公开(公告)号：US20210176080A1

公开(公告)日：2021-06-10

申请号：US17182493

申请日：2021-02-23

Applicant: Huawei Technologies Co., Ltd.

Inventor： Fei Li ,  Jintao Zhu ,  Chengdong He ,  Tao Bai

IPC: H04L9/32

Abstract: In a method for enabling a message receive end to quickly confirm a certificate status, a defined field of a certificate includes classification information of the certificate, and a defined field of a certificate revocation list includes classification information of a revoked certificate, so that the receive end can quickly narrow a searching or matching range in massive records of the certificate revocation list based on the classification information carried in the certificate of a transmit end.

公开(公告)号：US10958692B2

公开(公告)日：2021-03-23

申请号：US16538492

申请日：2019-08-12

Applicant: Huawei Technologies Co., Ltd.

Inventor： Chengdong He

IPC: H04L29/06 ,  H04W36/00 ,  H04W12/10 ,  H04W12/00 ,  H04W36/14

Abstract: A security capability negotiation method is provided that is applicable to perform security capability negotiation during a mobile network handover. Moreover, a security capability negotiation system is also provided. Consistent with the provided system and method, it may be unnecessary for the MME to know the security capability of the corresponding eNB in a certain manner during a handover from a 2G/3G network to an LTE network. Meanwhile, during the handover from the LTE network to the 3G network, the SGSN does not need to introduce new requirements.

公开(公告)号：US10595198B2

公开(公告)日：2020-03-17

申请号：US16023324

申请日：2018-06-29

Applicant: HUAWEI TECHNOLOGIES CO., LTD.

Inventor： Chengdong He

IPC: H04L29/06 ,  H04W12/04 ,  H04L9/08 ,  H04W36/00 ,  H04W12/10 ,  H04W8/02 ,  H04W12/12

Abstract: A communication method includes receiving by a SGSN a context request message from a mobility management entity (MME), obtaining by the SGSN an authentication vector-related key, and calculating by the SGSN a root key according to the authentication vector-related key. In addition, the method further includes sending by the SGSN a context response message including the root key to the MME, wherein the MME derives a NAS protection key according to the root key.

公开(公告)号：US10362043B2

公开(公告)日：2019-07-23

申请号：US15270722

申请日：2016-09-20

Applicant: Huawei Technologies Co., Ltd.

Inventor： Rong Wu ,  Chengdong He ,  Lu Gan

IPC: H04L29/00 ,  H04L29/06 ,  H04W12/12

Abstract: A method and an apparatus for detecting a man-in-the-middle attack, where the method includes receiving, by a macro evolved Node B (MeNB), a first check request message sent by a secondary evolved Node B (SeNB), where the first check request message includes first identifier information and a first data packet count value, generating a second check request message according to the first identifier information, sending the second check request message to a user terminal, receiving a first check response message generated by the user terminal according to the second check request message, where the first check response message includes second identifier information and a second data packet count value, determining, by the MeNB, that the man-in-the-middle attack exists between the SeNB and the user terminal when the first data packet count value is different from the second data packet count value.

公开(公告)号：US20190200233A1

公开(公告)日：2019-06-27

申请号：US16289106

申请日：2019-02-28

Applicant: Huawei Technologies Co., Ltd.

Inventor： Chengdong He

IPC: H04W12/12 ,  H04W76/12 ,  H04L29/06 ,  H04W8/08 ,  H04W8/04 ,  H04W76/11

CPC classification number: H04W12/1204 ,  H04L63/0876 ,  H04L63/126 ,  H04L63/1458 ,  H04L63/1466 ,  H04L2463/142 ,  H04W8/04 ,  H04W8/08 ,  H04W76/11 ,  H04W76/12 ,  H04W84/042

Abstract: A signaling attack prevention method and apparatus, where the method includes receiving a general packet radio service (GPRS) Tunneling Protocol (GTP-C) message from a serving gateway (SGW), determining whether the GTP-C message is received from an eighth data interface (S8), determining whether a first characteristic parameter of the GTP-C message is valid when the GTP-C message is received from the S8 interface, where the first characteristic parameter includes at least one of an international mobile subscriber identity (IMSI) of a user, or an identifier of a message source end of the GTP-C message, and discarding the GTP-C message or returning, to the SGW, a GTP-C response message carrying an error code cause value when the first characteristic parameter of the GTP-C message is invalid.

公开(公告)号：US10015669B2

公开(公告)日：2018-07-03

申请号：US15372093

申请日：2016-12-07

Applicant: Huawei Technologies Co., Ltd.

Inventor： Chengdong He

IPC: H04L29/06 ,  H04W12/04 ,  H04L9/08 ,  H04W36/00 ,  H04W12/10 ,  H04W8/02 ,  H04W12/12

CPC classification number: H04W12/04 ,  H04L9/0844 ,  H04L9/088 ,  H04L63/0492 ,  H04L63/062 ,  H04L63/0876 ,  H04L63/1441 ,  H04L63/20 ,  H04L63/205 ,  H04L69/24 ,  H04L2463/061 ,  H04W8/02 ,  H04W12/10 ,  H04W12/12 ,  H04W36/0038

Abstract: A communication method includes receiving by a SGSN a context request message from a mobility management entity (MME), obtaining by the SGSN an authentication vector-related key, and calculating by the SGSN a root key according to the authentication vector-related key. In addition, the method further includes sending by the SGSN a context response message including the root key to the MME, wherein the MME derives a NAS protection key according to the root key.

公开(公告)号：US09572027B2

公开(公告)日：2017-02-14

申请号：US14728687

申请日：2015-06-02

Applicant: Huawei Technologies Co., Ltd.

Inventor： Chengdong He

IPC: H04L29/06 ,  H04W12/04 ,  H04W60/04 ,  H04M1/66 ,  H04W80/02 ,  H04W88/12

CPC classification number: H04W12/08 ,  H04L63/06 ,  H04L63/083 ,  H04L63/107 ,  H04L63/205 ,  H04M1/66 ,  H04W8/02 ,  H04W8/22 ,  H04W12/04 ,  H04W12/06 ,  H04W60/04 ,  H04W80/02 ,  H04W88/12

Abstract: A method for negotiating security capabilities during movement of a User Equipment (UE) includes the following steps: a target network entity receives a Routing Area Update (RAU) Request from the UE; the entity obtains Authentication Vector (AV)-related keys deduced according to a root key, and sends the selected security algorithm to the UE; and the UE deduces the AV-related keys according to the root key of the UE. A system, SGSN, and MME for negotiating security capabilities during movement of a UE are also disclosed. The present invention is applicable to security capability negotiation between the UE and the network.

Abstract translation: 一种在用户设备（UE）移动期间协商安全能力的方法包括以下步骤：目标网络实体从UE接收路由区域更新（RAU）请求; 实体根据根密钥获得认证向量（AV）相关密钥，并将所选择的安全算法发送给UE; 并且UE根据UE的根密钥推断AV相关密钥。 还公开了用于在UE的移动期间协商安全能力的系统，SGSN和MME。 本发明适用于UE与网络之间的安全能力协商。

公开(公告)号：US20170005795A1

公开(公告)日：2017-01-05

申请号：US15268808

申请日：2016-09-19

Applicant: Huawei Technologies Co., Ltd.

Inventor： Lu Gan ,  Rong Wu ,  Chengdong He

IPC: H04L9/08 ,  H04L29/06 ,  H04W76/02

CPC classification number: H04L9/0869 ,  H04L63/061 ,  H04L63/123 ,  H04L2463/061 ,  H04W12/04 ,  H04W76/11

Abstract: The present disclosure relates to a key generation method, a master eNodeB, a secondary eNodeB, and UE. The key generation method includes: determining a key parameter corresponding to a data radio bearer DRB; sending the key parameter to UE corresponding to the DRB, so that the UE generates a user plane key according to the key parameter and a basic key generated by the UE; receiving a basic key generated by a master eNodeB and sent by the master eNodeB; and generating the user plane key according to the key parameter and the basic key generated by the master eNodeB.

Abstract translation: 本公开涉及密钥生成方法，主eNodeB，辅助eNodeB和UE。 密钥生成方法包括：确定与数据无线承载DRB对应的密钥参数; 向与所述DRB相对应的UE发送所述密钥参数，使得所述UE根据所述密钥参数和所述UE生成的基本密钥生成用户平面密钥; 接收由主eNodeB产生并由主机eNodeB发送的基本密钥; 以及根据由主eNodeB产生的密钥参数和基本密钥生成用户平面密钥。

公开(公告)号：US09497625B2

公开(公告)日：2016-11-15

申请号：US14957338

申请日：2015-12-02

Applicant: HUAWEI TECHNOLOGIES CO., LTD.

Inventor： Chengdong He

IPC: H04L29/06 ,  H04W12/04 ,  H04W12/06 ,  H04L9/08 ,  H04W36/00 ,  H04W12/10 ,  H04W12/12

CPC classification number: H04W12/04 ,  H04L9/0844 ,  H04L9/088 ,  H04L63/0492 ,  H04L63/062 ,  H04L63/0876 ,  H04L63/1441 ,  H04L63/20 ,  H04L63/205 ,  H04L69/24 ,  H04L2463/061 ,  H04W8/02 ,  H04W12/10 ,  H04W12/12 ,  H04W36/0038

Abstract: Methods of security negotiation for idle state mobility from a first network to a long term evolution (LTE) network are disclosed. In one embodiment, a service general packet radio service (GPRS) support node (SGSN) of the first network transmits an authentication vector-related key to a mobility management entity (MME). A user equipment (UE) sends its security capabilities including non-access stratum (NAS) security capabilities to the MME. The MME selects a NAS security algorithm, in accordance with the NAS security capabilities of the UE, and sends a message that indicates the selected NAS security algorithm to the UE. The MME also derives, in accordance with the selected NAS security algorithm, a NAS protection key from an authentication vector-related key so as to security communication between the UE and the LTE network.

Abstract translation: 公开了从第一网络到长期演进（LTE）网络的空闲状态移动性的安全协商的方法。 在一个实施例中，第一网络的服务通用分组无线服务（GPRS）支持节点（SGSN）向移动性管理实体（MME）发送认证向量相关密钥。 用户设备（UE）向MME发送包括非接入层（NAS）安全性能的安全功能。 MME根据UE的NAS安全能力选择NAS安全算法，并向UE发送指示选择的NAS安全算法的消息。 MME还根据所选择的NAS安全算法从认证向量相关的密钥导出NAS保护密钥，以便UE和LTE网络之间的安全通信。

公开(公告)号：US09241261B2

公开(公告)日：2016-01-19

申请号：US14303146

申请日：2014-06-12

Applicant: Huawei Technologies Co., Ltd.

Inventor： Chengdong He

IPC: H04L29/06 ,  H04W12/04 ,  H04W12/06 ,  H04L9/08 ,  H04W36/00 ,  H04W12/12

CPC classification number: H04W12/04 ,  H04L9/0844 ,  H04L9/088 ,  H04L63/0492 ,  H04L63/062 ,  H04L63/0876 ,  H04L63/1441 ,  H04L63/20 ,  H04L63/205 ,  H04L69/24 ,  H04L2463/061 ,  H04W8/02 ,  H04W12/10 ,  H04W12/12 ,  H04W36/0038

Abstract: An MME negotiates security in case of idle state mobility for a UE from a first network to a LTE network. The UE sends its security capabilities including non-access stratum (NAS) security capabilities supported by the UE to the LTE network. The MME selects a NAS security algorithm, in accordance with the NAS security capabilities of the UE, and sends the selected NAS security algorithm to the UE, sharing the NAS security algorithm between the UE and the LTE network when the UE moves from the first network to the LTE network. The MME also derives, in accordance with the selected NAS security algorithm, a NAS protection key from an authentication vector-related key so as to security communication between the UE and the LTE network.

Abstract translation: 在UE从第一网络到LTE网络的空闲状态移动性的情况下，MME协商安全性。 UE向LTE网络发送其安全能力，包括UE支持的非接入层（NAS）安全功能。 MME根据UE的NAS安全能力选择NAS安全算法，并将所选择的NAS安全算法发送给UE，当UE从第一个网络移动时，在UE和LTE网络之间共享NAS安全算法 到LTE网络。 MME还根据所选择的NAS安全算法从认证向量相关的密钥导出NAS保护密钥，以便UE和LTE网络之间的安全通信。