Patent ID: 8561150

Claim:
A method for supporting mobility security in a next generation network, comprising: configuring a Transport Authentication and Authorization Functional Entity (TAA-FE) and a mobile agent functional entity in the network, and establishing a reference point for transmitting key material between the TAA-FE and the mobile agent functional entity; and when a terminal moves, the mobile agent functional entity receiving the key material from the TAA-FE, and performing security protection for signaling between the terminal and the mobile agent functional entity according to the key material; wherein the mobile agent functional entity comprises a Mobile Access Functional Entity (MA-FE) and a Mobile Home Functional Entity (MH-FE); the method further comprising: when the terminal moves, terminal customer premises equipment attaching to the network, the attachment comprising: a step of authentication and authorization: the terminal initiating an authentication and authorization request and providing a credential to the TAA-FE; the TAA-FE inquiring user profile information of a Transport User Profile Functional Entity (TUP-FE), and authenticating the terminal according to the user profile information; if the authentication succeeds, the TAA-FE sending a key to the MH-FE and MA-FE; and the MH-FE establishing mobile security association with the terminal; a step of Internet Protocol (IP) configuration: the TAA-FE returning an authentication and authorization response to the terminal, the authentication and authorization response containing a random value from which the terminal derives the key, a dynamic Home Address (HoA), and a Home Agent (HA); the terminal acquiring a Care-of Address (CoA); a step of location management: the terminal registering location information to a Transport Location Management Functional Entity (TLM-FE), and the TLM-FE sending the information to a Resource Admission Control Function (RACF); and a step of tunnel establishment: the terminal constructing a Registration Request (RRQ) message according to a Network Access Identifier (NAI) and the CoA and HoA, and registering binding to the MH-FE; the MH-FE authenticating Mobile IP (MIP) signaling of the terminal according to the key sent by the TAA-FE, and after the authentication is passed, the MH-FE notifying the TLM-FE of a current tunnel state and sending a MIP Registration Reply (RRP) message to the terminal via the MA-FE.