Patent ID: 8862867

Claim:
A method for protecting security of layer-3 mobility user plane data in Next Generation Network (NGN), comprising: performing authentication by a terminal with an authentication server; obtaining shared key material A by both the terminal and the authentication server after the authentication is passed; interacting by the terminal with the authentication server, a Mobile Location Management Functional Entity (MLM-FE) and a Handover Decision and Control Functional Entity (HDC-FE) to obtain layer-3 mobility information, wherein the layer-3 mobility information includes: address of destination network and type of destination network; generating, by the terminal and the authentication server, shared key material C for protecting security of layer-3 mobility signaling plane according to the layer-3 mobility information and shared key material A; transmitting, by the authentication server, generated shared key material C to the MLM-FE; interacting by the terminal a mobility signaling with the MLM-FE, wherein the security of the mobility signaling is protected by shared key material C; generating, by the terminal and the MLM-FE, shared key material D for protecting security of layer-3 mobility user plane according to the layer-3 mobility information and shared key material A; transmitting, by the MLM-FE, generated shared key material D to the HDC-FE; transmitting, by the HDC-FE, received shared key material D to a layer-3 handover execution module; protecting security of the layer-3 mobility user plane data by the terminal and the layer-3 handover execution module by using received shared key material D.