Method and apparatus for obtaining security key in relay system

FIELD: radio engineering, communication.

SUBSTANCE: invention relates to communication engineering. The method of obtaining a security key in a relay system, wherein a node in a relay system obtains an initial key, in accordance with the initial key, the node obtains a root key of the security key of the radio interface between the node and another node adjoining said node, and in accordance with the root key, the node obtains a security key of the radio interface between the node and said other adjoining node. Therefore, in accordance with the initial key, each lower-level node obtains a root key of the security key of the radio interface between each lower-level node, such that UE data on an interface link Un can be secured accordingly.

EFFECT: effective data security in each radio interface segment.

12 cl, 11 dwg

The technical FIELD TO WHICH the INVENTION RELATES.

[0002] the Present invention relates to the field of communications technologies, and in particular, to a method and device to obtain the system key in a relay system.

The prior art INVENTIONS

[0003] LTE-A (Advanced long-term development, LTE-Advanced) is the development of technology standard broadband radio 3GPP LTE, which is closely considered in the present time. To increase throughput on the border of the cell, in LTE-A is entered relay node (Relay Node, RN), to meet the needs of temporary network deployment for operators or users and to maintain the function group move, where RN can be deployed in rural, urban and active home zone access or "dead zone.

[0004] RN is located between the donor eNB (DeNB, Donor eNB)belongs to RN and the UE, the RN sends a signal downlink to the UE receives the uplink signal due to the DeNB, where the radio interface between RN and DeNB is called the Un interface and the radio interface between the RN and the UE is called the Uu interface. Data from the DeNB to the UE passes through two segments of the radio interface, i.e. the data reaches the UE through two hops. When you add more RN, in LTE-A may also occur mnogoshagovyi script.

[0005] due to the introduction of the RN number NEGP the clients in the communication lines of the air increases, the key level is also increased and the existing security mechanism is unable to perform effective data security in each segment of the radio interface.

The INVENTION

[0006] embodiments of the present invention provide a method and apparatus for obtaining a security key in a relay system to properly secure data UE link interface Un.

[0007] Alternative implementation of the present invention discloses a method for obtaining a security key in a relay system, which includes:

getting primary key node in the relay system;

in accordance with the initial key receiving node of the root key from the security key of the air interface between the node and another node that is directly adjacent to the said node; and

according to the root key of the receiving node security key of the air interface between the node and said another node that is directly adjacent to the said node.

[0008] Alternative implementation of the present invention discloses a method for obtaining a security key in a relay system, which includes:

receiving the first relay node of the root key in the authentication process with the host, which borders per the th relay node; and

in accordance with the root key to obtain the first relay node protection key of the radio interface for performing protection between the first relay node and the adjacent node

where adjacent node to the first relay node includes the top-level node to the first relay node and/or the bottom node to the first relay node.

[0009] the eNB includes:

the module receiving configured to receive a seed node in the relay system;

the first module receiving, in accordance with the initial key received by the module receiving, configured to obtain the root key protection key of the radio interface between the node and another node that is directly adjacent to the said node; and

a second module for receiving, in accordance with the root key received by the first module receiving configured to receive a security key of the air interface between the node and said another node that is directly adjacent to the said node.

[0010] the Relay node includes:

the first module receiving configured for: the first relay node obtains a root key in the authentication process with the neighboring node to the first relay node; and

the second module of the floor the treatment, configured for: the first relay node receives in accordance with the root key received by the first module receiving the protection key of the radio interface for performing protection between the first relay node and the adjacent node

where adjacent node to the first relay node includes the top-level node to the first relay node and/or the bottom node to the first relay node.

[0011] In embodiments implementing the present invention, the relay node in the system receives the initial key in accordance with the initial key obtains the root key protection key of the radio interface between the node and another node that is directly adjacent to the node, and in accordance with the root key receives the security key of the air interface between the node and said another node that is directly adjacent to the site, so that you can properly secure data UE link interface Un, that is, each active UE has a set of security settings on the communication line interface of the Un and, in addition, effective security is relative to the data in each segment of the radio interface.

BRIEF DESCRIPTION of DRAWINGS

[0012] in order To more clearly describe the technical solutions in embodiments of implementation of the present invention or before actuuse the prior art, below are briefly presented accompanying drawings required for describing the embodiments. Obviously, the accompanying drawings in the following description are only some of the options for implementation of the present invention and medium-sized specialists in the art can obtain other drawings from these accompanying drawings without creative efforts.

[0013] Figure 1 - block diagram of the operational sequence of the method for obtaining a security key in a relay system in accordance with the first embodiment of the present invention;

[0014] Figure 2 - block diagram of the operational sequence of the method for obtaining a security key in a relay system in accordance with the second embodiment of the present invention;

[0015] Figure 3 - block diagram of the operational sequence of the method for obtaining a security key in a relay system in accordance with a third embodiment of the present invention;

[0016] Figure 4 is a block diagram of the operational sequence of the method for obtaining a security key in a relay system in accordance with the fourth embodiment of the present invention;

[0017] Figure 5 is a block diagram of the operational sequence of the method for obtaining a security key in a relay system according to the fifth embodiment of the present invention;

[0018] 6 is a block diagram of the operational sequence of the method for obtaining a security key in a relay system in accordance with the sixth embodiment of the present invention;

[0019] Fig.7 is a block diagram of the operational sequence of the method for obtaining a security key in a relay system according to the seventh embodiment of the present invention;

[0020] Fig - block diagram of the operational sequence of the method for obtaining a security key in a relay system in accordance with the eighth embodiment of the present invention;

[0021] Figure 9 is a block diagram of the operational sequence of the method for obtaining a security key in a relay system according to the ninth embodiment of the present invention;

[0022] Figure 10 is a schematic structural diagram of a node in the relay system according to the embodiment of the present invention; and

[0023] 11 - schematic structural diagram of another node in the relay system according to the embodiment of the present invention.

DETAILED DESCRIPTION of embodiments

[0024] in Order to clarify the objectives, technical solutions and advantages of the present invention, the present invention clearly and completely described below with exile of left-wing is to the accompanying drawings. It is obvious that variants of implementation that need to be described are only a part and not all variants of implementation of the present invention. On the basis of embodiments of the present invention, all other embodiments of received by specialists in the art without creative efforts should be included in the scope of protection of the present invention.

[0025] RN has the following characteristics :

[0026] RN can have its own identification information of the physical cell (PCI Physical Cell Identity), which is used for transmission of the synchronization signal and reference signal RN.

[0027] the UE may receive from RN scheduling information and feedback hybrid automatic request for retransmission (HARQ, Hybrid Automatic Retransmitting the Request) and send to RN control information of the UE.

[0028] For the UE release 8 3GPP RN can be eNB R8, that is, the RN has the characteristic of backward compatibility.

[0029] For UE LTE-A RN may be an object that differs from the eNB R8.

[0030] In the authentication process in the LTE system, the home subscriber server (HSS, Home Subscriber Server) generates the initial root encryption key and the initial root key integrity protection, namely CK,IK, in accordance with the local primary root key K. In the authentication process, the HSS receives an initial key K_ASMEcore network in accordance with the CK,the IK and the OTP is to place K _ASMEthe MME. MME receives the key K_NASwithout access service (NAS Non-Access Stratum), and the initial key K_eNBthe access network in accordance with K_ASMEand MME sends K_eNBto the eNB, and the eNB locally receives the key K_ASlevel access AS Access stratum) in accordance with K_eNBwhere K_NASincludes the encryption key message the NAS and the security key message integrity NAS and K_ASincludes the encryption key of the user plane UP (User Plane), key integrity protection for control plane CP (Control Plane) and the encryption key CP. Side UE may also generate CK,IK in accordance with the local primary root key K. UE receives K_ASMEin accordance with CK,IK UE receives the key K_NASNAS and K_eNBin accordance with K_ASMEand UE receives the key K_ASAS in accordance with K_eNB. The way to obtain the key used by the MME and the UE, as follows.

[0031] the development Function key (KDF) includes:

The derived key = HMAC-SHA-256 (Key, S).

Key is an input key, S=FC||P0||L0||P1||L1...

Length FC is one byte and is used to distinguish different algorithms, P0 is the input parameter, and L0 is the length of P0.

[0032] the Method of obtaining is as follows:

K_ASME=KDF (CK||IK, S10), S10=f (FC, PLMN ID, SQN AK).

[0033] the MME and UE receive locally:

K_eNB=KDF (K_ASME, S11), S11=f (Uplink NAS COUNT);

K_NAS=KDF (K_{ASME , S15), S15=f (identification of the type of algorithm id algorithm).}

_{[0034] the eNB and UE receive locally:}

_{KAS=KDF (KeNB, S15).}

[0035] S10=f (FC, PLMN ID, SQN AK)=FC||PLMN ID||the length of PLMN-ID ||SQN AK||length (SQN AK),

where FC=0×10, and the PLMN ID refers to the ID of the terrestrial mobile communication network for General use. SQN is the serial number, AK can be anonymous key, and the length of xx can be long xx.

S11=f (FC, Uplink NAS COUNT)=FC||Uplink NAS COUNT||the length of the Uplink NAS COUNT;

where FC=0×11, and the Uplink NAS COUNT may be a count value of the message NAS uplink connection.

S15=f (FC, identification of the type of algorithm id algorithm)=FC||hallmark-type algorithm||the length of the distinguishing sign of the type of algorithm||the id of the algorithm||the length of the id algorithm,

where FC=0×15, the hallmark of type of algorithm can be a distinctive type of algorithm, and the id of the algorithm may be an identification number of the algorithm.

[0036] However, due to the introduction of RN the number of segments of lines of air increases, the key level is also increased and the existing security mechanism is unable to perform effective data security in each segment of the radio interface. To solve this technical problem, a variant of implementation of the present invention provides a way to get the key in mnogochasovoj system, which is characterized by a situation you shall legit as follows.

[0037] embodiments of the present invention in further detail, taking as example 3-jumping system and method in each embodiment is also applicable to 2-Sackboy system or a system that contains more than 2 jumps (transitions).

[0038] Figure 1 - block diagram of the operational sequence of the method for obtaining a security key in a relay system in accordance with the first embodiment of the present invention. The method includes:

[0039] Step 101: the Node in the relay system receives an initial key.

[0040] Step 102: according To the initial key of the root node receives the key protection key of the radio interface between the node and another node that is directly adjacent to the said node.

[0041] Step 103: according To the root key node receives the security key of the air interface between the node and said another node that is directly adjacent to the said node.

[0042] In this embodiment of the present invention, the relay node in the system receives an initial key, in accordance with the initial key of the root node receives the key protection key of the radio interface between the node and said another node that is directly adjacent to the said node, and in accordance with the root key node receives the security key RA is iointerface between the node and said another node, which directly borders with the mentioned site, so that you can properly secure data UE link interface Un, that is, each active UE has a set of security settings on the communication line interface of the Un and, in addition, effective security is relative to the data in each segment of the radio interface.

[0043] in Addition, when the node in the relay system is eNB, the primary key node in the relay system includes:

[0044] the eNB receives an initial key from the object mobility management (MME).

[0045] in Addition, when the node in the relay system, the relay node RN, the primary key node in the relay system includes:

[0046] RN receives an initial key from the MME or eNB.

[0047] in Addition, when the node in the relay system is a user equipment UE, obtaining a seed node in the relay system includes:

[0048] the UE receives an initial key from the top-level node for the UE.

[0049] in Addition, when the node in the relay system is eNB, the method further includes:

[0050] the eNB receives an initial key from the bottom node to the eNB in accordance with an input parameter of the transmission and primary key.

[0051] the eNB sends nachalnika one of the nodes of the lower level for this node.

[0052] the eNB sends the input parameter passed to the host, which directly borders with one of the nodes of the lower level node so in accordance with the input parameter of the transmission and primary key one of the nodes of the lower level node and the node that is directly connected with one of the nodes of the lower level of this node received root key protection key of the radio interface between one of the nodes of the lower level of this node and the node that is directly connected with one of the nodes of the lower level of this node.

[0053] in Addition, when the node in the relay system, the relay node RN, the method further includes:

[0054] RN accepts an input parameter of the transmission, which is sent by the top-level node.

[0055] In accordance with the initial key of the root node receives the key protection key of the radio interface between the node and the node that is directly adjacent to the said site, which includes, in particular:

[0056] In accordance with the initial key and the input parameter of the transfer relay node RN obtains the root key protection key of the radio interface between the node and the node that is directly adjacent to the said node.

[0057] in Addition, when the node in the relay system is a user equipment UE, the method further includes:

[0058] the UE receives an input parameter transmission, which is sent by the top-level node.

[0059] In accordance with the initial key of the root node receives the key protection key of the radio interface between the node and the node that is directly adjacent to the said site, which includes, in particular:

[0060] In accordance with the initial key and the input parameter of the transmitting UE obtains the root key protection key of the radio interface between the node and the node that is directly adjacent to the said node.

[0061] Particularly noted that the input parameter in this embodiment, may be an input parameter transfer.

[0062] In this embodiment of the present invention, the relay node in the system receives an initial key, in accordance with the initial key of the root node receives the key protection key of the radio interface between the node and said another node that is directly adjacent to the said node, and in accordance with the root key node receives the security key of the air interface between the node and said another node that is directly adjacent to the said site so that you can properly secure data UE link interface Un, that is, each active UE has a set of security settings on the communication line interface of the Un and, in addition effective security is Uchenie security is relative to the data in each segment of the radio interface.

[0063] Figure 2 - block diagram of the operational sequence of the method for obtaining a security key in a relay system in accordance with the second embodiment of the present invention. In this embodiment, the UE receives all the keys of the radio interface in accordance with the local primary root key K UE, K_eNBis transmitted from the eNB or RN top level to the RN lower-level interface, the input parameter in this embodiment, may be a local input parameter. As shown in figure 2:

[0064] Step 201: RN1 accesses the network and the authentication process completes.

[0065] Step 202: RN2 accesses the network and the authentication process completes.

[0066] Step 203: the UE accesses the network, and the authentication process completes.

[0067] the Order of priority between steps 201, 202 and 203 is missing.

[0068] Step 204: the MME receives the K_NASand the initial key K_eNBin accordance with the key K_ASME'that is generated in the authentication process UE.

[0069] At step 204, the method for obtaining the K_NASand the initial key K_eNBa similar method to get the key in the LTE system, which is not described in detail here.

[0070] Step 205: the MME sends to the eNB initial key K_eNB.

[0071] Step 206: the eNB receives and stores the initial key K_eNBthat is sent by the MME.

[0072] Step 207: eNB PE napravlyaet to RN1 initial key K _eNB.

[0073] Step 208: RN1 maintains the initial key K_eNB.

[0074] Step 209: the eNB and the RN1 locally obtain the root key K_eNB' between the eNB and the RN1 in accordance with the initial key K_eNBand according to the root key K_eNB' get the keys of the radio interface used for protecting UP data and CP data between the eNB and the RN1 and the specific method is as follows:

K_eNB'=KDF (K_eNBf (first input)).

[0075] When RN1 accesses the network, the first input parameter may be a parameter C-RNTI1 temporary identification information, which is distributed RN1 through the eNB, where it should be noted that each time RN1 re-applying for a new DeNB received C-RNTI1 different; either the first input parameter may be a parameter RRC MESSAGE COUNT1 value of count messages of radio resource control (RRC) specific UE between the eNB and the RN1; or the first input parameter may be a parameter NONCE1 random values, which is coordinated by eNB with RN1, and the input parameter may include in but not limited to, one or any combination of the previous three types of parameters.

[0076] the Keys used for protecting UP data and CP data between the eNB and the RN1, obtained in accordance with the root key K_eNB'where the key data protection UP is the key K_UPencencryption UP, the keys of the data protection CP t is Auda key K _RRCencencryption CP and the key K_RRCiintprotect the integrity of the CP, the way to get the three keys refers to the formula to obtain the K_ASthe input key is the K_eNB'and further obtaining a key K_UPencconsidered as an example for description, namely:

K_UPenc= KDF (K_eNB', f (identification of the type of encryption algorithm UP, id encryption algorithm UP)),

where identification of the type of encryption algorithm UP is a distinguishing characteristic for the type of encryption algorithm UP, and the id of the encryption algorithm UP is the identifier of the encryption algorithm UP.

[0077] Step 210: RN1 redirects to RN2 initial key K_eNB.

[0078] Step 211: RN2 maintains the initial key K_eNB.

[0079] Step 212: RN1 and RN2 obtain the root key K_RN1in accordance with the initial key K_eNBwhere way to obtain is:

K_RN1= KDF (K_eNBf (the second input parameter)),

where the second input parameter may be a parameter C-RNTI2 temporary identification information, which is distributed RN2 RN1 through when RN2 accesses the network; or the second input parameter may be a parameter RRC MESSAGE COUNT2 values count RRC message, which is related to a specific UE between RN1 and RN2; or the second input parameter may be a parameter NONCE2 random values, which agreed is highlighted by RN1 with RN2. The input parameter may include, but is not limited to, one or any combination of the previous three types of parameters.

[0080] the Method for obtaining a key K_UPenc' protecting UP data and keys K_RRCenc' and K_RRCiint' data protection CP link of the Un interface between the RN1 and the RN2 according to the root key K_RN1a similar method to obtain the K_ASin the LTE system, which is not described in detail here.

[0081] Step 213: UE locally receives K_NASand the initial key K_eNBsynthesis method similar to that described in the prior art and is not described in detail here. RN2 and the UE receives the root key K_RN2in accordance with the initial key K_eNBand get the key of the air interface used for protecting UP data and CP data between the UE and RN2, in accordance with the root key K_RN2and the way to obtain the K_RN2may include the following two methods.

[0082] a. K_RN2= KDF (K_eNBf (the third input parameter)),

where the input key is the K_eNBand when the UE accesses the network, the third input parameter may be a parameter C-RNTI3 temporary identification information, which is distributed UE via RN2; or the third input parameter may be a parameter RRC MESSAGE COUNT3 the counter value of the RRC message, which is related to a specific UE between RN2 and the UE; or the third input is Noah parameter may be a parameter NONCE3 random values, which is coordinated by RN2 with the UE, where the input parameter may include, but is not limited to, one or any combination of the previous three types of parameters.

[0083] b. K_eNBupdated by adopting the style vnutrisajtovoj transfer service to get the root key K_RN2in particular:

K_RN2= KDF (K_eNBf (PCI, EARFCN-DL)),

where the input key is a key of K_eNBused before the transfer, and the input parameters can be PCI of the target cell and the number of EARFCN-DL RF channel of the target cell.

[0084] In this embodiment, the present invention eNB receives the initial key K_eNBgets the root key K_eNB' between the eNB and the node RN1 in accordance with the initial key K_eNBin accordance with the root key K_eNB' gets the protection key of the radio interface between the eNB and the immediate node of the eNB and forwards the initial key K_eNBto each node of the lower level of the received root key protection key of the radio interface between each node of the lower level in accordance with the initial key K_eNBand it was possible to appropriately protect the data UE link interface Un, that is, each active UE has a set of security settings on the communication line interface of the Un and, in addition, effective enforcement b is the security is relative to the data in each segment of the radio interface.

[0085] Figure 3 - block diagram of the operational sequence of the method for obtaining a security key in a relay system in accordance with a third embodiment of the present invention. In this embodiment, unlike the second variant implementation is that eNB locally receives primary keys of all RN lowest level in accordance with K_eNB, then delivers the results obtained or derived parameters for each node of the lower level, where the input parameters in this embodiment, may include an input parameter transfer and local input parameter. As shown in figure 3:

[0086] the Steps 301 to 305 are similar to steps 201 to 205 in the second embodiment, and not described in detail here.

[0087] Step 306: eNB locally receives an initial key K_RN1and K_RN2each node in the bottom level in accordance with the initial key K_eNBand the way to obtain is as follows:

K_RN1= KDF (K_eNBf (the fourth input parameter)).

K_RN2= KDF (K_eNBf (the fifth input parameter)).

[0088] the Fourth input parameter may be an input parameter of the transmission, and when RN2 accesses the network, the fourth input parameter may be a parameter C-RNTI4 temporary identification information, which is distributed RN2 pose the STV RN1, where it should be noted that each time RN2 are re-applying for a new DeNB received C-RNTI4 different; or the fourth input parameter may be a parameter NONCE4 random values, which is coordinated by RN1 with RN2.

[0089] the Fifth input parameter may be the fifth input parameter transfer, and when the UE accesses the network, the fifth input of the transmission parameter may be a parameter C-RNTI5 temporary identification information, which is distributed UE via RN2, where it should be noted that each time the UE re-applying for a new DeNB received C-RNTI5 different; or the fifth input of the transmission parameter may be a parameter NONCE5 random values, which is coordinated by eNB with RN1.

[0090] alternatively, the fourth input parameter and the fifth input parameter can also be other input parameters, such as id of the corresponding RN or point (value) of the carrier frequency of the corresponding RN. The input parameter may include, but is not limited to, one or any combination of the previous three types of parameters.

[0091] Step 307: the eNB sends to the RN1 initial key K_eNBand the fourth input parameter.

[0092] Step 308: the eNB and the RN1 obtain the root key K_eNB' between the eNB and the RN1 in accordance with the initial key K_eNB, eNB and the RN1 get the key, use is going to protect UP data and CP data, in accordance with the root key K_eNB'the way to obtain the K_eNB' looks as follows:

K_eNB' = KDF (K_eNBf (sixth local input parameter)),

where, when RN1 accesses the network, the sixth local input parameter may be a parameter C-RNTI6 temporary identification information, which is distributed RN1 through the eNB, where every time RN1 re-applying for a new DeNB received C-RNTI6 different; or the sixth local input parameter may be a parameter RRC MESSAGE COUNT6 the counter value of the RRC messages from a specific UE between the eNB and the RN1; or the sixth local input parameter may be a parameter NONCE6 random values, which is coordinated by eNB with RN1, and local input parameter may include, but is not limited to one or any combination of the previous three types of parameters.

[0093] the Keys used for protecting UP data and CP data between the eNB and the RN1, obtained in accordance with the root key K_eNB'where the key data protection UP is the key K_UPencencryption UP, the keys of the data protection CP are the key K_RRCencencryption CP and the key K_RRCiintprotect the integrity of the CP, the way to get the three keys refers to the formula to obtain the K_ASthe input key is the K_eNB'and further obtaining a key K_UPencconsidered the quality of the ve example for description, namely:

K_UPenc= KDF (K_eNB', f (identification of the type of encryption algorithm UP, id encryption algorithm UP)),

where identification of the type of encryption algorithm UP is a distinguishing characteristic for the type of encryption algorithm UP, and the id of the encryption algorithm UP is the identifier of the encryption algorithm UP.

[0094] Step 309: the eNB sends to the RN2 initial key K_RN1the initial key K_eNBand the fifth input parameter.

[0095] Step 310: RN1 receives an initial key K_RN1RN1 in accordance with the initial key K_eNBeNB and the fifth input parameter, RN1 and RN2 obtain the root key K_RN1' between the RN1 and the RN2 according to the initial key K_RN1and according to the root key K_RN1' RN1 and RN2 have the keys K_UPenc, K_RRCencand K_RRCiintradio interface, which are used for protecting UP data and CP data between the RN1 and RN2. The method of obtaining the same way to obtain the K_ASin the LTE system and the detail is not described here, and the way to obtain the K_RN1' looks as follows:

K_RN1' = KDF (K_RN1f (seventh local input parameter)),

where the input key is the K_RN1and seventh local input parameter may be a parameter RRC MESSAGE COUNT7 the counter value of the RRC message, which is related to a specific UE between RN1 and RN2 or seventh local input PA is amatr can be option C-RNTI7 temporary identification information, which is distributed RN2 RN1 through or seventh local input parameter may be a parameter NONCE7 random values, which is coordinated by RN1 with RN2, where local input parameter may include, but is not limited to, one or any combination of the previous three types of parameters.

[0096] Step 311: RN2 receives an initial key K_RN2the RN2 according to the initial key K_eNBeNB and the fifth input parameter, and the method for obtaining the K_RN2a similar way of getting on stage 306.

[0097] Step 312: RN2 sends to the UE the fifth input parameter.

[0098] Step 313: the UE locally receives K_NASand primary keys K_eNBand K_RN2, how to get the initial key K_eNBrefers to the formula to obtain the K_eNBand the detail is not described here; the way to obtain the initial key K_RN2a similar method to obtain the K_RN2at step 306, RN2 and the UE receives the root key K_RN2' between RN2 and the UE in accordance with the initial key K_RN2, RN2 and the UE receives the key-way radio service are used for protecting UP data and CP data between the UE and RN2, in accordance with K_RN2'where way to obtain K_RN2' may include the following two methods.

[0099] a. K_RN2' = KDF (K_RN2f (eighth local input parameter)),

where the input key is the K_RN2and the eighth l is local input parameter may be a parameter RRC MESSAGE COUNT8 values count of messages between RN2 and the UE, or eighth local input parameter may be a parameter C-RNTI8 temporary identification information, which is distributed UE via RN2 or eighth local input parameter may be a parameter NONCE8 random values, which is coordinated by RN2 with the UE, where the input parameter may include, but is not limited to, one or any combination of the previous three types of parameters.

[0100] b. K_RN2updated by adopting the style vnutrisajtovoj transfer service to get the K_RN2'and the specific method is:

K_RN2' = KDF (K_RN2f (PCI, EARFCN-DL)),

where the input key may be the key K_RN2used before the transfer, the input parameter PCI may be identification information of the physical target cell, and EARFCN-DL can be a number of radio frequency channels in the target cell.

[0101] In this embodiment, the present invention eNB receives an initial key of each node in the bottom level in accordance with K_eNB, eNB forwards the primary key of each node of the lower level and receives an input parameter, which is the primary key to each node of the lower level of the received root key protection key of the radio interface of each node of the lower level in accordance with the initial key and an input parameter and can be had with testwuide way to protect data UE link interface Un, that is, each active UE has a set of security settings on the communication line interface of the Un and, in addition, effective security is relative to the data in each segment of the radio interface.

[0102] Figure 4 - block diagram of the operational sequence of the method for obtaining a security key in a relay system in accordance with the fourth embodiment of the present invention. In this embodiment, unlike the third variant implementation is that primary keys eNB and RN work together in the MME, and then the obtained result is delivered or obtained result and the parameter to be delivered to each node, as shown in figure 4.

[0103] Steps 401 through 403 are similar to steps 201 to 203 in the second embodiment, and not described in detail here, where differences are that:

[0104] Step 404: the MME receives the K_NASand the initial key K_eNBeNB under MME in accordance with the key K_ASMEthat is generated in the authentication process of the UE, and the way to obtain is as follows:

K_eNB= KDF (K_ASMEf (UL NAS COUNT))

K_RN1= KDF (K_ASMEf (tenth input parameter))

K_RN2= KDF(K_ASMEf (eleventh input parameter)),

where the input key is a key of K_ASMEthat is generated in the authentication process, UL NAS COUNT is the parameter value calculation NAS signaling uplink communication UE in the MME, the tenth input parameter may include a tenth input parameter transfer, the tenth input transmission parameter may be a parameter NONCE10 random values or the value of the NAS COUNT between the MME and the corresponding RN, the eleventh input parameter may be the eleventh input parameter transfer and eleventh input transmission parameter may be a parameter NONCE11 random values or the value of the NAS COUNT between the MME and the corresponding RN, where the input parameter may include, but is not limited to, one or any combination of the previous three types of parameters.

[0105] Step 405: the MME sends to the eNB initial key K_eNB.

[0106] Step 406: the MME sends to the RN1 initial key K_eNBand the tenth input parameter.

[0107] Step 407: the MME sends to the RN2 initial key K_eNB, K_RN1and the eleventh input parameter.

[0108] Step 408: RN2 sends to the UE the eleventh input parameter.

[0109] Step 409: the RN1 and the eNB obtain the root key K_eNB' in accordance with the initial key K_eNBin accordance with the root key K_eNB' RN1 and the eNB receives the keys of the radio interface, which are used for protecting UP data and CP data between the RN1 and the eNB, and the way to obtain is as follows:

K_eNB' = KDF (K_eNBf (twelfth local input parameter)),

where, when RN1 accesses the network, the twelfth local input PA is amatr can be option C-RNTI12 temporary identification information, then RN1 through the eNB, where every time RN1 re-applying for a new DeNB received C-RNTI12 different; or twelfth local input parameter may be a parameter RRC MESSAGE COUNT12 the counter value of the RRC messages specific UE between the eNB and the RN1; or twelfth local input parameter may be a parameter NONCE12 random values, which is coordinated by eNB with RN1, and local input parameter may include, but is not limited to, one or any combination of the previous three types of parameters.

[0110] the Keys used for protecting UP data and CP data between the RN1 and the eNB, obtained in accordance with the root key K_eNB'the key data protection UP is the key K_UPencencryption UP, the keys of the data protection CP are the key K_RRCencencryption CP and the key K_RRCiintprotect the integrity of the CP, the way to get the three keys refers to the formula to obtain the K_ASthe input key is the K_eNB'and further obtaining a key K_UPencconsidered as an example for description, namely:

K_UPenc= KDF (K_eNB', f (identification of the type of encryption algorithm UP, id encryption algorithm UP)),

where identification of the type of encryption algorithm UP is a distinguishing characteristic for the type of encryption algorithm UP, and the id of the encryption algorithm UP is the tsya identifier of the encryption algorithm UP.

[0111] Step 410: RN1 receives an initial key K_RN1RN1 in accordance with the initial key K_eNBeNB and the tenth input parameter and method for producing the same as at stage 404 and the detail is not described here; RN1 and RN2, respectively, obtain the root key K_RN1' between the RN1 and the RN2 according to the initial key K_RN1and method for producing the same as at stage 310 in the third embodiment, and not described in detail here; RN1 and RN2 have the keys K_UPenc, K_CPencand K_CPintprotection of the radio interface, which are used for protecting UP data and CP data between the RN1 and the RN2 according to the root key K_RN1'.

[0112] Step 411: RN2 receives an initial key K_RN2between RN2 and the UE in accordance with the initial key K_eNBbetween the RN1 and the eNB and the eleventh input parameter and method for producing the same as in step 404.

[0113] Step 412: UE locally receives an initial key K_eNBeNB, the UE receives an initial key K_RN2RN2 in accordance with K_eNBand the eleventh input parameter, UE and RN2 obtain the root key K_RN2' between RN2 and the UE in accordance with the initial key K_RN2RN2, in accordance with K_RN2' RN2 and the UE receives the key K_UPenc, K_RRCencand K_RRCiintradio interface, which is used to protect data CP data and UP between the UE and RN2, the method of obtaining a similar way to the floor the value of K _ASin the LTE system and the detail is not described here, and the way to obtain the K_RN2' looks as follows.

[0114] a. K_RN2' = KDF (K_RN2f (thirteenth local input parameter)),

where the input key is the K_RN2and when the UE accesses the network, the thirteenth local input parameter may be a parameter C-RNTI13 temporary identification information, which is distributed UE via RN2; or thirteenth input parameter may be a parameter RRC MESSAGE COUNT13 values count of messages between RN2 and the UE; or the thirteenth local input parameter may be a parameter NONCE13 random values, which is coordinated by RN2 with the UE. Local input parameter may include, but is not limited to, one or any combination of the previous three types of parameters.

[0115] b. K_RN2updated by adopting the style vnutrisajtovoj transfer service to get the K_RN2'and the update method similar to that described in step 313 (b), and detail is not described here.

[0116] In this embodiment of the present invention the object MME mobility management receives an initial key node of the eNB under MME and primary key eNB in accordance with the key generated in the authentication process, the MME, and the MME sends to the node of the lower level of the home eNB key or start the key node of the lower level, to the bottom node has received root key protection key of the radio interface between the bottom node and the immediate bottom node to the bottom node in accordance with the initial eNB key or the key generated in the authentication process of the bottom node and the MME. Therefore, it is possible to appropriately protect the data UE link interface Un, that is, each active UE has a set of security settings on the communication line interface Un, so that effective security is relative to the data in each segment of the radio interface.

[0117] Figure 5 - block diagram of the operational sequence of the method for obtaining a security key in a relay system according to the fifth embodiment of the present invention. In this embodiment, the security key of the communication line interface Un is based on a constant key Ka RN and can be used to protect specific RB RN, and can also be used to protect all RB UE, which belong to RN. The input parameter in this embodiment, may be a local input parameter. As shown in Fig. 5:

[0118] Step 501: RN1 accesses the network and the authentication process ends, where in the process the authentication key K_ASME_RN1 obtained using Ka.

[0119] Step 502: RN2 accesses the network, the authentication process is completed, where in the process the authentication key K_ASME_RN2 obtained using a Kb.

[0120] Step 503: the MME and RN1 respectively receive the K_NASand the initial key K_RN1RN1 in accordance with the key K_ASME_RN1, which is generated in the authentication process, the MME and RN2, respectively, receive the K_NASand the initial key K_RN2RN2 in accordance with the key K_ASME_RN2, which is generated in the authentication process, the method of obtaining may relate to the formula for obtaining the K_NASand the input key is a key generated in the authentication process.

[0121] Step 504: the MME sends to the eNB received an initial key K_RN1.

[0122] Step 505: the MME sends to the RN1 received an initial key K_RN2.

[0123] Step 506: In accordance with the initial key K_RN1RN1 and the eNB receives the keys of the radio interface, which are used for protecting UP data and CP data between the RN1 and the eNB, the method of obtaining the same way to obtain the K_NASin the LTE system and the input key is the K_RN1.

[0124] Step 507: In accordance with the initial key K_RN2RN2 obtains a root key K_RN2' between RN1 and RN2 and in accordance with the root key K_RN2' RN1 and RN2 have the keys of the radio interface, which are used for protecting UP data and CP data between the RN1 and RN2. The method of obtaining the same way to obtain the K_ASin the LTE system, the input to Ucom is K _RN2' and the way to obtain the K_RN2' is:

K_RN2'=KDF (K_RN2f (fourteenth input parameter)),

where the fourteenth input parameter may be a parameter RRC MESSAGE COUNT14 the counter value of the RRC message, which is related to a specific UE between RN1 and RN2; or fourteenth input parameter may be a parameter C-RNTI14 temporary identification information, which is distributed RN2 RN1 through when RN2 accesses the network; or the fourteenth input parameter may be a parameter NONCE14 random values, which is coordinated by RN1 with RN2, where the input parameter may include, but is not limited to, one or any combination of the previous three types of parameters.

[0125] In this embodiment of the present invention the object MME mobility management receives an initial key node of the eNB under MME and primary key eNB in accordance with an input parameter and the key generated in the authentication process, the MME, the MME sends to the node of the lower level of the home eNB key or primary key of the node of the lower level, and the MME sends the input parameter node of the lower level to the bottom level node has received root key protection key of the radio interface between the bottom node and the immediate junction of the lower level of the above-mentioned bottom level node corresponding the input parameter and the initial key eNB or input parameter and key which is generated in the authentication process of the bottom node and the MME. Therefore, it is possible to appropriately protect the data UE link interface Un, that is, each active UE has a set of security settings on the communication line interface Un, so that effective security is relative to the data in each segment of the radio interface.

[0126] Each variant implementation of the present invention can also be used in combination, for example, when the Un interface between the RN1 and the eNB has two types of unidirectional channels, namely the unidirectional channel RN1 and unidirectional channel of the UE, respectively. For unidirectional channel RN1 key may be generated using a method in accordance with the fifth embodiment to perform protection, and for one-way channel of the UE can be used a method in accordance with the second embodiment to perform protection. Similarly for unidirectional channel RN2 on the Un interface between the RN1 and RN2 key can also be generated using a method in accordance with the fifth embodiment to perform protection, and for unidirectional channel UE on the Un interface between the RN1 and RN2 key can also be generated using a method in accordance with the second embodiment is La complete protection. For unidirectional channel UE on the Un interface between the RN1 and the eNB key can also be generated using a method in accordance with the third embodiment to perform protection, and for unidirectional channel UE on the Un interface between the RN1 and RN2 key can also be generated using a method in accordance with the third embodiment to perform protection. For unidirectional channel UE on the Un interface between the RN1 and the eNB key can also be generated using a method in accordance with the fourth embodiment to perform protection, and for unidirectional channel UE on the Un interface between the RN1 and RN2 key can also be generated using a method in accordance with the fourth embodiment for complete protection.

[0127] 6 is a block diagram of the operational sequence of the method for obtaining a security key in a relay system in accordance with the sixth embodiment of the present invention. In this embodiment, the security key, which is used by RN the lower level, is associated with a key that is used by RN the upper level. The input parameter in this embodiment, may be a local input parameter. As shown in Fig.6:

[0128] Step 601: RN1 accesses the network and the process is autentifikacii completes.

[0129] Step 602: the MME and RN1 respectively receive the K_NASand the initial key K_RN1RN1 in accordance with the key K_ASME_RN1, which is generated in the authentication process, the method of obtaining may be the same as in the LTE system, the input key is a key of K_ASME_RN1, which is generated in the authentication process, and the input parameter can be Uplink NAS COUNT RN1.

[0130] Step 603: the MME sends to the eNB initial key K_RN1.

[0131] Step 604: In accordance with the initial key K_RN1RN1 directly receives the keys of the radio interface, which are used for protecting UP data and CP data between the RN1 and the eNB, the method of obtaining the same way to obtain the K_ASin the LTE system and the input key is the K_RN1.

[0132] Step 605: RN2 accesses the network and the authentication process is completed, where the authentication process RN2 MME sends to the RN2 initial key K_RN1RN1.

[0133] Step 606: the MME and RN2 get K_NASand the initial key K_RN2RN2 in accordance with K_ASME_RN2, which is generated in the authentication process, and the initial key K_RN1RN1, the way to obtain the K_RN2as follows:

K_RN2=KDF (K_ASME_RN2, K_RN1f (Uplink NAS COUNT at RN2)).

[0134] the Input keys are K_ASME_RN2 and K_RN1.

[0135] Step 607: the MME sends to the RN1 initial key K_RN2.

[0136] Step 608: RN2 gets to the Neva key K _RN2' between the RN1 and the RN2 according to K_RN2in accordance with the root key K_RN2' gets the keys of the radio interface, which are used for protecting UP data and CP data between the RN1 and RN2, the method of obtaining the same way to obtain the K_ASin the LTE system and the input key is the K_RN2'.

[0137] Step 609: the UE accesses the network, the authentication process is terminated, and K_RN1and K_RN2sent to the UE.

[0138] Step 610: the MME and the UE receives the initial key K_eNBand K_NASin accordance with the key K_ASME_UE and K_RN2that are generated in the authentication process, where the method for obtaining the K_eNBas follows:

K_eNB=KDF (K_ASME_UE, K_RN2f (Uplink NAS COUNT at UE)).

[0139] the Input keys are K_ASME_UE and K_RN2.

[0140] Step 611: the MME sends to the RN2 initial key K_eNBthe eNB.

[0141] Step 612: RN2 obtains a root key K_eNB' between the UE and the RN2 according to the initial key K_eNBin accordance with K_eNB' RN2 and the UE receive the keys of the radio interface, which are used for protecting UP data and CP data between the RN2 and the UE, the input key is the K_RN2' and the way to obtain the K_eNB' includes two methods.

[0142] a. Similar to the way to obtain the K_eNB' at step 209 in the second method, the input key is the K_eNBthe first input parameter can be a value of the m count RRC messages between the RN2 and the UE, either the first input parameter may be a C-RNTI, which is distributed UE via RN2, either the first input parameter may be a new NONCE value, which is coordinated by RN2 and the UE; and the input parameter may include, but is not limited to, one or any combination of the previous parameters.

[0143] b. K_eNBupdated by adopting the style vnutrisajtovoj transfer service to get the root key K_eNB'and the update method is:

K_eNB'=KDF (K_eNBf (PCI, EARFCN-DL)),

where K_eNB' may be updated by the key, the input key may be the key K_eNBused before the transfer, the input parameter may be a PCI of the target cell, and EARFCN-DL is the number of radio frequency channels in the target cell.

[0144] In this embodiment of the present invention, the relay node in the system receives an initial key, in accordance with the initial key of the root node receives the key protection key of the radio interface between the node and another node that is directly adjacent to the said node, and in accordance with the root key node receives the security key of the air interface between the node and said another node that is directly adjacent to the said site so that you can properly secure data UE link interface Un,that is, each active UE has a set of security settings on the communication line interface Un and effective security is regarding the data in each segment of the radio interface.

[0145] Fig.7 is a block diagram of the operational sequence of the method for obtaining a security key in a relay system according to the seventh embodiment of the present invention. In this embodiment, RN at each level performs authentication with the top-level node RN and generates a security key of each segment of the radio interface. As shown in Fig.7:

[0146] Step 701: RN1 accesses the network, and authentication is performed with eNB.

[0147] Step 702: In accordance with the root key K_{AUT_RN1}that is generated in the authentication process between the RN1 and the eNB, RN1 and the eNB respectively receive the keys that are used for protecting UP data and CP data interface between the RN1 and the eNB, the method of obtaining the same way to obtain the K_ASin the LTE system and the input key is the K_RN1.

[0148] Step 703: RN2 accesses the network, and authentication is performed RN1.

[0149] Step 704: In accordance with the root key K_{AUT_RN2}that is generated in the authentication process between the RN1 and RN2, RN1 and RN2, respectively, receive the keys that are used for protecting UP data and CP data interface between the RN1 and RN2, the method of obtaining references the formula to obtain the K_ASand the input key is the K_RN2.

[0150] In this embodiment, the first relay node receives the root CL is h during the authentication procedure with the neighboring node to the first relay node and according to the root key of the first relay node receives the protection key of the radio interface for complete protection between the first relay node and the neighboring node, where the border node to the first relay node includes the top-level node to the first relay node and/or the bottom node to the first relay node, so that you can properly protect the data in each node, that is, each active UE has a set of security settings on the communication line interface Un and effective security is relative to the data in each segment of the radio interface.

[0151] This variant implementation of the present invention can also be used in conjunction with options 1, 2 and 3 implementation, the method in accordance with the seventh embodiment is used to protect the unidirectional channel, which is related to RN on the Un interface, and options 1, 2 and 3 of the implementation are used to protect the unidirectional channel, which is related to the UE on the Un interface.

[0152] Fig - block diagram of the operational sequence of the method for obtaining a security key in a relay system in accordance with the eighth embodiment of the present invention. In this embodiment, RN at each level performs authentication with eNB, to generate the security key of the radio interface of each segment. As shown in Fig:

[0153] the tap 801: RN1 accesses the network, and authentication is performed with eNB.

[0154] Step 802: In accordance with the root key K_RN1that is generated in the authentication process between the eNB and the RN1, eNB and the RN1 respectively receive the keys that are used for protecting UP data and CP data interface between the eNB and the RN1.

[0155] Step 803: RN2 accesses the network, and authentication is performed with eNB.

[0156] Step 804: eNB and RN2, respectively, generate the initial key K_RN2RN2 in the authentication process, and eNB forwards to RN1 initial key K_RN2. RN1 and RN2, respectively, obtain the root key K_RN2' between the RN1 and the RN2 according to K_RN2in accordance with K_RN2' get the keys that are used for protecting UP data and CP data interface between the RN1 and RN2.

[0157] In this embodiment, the first relay node obtains a root key in the authentication process with the neighboring node to the first relay node, and according to the root key of the first relay node receives the protection key of the radio interface for performing protection between the first relay node and the neighboring node, where the border node to the first relay node includes the top-level node to the first relay node and/or the bottom node to the first relay node, so that you can properly protect the data in each node, t is is, each active UE has a set of security settings on the communication line interface Un and effective security is relative to the data in each segment of the radio interface.

[0158] This variant implementation of the present invention can also be used in conjunction with options 1, 2 and 3 implementation, the method in accordance with the eighth embodiment is used to protect the unidirectional channel, which is related to RN on the Un interface, and options 1, 2 and 3 of the implementation are used to protect the unidirectional channel, which is related to the UE on the Un interface, so that you can properly protect the data UE link interface Un, that is, each active UE has a set of security settings on the communication line interface Un and effective security is regarding the data in each segment of the radio interface.

[0159] Fig.9 is a block diagram of the operational sequence of the method for obtaining a security key in a relay system according to the ninth embodiment of the present invention.

[0160] Step 901: the First relay node obtains a root key in the authentication process with the neighboring node to the first relay node.

[0161] Step 902: according To the root key of the first relay node receives the protection key of the radio interface for performing protection between the first relay node and the adjacent node.

[0162] the Border node to the first relay node including the et in the top-level node to the first relay node and/or the bottom node to the first relay node.

[0163] In this embodiment of the present invention, the relay node in the system receives an initial key, in accordance with the initial key of the root node receives the key protection key of the radio interface between the node and another node that is directly adjacent to the node, and in accordance with the root key node receives the security key of the air interface between the node and said another node that is directly adjacent to the site, so that you can properly secure data UE link interface Un, that is, each active UE has a set of security settings on the communication line interface Un and effective security is relative to the data in each segment of the radio interface.

[0164] Figure 10 is a schematic structural diagram of a node in the relay system according to the embodiment of the present invention, which includes:

module 1001 receiving configured to receive a seed node in the relay system;

the first module 1002 obtain, in accordance with the initial key received by the module receiving, configured to obtain the root key protection key of the radio interface between the node and another node that is directly adjacent to the site;

the second module 1003 get that in with the accordance with the root key, received by the first module receiving configured to receive a security key of the air interface between the node and said another node that is directly adjacent to the node.

[0165] the Module receiving specifically configured to: when the node in the relay system is eNB, get primary key from the object MME mobility management.

[0166] the Module receiving specifically configured to: when the node in the relay system, the relay node RN, get primary key from the MME or eNB.

[0167] the Module receiving specifically configured to: when the node in the relay system is a user equipment UE, receive a primary key from the top-level node for the UE.

[0168] in Addition, the device additionally includes:

Module additional configured to: when the node in the relay system is eNB, get primary key from the bottom node to the eNB in accordance with the input transmission parameter and an initial key, which is obtained by a module to retrieve.

[0169] the Module 1004 configured to send: sends the initial key to one of the nodes of the lower level node, and send the input parameter passed to the host, which directly borders with one of the nodes of the lower level of the node according to the input pair is the ETP transmission and primary key one of the nodes of the lower level node and the node, which directly borders with one of the nodes of the lower level node that has received root key protection key of the radio interface between one of the nodes of the lower level of the node and the node that is directly connected with one of the nodes of the lower level node.

[0170] in Addition, when the node in the relay system, the relay node RN, the device additionally includes:

Module 1005 is configured to receive: RN takes the input parameter, the transmission from the top-level node.

[0171] the First module receiving additionally configured to: RN in accordance with the initial key and the input transmission parameter obtains the root key protection key of the radio interface between the node and the node that is directly adjacent to the node.

[0172] in Addition, when the node in the relay system is a user equipment UE, the device additionally includes:

The receiving module is additionally configured to: when the node in the relay system is a user equipment UE, accept input parameter transfer from the top-level node.

[0173] the First module receiving additionally configured to: UE in accordance with the initial key and the input transmission parameter obtains the root key protection key of the radio interface between the node and the node which directly the state is bordered by the node.

[0174] In this embodiment of the present invention, the relay node in the system receives an initial key, in accordance with the initial key of the root node receives the key protection key of the radio interface between the node and said another node that is directly adjacent to the node, and in accordance with the root key node receives the security key of the air interface between the node and said another node that is directly adjacent to the site, so that you can properly protect the data UE link interface Un, that is, each active UE has a set of security settings on the communication line interface Un and effective security is relatively data in each segment of the radio interface.

[0175] 11 - schematic structural diagram of a relay node in accordance with the embodiment of the present invention, which includes:

The first module 1101 receive configured: the first relay node obtains a root key in the process, in which the first relay node authenticates the border node of the first relay node.

The second module 1102 receive configured: the first relay node receives in accordance with the root key, which is received by the first module receiving the key protection is s radio interface for performing protection between the first relay node and the adjacent node.

[0176] the Border node to the first relay node includes the top-level node to the first relay node and/or the bottom node to the first relay node.

[0177] In this embodiment of the present invention, the relay node in the system receives an initial key, in accordance with the initial key of the root node receives the key protection key of the radio interface between the node and another node that is directly adjacent to the node, and in accordance with the root key node receives the security key of the air interface between the node and said another node that is directly adjacent to the site, so that you can properly secure data UE link interface Un, that is, each active UE has a set of security settings on the communication line interface Un and effective security is relative to the data in each segment of the radio interface.

[0178] around the previous description of each alternative implementation specialists in the art can clearly understand that the present invention may be implemented using software on a necessary universal hardware platform, and definitely may be performed using hardware, but in many cases is the first preference is sustained fashion by the implementation. Therefore, based on this understanding, the technical solutions of the present invention or the part contributing to the prior art may be embodied in the form of a software product. The computer program product can be stored on the storage medium, which includes several instructions to specify the computing hardware (may be a personal computer, server, or network equipment) to perform the method in each embodiment of the present invention.

[0179] Although the present invention is illustrated and described with reference to some exemplary embodiments of the present invention, specialists in the art should understand that various changes in form and content can be made without deviating from the scope of the present invention.

1. Method for obtaining a security key in a relay system, characterized in that it contains stages, which are:
generate (101) with the first node and the network-side primary key of the first node in accordance with the authentication process, so that the network side sends the initial key to the top-level node, which is directly connected to a first node, and the top-level node obtains the root key of the top-level node in accordance with the initial key and according to the root key of the top-level node receives the protection key of the radio interface for performing protection between the first node and the top-level node;
get (102) using the first node to the root key of the first node in accordance with the initial key;
according to the root key of the first node receive (103) using the first node to the protection key of the radio interface for performing protection between the first node and the top-level node;
additionally generate, using the first node and the network-side input parameter to the first node through authentication and optionally sent by the network-side input parameter to the top-level node, which is directly connected to a first node, so that the top-level node obtains the root key of the top-level node in accordance with the initial key and the input parameter and according to the root key of the top-level node receives the protection key of the radio interface for performing protection between the first node and the top-level node; and
you can get the first node of the root key of the first node in accordance with a primary key that contains:
receive in accordance with the initial key of the first node and the input parameter using the first node of the root key protection key of the radio interface for performing protection between the first node and the top-level node;
you can get in accordance with the initial key of the first node and the input parameter using the first node of the root key is the protection of the radio interface for performing protection between the first node and the top-level node, in particular, is implemented through the following formula:
To_{root key}=KDF(K_{primary key}f(input parameter)),
where K_{root key}is the root key protection key of the radio interface between the node and another node that is directly adjacent to the said node, KDF is a function to provide the key To a_{primary key}is the initial key and f is a function, and
the input parameter contains any of the following options:
option C-RNTI of the temporary identification information mentioned site, and option C-RNTI of the temporary identity information of another node that is directly adjacent to the said node;
parameter RRC MESSAGE COUNT count value in the message radio resource control (RRC) between the node and said another node that is directly adjacent to the said node;NONCE random values, which coordinated the said node with said another node that is directly adjacent to the node;
identification information PCI physical cell number and EARFCN-DL radio channel referred to another node that is directly adjacent to the said node; and
parameter Uplink NAS COUNT value of the account at the message layer without access service (NAS) uplink communication referred to another node, which is right near St the state is bordered by the said node.

2. Method for obtaining a security key in a relay system, comprising stages, which are:
receive a primary key using a node in the relay system;
in accordance with the initial key are using the site root key protection key of the radio interface between the node and another node that is directly adjacent to the node; and
in accordance with the root key obtained using the node key of the air interface between the node and said another node that is directly adjacent to the said node;
when the node in the relay system is eNB, receiving primary key using a node in the relay system includes:
obtaining using eNB primary key from the object MME mobility management; and
when the above-mentioned node in the relay system, the relay node RN, the primary key using the node in the relay system includes:
getting through RN of the initial key from the MME or eNB or receive using RN saved seed from RN;
you can get in accordance with the initial key using the host root key protection key of the radio interface between the node and said another node that is directly adjacent to the said node, in particular, is implemented by what redstem the following formula:
To_{root key}=KDF(K_{primary key}f(input parameter)),
where K_{root key}is the root key protection key of the radio interface between the node and said another node that is directly adjacent to the said node, KDF is a function to provide the key To a_{primary key}is the initial key and f is a function, and
the input parameter contains any of the following options:
option C-RNTI of the temporary identification information mentioned site, and option C-RNTI of the temporary identification information referred to another node that is directly adjacent to the node;
parameter RRC MESSAGE COUNT count value in the message radio resource control (RRC) between the node and said another node that is directly adjacent to the said node;
the random NONCE value, which coordinated the said node with said another node that is directly adjacent to the node;
identification information PCI physical cell number and EARFCN-DL radio channel referred to another node that is directly adjacent to the said node; and
parameter Uplink NAS COUNT value of the account at the message layer without access service (NAS) uplink communication referred to another node that is directly adjacent to the node.

3. The method according to P2, in which
when the node in the relay system is eNB, the method further comprises:
obtaining using eNB root key node of the lower level eNB in accordance with an input parameter and an initial key; and
sending using eNB initial key and an input parameter to the first node and the second node, so that in accordance with an input parameter and an initial key of the first node and the second node to obtain the root key protection key of the radio interface between the first node and the second node,
the first node is one of the nodes of the lower level eNB; and
the second node is a node that is directly adjacent to one of the nodes of the lower level eNB.

4. The method according to claim 2, in which, when the node in the relay system, the relay node RN, the method further comprises:
reception with RN input parameter sent by the top-level node, or getting through RN locally generated input parameter; and
receive in accordance with the initial key using the root key protection key of the radio interface between the node and said another node that is directly adjacent to the site, in particular, contains:
in accordance with the initial key and the input parameter retrieval using RN root key protection key of the radio interface between the node and said another node that is directly connected with the node.

5. The method according to claim 2, in which, when the node in the relay system is a user equipment UE, the method further comprises:
reception with UE input parameter sent by the top-level node; and
receive in accordance with the initial key using the root key protection key of the radio interface between the node and said another node that is directly adjacent to the site, in particular, contains:
in accordance with the initial key and the input parameter retrieval using UE root key protection key of the radio interface between the node and said another node that is directly bordered by the node.

6. The communication node in the relay system, characterized in that it contains:
module (1001) receiving configured to receive the initial key;
module (1002) is first obtained, configured to receive in accordance with the initial key that is derived from the module receiving, root key protection key of the radio interface between the communication node and another communication node, which is directly adjacent to the communication node; and
module (1003) of the second receiving configured to receive in accordance with the root key obtained by the first obtaining module, a protection key of the radio interface between the communication node and said another communication node, which is directly is directly bordered by the communication node;
this module (1003) second obtaining, in particular, is implemented through the following formula:
To_{root key}=KDF(K_{primary key}f(input parameter)),
where K_{root key}is the root key protection key of the radio interface between the communication node and another node communication, which directly borders with the said communication node, KDF is a function to provide the key To a_{primary key}is the initial key and f is a function, and
the input parameter contains any of the following options:
option C-RNTI of the temporary identification information of the above-mentioned communication node and the parameter C-RNTI of the temporary identification information referred to another communication node, which is directly adjacent to the said communication node;
parameter RRC MESSAGE COUNT count value in the message radio resource control (RRC) between the communication node and said another communication node, which is directly adjacent to the said communication node;
the NONCE a random value, which is coordinated by the mentioned communication with said another communication node, which is directly adjacent to the said communication node;
identification information PCI physical cell number and EARFCN-DL radio channel referred to another communication node, which is directly bordered mention the first communication node; and
parameter Uplink NAS COUNT value of the account at the message layer without access service (NAS) uplink communication referred to another communication node, which is directly adjacent to the said communication node.

7. The communication node according to claim 6, in which
module (1001) obtain, in particular, configured to: when the said communication node in the relay system is eNB, primary key from the object MME mobility management; or
module (1001) obtain, in particular, configured to: when the said communication node in the relay system, the relay node RN, the initial key from the MME or eNB; or
module (1001) obtain, in particular, configured to: when the said communication node in the relay system is a user equipment UE, obtaining a seed from the top-level node UE.

8. The communication node according to claim 6, in which:
module (1001) more configured to: when the said communication node in the relay system is eNB, primary key node of the lower level eNB in accordance with an input parameter and an initial key;
moreover, the device further comprises:
module (1004) send, configured to send the first node and the second node of the initial key and an input parameter, which are obtained by the module receiving, so h is about in accordance with an input parameter and an initial key, see the module receiving the first node and the second node to obtain the root key protection key of the radio interface between the first node and the second node, the first node is one of the nodes of the lower level of the eNB, and the second node is a node that is directly adjacent to one of the nodes of the lower level eNB.

9. The communication node according to claim 6, in which the device further comprises:
module (1005) receiving configured to receive an input parameter sent by the top-level node, when the said communication node in the relay system, the relay node RN,
when the module is first obtained additionally configured to receive in accordance with the initial key that is derived from the module receiving, and input parameter received by the receiving module, the root key protection key of the radio interface between the communication node and said another communication node, which is directly adjacent to the said communication node.

10. The communication node according to claim 6, in which the device further comprises:
module (1005) receiving, further configured to: when the communication node in the relay system is a user equipment UE, receiving an input parameter of the top-level node; and
module (1002) of the first additional configured to receive in accordance with the laws the AI with primary key, receive module receiving, and input parameter received by the receiving module, the root key protection key of the radio interface between the communication node and another node communication, which directly borders with the said communication node.

11. The communication node in the relay system, characterized in that it contains:
a module configured to generate the primary key of the first node in accordance with the authentication process;
module, configured to obtain the root key of the first node in accordance with the initial key; and
module, configured to obtain, according to the root key protection key of the radio interface for performing protection between the first node and the top-level node;
when the communication node in the relay system is eNB, the module configured to generate a primary key, configured to obtain the primary key of the object MME mobility management when the communication node in the relay system, the relay node RN, the module configured to generate a primary key, configured to obtain a seed from the MME or eNB or saved seed from RN;
in this module, configured to obtain the root key of the first node in accordance with the initial key, the company shall and, implemented through the following formula:
To_{root key}=KDF(K_{primary key}f(input parameter)),
where K_{root key}is the root key protection key of the radio interface between the communication node and said another node that is directly adjacent to the said communication node, KDF is a function to provide the key To a_{primary key}is the initial key and f is a function, and
the input parameter contains any of the following options:
option C-RNTI of the temporary identification information of the communication node and the parameter C-RNTI of the temporary identification information referred to another communication node, which is directly adjacent to the communication node;
parameter RRC MESSAGE COUNT count value in the message radio resource control (RRC) between the communication node and said another communication node, which is directly adjacent to the said communication node;
the NONCE a random value, which is coordinated by the mentioned communication with said another communication node, which is directly adjacent to the said communication node;
identification information PCI physical cell number and EARFCN-DL radio channel referred to another communication node, which is directly adjacent to the said communication node; and
parameter Uplink NAS COUNT value of the account at the message layer be the access service (NAS) uplink communication referred to another communication node, which directly borders with the said communication node.

12. Machine-readable media containing computer program code which when executed by the computing unit makes computing unit to execute steps of the method according to claim 1.