Abstract:
The invention discloses a network function virtualization-based certificate configuration method, apparatus, and system. A virtualized network management entity obtains initial credential information of a virtualized network function entity; and installs the initial credential information onto the virtualized network function entity during or after instantiation of the virtualized network function entity, so that the virtualized network function entity obtains, from a certificate authority by using the initial credential information, a formal certificate issued by a network operator of the virtualized network function entity. The invention not only can apply to a network function virtualization scenario, but also can resolve a problem of a security risk in network function virtualization.
Abstract:
The embodiments of the present invention provide a secure establishment method, system and device of a wireless local area network. The method includes: acquiring, by a UE, a first key; the first key is a shared key of the UE and a network element equipment in a mobile communication network to which the UE is accessed when implementing air interface security, or is derived according to the shared key; deriving, by the UE, according to the first key and a derivation parameter to acquire a derivation key; establishing, by the UE, according to the derivation key, secure connection with a WLAN node acquiring a derivation key, wherein the derivation key acquired by the WLAN node is the same as the derivation key acquired by the UE.
Abstract:
A method, network element, and mobile station (MS) are disclosed. The method includes: obtaining information that a plug-in card of the MS does not support a first encryption algorithm; deleting the first encryption algorithm from an encryption algorithm list permitted by a core network element according to the information that the plug-in card of the MS does not support the first encryption algorithm; sending the encryption algorithm list excluding the first encryption algorithm to an access network element, so that the access network element selects an encryption algorithm according to the encryption algorithm list excluding the first encryption algorithm and the MS capability information sent from the MS and sends the selected encryption algorithm to the MS. By using the method, network element, and MS, errors due to the fact that the plug-in card of the MS does not support an encryption algorithm may be avoided during the encryption process.
Abstract:
A method and an apparatus for protecting data carried on an Un interface between a eNB and a relay node are disclosed. Three types of radio bearers (RBs) are defined over the Un interface: signaling radio bearers (SRBs) for carrying control plane signaling data, signaling-data radio bearers (s-DRBs) for carrying control plane signaling date; and data-data radio bearers (d-DRBs) for carrying user plane data. An integrity protection algorithm and an encryption algorithm are negotiated for control plane signaling data on an SRB, control plane signaling data carried on an s-DRB, and user plane data carried on a d-DRB. With the respective integrity protection algorithm and encryption algorithm, the data over the Un interface can be protected respectively. Therefore, the security protection on the Un interface is more comprehensive, and the security protection requirements of data borne over different RBs can be met.
Abstract:
The present invention provides a data transmission method and apparatus, where the method includes: performing, by UE, security processing on a NAS PDU by using a security parameter and a security algorithm, where data to be transmitted is encapsulated in the NAS PDU; and sending, by the UE, the NAS PDU to a serving SGSN by using an RNC. The present invention can improve efficiency of transmitting a small data packet, and further provide a security mechanism to ensure security of transmitting the small data packet.
Abstract:
A method, network element, and mobile station (MS) are disclosed. The method includes: obtaining information that a plug-in card of the MS does not support a first encryption algorithm; deleting the first encryption algorithm from an encryption algorithm list permitted by a core network element according to the information that the plug-in card of the MS does not support the first encryption algorithm; sending the encryption algorithm list excluding the first encryption algorithm to an access network element, so that the access network element selects an encryption algorithm according to the encryption algorithm list excluding the first encryption algorithm and the MS capability information sent from the MS and sends the selected encryption algorithm to the MS. By using the method, network element, and MS, errors due to the fact that the plug-in card of the MS does not support an encryption algorithm may be avoided during the encryption process.
Abstract:
Embodiments of the present invention pertain to the communications field and disclose a method, device, and system for managing quality of service. The method includes: receiving a service request; determining, according to configuration information, devices participating in negotiation on quality of service; and determining, according to a negotiation result of the devices participating in negotiation on quality of service, quality of service corresponding to the service request. The device includes: a receiving module, a first determining module and a second determining module. In the embodiments of the present invention, devices participating in negotiation on quality of service are determined according to configuration information, and the corresponding quality of service is determined according to the negotiation result of the devices participating in negotiation on quality of service, thereby not being limited to the subscription result of the HLR, and implementing flexible management for quality of service.
Abstract:
A method, and related apparatuses are provided. The method comprises receiving an initial layer-3 message, wherein the initial layer-3 message comprises an indication indicating that a part of the initial layer-3 message is encrypted, and generating a keystream, wherein the keystream is used to decrypt the encrypted part of the initial layer-3 message.
Abstract:
The present disclosure relates to mobile communications technologies, and in particular, to a mobile communication method, apparatus, and device. The method includes: receiving, by user equipment UE, a non-access stratum NAS security mode command message from a mobility management entity MME, where the NAS security mode command message carries first verification matching information used to verify UE capability information received by the MIME; determining, by the UE based on the first verification matching information, whether the UE capability information received by the MME is consistent with UE capability information sent by the UE to the MIME; and if the UE capability information received by the MME is consistent with the UE capability information sent by the UE to the MME, sending, by the UE, a NAS security mode complete message to the MME.
Abstract:
A service application programming interface (API) invoking method where a security method applied to an API exposing function entity is updated from an original security method to a new security method, and where the security method of the API exposing function entity is used for communication between the API exposing function entity and an invoker. The method includes: obtaining, by the invoker, a new security method of the API exposing function entity; and sending, by the invoker, a first invoking request to the API exposing function entity using the new security method, where the first invoking request includes a name of a service API, and where the first invoking request is used to invoke the service API.