Abstract:
The disclosure provides a connection processing method and system. The method includes: establishing a secure connection between a Mobility Management Entity (MME) and/or Serving Gateway (S-GW) and a Home (Evolved) NodeB (H(e)NB); and protecting a connection between the MME and/or S-GW and the H(e)NB via the secure connection. The disclosure increases the reliability and security of a data transmission mechanism of an H(e)NB system, overcomes the security defects of the H(e)NB system, and improves the security performance of the H(e)NB system.

Description:
TECHNICAL FIELD 
       [0001]    The disclosure relates to the field of communications, and in particular to a connection processing method and system. 
       BACKGROUND 
       [0002]    A Home NodeB (HNB) is used for providing 3rd Generation (3G) wireless coverage for 3G mobile phones in the home. The HNB is connected to existing residential broadband services, and includes the function of a standard Node B (one element of a 3G macro radio access network) and a radio resource management function of a standard Radio Network Controller (RNC). 
         [0003]      FIG. 1  shows a schematic diagram of the structure of an HNB system according to the related technology. As shown in  FIG. 1 , an interface between 3G Partnership Project (3GPP) User Equipment (UE) and the HNB is a backhaul and compatible air interface in a Universal Mobile Telecommunication System Radio Access Network (UTRAN). The HNB is accessed to a core network of an operator via a Security Gateway (SeGW), wherein the broadband Internet Protocol (IP) backhaul between the HNB and the SeGW may be unsafe. The information which is transmitted in this backhaul needs to be protected by a secure channel established between the HNB and the SeGW. The SeGW represents the core network of the operator to implement mutual authentication with the HNB. The HNB Gateway (HNB GW) and the SeGW are entities which are logically separated in the core network of the operator, and are used for access control of the UE of a Closed Subscriber Group (CSG). The Home (Evolved) Management System (H(e)MS) needs secure communications. 
         [0004]      FIG. 2  shows a schematic diagram of the structure of a Home (Evolved) NodeB (H(e)NB, also HeNB) system according to the related technology. Compared with the HNB, the H(e)NB is an air interface for connecting the 3GPP UE and an Evolved UTRAN (E-UTRAN). A Home eNodeB Gateway (H(e)NB GW) is selectively deployed. If the H(e)NB GW is deployed, the SeGW and the H(e)NB GW can be combined together. If the SeGW and the H(e)NB GW are not combined, the interface between the SeGW and the H(e)NB GW can be protected by a Network Domain Security/Internet Protocol (NDS/IP). 
         [0005]    The H(e)NB includes the HNB and the H(e)NB, and is a common name of the HNB and the H(e)NB. 
         [0006]    Aiming at the security of the H(e)NB, the 3GPP TR 33.820 defines 27 threats. The 27 threats are grouped into 7 categories, which respectively are: hazards on the qualification certificate of the H(e)NB, physical attack on the H(e)NB, attack on the construction of the H(e)NB, attack on the protocol of the H(e)NB, attack on the core network (including the attack based on the location of the H(e)NB), attack on the data and identity privacy of users, and attack on radio resource and management. 
         [0007]      FIG. 3  shows a schematic diagram of a EUTRAN architecture which includes the H(e)NB GW according to the related technology. As shown in  FIG. 3 , in this architecture, an S1 interface is set between a Mobility Management Entity (MME) and/or a Serving Gateway (S-GW) and the H(e)NB GW to transmit data of the control plane and the user plane. An S1 interface is set between the MME and/or S-GW and the H(e)NB to transmit data of the control plane and the user plane. An S1 interface is also set between the H(e)NB GW and the H(e)NB to transmit data of the control plane and the user plane. 
         [0008]    In  FIG. 3 , the S1 interface between the MME and/or S-GW and the eNB is implemented with security protection by the existing security specifications. Different from the eNB, the H(e)NB is located in a more vulnerable environment, and thus is easier to be attacked. However, in the related technologies, the S1 interface between the MME and/or S-GW and the H(e)NB is not protected, such that the reliability and security of the data transmission mechanism of the H(e)NB cannot be guaranteed. 
       Summary 
       [0009]    The disclosure provides a connection processing method and system, which solve the problem that the S1 interface between the H(e)NB and the MME and/or S-GW is not protected in the related technology. 
         [0010]    The disclosure provides a connection processing method according to one aspect. 
         [0011]    The connection processing method according to the disclosure includes: establishing a secure connection between an MME and/or S-GW and an H(e)NB; protecting a connection between the MME and/or S-GW and the H(e)NB via the secure connection. 
         [0012]    Establishing the secure connection between the MME and/or S-GW and the H(e)NB includes: establishing the secure connection between the MME and/or S-GW and a Security Gateway (SeGW); establishing the secure connection between the SeGW and the H(e)NB. 
         [0013]    Establishing the secure connection between the MME and/or S-GW and the SeGW includes: establishing the secure connection between the MME and/or S-GW and an H(e)NB Gateway (H(e)NB GW); establishing the secure connection between the H(e)NB GW and the SeGW. 
         [0014]    The secure connection established between the MME and/or S-GW and the H(e)NB GW includes at least one of the following: an Internet Protocol Security (IPsec) tunnel, a Transport Layer Security (TLS) tunnel, a Network Domain Security/Internet Protocol (NDS/IP). 
         [0015]    The secure connection established between the H(e)NB GW and the SeGW includes one of the following: an NDS/IP, combination of the H(e)NB GW and the SeGW. 
         [0016]    When the secure connection established between the MME and/or S-GW and the SeGW does not pass through the H(e)NB GW, the method further includes: establishing the secure connection between the MME and/or S-GW and the H(e)NB GW; establishing the secure connection between the H(e)NB GW and the SeGW. 
         [0017]    The secure connection which is established between the MME and/or S-GW and the SeGW, and does not pass through the H(e)NB GW includes at least one of the following: an IPsec tunnel, a TLS tunnel, an NDS/IP. 
         [0018]    After establishing the secure connection between the SeGW and the H(e)NB, the method further includes: the SeGW and the H(e)NB performing authentication. 
         [0019]    The secure connection includes at least one of the following: data source authentication, confidentiality protection, integrity protection, anti-replay protection. 
         [0020]    The disclosure provides a connection processing system according to another aspect. 
         [0021]    The connection processing system according to the disclosure includes an MME and/or S-GW and an H(e)NB, wherein the MME and/or S-GW includes: a first establishment module, configured to establish a secure connection with the H(e)NB; a first connection processing module, configured to protect a connection between the MME and/or S-GW and the H(e)NB via the secure connection; the H(e)NB includes: a second establishment module, configured to establish the secure connection with the MME and/or S-GW; a second connection processing module, configured to protect the connection between the MME and/or S-GW and the H(e)NB via the secure connection. 
         [0022]    By establishing a secure connection between the MME and/or S-GW and the H(e)NB, and using the secure connection to implement data transmission, the disclosure solves the problem that the S1 interface between the H(e)NB and the MME and/or S-GW is not protected in the related technology, thus increasing the reliability and security of the data transmission mechanism of the H(e)NB system, solving the security defects of the H(e)NB system, and improving the security performance of the H(e)NB system. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0023]    Drawings, provided for further understanding of the disclosure and forming a part of the specification, are used to explain the disclosure together with embodiments of the disclosure rather than to limit the disclosure, wherein: 
           [0024]      FIG. 1  shows a schematic diagram of the structure of an HNB system according to the related technology; 
           [0025]      FIG. 2  shows a schematic diagram of the structure of a Home (Evolved) NodeB (H(e)NB) system according to the related technology; 
           [0026]      FIG. 3  shows a schematic diagram of a EUTRAN architecture which includes the H(e)NB GW according to the related technology; 
           [0027]      FIG. 4  shows a flowchart of a connection processing method according to an embodiment of the disclosure; 
           [0028]      FIG. 5  shows a flowchart of the connection processing method according to a preferred embodiment of the disclosure; 
           [0029]      FIG. 6  shows an interactive flowchart of the connection processing method according to a preferred embodiment 1 of the disclosure; 
           [0030]      FIG. 7  shows an interactive flowchart of the connection processing method according to a preferred embodiment 2 of the disclosure; 
           [0031]      FIG. 8  shows an interactive flowchart of the connection processing method according to a preferred embodiment 3 of the disclosure; 
           [0032]      FIG. 9  shows an interactive flowchart of the connection processing method according to a preferred embodiment 4 of the disclosure; 
           [0033]      FIG. 10  shows an interactive flowchart of the connection processing method according to a preferred embodiment 5 of the disclosure; 
           [0034]      FIG. 11  shows an interactive flowchart of the connection processing method according to a preferred embodiment 6 of the disclosure; 
           [0035]      FIG. 12  shows a structure diagram of a connection processing system according to an embodiment of the disclosure. 
       
    
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS 
       [0036]    It should note that, the embodiments in the application and the characteristics of the embodiments can be mutually combined without conflict. The disclosure is described below in details with reference to the drawings and embodiments. 
         [0037]    An embodiment of the disclosure provides a connection processing method.  FIG. 4  shows a flowchart of a connection processing method according to an embodiment of the disclosure. As shown in  FIG. 4 , the method includes the following Steps S 402 -S 404 . 
         [0038]    Step S 402 , a secure connection is established between an MME and/or S-GW and an H(e)NB. 
         [0039]    Step S 404 , a connection between the MME and/or S-GW and the H(e)NB is protected via the secure connection. 
         [0040]    The S1 interface between the H(e)NB and the MME and/or S-GW is not protected in the related technology, such that the reliability and security of the data transmission mechanism of the H(e)NB cannot be guaranteed. In the embodiment of the disclosure, by establishing a secure connection between the H(e)NB and the MME and/or S-GW, and using the secure connection to implement connection processing, the reliability and security of the data transmission mechanism of the H(e)NB can be increased, the security defects of the H(e)NB system can be solved, and the security performance of the H(e)NB system can be improved. 
         [0041]    Preferably, establishing the secure connection between the MME and/or S-GW and the H(e)NB includes that: a secure connection is established between the MME and/or S-GW and an SeGW; and a secure connection is established between the SeGW and the H(e)NB. 
         [0042]    Preferably, establishing the secure connection between the MME and/or S-GW and the SeGW includes: a secure connection is established between the MME and/or S-GW and an H(e)NB GW; and a secure connection is established between the H(e)NB GW and the SeGW. 
         [0043]    Preferably, the secure connection established between the MME and/or S-GW and the H(e)NB GW includes at least one of the following: an IPsec tunnel, a TLS tunnel, an NDS/IP. 
         [0044]    Preferably, the secure connection established between the H(e)NB GW and the SeGW includes one of the following: an NDS/IP, combination of the H(e)NB GW and the SeGW. 
         [0045]    Preferably, when the secure connection established between the MME and/or S-GW and the SeGW does not pass through the H(e)NB GW, the method further includes that: a secure connection is established between the MME and/or S-GW and the H(e)NB GW; and a secure connection is established between the H(e)NB GW and the SeGW. 
         [0046]    Preferably, the secure connection which is established between the MME and/or S-GW and the SeGW, and does not pass through the H(e)NB GW includes at least one of the following: an IPsec tunnel, a TLS tunnel, an NDS/IP. 
         [0047]    Preferably, after the secure connection is established between the SeGW and the H(e)NB, the method further includes: the SeGW and the H(e)NB performs authentication. 
         [0048]    Preferably, the secure connection includes at least one of the following: data source authentication, confidentiality protection, integrity protection, anti-replay protection. 
         [0049]    Preferably, security protection is provided, via two and/or one secure connection(s), for the connection processing between the MME and/or S-GW and the H(e)NB. 
         [0050]    The implementation process of the embodiment of the disclosure is described below in details with reference to the examples. 
         [0051]      FIG. 5  shows a flowchart of the connection processing method according to a preferred embodiment of the disclosure. As shown in  FIG. 5 , the method includes the following Steps S 502 -S 514 . 
         [0052]    Step S 502 , an IPsec tunnel and/or TLS tunnel is established between an MME and/or S-GW and an HeNB GW. 
         [0053]    Step S 504 , a secure connection is established between the HeNB GW and an SeGW, wherein this secure connection may be the NDS/IP, or the combination of the H(e)NB GW and the SeGW. 
         [0054]    Step S 506 , a secure connection is established between the MME and/or S-GW and the SeGW, wherein this secure connection may be formed by the secure connection between the MME and/or S-GW and the H(e)NB GW and the secure connection between the H(e)NB GW and the SeGW, or may be another IPsec tunnel and/or TLS tunnel. 
         [0055]    Step S 508 , mutual authentication is implemented between the HeNB and the SeGW, and a secure connection is established between the HeNB and the SeGW. 
         [0056]    Step S 510 , it is judged whether the data transmission between the MME and/or S-GW and the HeNB is implemented with security protection via two secure connections, if yes, Step S 512  is implemented, otherwise, Step S 514  is implemented. 
         [0057]    Step S 512 , the data transmission between the MME and/or S-GW and the HeNB is separately protected, namely, is implemented with security protection via two security connections. 
         [0058]    Step S 514 , the data transmission between the MME and/or S-GW and the HeNB is protected via the same secure connection, namely, is implemented with security protection via one secure connection. 
         [0059]    It should be noted that, the security protection in Steps S 512 -S 514  may be data source authentication and/or confidentiality protection and/or integrity protection and/or anti-replay protection. The secure connection(s) used for protecting the data transmission between the H(e)NB and the MME and/or S-GW can be IPsec tunnel(s) and/or TLS tunnel(s). 
         [0060]      FIG. 6  shows an interactive flowchart of the connection processing method according to a preferred embodiment 1 of the disclosure. As shown in  FIG. 6 , the method includes the following Steps S 602 -S 612 . 
         [0061]    Step S 602 , an IPsec tunnel and/or TLS tunnel is established between an MME and/or S-GW and an H(e)NB GW. 
         [0062]    Step S 604 , a secure connection is established between the H(e)NB GW and an SeGW, wherein this secure connection may be an NDS/IP, or the combination of the H(e)NB GW and the SeGW. 
         [0063]    Step S 606 , a secure connection is established between the MME and/or S-GW and the SeGW, wherein this secure connection is another IPsec tunnel and/or TLS tunnel, and does not pass through the H(e)NB GW. 
         [0064]    Step S 608 , mutual authentication is implemented between the H(e)NB and the SeGW, and a secure connection is established between the H(e)NB and the SeGW. 
         [0065]    Step S 610 , control plane data transmission between the H(e)NB and the MME and/or S-GW is protected by the secure connection which passes through the H(e)NB GW. 
         [0066]    Step S 612 , user plane data transmission between the H(e)NB and the MME and/or S-GW is protected by the secure connection which does not pass through the H(e)NB GW. 
         [0067]    It should be noted that, the security protection in the Steps S 610 -S 612  may be data source authentication and/or confidentiality protection and/or integrity protection and/or anti-replay protection. The security connection for protecting the data transmission between the H(e)NB and the MME and/or S-GW may be the IPsec tunnel and/or the TLS tunnel. 
         [0068]      FIG. 7  shows an interactive flowchart of the connection processing method according to a preferred embodiment 2 of the disclosure. As shown in  FIG. 7 , the method includes the following Steps S 702 -S 712 . 
         [0069]    Step S 702 , an IPsec tunnel and/or TLS tunnel is established between an MME and/or S-GW and an H(e)NB GW. 
         [0070]    Step S 704 , a secure connection is established between the H(e)NB GW and an SeGW, wherein this secure connection may be an NDS/IP or the combination of the H(e)NB GW and the SeGW. 
         [0071]    Step S 706 , a secure connection is established between the MME and/or S-GW and the 
         [0072]    SeGW, wherein this secure connection is another IPsec tunnel and/or TLS tunnel, and does not pass through the H(e)NB GW. 
         [0073]    Step S 708 , mutual authentication is implemented between the H(e)NB and the SeGW, and a secure connection is established between the H(e)NB and the SeGW. 
         [0074]    Step S 710 , control plane data transmission between the H(e)NB and the MME and/or S-GW is protected by the secure connection which passes through the H(e)NB GW. 
         [0075]    Step S 712 , control plane data transmission and user plane data transmission between the H(e)NB and the MME and/or S-GW is protected by the secure connection which does not pass through the H(e)NB GW. 
         [0076]    It should be noted that, the security protection in the Steps S 710 -S 712  may be data source authentication and/or confidentiality protection and/or integrity protection and/or anti-replay protection. The security connection for protecting the data transmission between the H(e)NB and the MME and/or S-GW may be an IPsec tunnel and/or an TLS tunnel. 
         [0077]      FIG. 8  shows an interactive flowchart of the connection processing method according to a preferred embodiment 3 of the disclosure. As shown in  FIG. 8 , the method includes the following Steps S 802 -S 812 . 
         [0078]    Step S 802 , an IPsec tunnel and/or TLS tunnel is established between an MME and/or S-GW and an HeNB GW. 
         [0079]    Step S 804 : a secure connection is established between the H(e)NB GW and an SeGW, wherein this secure connection may be an NDS/IP or the combination of the H(e)NB GW and the SeGW. 
         [0080]    Step S 806 : a secure connection is established between the MME and/or S-GW and the SeGW, wherein this secure connection is another IPsec tunnel and/or TLS tunnel, and does not pass through the H(e)NB GW. 
         [0081]    Step S 808 : mutual authentication is implemented between the H(e)NB and the SeGW, and the secure connection is established between the H(e)NB and the SeGW. 
         [0082]    Step S 810 : control plane data transmission and user plane data transmission between the H(e)NB and the MME and/or S-GW is protected via the secure connection which passes through the H(e)NB GW. 
         [0083]    Step S 812 : user plane data transmission between the H(e)NB and the MME and/or S-GW is protected via the secure connection which does not pass through the H(e)NB GW. 
         [0084]    It should be noted that, the security protection in the Steps S 810 -S 812  may be data source authentication and/or confidentiality protection and/or integrity protection and/or anti-replay protection. The security connection for protecting the data transmission between the H(e)NB and the MME and/or S-GW may be an IPsec tunnel and/or a TLS tunnel. 
         [0085]      FIG. 9  shows an interactive flowchart of the connection processing method according to a preferred embodiment 4 of the disclosure. As shown in  FIG. 9 , the method includes the following Steps S 902 -S 912 . 
         [0086]    Step S 902 , an IPsec tunnel and/or TLS tunnel is established between an MME and/or S-GW and an H(e)NB GW. 
         [0087]    Step S 904 : a secure connection is established between the H(e)NB GW and an SeGW, wherein this secure connection may be an NDS/IP or the combination of the H(e)NB GW and the SeGW. 
         [0088]    Step S 906 : a secure connection is established between the MME and/or S-GW and the SeGW, wherein this secure connection is another IPsec tunnel and/or TLS tunnel, and does not pass through the H(e)NB GW. 
         [0089]    Step S 908 : mutual authentication is implemented between the H(e)NB and the SeGW, and the secure connection is established between the H(e)NB and the SeGW. 
         [0090]    Step S 910 : control plane and user plane data transmission between the H(e)NB and the MME and/or S-GW is protected via the secure connection which passes through the H(e)NB GW. 
         [0091]    Step S 912 : control plane and user plane data transmission between the H(e)NB and the MME and/or S-GW is protected via the secure connection which does not pass through the H(e)NB GW. 
         [0092]    It should be noted that, the security protection in the Steps S 910 -S 912  may be data source authentication and/or confidentiality protection and/or integrity protection and/or anti-replay protection. The security connection for protecting the data transmission between the H(e)NB and the MME and/or S-GW may be an IPsec tunnel and/or a TLS tunnel. 
         [0093]      FIG. 10  shows an interactive flowchart of the connection processing method according to a preferred embodiment 5 of the disclosure. As shown in  FIG. 10 , the method includes the following Steps S 1002 -S 1010 . 
         [0094]    Step S 1002 , an IPsec tunnel and/or TLS tunnel is established between an MME and/or S-GW and an H(e)NB GW. 
         [0095]    Step S 1004 : a secure connection is established between the H(e)NB GW and an SeGW, wherein this secure connection may be an NDS/IP or the combination of the H(e)NB GW and the SeGW. 
         [0096]    Step S 1006 : a secure connection is established between the MME and/or S-GW and the SeGW, wherein this secure connection can be formed by the secure connection between the MME and/or S-GW and the H(e)NB GW and the secure connection between the H(e)NB GW and the SeGW. 
         [0097]    Step S 1008 : mutual authentication is implemented between the H(e)NB and the SeGW, and the secure connection is established between the H(e)NB and the SeGW. 
         [0098]    Step S 1010 : user plane and/or control plane data transmission between the H(e)NB and the MME and/or S-GW is implemented with security protection via a hop-by-hop secure connection. 
         [0099]    It should be noted that, the security protection in the Step S 1010  may be data source authentication and/or confidentiality protection and/or integrity protection and/or anti-replay protection. The security connections for protecting the data transmission between the H(e)NB and the MME and/or S-GW may be the IPsec tunnels and/or the TLS tunnels. 
         [0100]      FIG. 11  shows an interactive flowchart of the connection processing method according to a preferred embodiment 6 of the disclosure. As shown in  FIG. 11 , the method includes the following Steps S 1102 -S 1112 . 
         [0101]    Step S 1102 , an IPsec tunnel and/or TLS tunnel is established between an MME and/or S-GW and an H(e)NB GW. 
         [0102]    Step S 1104 : a secure connection is established between the H(e)NB GW and an SeGW, wherein this secure connection may be an NDS/IP or the combination of the H(e)NB GW and the SeGW. 
         [0103]    Step S 1106 : a secure connection is established between the MME and/or S-GW and the SeGW, wherein this secure connection can be formed by the secure connection between the MME and/or S-GW and the H(e)NB GW and the secure connection between the H(e)NB GW and the SeGW. 
         [0104]    Step S 1108 : mutual authentication is implemented between the H(e)NB and the SeGW, and the secure connection is established between the H(e)NB and the SeGW. 
         [0105]    Step S 1110 : control plane data transmission between the H(e)NB and the MME and/or S-GW is implemented with security protection via the hop-by-hop secure connection. 
         [0106]    Step S 1112 , this security protection may be data source authentication and/or confidentiality protection and/or integrity protection and/or anti-replay protection. 
         [0107]    The user plane data transmission between the H(e)NB and the MME and/or S-GW is implemented with security protection via a hop-by-hop secure connection. This secure protection may be data source authentication and/or confidentiality protection and/or anti-replay protection. The secure connections for protecting the data transmission between the H(e)NB and the MME and/or S-GW may be the IPsec tunnels and/or the TLS tunnels. 
         [0108]    It should be noted that, the steps shown in the flowcharts of the drawings can be executed by a computer system, such as a group of computers which can execute the instructions, in addition, although the logic sequences are shown in the flowchart, the shown or described steps can be executed according to different sequences in some cases. 
         [0109]    An embodiment of the disclosure provides a connection processing system, which can be used for realizing the above connection processing method.  FIG. 12  shows a structure diagram of the connection processing system according to the embodiment of the disclosure. As shown in  FIG. 12 , the connection processing system includes an MME and/or S-GW  122  and an H(e)NB  124 , wherein the MME and/or S-GW  122  includes a first establishment module  1222  and a first connection processing module  1224 ; the H(e)NB  124  includes a second establishment module  1242  and a second connection processing module  1244 . The system is described below in details. 
         [0110]    The first establishment module  1222  is configured to establish a secure connection with the H(e)NB  124 ; the first connection processing module  1224  is coupled with the first establishment module  1222 , and is configured to protect a connection between the MME and/or S-GW  122  and the H(e)NB  124  via the secure connection established by the first establishment module  1222 . 
         [0111]    The second establishment module  1242  is configured to establish a secure connection with the MME and/or S-GW  122 ; the second connection processing module  1244  is coupled with the second establishment module  1242 , and is configured to protect the connection between the MME and/or S-GW  122  and the H(e)NB  124  via the secure connection established by the second establishment module  1242 . 
         [0112]    Specifically, the second establishment module  1242  is configured to establish the secure connection with the first establishment module  1222  in the MME and/or S-GW  122 ; the second connection processing module  1244  is connected to the second establishment module  1242 , and is configured to protect the connection between the first connection processing module  1224  and the second connection processing module  1244  in the MME and/or S-GW  122  via the secure connection established by the second establishment module  1242 . 
         [0113]    It should be noted that, the connection processing system described in the device embodiment is corresponding to the above method embodiment, the specific implementation process has been described in details in the above method embodiment, and thus is not repeated. 
         [0114]    In conclusion, a connection processing method and system is provided according to the above embodiments of the disclosure. By establishing the secure connection between the H(e)NB and the MME and/or S-GW, and using this secure connection to implement connection processing, the problem that the S1 interface between the H(e)NB and the MME and/or S-GW is not protected is solved, such that the reliability and security of the data transmission mechanism of the H(e)NB system can be increased, the security defects of the H(e)NB system can be solved, and the security performance of the H(e)NB system can be improved. 
         [0115]    Obviously, those skilled in the art shall understand that the above-mentioned modules and steps of the disclosure can be realized by using general purpose calculating device, can be integrated in one calculating device or distributed on a network which consists of a plurality of calculating devices. Alternatively, the modules and the steps of the disclosure can be realized by using the executable program code of the calculating device. Consequently, they can be stored in the storing device and executed by the calculating device, or they are made into integrated circuit module respectively, or a plurality of modules or steps thereof are made into one integrated circuit module. In this way, the disclosure is not restricted to any particular hardware and software combination. 
       INDUSTRIAL APPLICABILITY 
       [0116]    The technical solution of the disclosure has industrial applicability. By establishing the secure connection between the H(e)NB and the MME and/or S-GW, and using this secure connection to implement connection processing, the problem that the S1 interface between the H(e)NB and the MME and/or S-GW is not protected is solved, such that the reliability and security of the data transmission mechanism of the H(e)NB system can be increased, the security defects of the H(e)NB system can be solved, and the security performance of the H(e)NB system can be improved. 
         [0117]    The descriptions above are only the preferable embodiment of the disclosure, which are not used to restrict the disclosure. For those skilled in the art, the disclosure may have various changes and variations. Any amendments, equivalent substitutions, improvements, etc. within the principle of the disclosure are all included in the scope of the protection of the disclosure.