WO2007033548A1 - A method and device for obtaining the security association information during the mobile terminal handoff procedure - Google Patents

Abstract

A method and device for the mobile terminal obtaining the security association (SA) information during the handoff procedure enable the target base station use the same SA list recording the SA information as that used by the original base station after the mobile terminal handoffs the base station. That is, during the mobile terminal handoff procedure, the target base station obtains the same SA list used between the mobile terminal and the original base station as the SA list used between the mobile terminal and the target base station. The implementation of the invention makes the same SA list used by the original base station could be used in the target base station after the mobile terminal handoffs the base station. During the mobile terminal handoff procedure, the target base station obtains the same SA list used between the mobile terminal and the original base station as the SA list used between the mobile terminal and the target base station, thus a feasible implementation for obtaining the SA list during the mobile terminal handoff procedure is provided.

Description

 Method and device for obtaining security alliance information in handover process of mobile terminal

Technical field

 The present invention relates to the field of communications technologies, and in particular, to a method and apparatus for obtaining security association information or a user plane communication encryption key during handover of a mobile terminal. BACKGROUND OF THE INVENTION In a mobile communication system, the mobility of a mobile terminal is such that it often switches from one base station to another. When the mobile terminal switches to another base station, in order to reduce the delay of communication between the mobile terminal and the new base station, new The base station needs to obtain security parameter information, including security association information, required by some mobile terminals to perform communication services on the original serving base station.

 In IEEE 802.16, the security association information, that is, the security association context information, the content in the SA (Security Association) context, especially the TEK (Traffic Encryption Key), is used as the MSS. (Mobile Subscriber Station, mobile terminal is also called mobile subscription station) and BS (Base Station, base station) user data and / or network management data encryption use.

 It should be noted that the SA is actually all the content contained in the context of the SA, and has SAID (Security Association Identity), SA Type (Security Association Type), SA Service Type (Security Alliance Service Type), Cryptographic. The contents of the parameters of the Suite (crypto tuple) and TEK (communication encryption key) pairs, the encryption tuple includes a data encryption algorithm and mode, a data authentication algorithm and mode, and a communication encryption key encryption algorithm and mode. The parameters of the TEK pair include: TEK, KEY-Lifetime (remaining life cycle of communication encryption key), Key- Sequence-Number (communication encryption key serial number), CBC-IV (communication encryption key in CBC) Initial vector in mode), PN (sent packet sequence number), RxPN (received packet number), Associated GKEK Sequence Number (multicast key encryption key sequence number under multicast).

In a WiMAX (Worldwide Interoperability Microwave Access) network, a security association such as an encryption key of a base station can be obtained by an Authenticator or an Access Network Gateway (ASN-GW). The authority or the access network gateway may be on a different physical network element than the BS. There may be multiple BSs under one authenticator or access network gateway, that is, the authenticator or the access network gateway does not communicate with the BS. Located on the same physical network element. For example, in the WiMAX network working group, as shown in Figure 1, the authenticator or the access network gateway and the BS are both in an ASN (Access Service Network), but may not be in the same On a physical network element. In the above case, the problem that needs to be faced is: After the MSS switches between different BSs, how to obtain the communication encryption key and encryption used for communication between the MSS and the target base station through the authenticator or the access network gateway. Security alliance information such as algorithms and patterns is a problem that needs to be solved. At present, there is no way to solve this problem. Summary of the invention

 An object of the present invention is to provide a method and apparatus for obtaining security association information in a mobile terminal handover process, so that the SA context list (ie, security association information) on the original BS can be taken over in the communication system. .

 The object of the invention is achieved by the following technical solutions:

 The present invention provides a method for obtaining security association information in a mobile terminal handover process, including: in a process in which a mobile terminal performs handover in a communication system, the target base station acquires the same security association information of the mobile terminal as the original base station as the target base station and the mobile terminal. Security alliance information.

 The security association information includes a security association, a negotiated encryption algorithm and mode, and/or a communication encryption key and parameter information.

 In the present invention, when the mobile terminal switches between the base station in the range of the same authenticator or the access network gateway in the communication system, the original base station has actively reported the SA message to the authenticator or the device. The access gateway, the method includes:

 The authenticator or the access network gateway directly delivers the security association information corresponding to the mobile terminal to the target base station; or

 The target base station requests the security association information of the mobile terminal from the authenticator or the access network gateway, and the authenticator or the access network gateway acquires the required security association information from the original base station, and then, according to the request, the security alliance. The information is sent to the target base station.

 The original base station reports the security association information of the mobile terminal to the authenticator or the access network gateway through the handover request/instruction information.

 In the present invention, when the mobile terminal switches between the base stations in the range to which the same authenticator or the access network gateway belongs, and the original base station passively reports the security association information to the authenticator or the access network gateway, Methods include:

A. The authenticator or the access network gateway requests the original base station for the security association information of the mobile terminal, and the original base station reports the security association information of the mobile terminal to the authenticator or the access network gateway according to the request;

B. The authenticator or the gateway gateway directly delivers the security association information of the mobile terminal to the target base station; or The Cs authenticator or the access network gateway requests the original base station for the security association information of the mobile terminal, and the original base station reports the security association information of the mobile terminal to the authenticator or the access network gateway according to the request;

 D. The target base station requests the security association information of the mobile terminal from the authenticator or the access network gateway, and the authenticator or the access network gateway sends the security association information to the target base station according to the request.

 In the present invention, when the mobile terminal switches between different authenticators in the communication system or the base stations in the range to which the access network belongs, the original base station has actively reported the SAS information to the original authenticator or the original service. Accessing the network gateway, the method includes:

 E. The target authenticator or the access network gateway requests the original authentication device or the original service access network gateway directly or through the network entity in the target network to request the mobile terminal security alliance information from the original authenticator or the access network gateway. The original authenticator or the original service access network gateway reports the mobile terminal security association information to the target authenticator or the access network gateway;

 F. The target authenticator or the access network gateway directly delivers the security association information corresponding to the mobile terminal to the target base station; or

 G. The target authenticator or the access network gateway requests the original authentication device or the access network gateway directly or through the network entity in the target network to request the mobile terminal security association information from the original authenticator or the access network gateway. The right device or the original service access network gateway reports the mobile terminal security association information to the target authenticator or the access network gateway;

 H. The target base station requests the security association information of the mobile terminal from the target authenticator or the access network gateway, and the target authenticator or the access network gateway sends the security association information to the target base station according to the request.

 In the present invention, when the mobile terminal switches between different authenticators or base stations within the range to which the access network belongs in the communication system, and the original base station passively reports the security association information to the original authenticator or the original service access network gateway. , the method includes -

I. The target authenticator or the access network gateway requests the mobile terminal security alliance from the original authenticator or the original service access network gateway directly or after the network entity in the target network identifies the original authenticator or the original service access network gateway. information;

J, the original authenticator or the original service access network gateway requests the original base station for the security association information of the mobile terminal; the original base station reports the security association information of the mobile terminal to the original authenticator or the original service access network gateway according to the request;

 κ, the original authenticator or the original service access network gateway reports the mobile terminal security association information to the target authenticator or the access network gateway;

 L. The target authenticator or the access network gateway directly delivers the security association information corresponding to the mobile terminal to the target base station; or

M. The target authenticator or the access network gateway requests the mobile terminal security alliance from the original authenticator or the original service access network gateway directly or after the network entity in the target network identifies the original authenticator or the original service access network gateway. information; N, the original authenticator or the original service access network gateway requests the original base station for the security association information of the mobile terminal; the original base station reports the security association information of the mobile terminal to the original authenticator or the original service access network gateway according to the request;

 0. The original authenticator or the original service access network gateway reports the mobile terminal security association information to the target authenticator or the access network gateway;

 P. The target base station requests the security association information of the mobile terminal from the target authenticator or the access network gateway, and the target authenticator or the access network gateway sends the security association information to the target base station according to the request.

 The method of the present invention further includes:

 The target base station obtains the security association information from the handover preparation/confirmation message, or initiates a request for acquiring the security association information of the mobile terminal, triggered by the transmitted parameter and the power adjustment request message sent by the terminal.

 The mobile communication system includes a microwave access global interworking Wimax system, and the security association information in the system includes: a security association identifier, a security association type, a security association service type, an encryption tuple, and/or a communication encryption. Key pair information, the encryption tuple includes a data encryption algorithm and a mode, a data authentication algorithm and a mode and/or a communication encryption key encryption algorithm and a mode, and the communication encryption key pair information includes a communication encryption key, Remaining lifetime of the communication encryption key, communication encryption key serial number, communication encryption key, initial vector of the communication encryption key in CBC mode, packet sequence number, received packet number, and/or under multicast Multicast key encryption key serial number.

 The present invention also provides an apparatus for obtaining security association information in a handover process of a mobile terminal that implements the foregoing method, including:

 a security association list sending module, configured to provide a security association list to the target base station;

 The security association information obtaining module: acquiring the security association information of the mobile terminal of the original base station;

 The security association information transmission module transmits the security association information of the mobile terminal acquired by the security association information obtaining module to the target base station.

 The security association list sending module is configured on the original serving base station, and the security association information obtaining module is disposed on the target base station, and/or the authenticator or the access network gateway, and the security alliance information transmission module It is located on the authenticator or access network gateway. .

 The authenticator or the access network gateway includes a primary authenticator or an original serving access network gateway to which the original base station of the mobile terminal belongs and/or a target authenticator or an access network gateway to which the target base station belongs.

As can be seen from the technical solution provided by the present invention, the present invention provides a method for obtaining security association information during handover of a mobile terminal, so that after the mobile terminal switches the base station, the target base station can still use the same security as the original base station. Alliance list. That is, during the handover process of the mobile terminal, the target base station acquires the mobile terminal and the primordial base. The same security association list is used as a security association between the target base station and the mobile terminal, and a corresponding implementation process is provided. Therefore, the present invention provides a feasible implementation solution for the acquisition of the security association in the handover process of the mobile terminal. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a schematic diagram showing the structure of a Wimax system networking;

 Figure 2 is a flow chart 1 of the method of the present invention;

 Figure 3 is a flow chart 2 of the method of the present invention;

 Figure 4 is a flow chart 3 of the method of the present invention;

 Figure 5 is a flow chart 4 of the method of the present invention;

 Figure 6 is a schematic view showing the structure of the apparatus of the present invention. Mode for Carrying Out the Invention At the core of the present invention is a method for obtaining a security association in a mobile terminal handover process, so that after the mobile terminal switches the base station, the target base station still uses the same security association as the original base station. That is, during the handover of the mobile terminal, the target base station acquires the same security association as the original base station of the mobile terminal as a security association between the target base station and the mobile terminal. The security associations described herein include the security association information and/or communication encryption keys mentioned above.

 The process of the mobile terminal switching the base station in the communication system generally includes the following two main situations: 1. The mobile terminal switches between the same authenticator or the BS within the range to which the access network belongs in the communication system; 2. The mobile terminal Switching between different authenticators or BSs within the range to which the access network belongs in the communication system. When the authenticator or the access network gateway obtains the security association of the mobile terminal on the original base station, there are two main implementation forms: 1. The original base station actively reports the security association of the mobile terminal to the authenticator or the access network. The gateway sends the security association of the mobile terminal to the authenticator or the access gateway after receiving the request message from the authenticator or the access network gateway.

In the present invention, the access network gateway includes but is not limited to the original service access network gateway, the target access network gateway, the access network gateway where the authenticator is located, and/or the access network gateway where the foreign agent is located. , and many more. According to the above situation, there are four combinations, and the following is a detailed description of the four specific embodiments in conjunction with the switching request and the conventional processing after the switching. Embodiment 1 As shown in FIG. 2, when the mobile terminal performs the handover between the same authenticator or the BS in the range to which the access network belongs in the communication system, the original base station has actively reported the security association to the corresponding authentication. The method of the present invention includes the following steps when accessing the network gateway:

 Step 21: The mobile terminal sends a handover request/instruction message to the original base station. ·

 Step 22: The original base station sends a handover request/indication message to the authenticator or the access network gateway, where the message includes a mobile terminal identity (MSS), a target base station identifier (T-BSID), and all related to the mobile terminal. A list of security associations, including the security association information of the mobile terminal, by which the security association in the base station can be reported to the authenticator or the access network gateway.

 Step 23: Perform an exchange preparation message exchange between the authenticator or the access network gateway and the target base station, so as to prepare for some handover.

 Step 24: After the handover preparation is completed, the authenticator or the access network gateway needs to reply a response message to the serving base station (ie, the original base station).

 Step 25: After the handover preparation is completed, the target base station needs to send a message requesting the mobile terminal security association to the authenticator or the access network gateway, where the message needs to include the identifier of the mobile terminal (ie, MSSID).

 This step is not required in the implementation process of the present invention. Specifically, the security base station information of the mobile terminal may be sent after the target base station requests the authenticator or the access network gateway, or may be connected to the authenticator without the target base station. The access gateway requests the security association information of the mobile terminal directly. When the second implementation scheme is selected, the step can be omitted.

 Step 26: The authenticator or the access network gateway sends the security association information to the target base station according to the request, and the message includes a mobile terminal identifier (MSS) and a corresponding security association list.

 Step 27: After receiving the SA list sent from the authenticator or the access network gateway, the target base station first allocates a new SA identity (SAID) to the SA in the SA list to replace the old SAID. .

 After step 28, the corresponding Ranging (parameter and power adjustment) process begins. In this process, the target base station will update all updated SAIDs associated with an MSS to the MSS so that the SAID on the MSS side is consistent with that on the target base station.

 Step 29. The session continues and the subsequent session process continues.

In the foregoing process, after performing step 24, after the target base station receives the Ranging Request (request for adjusting parameters and power information of the uplink and downlink) sent by the mobile terminal, step 25 is performed. At this point, in a subsequent step 28, the Ranging response message will be sent by the target base station to the mobile terminal instead. Embodiment 2

 As shown in FIG. 3, when the mobile terminal switches between the same authenticator or the BS within the range to which the access network belongs in the communication system, and the original base station is reported to the gateway or the access network gateway. After the request, when the security association of the mobile terminal is passively reported to the authenticator or the access network gateway, the method includes:

 Step 31: The mobile terminal sends a handover request/instruction message to the original base station.

 Step 32: The original base station sends a handover request/indication message to the authenticator or the access network gateway, where the message includes a mobile terminal identity (MSS) and a target base station identifier (T-BSID).

 Step 33: Prepare for some handover between the authenticator or the access network gateway and the target base station.

 Step 34: The authenticator or the access network gateway replies to the serving base station with a response message.

 Step 35: The target base station sends a message requesting the mobile terminal security association to the authenticator or the access network gateway; the message includes the identifier (MSS) of the mobile terminal.

 Similarly, this step is not necessary, and the target base station may request the original base station to request the security alliance of the mobile terminal from the original base station after the target base station requests to the authenticator or the access network gateway; or may not go to the authenticator or the access without the target base station. The network gateway requests the security association of the mobile terminal directly to the original base station. When the second implementation scheme is selected, the step can be omitted.

 Step 36: The authenticator or the access network gateway sends an SA message to the original base station, where the identifier of the mobile terminal is specified in the message, so as to obtain the corresponding SA information.

 Step 37: The original base station reports the SA message of the mobile terminal to the authenticator or the access network gateway according to the request, and the identifier of the mobile terminal also needs to be specified in the message.

 Step 38: The authenticator or the access network gateway sends the SA message to the target base station according to the request, where the message includes a mobile terminal identifier (MSS) and a corresponding security association list, where the mobile terminal is recorded in the list. Security Alliance information.

 Step 39: After receiving the SA list sent from the authenticator or the access network gateway, the target base station first allocates a new SA identity (SAID) to the SA in the SA list to replace the old SAID. .

 Step 310: Start the Ranging process. In this process, the target base station will update all updated SAIDs associated with an MSS to the MSS, so that the SAID on the MSS side is consistent with that on the target base station.

 Step 311: Continue the subsequent session process.

Similarly, in the foregoing process, after performing the step 34, after the target base station receives the Ranging Request message sent by the mobile terminal, step 35 is performed, and at this step, in the subsequent step 38, the target is changed to The base station sends a Ranging response message to the mobile terminal. Embodiment 3

 As shown in FIG. 4, when the mobile terminal switches between the different authenticators or the BSs in the range to which the access network belongs, the original base station has reported the security association to the authenticator or the active association. When the gateway is in the network, the method of the present invention includes the following steps: Step 41: The mobile terminal sends a handover request/indication message to the original base station.

 Step 42: The original base station sends a handover request/indication message to the authenticator or the access network gateway, where the message includes a mobile terminal identity (MSS), a target base station identifier (T-BSID), and all related to the mobile terminal. A list of security associations to facilitate reporting of the security association information described.

 Step 43: Prepare for some handover between the original authenticator or the original serving access network gateway and the target base station. Step 44: The original authenticator or the original serving access network gateway replies to the serving base station with a response message.

 Step 45: The target base station sends a message requesting the mobile terminal security association to the target authenticator or the access network gateway; the message includes the identifier of the mobile terminal (MSS);

 The request message may need to pass through a network entity in the target network, such as a network management device, to find a corresponding original device according to the record information provided by the network device.

 Similarly, this step may also be requested by the target base station to the target authenticator or the access network gateway, and then the target authenticator or the access network gateway requests the original authenticator or the original serving access network gateway to deliver the mobile terminal. Alternatively, the target authenticator or the access network gateway may request the original authenticator or the original serving access network gateway to deliver the mobile terminal without requesting the target authenticator or the access network gateway. Security Alliance, when the second implementation is selected, this step can be omitted.

 Step 46: The target authenticator or the access network gateway sends the SA request message to the original authenticator or the original service access network gateway according to the request, and the message includes the mobile terminal's indication (MSS) and corresponding The list of security associations to request the corresponding security association information from the original authenticator or the original service access network gateway.

 Step 47: After receiving the request message, the original authenticator or the original service access network gateway reports the mobile terminal security association message to the target authenticator or the access network gateway, where the message includes the mobile terminal. The identification (MSS) and the corresponding security association list, the security association information of the mobile terminal is recorded in the list.

 Step 48: The target authenticator or the access network gateway sends the mobile terminal security association message to the target base station, where the message includes the identity of the mobile terminal (MSS) and the corresponding security association list.

 Step 49: After receiving the SA list sent from the target authenticator or the access network gateway, the target base station first allocates a new SA identity (SAID) to the SA in the SA list to replace the old SA. SAID.

Step 410, after, start the Ranging process, in which the target base station will put all the MSS with The associated updated SAID is updated to the MSS such that the SAID on the MSS side is consistent with that on the target base station.

 Step 411, the session continues.

 Similarly, in the foregoing process, after performing step 44, after the target base station receives the Ranging Request message sent by the mobile terminal, step 45 is performed, and at this step, in the subsequent step 48, the target is changed to The base station sends a Ranging response message to the mobile terminal. Embodiment 4

 As shown in FIG. 5, when the mobile terminal switches within the range of different authenticators or access networks in the communication system, and the original base station is after receiving the report request from the authenticator or the access network gateway, The security association of the mobile terminal is passively reported to the authenticator or the access network gateway, and the method includes:

 Step 51: The mobile terminal sends a handover request/instruction message to the original base station.

 Step 52: The original base station sends a handover request/indication message to the authenticator or the access network gateway, where the message includes a mobile terminal identity (MSS), a target base station identifier (T-BSID), and all related to the mobile terminal. A list of security associations to actively report the corresponding SA information to the authenticator or the access network gateway.

 Step 53: Prepare for some handover between the authenticator or the access network gateway and the target base station.

 Step 54: The authenticator or the access network gateway replies to the serving base station with a response message.

 Step 55: The target base station sends a message requesting the mobile terminal security association to the target authenticator or the access network gateway; the message includes the identifier of the mobile terminal (MSS);

 Similarly, the request message may need to pass through a network entity in the target network, such as a network management device, to find a corresponding original device according to the record information provided by the network device.

 The step 55 is an optional step, and may be requested by the target base station to the target authenticator or the access network gateway, and then requested by the target authenticator or the access network gateway to the original authenticator or the original service access network gateway. The security association of the mobile terminal may be requested to be sent to the target authenticator or the access network gateway without requesting the target base station, and the target authenticator or the access network gateway requests the original authenticator or the original serving access network gateway to send the request. The security association of the mobile terminal, when the second implementation is selected, the step can be omitted.

 Step 56: The target authenticator or the access network gateway sends the SA request message to the original authenticator or the original service access network gateway according to the request, and the message includes the identifier (MSS) of the mobile terminal and the corresponding Security Alliance list.

 Step 57: The original authenticator or the original serving access network gateway sends an SA request message to the original base station, where the identifier of the mobile terminal is indicated in the message.

Step 58: The original base station reports the SA message of the mobile terminal to the original authenticator or the original service access network gateway according to the request; the identifier of the mobile terminal is indicated in the message. Step 59: The original authenticator or the original service access network gateway reports the mobile terminal security association message to the target authenticator or the access network gateway; the message includes the mobile terminal identifier (MSS) and the corresponding security association list.

 Step 510: The target authenticator or the access network gateway sends the mobile terminal security association message to the target base station, where the message includes the identity of the mobile terminal (MSS) and the corresponding security association list.

 Step 511: After receiving the security association list sent from the authenticator or the access network gateway, the target base station first allocates a new security association identifier (SAID) to the SA in the security association list to replace the old one. SAID.

 After step 512, the Ranging process is started. In this process, the target base station will update all the updated SAIDs associated with an MSS to the MSS, so that the SAID on the MSS side is consistent with that on the target base station.

 Step 513, the session continues.

 Similarly, in the foregoing process, after performing the step 54, after the target base station receives the Ranging Request message sent by the mobile terminal, step 55 is performed, and in the subsequent step 58, the target is changed to The base station sends a Ranging response message to the mobile terminal. The present invention also provides a device for obtaining a security association in a handover process of a mobile terminal that implements the foregoing method, as shown in FIG. 6, including a security association acquisition module and a security association transmission module, where:

 Security association acquisition module: obtaining a security association of the mobile terminal from the original base station;

 The security association information obtaining module receives the security association information of the mobile terminal sent by the security association information sending module of the original serving base station of the mobile terminal, and the security alliance information sending module is configured to be used in the original service of the mobile terminal. The base station is responsible for providing the security association information to the target base station, that is, the corresponding security association list of the mobile terminal.

 The security association transmission module: transmitting the security association of the mobile terminal acquired by the security association acquisition module to the target base station;

 The security association information transmission module sends the corresponding security association information to the security association information receiving module set in the target base station, and the security association information receiving module receives the security association information of the mobile terminal in the target base station.

 The security association obtaining module is configured on a original authenticator or an original serving access network gateway of the mobile terminal in the communication system, or a target authenticator or an access network gateway; the security alliance transmission module The original authenticator or the original serving access network gateway and/or the target authenticator or the access network gateway to which the original base station belongs to the mobile terminal set in the communication system.

That is, the device according to the present invention may be specifically configured in an authenticator or an access network gateway, where the access network gateway includes: a primary service access network gateway, a target access network gateway, and an authentication Access network gateway where the device is located and ' And the access network gateway where the foreign agent is located; the authenticator includes: the original authenticator to which the original base station of the mobile terminal belongs and/or the target authenticator to which the target base station belongs.

 The above is only a preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or within the technical scope disclosed by the present invention. Alternatives are intended to be covered by the scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

Rights request  A method for obtaining security association information in a mobile terminal handover process, characterized in that, in a process in which a mobile terminal performs handover in a communication system, the target base station acquires the same security association information of the mobile terminal and the original base station as the target base station and the mobile terminal. Security alliance information.  The method for obtaining security association information in a mobile terminal handover process according to claim 1, wherein the security association information includes a security association, a negotiated encryption algorithm, and a mode and/or communication encryption key and parameters. information.  The method for obtaining security association information in a handover process of a mobile terminal according to claim 1, wherein when the mobile terminal switches between the same authenticator or the base station within the range to which the access network gateway belongs in the communication system At the same time, the original base station has reported the SA message to the authenticator or the access network gateway. The method includes:  The authenticator or the access network gateway directly delivers the security association information corresponding to the mobile terminal to the target base station; or  The target base station requests the security gateway information of the mobile terminal from the access gateway, and the authenticator or the access network gateway sends the security association information to the target base station according to the request.  The method for obtaining the security association information in the handover process of the mobile terminal according to claim 3, wherein the original base station transmits the security association information of the mobile terminal to the target base station by using the handover request/indication information.  The method for obtaining the security association information in the handover process of the mobile terminal according to claim 1, wherein the method further comprises:  For the normal handover process, the original service base actively sends the security association information corresponding to the corresponding mobile terminal to the target base station, and the security association information is forwarded to the target base station directly or through the authenticator or the access network gateway;  Or,  For the abnormal handover process, the target base station requests the original serving base station for the security association information of the mobile terminal, and the original serving base station sends the corresponding security association information to the target base station according to the request, where the security association information is directly or through authentication. Forwarded to the target base station in the gateway or access network gateway.  The method for obtaining security association information in a handover process of a mobile terminal according to claim 1, wherein when the mobile terminal switches between base stations within a range to which the same authenticator or access network gateway belongs, The original base station passively reports the security association information to the authenticator or the access network gateway, and the method includes: A. The authenticator or the access network gateway requests the original base station for the security association information of the mobile terminal, and the original base station according to the request Requesting to report the security association information of the mobile terminal to the authenticator or the access network gateway;  B. The authenticator or the access network gateway directly sends the security association information of the mobile terminal to the target base station; or  C. The authenticator or the access network gateway requests the original base station for the security association information of the mobile terminal, and the original base station reports the security association information of the mobile terminal to the authenticator or the access network gateway according to the request;  D. The target base station requests the security association information of the mobile terminal from the authenticator or the access network gateway, and the authenticator or the access network gateway sends the security association information to the target base station according to the request.  The method for obtaining security association information in a handover process of a mobile terminal according to claim 1, wherein when the mobile terminal switches between different base stations in the communication system or between base stations within the range to which the access network gateway belongs And the original base station has reported the SA message to the authenticator or the access network gateway. The method includes: E. The target authenticator or the access network gateway requests the original authenticator or the access network gateway directly or through the network entity in the target network to request the mobile terminal security association information from the original authenticator or the access network gateway. The authenticator or the access network gateway reports the mobile terminal security association information to the target authenticator or the access network gateway;  F. The target authenticator or the access network gateway directly delivers the security association information corresponding to the mobile terminal to the target base station; or  G. The target authenticator or the access network gateway requests the original authentication device or the access network gateway directly or through the network entity in the target network to request the mobile terminal security association information from the original authenticator or the access network gateway. The right device or the access network gateway reports the mobile terminal security association information to the target authenticator or the access network gateway;  H. The target base station requests the security association information of the mobile terminal from the target authenticator or the access network gateway, and the target authenticator or the access network gateway sends the security association information to the target base station according to the request.  8. The method for obtaining security association information in a handover process of a mobile terminal according to claim 1, wherein when the mobile terminal switches between different base stations in the communication system or between base stations within the range to which the access network gateway belongs And the original base station passively reports the security association information to the authenticator or the access network gateway, and the method includes I. The target authenticator or the access network gateway requests the original authentication device or the access network gateway to request the mobile terminal security alliance information directly or after the network entity in the target network identifies the original authenticator or the access network gateway;  J, the original authenticator or the access network gateway requests the original base station for the security association information of the mobile terminal; the original base station reports the security association information of the mobile terminal to the original authenticator or the access network gateway according to the request;  K, the original authenticator or the access network gateway reports the mobile terminal security association information to the target authenticator or the access network gateway; The L-target authenticator or the access network gateway directly delivers the security association information corresponding to the mobile terminal to the target base station; or,  The M, the target authenticator or the access network gateway requests the original authentication device or the access network gateway to request the mobile terminal security alliance information directly or after the network entity in the target network identifies the original authenticator or the access network gateway;  N, the original authenticator or the access network gateway requests the original base station for the security association information of the mobile terminal; the original base station reports the security association information of the mobile terminal to the original authenticator or the access network gateway according to the request;  0. The original authenticator or the access network gateway reports the mobile terminal security association information to the target authenticator or the access network gateway;  P. The target base station requests the security association information of the mobile terminal from the target authenticator or the access network gateway, and the target authenticator or the access network gateway sends the security association information to the target base station according to the request.  The method for obtaining the security association information in the handover process of the mobile terminal according to any one of claims 1 to 8, wherein the method further comprises:  The target base station initiates a handover preparation message sent by the authenticator or the access network gateway, or initiates a request for acquiring the security association information of the mobile terminal under the trigger of the parameter and the power adjustment request message sent by the authenticator or the access network gateway.  The method for obtaining security association information in a mobile terminal handover process according to any one of claims 1 to 8, wherein the mobile communication system comprises a microwave access global interworking Wimax system, and in the system The security association information includes: a security association identifier, a security association type, a security association service type, an encryption tuple, and/or a communication encryption key pair information, where the encryption tuple includes a data encryption algorithm and a mode, and data authentication. Algorithm and mode and/or communication encryption key encryption algorithm and mode, the communication encryption key pair information includes a communication encryption key, a remaining life cycle of the communication encryption key, a communication encryption key serial number, a communication encryption key The initial vector of the communication encryption key in CBC mode, the packet sequence number, the received packet number, and/or the multicast key encryption key sequence number under multicast.  The method for obtaining the security association information in the handover process of the mobile terminal according to any one of claims 1 to 8, wherein the access network gateway comprises:  The original service access network gateway, the target access network gateway, the access network gateway where the authenticator is located, and/or the access network gateway where the foreign agent is located.  A device for obtaining security association information in a handover process of a mobile terminal, comprising: a security alliance information acquisition module: acquiring security association information of the mobile terminal of the original base station;  The security association information transmission module transmits the security association information of the mobile terminal acquired by the security association information obtaining module to the target base station. 13. The apparatus for obtaining security association information during handover of a mobile terminal according to claim 12, characterized in that The device is arranged on an authenticator or an access network gateway.  14. The apparatus for obtaining security association information during handover of a mobile terminal according to claim 13, wherein:  The access network gateway includes: an original service access network gateway, a target access network gateway, an access network gateway where the authenticator is located, and/or an access network gateway where the foreign agent is located;  The authenticator includes: a primary authenticator to which the original base station of the mobile terminal belongs and/or a target authenticator to which the target base station belongs.  The apparatus for obtaining the security association information in the handover process of the mobile terminal according to claim 12, wherein the security association information acquisition module receives the security association information sending module set on the original serving base station of the mobile terminal. Security alliance information from the mobile terminal.  The apparatus for obtaining the security association information in the handover process of the mobile terminal according to claim 12, wherein the security association information transmission module sends the corresponding security association information to the security alliance information received in the target base station. The module, in the target base station, receives the security association information of the mobile terminal by using the security association information receiving module.