Method for implementing local routing of traffic, base station and system

Patent metadata

Field	Value
Publication number	US-9215221-B2
Application number	US-201113331803-A
Country	US
Kind code	B2
Filing date	Dec 20, 2011
Priority date	Dec 24, 2010
Publication date	Dec 15, 2015
Grant date	Dec 15, 2015

Abstract

Embodiments of the present invention provide a method for implementing local routing of traffic, a base station and a system are provided, which relate to the field of communications technologies. The method for implementing local routing of traffic includes: judging whether local routing processing is performed on an uplink traffic flow of a first terminal that serves as a sending end; if it is judged as yes, updating a key of the uplink traffic flow of the first terminal and/or a key of a downlink traffic flow of a second terminal that serves as a receiving end to a public key; forwarding an encrypted data packet of the uplink traffic flow of the first terminal to the second terminal through the downlink traffic flow of the second terminal, where an encryption and decryption operation is not performed on the encrypted data packet before the forwarding or during the forwarding.

First claim

What is claimed is:

1. A method for implementing local routing of traffic, comprising:
receiving, by a base station, at least one encrypted data packet in an uplink traffic flow of a first terminal that serves as a sending end;
afterwards, judging by the base station, whether local traffic routing processing is performed on the at least one encrypted data packet in the uplink traffic flow of the first terminal, wherein the local traffic routing comprising routing of the at least one encrypted data packet from the first terminal to a second terminal within a network through the same base station;
if it is judged as yes, updating by the same base station, a key of the uplink traffic flow of the first terminal and a key of a downlink traffic flow of the second terminal that serves as a receiving end to a public key; and
forwarding, by the same base station, the at least one encrypted data packet of the uplink traffic flow of the first terminal to the second terminal through the downlink traffic flow of the second terminal, wherein an encryption and decryption operation is not performed on the at least one encrypted data packet before the forwarding or during the forwarding.

2. The method for implementing local routing of traffic according to claim 1 , wherein the judging whether the local routing processing is performed on the uplink traffic flow of the first terminal that serves as the sending end comprises:
judging whether the local routing processing is performed on the uplink traffic flow when a first encrypted data packet of the uplink traffic flow of the first terminal that serves as the sending end is received; or
judging whether the local routing processing is performed on the uplink traffic flow when the uplink traffic flow of the first terminal that serves as the sending end is created.

3. The method for implementing local routing of traffic according to claim 1 , wherein the updating the key of the uplink traffic flow of the first terminal and/or the key of the downlink traffic flow of the second terminal that serves as the receiving end to the public key comprises:
judging whether an encryption and decryption algorithm adopted by the uplink traffic flow of the first terminal and the downlink traffic flow of the second terminal each is the same; and
if it is judged as yes, updating the key of the uplink traffic flow of the first terminal and the key of the downlink traffic flow of the second terminal to the public key.

4. The method for implementing local routing of traffic according to claim 1 , wherein the updating the key of the uplink traffic flow of the first terminal and/or the key of the downlink traffic flow of the second terminal that serves as the receiving end to the public key comprises:
judging whether an encryption and decryption algorithm adopted by the uplink traffic flow of the first terminal and the downlink traffic flow of the second terminal each is the same; and
if it is judged as no, updating an encryption and decryption algorithm of the uplink traffic flow of the first terminal and an encryption and decryption algorithm of the downlink traffic flow of the second terminal, so that the encryption and decryption algorithms adopted by the uplink traffic flow of the first terminal and the downlink traffic flow of the second terminal are the same, and updating the key of the uplink traffic flow of the first terminal and the key of the downlink traffic flow of the second terminal to the public key.

5. The method for implementing local routing of traffic according to claim 1 , wherein the forwarding of the at least one encrypted data packet of the uplink traffic flow of the first terminal to the second terminal through the downlink traffic flow of the second terminal, wherein the encryption and decryption operation is not performed on the at least one encrypted data packet before the forwarding or during the forwarding, comprises:
judging, according to a key identifier carried in the at least one encrypted data packet of the uplink traffic flow of the first terminal, whether a key adopted by the at least one encrypted data packet is the public key; and
if it is judged as yes, forwarding the at least one encrypted data packet to the second terminal through the downlink traffic flow of the second terminal, wherein the encryption and decryption operation is not performed before the forwarding or during the forwarding.

6. A base station, comprising:
a judging module, after receiving at least one encrypted data packet in an uplink traffic flow of a first terminal that serves as a sending end, the judging module is configured to judge whether local routing processing is performed on the at least one encrypted data packet in the uplink traffic flow of the first terminal, wherein the local routing comprises routing of the at least one encrypted data packet from the first terminal to a second terminal within a network through the same base station;
an updating module, configured to update a key of the uplink traffic flow of the first terminal and/or a key of a downlink traffic flow of the second terminal that serves as a receiving end to a public key when an output result of the judging module is yes; and
a forwarding module, configured to forward the at least one encrypted data packet of the uplink traffic flow of the first terminal to the second terminal through the downlink traffic flow of the second terminal after the updating module finishes updating the key, wherein an encryption and decryption operation is not performed on the at least one encrypted data packet before the forwarding or during the forwarding.

7. The base station according to claim 6 , wherein the judging module at least comprises one of the following modules:
a first judging module, configured to judge whether local routing processing is performed on the uplink traffic flow when a first encrypted data packet of the uplink traffic flow of the first terminal is received; and
a second judging module, configured to judge whether local routing processing is performed on the uplink traffic flow when the uplink traffic flow of the first terminal is created.

8. The base station according to claim 6 , wherein the updating module comprises:
an algorithm judging module, configured to judge whether an encryption and decryption algorithm adopted by the uplink traffic flow of the first terminal and the downlink traffic flow of the second terminal each is the same;
a first updating module, configured to update the key of the uplink traffic flow of the first terminal and the key of the downlink traffic flow of the second terminal to the public key when an output result of the algorithm judging module is yes; and
a second updating module, configured to update an encryption and decryption algorithm of the uplink traffic flow of the first terminal and an encryption and decryption algorithm of the downlink traffic flow of the second terminal when the output result of the algorithm judging module is no, so that the encryption and decryption algorithms adopted by the uplink traffic flow of the first terminal and the downlink traffic flow of the second terminal are the same, and update the key of the uplink traffic flow of the first terminal and the key of the downlink traffic flow of the second terminal to the public key.

9. The base station according to claim 8 , wherein the forwarding module comprises:
a key judging module, configured to judge, according to a key identifier carried in the at least one encrypted data packet of the uplink traffic flow of the first terminal, whether a key adopted by the at least one encrypted data packet is the public key; and
a processing module, configured to forward the at least one encrypted data packet to the second t

Assignees

• Pan Su
• Ding Zhiming
• Shu Guiming
• Zhang Zhiyong
• Chen Guoqiao
• Huawei Device Co Ltd

Inventors

• Pan Su
• Ding Zhiming
• Shu Guiming
• Zhang Zhiyong
• Chen Guoqiao

Classifications

• H04L63/06 Primary

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L63/0464

  using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04L2209/80

  Wireless · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title