contain, for example, the same transport layer address as the current transport layer address and E-radio access bearer (E-RAB) information.

[0165] Unless a path switch request (PATH SWITCH REQUEST) message received from the macrocell base station 910 indicates a path switch or change (eg, Figure 4 and Figure 5 ), otherwise the MME 930 only performs operations related to the NH and NCC without performing path switching, and in the case where the path switch request (PATH SWITCH REQUEST) message indicates path switching, the MME 930 performs operations related to the NH and NCC and data path switching operations (1306). That is, the MME 930 transmits a path switch request confirmation (PATH SWITCH REQUEST ACK) message containing an NH-NCC pair to the macro cell base station 910 in response to the path switch request message (1308).

[0166] Optionally, the PATH SWITCH REQUEST ACK message 1308 may include multiple NH-NCC pairs {NH, NCC}. Since the small cell base station has a small cell coverage, handover or the addition, release or change of the small cell may be frequent, and therefore, more NH-NCC pairs {NH, NCC} are required to generate security keys for the base station.

[0167] Although the macro cell base station is the entity that transmits the PATH SWITCH REQUEST message 1304 for requesting {NH, NCC}, for example, the small cell base station may transmit a message for obtaining {NH, NCC} from the MME in some cases.

[0168] An embodiment is described in which a security key is independently generated and managed when a user terminal adds a link with a small cell base station.

[0169] According to an embodiment of the present disclosure, a scheme for selectively maintaining the independence of security keys between small cell base stations while managing the security keys of macro cells and small cells to be independently generated is proposed. That is, in some cases, the security keys between small cells can be determined to be generated independently of each other, or in other cases, the security keys between small cells can be determined to be dependent on each other, the same or similar.

[0170] Specifically, the first small cell added to the macro cell coverage may be caused to generate a security key independent of the security key of the macro cell base station. The small cell added immediately after the first small cell may generate a dependent security key based on the security key of the first small cell.

[0171] In addition, under certain conditions, it may be determined to generate a security key independent of the added small cell base station. For example, the conditions for generating a security key independent of the added small cell base station may include: when a small cell cluster located within a predetermined physical distance changes, or when a timer for generating an independent security key expires (i.e., a predetermined time or more has passed after the previous independent security key was generated).

[0172] Fig.14 is a view showing an exemplary process of generating security keys for a macro cell base station, a small cell base station, and a user terminal and applying the generated security keys when the macro cell base station determines to add a small cell according to an embodiment of the present disclosure.

[0173] Alternatively, the small cell base station may be notified that the small cell ServCEll_s is added (1400) by receiving information such as SCellToAddRemove information element (IE) from the macro cell base station. Here, ServCEll_s means a serving cell controlled by the small cell base station. For example, the SCellToAddRemove IE may be included in a small cell add request (SCELL ADD REQUEST) message.

[0174] The macro cell base station (or the small cell base station or the user terminal) determines whether the small cell to be added is the first small cell to be added (1402). In addition, the user terminal can generate a security key for the small cell base station (a security key for the DRB to be added) through operations 1410 and 1412 for determining the NCC value transmitted from the macro cell base station (or the small cell base station). That is, different security key generation methods can be applied depending on the NCC value transmitted from the base station.

[0175] The process of generating and applying a security key will be described in detail.

[0176] In the case where the small cell is added first as a result of the determination 1402, the user terminal sets the sum of the received NCC_s value and 1, that is, NCC_s+1, as a local NCC_s value (1404). Here, NCC_s is the NCC maintained by the security key KeNB_s for the small cell base station. The next hop chain counter (NCC) can be represented as three bits, and at this time, the next hop chain counter can be used for a K ASME To distinguish the security keys used for the eight base stations.

[0177] The user terminal selects the ID of the macrocell base station, the physical cell ID (PCI), the operating frequency, and the downlink-EUTRAN absolute radio frequency channel number (DL-EARFCN) according to a predetermined rule (1406).

[0178] Then, the user terminal may generate a security key KeNB_s* for the small cell base station by applying the received NCC_s, PCI, and DL_EARFCN to a key derivation function (KDF) as in the following equation (1408).

[0179] [Equation 1]

[0180] KeNB_s*=KDF[NH(NCC_s), PCI, DL-EARFCN]

[0181] Here, NH(NCC_s) is a function for calculating the next hop (NH) using NCC_s.

[0182] In this way, the method of generating a new security key using the NH value to independently maintain the security keys of the macrocell base station and the small cell base station is called vertical security key derivation. That is, when the received NCC value is different from the previous NCC (local NCC), it can be determined that a new security key is generated according to the vertical security key derivation method.

[0183] If it is determined in 1402 that the small cell is not the first one to be added (ie, when there are one or more small cells that have already been added), the user terminal determines whether NCC_s is signaled from the macro cell base station (1410).

[0184] In case it is determined in 1410 that NCC_s has not been signaled, the user terminal may determine to use (reuse) an existing security key of the small cell base station without generating a security key ( 1424 ).

[0185] Therefore, the user terminal applies the security key KeNB_s for the logical channel LCH_s served by the small cell, and applies the security key KeNB_m for the logical channel LCH_m served by the macro cell (1422).

[0186] Meanwhile, in case it is determined in 1410 that the NCC_s has been signaled, the user terminal determines whether the signaled (received) NCC_s is identical to the local NCC_S ( 1412 ).

[0187] In the case where the result determined in 1412 indicates "same", the user terminal can select PCI and DL-EARFCN (1416) according to predetermined rules, and can apply the current security key KeNB_s, PCI and DL-EARFCN of the small cell base station to the key derivation function to generate a security key KeNB_s* (1408) for the small cell base station as in the following equation.

[0188] [Equation 2]

[0189] KeNB_s*=KDF[KeNB_s, PCI, DL-EARFCN] The method of generating a new security key based on the existing base station security key as shown in Equation 2 is called a horizontal security key derivation method. That is, when the received NCC value is the same as the previous NCC (local NCC), it can be determined that a new security key is generated according to the horizontal security key derivation method.

[0190] In other words, although the small cell base station (or macro cell base station) does not receive control information (e.g., NH or NCC) for generating new security keys from the MME, the user terminal generates new security keys based on the existing small cell base station. This approach can reduce the overhead that may be caused by control signaling in the MME due to frequent security key generation tasks.

[0191] Unless the result of the determination at 1412 indicates "same", the user terminal sets the received NCC_s value as the local NCC_s value (1414) and performs selection of PCI and DL-EARFCN (1406) and key generation using NCC_s (1408).

[0192] If the security key of the small cell base station is generated through operation 1418 or 1408 , the user terminal sets the generated base station security key KeNB_s* as a new base station security key KeNB_s ( 1420 ) and may apply the security key to a logical channel for data transmission ( 1422 ).

[0193] Alternatively, under certain conditions or when required, independent security keys for the macro cell base station and the small cell base station, respectively, may be generated according to the determination or rule of the macro cell. For example, the macro cell base station or the small cell base station (or the user terminal) may operate a security key generation timer to perform management so that if a predetermined time has passed, the security key may be independently and periodically generated, or management may be performed so that an independent security key may be generated when the number of times the small cell base station reuses the security key exceeds a predetermined number of times.

[0194] Fig.15 is a view showing an exemplary process of generating security keys for a macro cell base station, a small cell base station, and a user terminal and applying the generated security keys when the macro cell base station determines to release or replace a small cell according to an embodiment of the present disclosure.

[0195] Alternatively, the small cell base station may be notified that the small cell ServCell_s is released by receiving information such as SCellToAddRemove IE from the macro cell base station (1500). For example, the SCellToAddRemove IE may be included in a SCELL RELEASE REQUEST message.

[0196] The macrocell base station (or small cell base station or user terminal) determines whether the small cell to be released is the last small cell to be released (1502). In addition, the user terminal can determine the base station security key to be used by determining the operation of the NCC value transmitted from the macrocell base station (or small cell base station). That is, depending on the NCC value transmitted from the base station, different base station security key application methods can be applied.

[0197] The process of generating and / or applying security keys is described in detail.

[0198] When it is determined in 1502 that the small cell is released last, the user terminal releases the existing security key KeNB_s of the small cell base station and resets (i.e., initializes) the local NCC_s value (1504). Therefore, the security key KeNB_m of the macro cell base station can be applied to both the logical channel LCH_m served by the macro cell and the logical channel LCH_s served by the small cell (i.e., to replace the logical channel of the released small cell) (1506). Here, although the logical channel when the small cell is released is labeled as LCH_s for convenience, the logical channel LCH_s with the small cell is released (and therefore no longer exists) and should be interpreted as meaning the logical channel with the macro cell base station (regardless of how it is labeled).

[0199] If it is determined in 1502 that the small cell is not the last one to be released (ie, when there are one or more small cells remaining after the release), the user terminal determines whether NCC_s is signaled from the macro cell base station (1508).

[0200] If it is determined in 1508 that NCC_s has not been signaled, the user terminal does not generate a security key. The user terminal determines to use (ie, reuse) an existing security key of the small cell base station as a base station security key for replacing the released small cell (1414).

[0201] When it is determined in 1508 that NCC_s has been signaled, the user terminal generates a security key (1510) for the small cell base station to replace the released small cell based on the signaled (or received) NCC_s value similar to when the small cell was added, using a vertical security key derivation method or a horizontal security key derivation method.

[0202] If the security key of the small cell base station is determined (generated) according to operation 1514 or 1510, the security key KeNB_m of the macro cell base station is applied to the logical channel LCH_m served by the macro cell, and the determined (generated) security key KeNB_s of the small cell base station is applied to the logical channel LCH_s served by the small cell (i.e., used to replace the released small cell's logical channel with the base station) (1512).

[0203] Figures 16a and 16b are views showing examples of generating and transmitting security keys when a small cell base station is added, when a small cell base station is changed, and when all linked small cells are released in a dual-connectivity environment where a macro cell and a small cell use separate security keys according to an embodiment of the present disclosure.

[0204] The embodiments shown in Figures 16a and 16b are about the following situation: in this situation, a user terminal that initially receives two DRBs through a macro cell base station using the security key KeNB of the macro cell base station receives one of the DRBs (referred to as DRB 2 and indicated as LCH_s, as shown in Figures 16a and 16b) through the added small cell base station 1, and then hands over to the small cell base station 2 for DRB 2, and finally releases the link with the small cell base station 2 to receive two DRBs from the macro cell base station.

[0205] As shown in Equation 3, the security key KeNB_m of the macro cell base station can be obtained using a key derivation function, the input values ​​of which include the macro cell base station ID as the physical cell ID (PCI), the operating frequency as the downlink-EUTRAN absolute radio frequency channel number (DL_EARFCN), and the next hop (NH) (1610).

[0206] [Equation 3]

[0207] KeNB_m=KDF[NH(n), PCI, DL-EARFCN]=K1

[0208] Initially, user terminal 1600 is served two DRBs (DRB 1 indicating LCH_m and DRB 2 indicating LCH_s) by macrocell base station 1602, and the security key of the macrocell base station is usually used for the two DRBs (1612 and 1614).

[0209] In the case where a change in the channel state is detected based on the channel measurement report of the user terminal, the macro cell base station 1602 adds a new small cell and determines to connect one of the user DRBs (here, DRB 2) to the small cell base station 1604 (1602). The macro cell base station 1602 generates an NH value for use in vertical security key generation (1618).

[0210] At this time, as shown in Equation 4, a security key for the new small cell base station 1604 is obtained using KDF, and the input value of KDF includes: PCI as the ID of the small cell base station, DL-EARFCN as the operating frequency, and the new NH value (1620). That is, the security key for the new small cell base station 1604 can be generated by the vertical security key derivation method.

[0211] [Equation 4]

[0212] KeNB_s*=KDF[NH(n+1), PCI, DL-EARFCN]=K2

[0213] Here, n is the value of NCC_m which is the NCC maintained by the security key of the macro cell base station.

[0214] If the macro cell base station 1602 transmits the security key KeNB_s* generated for the small cell base station to the small cell base station ( 1656 ), the small cell base station applies the received KeNB_s* as the security key of the new base station.

[0215] The macro cell base station also transmits NCC_s information to the user terminal 1600 (1658). The user terminal 1600 can restore (generate) and use the security key KeNB_s* for DRB 2 connected to the small cell base station 1 1604 based on the received NCC_s.

[0216] Specifically, the user terminal 1600 compares the received NCC_s (1622). When handover occurs (or when the initial small cell is added), NCC_s is initialized to the local NCC, and when the new NCC_s value is signaled, the received NCC_s value is used to update it. When the received NCC_s value is different from the local NCC_s value, the user terminal 1600 can use the received NCC_s value to generate NH (1624), and can use the PCI and DL-EARFCN value to generate the value K2 of the security key KeNB_s of the small cell base station (1626). Then, the security key KeNB_m can be applied to DRB1 (1628), and the security key KeNB_s can be applied to DRB 2 (1630).

[0217] Next, the channel condition changes, and the macro cell base station 1602 determines to switch (i.e., handover) the DRB 2 connection of the user terminal 1600 from the small cell base station 1 1604 to the new small cell base station 2 1606 (1632). At this time, as shown in Equation 5, a security key for the small cell base station 2 1606 is obtained using a key derivation frequency (KDF) based on the PCI as the ID of the small cell base station 2 1606, the operating frequency DL-EARFCN, and the security key KeNB_s of the previous small cell base station. That is, a security key for the replacement small cell base station 1606 can be generated by a horizontal security key derivation method.

[0218] [Equation 5]

[0219] KeNB_s*=KDF[KeNB_s, PCI, DL-EARFCN]=K3

[0220] The macro cell base station 1602 may transmit the security key KeNB_s*(K3) generated for the small cell base station 2 1606 to the small cell base station 2 1606 (1660). In addition, the macro cell base station 1602 also transmits NCC_s information to the user terminal 1600 (1662). The user terminal 1600 may compare the received NCC_s (SeNB_NCC), and restore (generate) and use the security key KeNB_s* for DRB 2 connected to the small cell base station 2 1606 based on the NCC_s (1636 and 1638). As a result, the user terminal may apply the base station security key for DRB 1 and DRB 2 (1640 and 1642).

[0221] Next, the channel condition changes, and if the macro cell base station 1602 determines to release DRB 2, which is the connection of the user terminal 1600 to the small cell base station 2 1606, and connects it to the macro cell base station 1602 (handover) (1644), the macro cell base station 1602 transmits a SCELL RELEASE message to the user terminal 1600 (1646).

[0222] When the last small cell base station is released (1648) (i.e., when there is no longer a serving cell to be linked to LCH_s), the macro cell base station 1602 discards the security key KeNB_s of the small cell base station 2 that has been used, and resets NCC_s (1650). Transmission is performed using the security key KeNB_m (k1) of the macro cell base station 1602 applied to DRB 2 and DRB 1 (1652 and 1654).

[0223] Figures 17a and 17b are views showing examples of establishing DRB paths on the control plane and the user plane and generating and transmitting security keys when a small cell base station is added, when a small cell base station is changed, and when all linked small cells are released in a dual-connectivity environment where a macro cell and a small cell use separate security keys according to an embodiment of the present disclosure.

[0224] The embodiments shown in Figures 17a and 17b are also related to the following scenario: in this scenario, a user terminal that initially receives two DRBs through a macro cell base station using the security key KeNB of the macro cell base station receives one of the DRBs (referred to as DRB 2 and indicating LCH_s, as shown in Figures 17a and 17b) through the added small cell base station 1, and then hands it over to the small cell base station 2 for DRB 2.

[0225] When the user terminal 1700 initially connected to the macro cell base station 1702 independently determines to add a small cell base station to receive services (1710), the macro cell base station 1702 transmits a small cell addition request to the small cell base station 1704, and generates and forwards a security key KeNB_s* (1712). The small cell base station 1704 responds to the request 1712 (1714).

[0226] The macro cell base station 1702 stops the logical channel LCH_s, connects the user terminal 1700 to the macro cell base station 1702 through the logical channel LCH_s (1716), and transmits an RRC reconfiguration message for the connection with the small cell base station 1 1704 and the user terminal 1700 to the user terminal 1700, while notifying the user terminal 1700 of the NCC_s information (1718).

[0227] The user terminal 1700 stops the logical channel LCH_s connected to the macro cell base station (1724), and generates KeNB_s based on the NCC_s information and applies it to DRB 2 (1726). Here, although the logical channel through which the user terminal communicates with the macro cell base station is marked as LCH_s for convenience, when the communication with the macro cell base station is stopped in order to communicate with the new small cell base station, LCH_s should be interpreted as meaning the logical channel with the macro cell base station (regardless of how it is marked).

[0228] Subsequently, the user terminal 1700 sends an RRC reconfiguration complete message to the macro cell base station 1702 (1728). The user terminal 1700 begins to use the small cell base station 1704 to transmit DRB 2 (1732). In this case, the security key KeNB_s is applied to the logical channel LCH_s served by the small cell, and the security key KeNB_m is applied to the logical channel LCH_m served by the macro cell (1734 and 1736).

[0229] Alternatively, the PDCP status report 1738 may occur between the user terminal 1700 and the small cell base station 1704 , and the radio environment measurement report 1740 may occur from the user terminal 1700 to the macro cell base station 1702 .

[0230] Next, in the case where the macro cell base station 1702 determines that the small cell base station to be used for DRB 2 is changed from the small cell base station 1 1704 to the small cell base station 2 1706 (1742), the macro cell base station 1702 sends a request message for releasing the small cell base station 1 1704 to the small cell base station 1 1704 (1744). At this time, the small cell base station 1 1704 stops transmitting DRB 2 (1746) and sends a response to the request message 1744 to the macro cell base station 1702 (1748). At this time, the macro cell base station 1702 can generate and transmit the security key KeNB_s*, while sending a request for adding the small cell base station to the small cell base station 2 1706 (1750). The small cell base station 2 1706 responds to the addition request 1750 (1752).

[0231] The macro cell base station 1702 performs RRC reconfiguration (1754 and 1760) for the connection with the new small cell base station 2 1706 and the user terminal 1700. The macro cell base station 1702 may pass the NCC_s while sending an RRC connection reconfiguration message 1754 to the user terminal 1700. The user terminal 1700 stops the logical channel LCH_s for DRB 2 (1756), generates a new small cell base station security key KeNB_s* (i.e., a horizontal base station security key) based on the received NCC_s, and applies it to DRB 2 (1758).

[0232] Fig.18 is a view showing a configuration of a user terminal according to an embodiment of the present disclosure.

[0233] UE 1800 includes a transceiver 1810 that communicates signals and a controller 1805 that controls the overall operation of UE 1800. Transceiver 1810 can play a role in communicating various control signals and data with a macro cell base station or a small cell base station. The operation of the user terminal as illustrated here can be understood to be performed under the control of controller 1805.

[0234] Although the transceiver 1810 and the controller 1805 are shown as if they were separate components, they may also be implemented in a single component.

[0235] Fig.19 is a view showing a configuration of a base station according to an embodiment of the present disclosure.

[0236] Base station 1900 is an example of a macro cell base station and a small cell base station as described herein.

[0237] The base station 1900 includes a transceiver 1910 for communicating signals and a controller 1905 for controlling the overall operation of the base station 1900. The transceiver 1910 can play a role in communicating various control signals and data with a user terminal or a small cell base station. The operation of the macro cell base station and the small cell base station as illustrated here can be understood to be performed under the control of the controller 1905.

[0238] Although the transceiver 1910 and the controller 1905 are shown as if they were separate components, they may also be implemented in a single component.

[0239] It should be noted that Figures 3 to 19 The illustrated inter-system signaling, generation of security keys, and configuration of devices are not intended to limit the scope of the present disclosure. Figures 3 to 19 All entities, operating steps or components shown in the disclosure should not be construed as core components for practicing the present disclosure, and rather the present disclosure may be implemented with only some components without departing from the gist of the present disclosure.

[0240] The above operations can be implemented by equipping a memory device that keeps the corresponding codes in the entity, base station or user terminal of the communication system. That is, the controller in the entity, base station or user terminal can perform the above operations by reading and executing the program code stored in the memory device by a processor or a central processing unit (CPU).

[0241] As described herein, various components or modules in an entity, base station, or user terminal may operate using hardware circuits such as complementary metal oxide semiconductor-based logic circuits, firmware, software, and / or hardware circuits using a combination of hardware, firmware, and / or software embedded in a machine-readable medium. As an example, various electronic structures and methods may be performed using electronic circuits such as transistors, logic gates, or ASICs.

[0242] Although specific embodiments of the present disclosure have been described above, various changes may be made thereto without departing from the scope of the present disclosure. Therefore, the scope of the present disclosure should not be limited to the embodiments described above, but should be defined by the following claims and their equivalents.

Claims

1. A method for communicating by a user equipment UE in a communication system, the method comprising: receiving a radio resource control (RRC) connection reconfiguration message from the first base station including a counter of the second base station; applying the counter of the second base station to a key derivation function KDF to generate a second security key for a data radio bearer DRB for communication with a packet data convergence protocol PDCP in the second base station; generating a second security key for a DRB for communication with a PDCP in a second base station based on the counter and the KDF; as well as A second security key associated with the DRB used for communication with the PDCP in the second base station is applied.

2. The method according to claim 1, further comprising: Generate encryption keys; as well as transmitting data by communicating with the second base station, The encryption key is used to encrypt the data.

3. The method according to claim 2, wherein: Before transmitting the data, the method further comprises: Sending an RRC reconfiguration complete message to the first base station; and A random access procedure is performed with the second base station.

4. The method according to claim 1, in, When the second base station is newly added in the communication system, an RRC connection reconfiguration message including the counter is received.

5. The method according to claim 4, wherein: The generated second security key is a new security key of the newly added second base station.

6. The method according to claim 1, further comprising: A second security key for the second base station is generated based on the first security key, wherein the first security key is applied for communication with the first base station.

7. A user equipment UE communicating in a communication system, the UE comprising: a memory storing one or more instructions; and A controller configured to execute the one or more instructions to: receiving a radio resource control (RRC) connection reconfiguration message from the first base station including a counter of the second base station; applying the counter of the second base station to a key derivation function KDF to generate a second security key for a data radio bearer DRB for communication with a packet data convergence protocol PDCP in the second base station; generating a second security key for a DRB for communication with a PDCP in a second base station based on the counter and the KDF; as well as A second security key associated with the DRB used for communication with the PDCP in the second base station is applied.

8. The UE according to claim 7, in, The controller is further configured to execute the one or more instructions to: Generate encryption keys; transmitting data by communicating with the second base station, The encryption key is used to encrypt the data.

9. The UE according to claim 8, wherein: Prior to transmitting the data, the controller is further configured to execute the one or more instructions to: Sending an RRC reconfiguration complete message to the first base station; and A random access procedure is performed with the second base station.

10. The UE according to claim 7, in, When the second base station is newly added in the communication system, an RRC connection reconfiguration message including the counter is received.

11. The UE according to claim 10, wherein: The generated second security key is a new security key of the newly added second base station.

12. The UE according to claim 7, wherein: The controller is also configured to: A second security key for the second base station is generated based on the first security key, wherein the first security key is applied for communication with the first base station.

13. A method for communicating by a second base station in a communication system, the method comprising: receiving a second security key to be used for communication with a user equipment UE from the first base station, wherein the second security key is for a data radio bearer DRB for communication with a packet data convergence protocol PDCP in the second base station; and applying a second security key to communications with the UE, wherein the second security key is generated by applying a counter used for communication with the UE to a key derivation function KDF, and Wherein, the counter is included in a radio resource control (RRC) connection reconfiguration message.

14. The method according to claim 13, further comprising: Generate encryption keys; as well as transmitting data by communicating with the UE, The encryption key is used to encrypt the data.

15. The method according to claim 14, wherein: Before transmitting the data, the method further comprises: Perform a random access procedure with the UE.

16. The method according to claim 13, in, When a second base station is newly added in the communication system, an RRC connection reconfiguration message including the counter is received.

17. The method according to claim 16, in, The generated second security key is a new security key of the newly added second base station.

18. A second base station for communicating in a communication system, the second base station comprising: a memory storing one or more instructions; and A controller configured to execute the one or more instructions to: receiving a second security key to be used for communication with a user equipment UE from the first base station, wherein the second security key is for a data radio bearer DRB for communication with a packet data convergence protocol PDCP in the second base station; and applying a second security key to communications with the UE, wherein the second security key is generated by applying a counter used for communication with the UE to a key derivation function KDF, and Wherein, the counter is included in a radio resource control (RRC) connection reconfiguration message.

19. The second base station according to claim 18, in, The controller is further configured to execute the one or more instructions to: Generate encryption keys; and transmitting data by communicating with the UE under the control of the controller, The encryption key is used to encrypt the data.

20. The second base station according to claim 18, wherein: Prior to transmitting the data, the controller is configured to execute the one or more instructions to: Perform a random access procedure with the UE.

21. The second base station according to claim 18, in, When the second base station is newly added in the communication system, an RRC connection reconfiguration message including the counter is received.

22. The second base station according to claim 21, wherein: The generated second security key is a new security key of the newly added second base station.

Images