The present invention is a communication system, a base station, a control method, and a computer-readable medium.
BACKGROUND
[0002]
　Currently, as a radio communication scheme used between the communication terminal and the base station, LTE (Long Term Evolution) has become widespread it is stipulated specifications in 3GPP (3rd Generation Partnership Project). LTE is a wireless communication system used to implement the wireless communication of the high-speed and large capacity. Further, as the core network that accommodates a wireless network using LTE, the 3GPP, SAE (System Architecture Evolution) or EPC (Evolved Packet Core) or the like called a packet network it is defined.
[0003]
　Communication terminal, in order to utilize the communication service using LTE, are required to register with the core network. As a procedure for registering the communication terminal to the core network, Attach Procedure is defined in 3GPP. MME disposed within a core network (Mobility Management Entity) executes authentication processing of the communication terminal using the identification information of the communication terminal in Attach Procedure. The MME, in cooperation with the HSS (Home Subscriber Server) or the like which manages subscriber information and performs authentication processing of the communication terminal. As the identification information of the communication terminal, for example, IMEISV (International Mobile Equipment Identity) or IMSI (International Mobile Subscriber Identity) or the like is used.
[0004]
　In recent years, in 3GPP, IoT is Study (Internet of Things) service has been promoted. The IoT services, without user terminal to perform autonomously communication (hereinafter referred to as IoT terminal) is used numerous. Therefore, the service provider is to provide the IoT services using a number of IoT terminal, the mobile network operators, etc. are managed, it is desirable to efficiently accommodate many IoT terminal. Mobile network is a network that includes a wireless network and a core network.
[0005]
　In Annex B of Non-Patent Document 1, the configuration of the core network to which the network slicing is described. Network slicing, in order to accommodate more IoT terminal efficiently, a technique for dividing the core network for each service provided. Further, in Section 5.1, the divided each network (network slice system), it is described that customization and optimization is required.
[0006]
　System to which the network slicing, for example, also called NextGen (Next Generation) System. The radio network used in NextGen System may also be referred to as NG (Next Generation) RAN (Radio Access Network).
[0007]
　Further, in Annex J of the non-patent document 1, configuration for Dual connectivity using E-UTRA and (Evolved Universal Terrestrial Radio Access) and NR (New Radio) is disclosed. For example, NR is a device corresponding to a base station for use in E-UTRA subsequent next-generation wireless networks.
CITATION
Non-patent literature
[0008]
Non-Patent Document 1: 3GPP TR23.799 V1.0.2 (2016-9)
Non-Patent Document 2: 3GPP TR33.899 V0.5.0 (2016-10)
Summary of the Invention
Problems that the Invention is to Solve
[0009]
　When realizing the Dual connectivity by using the E-UTRA and NR, as in the case of using the two E-UTRA, it is necessary to realize a high degree of security. However, in the NextGen System including NR, various functions related to security processing is introduced, the security procedures that are currently defined in 3GPP, there is a problem that can not be directly applied to NextGen System. Specifically, in Non-Patent Document 2, ARPF (Authentication Credential Repository and Processing Function), AUSF (Authentication Server Function), SEAF (Security Anchor Function), and SCMF introducing (Security Context Management Function), etc. NextGen System There has been studied.
[0010]
　An object of the present invention, in implementing Dual connectivity using different communication methods, to provide a related communication system, a base station, control method, and a program capable of providing a high degree of security.
Means for Solving the Problems
[0011]
　Communication system according to a first aspect of the present invention is a communication terminal and a communication system comprising a second base station that communicates with the second communication method, for accessing the second base station and the communication terminal with information about the terminal capabilities, the communication terminal and a first base station communicating with a first communication scheme, the terminal capability and the second information and the communication terminal is given regarding a receiver for receiving the information about the access rights to the base station of, on the basis of the information and the information about the access rights for the terminal capability, sending a message requesting a connection to said communication terminal to said second base station comprising a transmitter which includes a first base station including, a.
[0012]
　The base station according to the second aspect of the present invention is a base station that communicates with the communication terminal and the first communication method, the second base by the communication terminal communicates with the second communication method a receiving unit for information and the communication terminal about the terminal capabilities for accessing to receive information about the access rights of the to the second base station given the station, based on information relating to the information and the access authority for the terminal capability Te, and a transmission unit for transmitting a message requesting a connection to said communication terminal to said second base station.
[0013]
　Control method according to a third aspect of the present invention is a communication terminal and a control method of a base station that communicates with the first communication method, first the communication terminal communicates with the second communication method receiving information about the access rights of the to the second base station information and the communication terminal is given regarding terminal capabilities for accessing the second base station, based on the information about the information and the access authority for the terminal capability Te, and transmits a message requesting a connection to said communication terminal to said second base station.
[0014]
　Program according to a fourth aspect of the present invention is a program to be executed by a computer that communicates with a communication terminal and the first communication scheme, a second of the communication terminal communicates with the second communication method base station information and the communication terminal about the terminal capabilities for accessing receives the information about the access rights of the to the second base station given the, on the basis of the information about the information and the access authority for the terminal capability to execute sending a message requesting a connection to said communication terminal to said second base station to the computer.
Effect of the invention
[0015]
　The present invention, in implementing Dual connectivity using different communication methods, it is possible to provide on advanced security communication system capable of providing a base station, control method, and a program.
BRIEF DESCRIPTION OF THE DRAWINGS
[0016]
FIG. 1 is a configuration diagram of a communication system in the first embodiment.
FIG. 2 is a configuration diagram of a communication system according to the second embodiment.
3 is a configuration diagram of a communication system to the second embodiment.
4 is a diagram illustrating a security key to be applied to the user data to be transmitted via the NR in accordance with the second embodiment.
5 is a diagram showing the hierarchical structure of security keys according to the second embodiment.
6 is a diagram illustrating the Initial the attach procedure according to the second embodiment.
7 is a diagram illustrating a Dual connectivity procedure according to the second embodiment.
8 is a diagram illustrating a Dual connectivity procedure according to the second embodiment.
9 is a diagram illustrating a Dual connectivity procedure according to the second embodiment.
10 is a diagram for explaining such a Dual connectivity procedure in the second embodiment.
11 is a diagram illustrating a Dual connectivity procedure according to the third embodiment.
12 is a diagram for explaining a Dual connectivity procedure according to the third embodiment.
13 is a diagram illustrating a Dual connectivity procedure according to the third embodiment.
14 is a diagram illustrating a Dual connectivity procedure according to the third embodiment.
15 is a diagram for explaining such a Dual connectivity procedure in the third embodiment.
16 is a diagram illustrating a format of UE network capability data according to the fourth embodiment.
17 is a diagram for explaining the information list stored in the MME and HSS according to the fourth embodiment.
18 is a diagram illustrating a format of UE security capability data according to the fourth embodiment.
19 is a diagram illustrating the format of Initial Context setup request message according to the fourth embodiment.
FIG. 20 is a diagram for explaining a Handover Resticrion List IE according to the fourth embodiment.
21 is a diagram illustrating a Dual connectivity procedure according to the fourth embodiment.
22 is a diagram illustrating a method of requesting the UE's capability data and NR Subscription according to the fourth embodiment.
23 is a diagram for explaining a method of requesting the UE's capability data and NR Subscription according to the fourth embodiment.
FIG. 24 is a diagram illustrating the derivation of the security keys according to the first to third embodiments.
[FIG 25 is a diagram for explaining the derivation of the security keys according to the first to third embodiments.
DESCRIPTION OF THE INVENTION
[0017]
　(Embodiment 1)
　Hereinafter, with reference to the drawings will be described embodiments of the present invention. A configuration example of a communication system according to the first embodiment will be described with reference to FIG. Communication system of FIG. 1 includes a base station 10, base station 20, and the communication terminal 30.
[0018]
　The base station 10, base station 20 and the communication terminal 30, may be a computer system that operates by the processor executing the program stored in the memory. The processor may, for example, a microprocessor may be a MPU (Micro Processing Unit), or CPU (Central Processing Unit). The memory may be a volatile memory or nonvolatile memory, it may be configured by a combination of volatile and nonvolatile memory. Processor executes one or more programs including instructions for performing the algorithm described with reference to subsequent figures the computer.
[0019]
　Communication terminal 30, a mobile phone terminal, a smartphone terminal, may be the IoT terminal and the like. Communication terminal 30 may have information about the terminal capabilities to access the base station 20 (UE NR capability). Terminal capabilities may include a capability related to security.
[0020]
　The base station 10 communicates with the communication terminal 30 using the first communication method. The first communication method, for example, may be a wireless communication system standards have been defined in 3GPP, may be a wireless communication system standards it has been defined in other standards bodies. Or, the first communication method may be a wireless LAN communication. The base station 10 is connected to the core network. Core network, the information about the access rights to the base station 20 to the communication terminal 30 is given, may be transmitted to the base station 10.
[0021]
　The base station 20 communicates with the communication terminal 30 by using the second communication method. The second communication method is a communication method different from the first communication method. The second communication method, for example, since E-UTRA or LTE standards have been defined in 3GPP (Long Term Evolution), or may be a next-generation communication scheme. The base station 20 may be a 5G (Generation) (NextGen (Next Generation) and may be referred to.) Of NR (New Radio). For example, the communication terminal 30 while continuing the communication with the base station 10, further, also communicates with the base station 20. Communication terminal 30, a communication method to communicate with substantially the same timing and the base station 10 and base station 20 may be referred to as a Dual connectivity.
[0022]
　The base station 10 receives the first message including the sent UE (User Equipment) capability from the communication terminal 30. For example, the base station 10 determines whether it is possible to communication terminal 30 communicates with base station 20 using a UE capability data. That is, the base station 10, communication terminal 30 determines whether it is possible to perform Dual connectivity with base station 20. The base station 10 transmits a second message comprising UE capability data, determined based on the UE capability data, and transmits the information about the security key used for communication between the communication terminal 30 and the base station 20 to the communication terminal 30 .
[0023]
　UE capabilities may be, for example, identification information indicating a communication scheme that the communication terminal 30 supports. UE capabilities may include identification information indicating at least one communication method. UE capabilities, the communication terminal 30 may include information about the terminal capabilities to access the base station 20. Terminal capabilities may include a capability related to security.
[0024]
　In the base station 10, when the communication terminal 30 is determined to be able to communicate with the base station 20, base station 20, the base station 10 is different from the first security key used for communication with the communication terminal 30 communicating with the communication terminal 30 using the second security key. The second security key is derived based on the UE capabilities.
[0025]
　Security keys, for example, may be a key used for encryption and integrity protection of data transmitted between the base station 10 or the base station 20 and the communication terminal 30.
[0026]
　As described above, the communication system of FIG. 1, in the communication base station 10 and the communication terminal 30, the communication terminal 30 or perform the Dual connectivity with base station 20, determines based on the UE capabilities can. Furthermore, the base station 20 may be the base station 10 by using different security keys and security key used for communication with the communication terminal 30, it communicates with the communication terminal 30. In other words, the communication terminal 30, the communication between the base station 10 for communication between the first using security keys, the base station 20 can perform Dual connectivity using the second security key it can. As a result, the communication terminal 30 can perform Dual connectivity while ensuring security in communication with each base station.
[0027]
　(Second Embodiment)
　Subsequently, a configuration example of a communication system according to the second embodiment will be described with reference to FIG. Communication system of FIG. 2 includes a UE31, eNB (Evolved Packet Core) 12, NR21, and EPC40. UE31 in Figure 2 corresponds to the communication terminal 30 of FIG. 1. eNB (evolved Node B) 12 corresponds to the base station 10 of FIG. NR21 corresponds to the base station 20 of FIG. UE31 is a general term for a communication terminal used in 3GPP. eNB12 is a base station that supports LTE as a wireless communication scheme. NR21 corresponds to a base station that supports wireless communication systems since LTE. Base station supporting the LTE subsequent wireless communication system, for example, a 5G of NR, may be GNB22.
[0028]
　2, UE31 have shown that performing Dual connectivity between the eNB12 and NR21. Reference point between UE31 and eNB12 are defined as LTE Uu in 3GPP. Reference point may be referred to as interfaces.
[0029]
　Further, in FIG. 2, when the UE31 performs Dual connectivity, eNB 12 determines whether to add NR21. In other words, eNB 12 is in the middle of performing a communication with UE31, in order to realize the Dual connectivity related UE31, determines whether to add NR21 as second connection destination of UE31.
[0030]
　eNB12, to make a determination of whether to add NR21, communicates with node devices constituting the EPC40. That, eNB 12 is connected to a core network EPC40. Node device constituting the EPC40 may be, for example, a MME which is stipulated in 3GPP (Mobility Management Entity). UE31, in between the MME constituting the EPC40, executes the NAS (Non Access Stratum) Signalling. NAS Signaling is a control message transmitted between the UE31 and MME. Reference point used to transmit control messages between the eNB12 and EPC40, in 3GPP, is defined as S1-MME.
[0031]
　Further, eNB 12 is configured to transmit the user data transmitted via the LTE Uu reference point (U (User) Plane data) to EPC40 from UE31, it transmits the user data transmitted from the UE31 via the NR21 to EPC40 . Further, eNB 12 is adapted to transmit to the UE31 via the LTE Uu reference point to user data addressed to UE31 transmitted from EPC40, transmitted to UE31 through NR21. Node device for relaying user data in EPC40, for example, be a S-GW (Serving-Gateway). To transmit user data, the reference points used to transmit user data between the eNB12 and EPC40 is defined as S1-U in 3GPP.
[0032]
　Subsequently, with reference to FIG. 3, illustrating an example of the configuration of a communication system different from the FIG. 3, as a reference point to be used for transmitting user data between the NR21 and EPC40, in that it is determined that S1-U, different from FIG. In FIG. 3, NR21 is a user data transmitted from UE31, and transmits to the EPC40 via the S1-U reference point which is defined between the EPC40. Further, EPC40 is the user data destined to UE31, transmits and distributes to the eNB12 and NR21. NR21 transmits the user data transmitted from EPC40 to UE31.
[0033]
　Next, the security key to be applied to the user data to be transmitted will be described through NR21 with reference to FIG. In FIG. 4, as NR21, it will be described with reference to GNB22. gNB22 corresponds to a base station used in the NR21.
[0034]
　4, between UE31 and eNB12, between eNB12 and the MME 41, between the MME 41 and S-GW 42, and the dotted line shown between eNB12 and gNB22 a control message (C (Control) - Plane data) indicates that it is transmitted. Further, between UE31 and eNB12, between UE31 and GNB22, between the eNB12 and S-GW 42, the solid lines shown between the GNB22 and S-GW 42, user data (U-Plane data) It indicates that it is transmitted.
[0035]
　Also, if the GNB22 is used as the security anchor (security anchor), the user data to be transmitted between the UE31 and GNB22, security key K AN is used. Further, if the S-GW 42 is used as a security anchor, the user data to be transmitted between the UE31 and S-GW 42, the security key K UP is used. Security anchor, for example, a security key that is not transmitted in the radio section, it may be a node device for deriving a security key used for encryption or integrity protection of data transmitted in the radio section.
[0036]
　Subsequently, with reference to FIG. 5, it will be described hierarchical structure of security keys used in the communication system including the structure shown in FIG. 2 or FIG. 3.
[0037]
　USIM (Universal Subscriber identification Module) may be a module for storing subscriber information related to UE31. AuC (Authentication Center) is located in the core network, a node device that performs processing related to security. USIM and AuC has a security key K, respectively.
[0038]
　USIM and the AuC, to derive the encryption key CK from the security key K (Cipher Key) and integrity assurance key IK (Integrity Key). The USIM, the encryption key CK and integrity assurance key IK and output to UE31, AuC transmits the encryption key CK and integrity assurance key IK to the HSS (Home Subscriber Server). HSS is a node device for managing subscriber information about the UE.
[0039]
　UE31 and HSS, the security key K from the encryption key CK and integrity assurance key IK ASME to derive. HSS, the security key K ASME to send to MME41. UE31 and MME41 the security key K ASME security from the key K NASenc , security key K NASint , security key K eNB / NH, and security key K UP generates a.
[0040]
　Security key K NASenc is used to encrypt the NAS messages transmitted between the UE31 and the MME 41. Security key K NASint is used integrity protection of the NAS messages transmitted between the UE31 and the MME 41.
[0041]
　MME41, the security key K ENB sends a / NH to eNB12, security key K UP to send to the S-GW42.
[0042]
　UE31 and eNB12, the security key K eNB / NH from the security key K UPint , security key K UPenc , security key K RRCint , and security key K RRCenc to derive. Security key K UPint is used to encrypt the user data. Security key K UPenc are used in integrity assurance of user data. Security key K RRCenc is used to encrypt the RRC (Radio Resource Control) message. Security key K RRCint are used in integrity assurance of the RRC message.
[0043]
　Security key K UPenc and security key K UPint , when S-GW 42 is used as a security anchor, may be derived in S-GW 42. In other words, if the S-GW 42 is used as a security anchor, S-GW 42 is, the security key K UP security key K from UPenc and security key K UPint may derive.
[0044]
　Security key K UPenc and security key K UPint , when GNB22 is used as a security anchor, may be derived in GNB22. In other words, if the GNB22 is used as a security anchor, GNB22 is, the security key K AN security key K from UPenc and security key K UPint may derive. eNB12, the security key K ENB security key K from / NH AN derives the security key K AN may transmit to gNB22.
[0045]
　Or, security key K AN , the security key K NG may be derived from. Security key K NG may be derived from the security key K. In addition, the security key K NG may be derived from the encryption key CK and integrity assurance key IK, security key K ASME may be derived from. Security key K NG is a security key that is used in the NextGen System.
[0046]
　In addition, the security key K UP , the security key K ENB may be derived from / NH. In addition, the security key K AN , the security key K ASME may be derived from.
[0047]
　The security key K used in the eNB 12 UPenc and security key K UPint the security key K used in GNB22 UPenc and security key K UPint different from. Furthermore, the security key K used in the eNB 12 UPenc and security key K UPint the security key K used in the S-GW 42 UPenc and security key K UPint different from. For example, the security key K used in the eNB 12 UPenc and security key K UPint the security key K used in gNB22 or S-GW 42 UPenc and security key K UPint is derived using parameters different from the parameters used in deriving it may be. Parameters are, for example, may be for identifying a network slice NS (Network Slice) ID, and the like.
[0048]
　Subsequently, Initial the attach procedure is described according to the second embodiment with reference to FIG. First, UE31 transmits the Attach request message containing the UE capabilities to the eNB 12 (S11). Further, Attach request message is used in GNB22, may include capacity for NR and security algorithms. Then, eNB 12 transmits an Attach request message including the UE capability data check request to the MME 41 (S12). Attach request message sent from the eNB12 to MME41 is used in GNB22, it may include capacity for NR and security algorithms.
[0049]
　Then, between the UE31 and MME41, AKA (Authentication and Key Agreement) & NAS security establishment is performed (S13). By AKA & NAS security establishment is performed, in UE31 and the MME 41, the security key is shared. Further, AKA & NAS security establishment, if already performed previously, may be omitted.
[0050]
　Next, the MME 41 performs a UE capabilities and NR subscription check (S14). For example, the MME 41, from the HSS or other network node, and acquires and holds the subscriber information relating to UE, by using the acquired subscriber information, may be performed UE capabilities and NR subscription check.
[0051]
　UE capabilities check and NR subscription check, for example, in UE31, may be to determine whether or not the permitted to utilize the communication system UE31 supports. For example, the MME 41, of the plurality of communication methods UE31 supports, it may be determined that the accepted use of part of the communication system. Specifically, the MME 41 determines whether UE31 are given access to NR, further, UE31 users may determine whether to register with the service that NR is provided.
[0052]
　Next, the MME 41 transmits an Attach response with UE capability check response to the eNB 12, eNB 12 transmits an Attach response with UE capability check response to UE31 (S15). Attach response with UE capability check response may include information indicating the communication scheme has been observed that the use in UE31. MME41 may send the Initial Context setup request message including the Attach response with UE capability check response to the eNB 12. Further, eNB 12 is to UE31, it may transmit the RRC connection reconfiguration message including the Attach response with UE capability check response.
[0053]
　Then, eNB 12 may, UE31 stores the information about the access rights to NR which has terminal capability (UE capabilities) and UE31 for accessing NR given to the memory, etc. (S16). UE capabilities that eNB12 stores to memory, for example, of one or more communication method transmitted from the UE31 in step S11, may be information including a portion of the communication system recognized available. Thus, in Initial Attach phase, the node (e.g., eNB 12) at a distance close to UE31, by storing information about the terminal capabilities access to (UE capabilities) and NR for accessing the NR, Security it can be further quickly execute the processing simpler.
[0054]
　The following describes Dual connectivity procedure with reference to FIG. First, UE31, eNB12, and in the MME 41, and the Initial the attach procedure described in FIG. 6 is executed (S21). Then, UE31 transmits a RRC connection establishment message to the eNB 12 (S22). RRC connection establishment message comprises a UE req.algo./KDF IDs and UE capability data. UE req.algo./KDF IDs are, UE31 requests is identification information KDF to algorithms and used used for encryption and integrity protection (Key Derivation Function). Identity algorithm, such as used for encryption and integrity protection UE31 requests may be paraphrased as identification information such as algorithm used for encryption and integrity protection UE31 specifies. UE req.algo./KDF IDs may include identification information of a plurality of algorithms and KDF. UE capability may be information indicating a communication scheme to be used for communication with the UE31 is GNB22.
[0055]
　Then, eNB 12 in order to determine the use of Dual connectivity with gNB22, UE31 confirms whether the given access to either or NR has terminal capability for accessing the NR. eNB12 determines UE capability transmitted from the UE31 is, whether included in the UE capabilities stored in step S16 in FIG. 6 (S23). That, eNB 12 determines whether before starting the security processing for selecting the appropriate security algorithms for GNB22, have the terminal capability for UE31 to access the NR. Furthermore, by checking whether the authorized for UE31 to access the NR, it can be avoided access to NR by the UE not authorized to access.
[0056]
　eNB12 is, UE capability data sent from the UE31 is, if it is determined to be included in the UE capabilities stored in step S16 in FIG. 6, the security key K AN deriving a (S24).
[0057]
　Then, eNB 12 transmits the GNb Addition, request message to gNB22 (S25). GNb Addition, request message, the security key K AN including the UE req.algo./KDF IDs and UE capability data. eNB12, based on the UE capability data, select gNB22 it capable of performing Dual Connectivity, may transmit the GNb Addition, request message to gNB22 selected.
[0058]
　Then, GNB22 from a plurality of algorithms and KDF, based on the UE capability data, to determine the algorithm and KDF used to communicate with the UE31 (S26). algorithms and KDF determined in GNB22 is different from the algorithm and KDF requested by UE31, eNB 12 may, K using an algorithm and KDF determined in GNB22 AN deriving a. In addition, gNB22 is, the derived K AN to send to gNB22. Then, GNB22 transmits the GNb Addition, response message to the eNB 12 (S27). GNb Addition, response message includes identification information of the determined algorithm and KDF the (decided.algo./KDF IDs).
[0059]
　Then, eNB 12 transmits an RRC connection reconfig request message to UE31 (S28). RRC connection reconfig request message includes identification information of GNb Addition, response algorithm included in the message and KDF. By thus KDF identification information (KDF ID) is sent to UE31, between the UE31 and eNB 12, without transmitting the security keys directly, UE31 and eNB 12, or, in such UE31 and the MME 41, the security it is possible to derive the key.
[0060]
　Then, UE31 transmits a RRC connection reconfig response message to the eNB 12 (S29). Then, eNB 12 is to GNB22, transmits the GNb Reconfiguration complete message (S30).
[0061]
　Further, UE31, at step S29, after transmitting the RRC connection reconfig response message, the security key K AN deriving a (S31). In addition, UE31 and gNB22, the security key K AN from, K UPint and K UPenc to derive. Then, UE31 and gNB22 performs encryption (encryption) and decoding (decryption) (activation) (S32 , S33).
[0062]
　Subsequently, with reference to FIG. 8, it will be described different Dual connectivity procedure and FIG. For Figure 8 will be mainly described contents different from FIG.
[0063]
　In step S42 in FIG. 8, UE31 is free of UE req.algo./KDF IDs, it sends the RRC connection establishment message comprising UE capability to the eNB 12. Further, eNB 12, at step S45, the UE req.algo./KDF IDs without transmitting the GNb Addition, request message containing the eNB req.algo./KDF IDs to GNB22. That is, in FIG. 8, eNB 12 to request or specify identification information of the KDF to algorithms and used used for encryption and integrity protection (Key Derivation Function) is included in the GNb Addition, request message.
[0064]
　Other processing will not be described in detail because it is similar to the process of FIG.
[0065]
　Subsequently, with reference to FIG. 9, a description will be given different Dual connectivity procedure and FIGS. For Figure 9, mainly explained contents different from FIGS.
[0066]
　Step S61 ~ S63 are omitted steps S41 ~ S43 and hence detailed similar description of FIG.
[0067]
　Then, eNB 12 does not include a UE req.algo./KDF IDs and eNB req.algo./KDF IDs, sends the GNb Addition, request message containing the UE capability to gNB22 (S64).
[0068]
　Then, GNB22 from a plurality of algorithms and KDF, based on the UE capability data, to determine the algorithm and KDF used to communicate with the UE31 (S65). Then, GNB22 transmits the GNb Addition, response message to the eNB 12 (S27). GNb Addition, response message includes identification information of the determined algorithm and KDF.
[0069]
　Then, eNB12, the security key K AN to derive the (S67). Then, eNB12 is, the derived security key K AN to send to gNB22 (S68). Step S69 ~ S74 is a detailed description thereof will be omitted because it is similar to that of steps S28 ~ S33 of FIG. 7.
[0070]
　Next, with reference to FIG. 10, a description will be given different Dual connectivity procedure and 7 to 9. For Figure 10, mainly explained contents different from FIGS. 7-9.
[0071]
　Step S81 ~ S83 are omitted steps S41 ~ S43 and hence detailed similar description of FIG.
[0072]
　Then, eNB 12 transmits the GNb Addition, request message to gNB22 (S84). GNb Addition, request messages, UE capability data and security keys K eNB including. Security key K eNB , the security key K derived in example the MME 41 eNB be, at any time before the step S84, the may be transmitted from the MME 41 to the eNB 12.
[0073]
　Then, GNB22 from a plurality of algorithms and KDF, based on the UE capability data, to determine the algorithm and KDF used to communicate with the UE31, further security key K eNB security key K from AN to derive (S85 ).
[0074]
　Step S86 ~ S92 is a detailed description thereof will be omitted because it is similar to that of steps S27 ~ S33 of FIG. 7.
[0075]
　As described above, by Dual connectivity procedure according to the second embodiment is executed, GNB22 added to perform Dual connectivity is, UE31 and security key K AN may share. Thus, UE31 is, when executing Dual connectivity, UE31 can perform communication by establishing respectively security status of eNB12 and GNB22.
[0076]
　(Third Embodiment)
　Subsequently, with reference to FIG. 11 will be described according Dual connectivity procedure in the third embodiment. In the third embodiment, the MME 41 that are located in the core network, security key K AN explaining a process of deriving.
[0077]
　First, UE31, eNB12, and in the MME 41, and the Initial the attach procedure described in FIG. 6 is executed (S101). Then, UE31 transmits a RRC connection establishment message to the eNB 12 (S102). RRC connection establishment message comprises a UE req.algo./KDF IDs and UE capability data.
[0078]
　Then, eNB 12 determines UE capability transmitted from the UE31 is, whether included in the UE capabilities stored in step S16 in FIG. 6 (S103).
[0079]
　Then, eNB 12 transmits the GNb Addition, request message to gNB22 (S104). GNb Addition, request message includes a UE req.algo./KDF IDs and UE capability data.
[0080]
　Then, GNB22 from a plurality of algorithms and KDF, based on the UE capability data, to determine the algorithm and KDF used to communicate with the UE31 (S105). Then, GNB22 transmits the GNb Addition, response message to the eNB 12 (S106). GNb Addition, response message includes identification information of the determined algorithm and KDF the (decided.algo./KDF IDs).
[0081]
　Then, eNB 12, the security key K AN to request derivation of, transmits a Key Canada request message to the MME 41 (S107). Key Canada request message, the security key K eNB including the identification information of the determined algorithm and KDF (decided.algo./KDF IDs), and the UE capability data. Next, the MME 41, as eNB12 is performed in step S103, UE capability data is included in the Key Canada request message, it determines whether included in the UE capabilities (S108). Note that the processing in step S108 may be omitted. MME41 is the UE capabilities, for example, may be obtained from HSS. Further, the MME 41 without performing the step S108, may proceed to the next step S109.
[0082]
　Next, the MME 41, the security key K included in the Key Canada request message eNB security key K from AN deriving a (S109). Here, the security key K AN is, the security key K ASME if derived from, eNB 12, at step S107, the security key K to Key Canada request message eNB may not include.
[0083]
　eNB12, after transmitting a Key Canada request message to UE31 in step S107, transmits the RRC connection reconfig request message to UE31 (S110). RRC connection reconfig request message includes identification information of GNb Addition, response algorithm included in the message and KDF.
[0084]
　Here, MME41, the security key K AN after deriving the security key K AN to send to eNB12 (S111). Then, eNB 12, the security key K received AN transmits the to gNB22 (S112). If direct communication between the MME 41 and GNB22 is possible, the MME 41 is directly security key K AN may transmit to the GNB22.
[0085]
　Step S113 ~ S117, the detailed description thereof is omitted because it is similar to that of steps S29 ~ S33 of FIG. 7.
[0086]
　The following describes different Dual connectivity procedure and 11 with reference to FIG. 12. For Figure 12, mainly explained contents different from FIG. 11.
[0087]
　In step S112 of FIG. 12, UE31 is free of UE req.algo./KDF IDs, it sends the RRC connection establishment message comprising UE capability to the eNB 12. Further, eNB 12, at step S114, the UE req.algo./KDF IDs without transmitting the GNb Addition, request message containing the eNB req.algo./KDF IDs to GNB22. That is, in FIG. 12, eNB 12 to request or specify identification information of the KDF to algorithms and used used for encryption and integrity protection (Key Derivation Function) is included in the GNb Addition, request message.
[0088]
　Other processing will not be described in detail because it is similar to the process of FIG. 11.
[0089]
　The following describes different Dual connectivity procedure and 11 and 12 with reference to FIG. 13. For Figure 13, mainly explained contents different from FIGS.
[0090]
　Step S131 ~ S133, the detailed description thereof is omitted because it is similar to that of steps S 111 ~ S113 in FIG. 12.
[0091]
　Then, eNB 12 does not include a UE req.algo./KDF IDs and eNB req.algo./KDF IDs, sends the GNb Addition, request message containing the UE capability to gNB22 (S134).
[0092]
　Then, GNB22 from a plurality of algorithms and KDF, based on the UE capability data, to determine the algorithm and KDF used to communicate with the UE31 (S135). Then, GNB22 transmits the GNb Addition, response message to the eNB 12 (S136). GNb Addition, response message includes identification information of the determined algorithm and KDF. Step S137 ~ S147, the detailed description thereof is omitted because it is similar to that of steps S117 ~ S127 in FIG. 12.
[0093]
　The following describes different Dual connectivity procedure and 11 to 13 with reference to FIG. 14. For Figure 14, mainly explained contents different from FIGS. 11 to 13.
[0094]
　Step S151 ~ S153, the detailed description thereof is omitted because it is similar to that of steps S 111 ~ S113 in FIG. 12.
[0095]
　Then, eNB 12 transmits the GNb Addition, request message to the MME 41 (S154). GNb Addition, request message, the security key K eNB including and UE capability data.
[0096]
　Step S155 is a detailed description thereof will be omitted since it is similar to step S108 of FIG. 11. Next, the MME 41, from a plurality of algorithms and KDF, based on the UE capability data, to determine the algorithm and KDF used to communicate with the UE31. Further, the MME 41, the security key K included in the Key Canada request message eNB security key K from AN deriving a (S156). Here, the security key K AN is, the security key K ASME if derived from, eNB 12, at step S154, the security key K to Key Canada request message eNB may not include.
[0097]
　Next, the MME 41, the security key K AN transmits identification information of the determined algorithm and KDF the (decided.algo./KDF IDs) to eNB 12 (S157). Then, eNB12, the security key K AN to send to gNB22 (S158).
[0098]
　Then, eNB 12 transmits an RRC connection reconfig request message to UE31. RRC connection reconfi request message includes the determined algorithm and KDF identification information (decided.algo./KDF IDs). Step S160 ~ S164, the detailed description thereof is omitted because it is similar to that of steps S113 ~ S117 in FIG.
[0099]
　Subsequently, with reference to FIG. 15, S-GW 42 is explained Dual connectivity procedure when used as a security anchor. In Figure 15, S-GW 42, which is disposed in the core network, security key K UP explaining a process of deriving.
[0100]
　Step S171 ~ S174 is omitted steps S101 ~ S104 and hence detailed similar description of Figure 11.
[0101]
　Then, GNB22 is, UE req.algo./KDF IDs identifying information and UE capability received from eNB 12, further, K ASME sends a to the S-GW42 (S175). K ASME may be transmitted from MME41 to S-GW 42.
[0102]
　Next, S-GW 42 from a plurality of algorithms, based on the UE capability data, to determine the algorithm and KDF used to communicate with the UE31 (S176). Furthermore, in step S176, S-GW42, the security key K ASME security key K from UP to derive.
[0103]
　Next, S-GW 42, the identification information of the determined algorithm and KDF the (decided.algo./KDF IDs) transmitted to the MME 41 (S177). Further, the MME 41 the identification information of the determined algorithm and KDF, and transmits to the gNB22 and eNB12 (S178, S179).
[0104]
　Step S180 ~ S185, the detailed description thereof is omitted because it is similar to that of steps S110 and 113-117 in FIG. 11. In the step S117 of FIG. 11, GNB22 it is performing encryption and integrity protection, at step S185 of FIG. 15, S-GW 42 performs the encryption and integrity protection (activation) ( S32, S33).
[0105]
　As described above, by Dual connectivity procedure according to the third embodiment is executed, GNB22 added to perform Dual connectivity, the security key K generated in the MME 41 AN can obtain . Thus, GNB22 is, UE31 and security key K AN may share. As a result, UE31, when executing Dual connectivity, UE31 can perform communication by establishing respectively security status of eNB12 and GNB22.
[0106]
　(Embodiment 4)
　Subsequently, with reference to FIG. 16, described the format of the UE network capability data according to the fourth embodiment. UE network capability data, in Initial the attach procedure, is included in the Attach request message sent from the UE31. UE network capability data includes, for example, algorithms for algorithms and integrity assurance of encryption used in the NR. In other words, a new algorithm for the NR is, for transmitting the algorithm Attach request, is added to the UE network capability IE. For example, algorithms for algorithms and integrity assurance of encryption is identified by a four-digit number and an algorithm name represented by a binary number. Specifically, the algorithm for encryption, "0000 2 ": NEA0, "0001 2 ": NEA1, "0010 2 ": NEA2, "0011 2 ": NEA3, and may be represented. Further, algorithms for integrity assurance, "0000 2 ": NIA0, "0001 2 ": NIA1, "0010 2 ": nia2, "0011 2 ": NIA3, and it may be represented.
[0107]
　Format shown in FIG. 16, for example, in Ocetet 9 and bit 3, information indicating whether UE31 has a NR (or NG-RAN) ability to access (NR capability data) is set. Moreover, the octet 10 and bit 1-8, shown is an algorithm (NEA0-NEA7) regarding encryption UE31 supports. Moreover, the octet 11 and bit 1-8, shown is an algorithm (NIA0-NIA7) regarding integrity assurance that UE31 supports. Algorithm for integrity assurance shown in algorithms and octet 11 regarding encryption shown in octet 10 is an algorithm used in the NR or 5GS (5G System). For example, when 1 is set for each bit, is UE31, indicates that it supports the algorithm associated with the bit, if 0 is set, the UE31, are associated with the bit indicating that it does not support the algorithm.
[0108]
　Subsequently, with reference to FIG. 17, described MME41 and information list stored in the HSS. Here, it will be described mainly subscriber information (Subscription information) relating NR capability data and NR stored in MME41 and HSS.
[0109]
　In 17, the MME 41 and the HSS as a subscriber information on NR capability data and NR, NR Subscription, UE NR Capability, Selected NR Security Algorithm, and shows that it retains the UE NR Security Algorithm Preference. In other words, NR subscription IE is added to MME41 and HSS stores the NR subscription IE.
[0110]
　NR Subscription is, UE31 users shows information about whether or not registered in the service with the access to the NR. UE NR Capability include security algorithms and key derivation function are supported in UE31 (key derivation functions). The Selected NR Security Algorithm indicates the selected NR security algorithm. UE NR Security Algorithm Preference shows Preference information on NR security algorithm and a key derivation function (key derivation functions).
[0111]
　UE NR Capability may be included in other Field stored in MME41 and HSS, for example, UE Radio Access Capability, UE Network Capability, or may be included in the MS Network Capability.
[0112]
　Furthermore, NR Subscription also may be included in other Field stored in MME41 and HSS, for example, it may be included in the Access Restriction or EPS Subscribed Charging Characteristics. If NR Subscription is included in the Access Restriction, added to indicate whether the UE31 is permitted to use NR, information indicating RATs (Radio Access Technologies), such as NR or NG-RAN within Access Restriction It is.
[0113]
　Subsequently, with reference to FIG. 18, described the format of the UE security capability data according to the fourth embodiment. UE security capability data, in Initial the attach procedure, is included in the Initial Context setup request message transmitted from the MME 41. Figure 18 is the octet 8 and bit 1-8, shown is an algorithm (NEA0-NEA7) regarding encryption UE31 supports. Moreover, the octet 9 and bit 1-8, shown is an algorithm (NIA0-NIA7) regarding integrity assurance that UE31 supports. Algorithm for integrity assurance shown in algorithms and octet 9 regarding encryption shown in octet 8 is the algorithm used in the NR or 5GS (5G System). In other words, a new algorithm for the NR is to send a new algorithm for the NR in Initial context setup request, is added to the UE security capability IE.
[0114]
　Subsequently, with reference to FIG. 19, described the format of the Initial Context setup request message according to the fourth embodiment. As shown in FIG. 19, the Initial Context setup request message includes a UE NR capabilities and NR subscription. Furthermore, NR Subscription is shown in FIG. 20, it may be included in the Handover Resticrion List IE. If NR Subscription is included in the Handover Resticrion List IE, to indicate whether UE31 is permitted to use NR, information indicating RATs (Radio Access Technologies), such as NR or NG-RAN is Handover Resticrion It is added to the List IE.
[0115]
　Next, the Dual connectivity procedure according to the fourth embodiment will be described with reference to FIG. 21. In the following description, eNB 12 operates as a Master eNB, also, GNB22 operates as Secondary GNb. First, UE31, between the eNB 12, establishing the RRC connection (RRC connection establishment) (S201).
[0116]
　Then, eNB 12, when not holding a UE's capability data and NR Subscription, requests the UE's capability data and NR Subscription (S202). Step S202 is, eNB 12 is implemented as Method 1 for requesting UE's capability data and NR Subscription to UE31, and Method 2 for requesting UE's capability data and NR Subscription to the MME 41, one of the. It will be described in detail later Method 1 and Method 2. UE's capability data, for example, may be a UE NR Capability.
[0117]
　Then, eNB 12 checks the UE NR capability data and NR subscription (S203). eNB12 may, UE31 is, has the ability to access the NR, further, when it is determined to have access to NR, the process proceeds to the next step. Otherwise, eNB 12, rather than GNB22, other eNB is available, executing the process of forming the eNB and Dual connectivity. Below, eNB 12 may, UE31 is, has the ability to access the NR, further processing will be described when it is determined to have access to NR.
[0118]
　Then, eNB 12, the security key K eNB from the security key S-K GNb deriving a (S204). Security key S-K GNb , in GNB22, used for integrity protection and ciphering (Integrity and Confidentiality protection). Security key S-K GNb , for example, the security key K in FIG. 5 AN corresponds to. Then, eNB 12 transmits the SgNB addition request message to the gNB22 (S205). SgNB addition request message, the security key S-K GNb, including UE NR Capability containing and security algorithms.
[0119]
　Then, GNB22, based on the UE NR Capability, determines the security algorithms used for integrity protection and encryption (S206). Then, eNB 12, the security key S-K GNb from derives the security key used for integrity protection and encryption. Security key eNB12 derives, for example, SRB (Signaling Radio Bearer) key in order to integrity protection and encryption related (e.g., K RRCint and K RRCenc ) and DRB (Data Radio Bearer) regarding integrity protection and encryption key in order to reduction (e.g., K UPint and K UPenc including).
[0120]
　Then, GNB22 transmits SgNB addition request Acknowledge message to the eNB 12 (S208). SgNB addition request Acknowledge message includes a security algorithm determined in GNB22.
[0121]
　Then, eNB 12 transmits an RRC connection reconfig request message to UE31 (S209). RRC connection reconfig request message includes a security algorithm determined in GNB22. Then, UE31 transmits a RRC connection reconfig response message to the eNB 12 (S210). Then, eNB 12 transmits the SgNB Reconfiguration complete message to gNB22 (S211). Thereafter, the UE31 and GNB22, executes encryption 及復-coding (activation) (S212, S213).
[0122]
　Subsequently, with reference to FIG. 22, described Method 1 in step S202 of FIG. 21. eNB12, in order to request the UE's capability (UE NR capability) to UE31, transmits a UECapabilityEnquiry message to UE31 (S221). Then, UE31 transmits a UECapabilityInformation message to eNB 12 (S222). The UECapabilityEnquiry message and UECapabilityInformation message, SecurityAlgorithmConfigIE are included. UE31 is, in SecurityAlgorithmConfigIE, UE's capability, to add a security algorithm in other words.
[0123]
　Subsequently, with reference to FIG. 23, described Method 2 in step S202 of FIG. 21. eNB12, in order to request the UE's capability (UE NR capability) to the MME 41, and transmits the UE Capability Request message to the MME 41 (S231). Next, the MME 41 transmits a UE Capability Response message to the eNB 12 (S232). eNB12 is, UE network capability, UE security capability, NR Subscriotion, UE NR Capability, Selected NR Security Algorithm, and, among the UE NR Security Algorithm Preference, to include IE related information necessary to obtain the UE Capability Request message . MME41 may include information that eNB12 requests the UE Capability Response message.
[0124]
　Here, with reference to FIGS. 24 and 25, the security key derivation will be described using the KDF in the first to third embodiments. KDF may, for example, derivation function such as HMAC-SHA-256 is used. Figure 24 is a security key K using the KDF AN indicates the derivation of. Specifically, the security key K as a parameter to the KDF eNB (K ASME ), SCG Counter, KDF ID, NR ID, Slice ID, enter the Session ID, the security key K AN obtained. Furthermore, the security key K as a parameter to the KDF AN , KDF ID, NR ID, Slice ID, enter the ID Session, K UPint , K UPenc obtained. NR ID is identification information indicating a communication scheme that can be utilized UE31. For example, NR ID is included in the UE capability data. Further, Slice ID, Session ID may also be included in the UE capability data.
[0125]
　FIG. 25 is a security key K using the KDF UP shows the derivation of. Specifically, the security key K as a parameter to the KDF eNB (K ASME ), SCG Counter, KDF ID, NR ID, Slice ID, enter the Session ID, the security key K UP obtained. Furthermore, the security key K as a parameter to the KDF UP , KDF ID, NR ID, Slice ID, enter the ID Session, K UPint , K UPenc obtained.
[0126]
　The above embodiment has been described as an example composed of hardware, but is not limited thereto. The present disclosure, the processing in the UE and each device can also be implemented by executing a computer program to CPU (Central Processing Unit).
[0127]
　In the above example, the program may be stored using a non-transitory computer readable media of various types (non-transitory computer readable medium), it can be supplied to the computer. Non-transitory computer readable media include with various types of entities (tangible storage medium). Examples of non-transitory computer readable media include magnetic storage media (such as floppy disks, magnetic tape, hard disk drive), magneto-optical recording medium (e.g. optical disk), CD-ROM (Read Only Memory), CD-R, CD-R / W, a semiconductor memory (e.g., a mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (Random Access memory)) includes a. The program may be provided to a computer using a temporary computer readable media of various types (transitory computer readable medium). Examples of transitory computer readable media include electric signals, optical signals, and electromagnetic waves. Transitory computer readable media, wired communication path such as electrical wires and optical fibers, or via a wireless communication path can provide the program to a computer.
[0128]
　The present invention is not limited to the above embodiments, but can be appropriately changed without departing from the spirit. The present disclosure may be implemented in combination in the form of respective embodiments as appropriate.
[0129]
　Although the present invention has been described with reference to the embodiments, the present invention is not limited by the foregoing. Configuration and details of the present invention, it is possible to make various modifications that those skilled in the art can understand within the scope of the invention.
[0130]
　This application claims priority based on Indian Application 201711014793, filed on Indian application 201611036776 and April 26, 2017, filed October 26, 2016, the entire disclosure of which is incorporated herein.
DESCRIPTION OF SYMBOLS
[0131]
　10 a base station
　12 is the eNB
　20 is a base station
　21 is NR
　22 is GNB
　30 communications terminal ends
　31 is the UE
　40 the EPC
　41 is the MME
　42 is S-GW

WE claims

A communication terminal and a communication system comprising a second base station that communicates with the second communication method,
　and the communication terminal with information on the terminal capability for accessing the second base station,
　the communication a first base station communicating with the terminal and the first communication method, receiving for receiving information about the access rights to the second base station information and the communication terminal is given regarding the terminal capabilities and parts, based on the information about the information and the access authority for the terminal capability, the first base station including a transmission unit for transmitting a message requesting a connection to said communication terminal to said second base station It comprises, when the communication system.
[Requested item 2]
　Further comprising a core network that transmits information about the access rights to the first base station, a communication system according to claim 1.
[Requested item 3]
　The second base station is the 5G of NR (New Radio), a communication system according to claim 1 or 2.
[Requested item 4]
　The terminal capability include the ability of security, the communication system according to any one of claims 1 to 3.
[Requested item 5]
　A base station for communicating with a communication terminal and the first communication scheme,
　the communication terminal information and the communication related to terminal capability for accessing the second base station communicate using the second communication scheme a receiver terminal receives the information about the access rights of the to the second base station given,
　on the basis of the information and the information about the access rights for the terminal capability, a message requesting a connection to said communication terminal base station and a transmission unit that transmits to the second base station.
[Requested item 6]
　The receiver receives the information about the access rights from a core network, a base station according to claim 5.
[Requested item 7]
　The second base station is the 5G of NR (New Radio), the base station according to claim 5 or 6.
[Requested item 8]
　The terminal capability include the ability of security, the base station according to any one of claims 5 to 7.
[Requested item 9]
　A communication terminal and a control method of a base station that communicates with the first communication method,
　information about the terminal capabilities for accessing the second base station that the communication terminal communicates with the second communication method and receiving the information about the access rights to the communication terminal is given a second base station,
　based on said information and information relating to the access rights for the terminal capability, a message requesting a connection to said communication terminal transmitting to said second base station, control method for a base station.
[Requested item 10]
　Information relating to the access rights is transmitted from the core network, a control method of a base station according to claim 9.
[Requested item 11]
　The second base station is the 5G of NR (New Radio), the control method of a base station according to claim 9 or 10.
[Requested item 12]
　The terminal capability includes the capability security, control method of a base station according to any one of claims 9 to 11.
[Requested item 13]
　A communication terminal and a non-transitory computer readable medium which stores a program to be executed by a computer that communicates with the first communication method,
　the communication terminal a second communicating using the second communication scheme receiving information about the access rights of the to the second base station information and the communication terminal about the terminal capabilities to access the base station is given,
　based on the information about the information and the access authority for the terminal capability, non-transitory computer readable medium having a program to be executed by a computer to send a message to the second base station is stored for requesting a connection to the communication terminal.