JP2009532959A - Communication method and communication system in user network - Google Patents

Abstract

  In the communication method and communication system in a user network, before forming a point-to-point connection, two UEs in the user network request security authentication of the corresponding UE via the access network from the management entity, and the corresponding UE After passing the authentication, a point-to-point connection is formed. The management entity can provide keys to authenticated UEs to ensure the security of data transmission. If the two UEs are in the same personal area network, the point-to-point connection is a direct connection in the personal area network range. If the two UEs are not in the same personal area network, the point-to-point connection is a remote connection formed by the respective access network. By using the present invention, the security of data transmission between UEs in the user network is guaranteed.

Description

  The present invention relates to the communication field, and in particular, to a communication technique between user devices of a user network.

  In recent years, with the development of science and technology and the increasing demand for high-tech products, more and more peripheral devices are owned. In addition to having multiple laptops and mobile phones, users must connect peripheral devices such as printers, scanners, and modems to the PC. The user may need to transfer an image from the digital camera using the USB interface and save the image to a hard disk. Frequently plugging and unplugging wires and cable plugs that entangle with the interface and PC can be inconvenient for the user while enjoying the new technology. In addition, information communication between staff in various departments in a company imposes high demands on the mobility of information communication in modern companies. A local area network built in a restricted office environment can share information and devices (eg, printers and scanners), but inconvenience arises due to complex wiring.

  In consideration of this situation, a new concept called personal area network (PAN) has been proposed. A PAN is a mobile communication network that provides wireless connectivity for a specific group within a narrow range that is rich in services. This is a wireless network comparable to a wide area network and a local area network, but within a narrow range.

  The concept of PAN is to replace the conventional wired cable with wireless or infrared, and realize intelligent interconnection between personal information terminals and construct individual information networks. From a computer network perspective, PAN is a local area network, and from a telecommunications network perspective, PAN is an access network. PAN is therefore called the solution for the “last meter” of a telecommunications network. PAN is for applications in homes and small offices mainly including voice communication gateways, data communication gateways, information device interconnection means, automatic information exchange means, and the like.

  Technologies for PAN mainly include the infrared communication technology of Bluetooth and Infrared Data Communication Association (IRDA).

  According to PAN, management and information exchange can be successfully performed for all user equipments (UEs) close to the same user. However, the network range of the PAN is narrow, and it is unlikely that a highly mobile UE such as a mobile phone can be limited to one PAN. In order to easily manage all UEs owned by the user, a user network is constructed with UEs belonging to the same user. The network may include multiple physically separated UEs or multiple PANs consisting of UEs.

  In the prior art, there are two cases for communication between UEs in the same user network. The first is the case where both communicating UEs are in the same PAN of the same user network, i.e. communication between two adjacent UEs. In this case, the point-to-point communication between the two UEs can be directly performed without the management of the network provider by a wireless technology such as Bluetooth or infrared communication or a wired technology including a USB cable. That is, as shown in FIG. 1, the two UEs communicate directly with each other through a close connection in the PAN without passing through the core network. In FIG. 1, UE1 and UE2 adopt this communication mode.

  In the second case, for UEs that are not in the same access network, ie not in the same PAN, such as UE1 and UE3 in FIG. 1, the communication between them is a switch provided by the network provider because it requires remote communication It must be switched by the center. In other words, when UE1 and UE2 have to communicate, UE1 issues a request through access network A and reaches UE3 through the switch center and access network B. With the exception of some control signaling, UE1 data must also pass through access network A, switch center, and access network B before reaching UE3.

  In actual applications, the security of communication between UEs in the same user network cannot be guaranteed with the above solution, and communication between UEs occupies a considerable amount of switch center resources.

  Reasons that UEs in the same PAN in the same user network employ point-to-point communication, i.e. both UEs communicate directly in the PAN without going through the core network, so they do not have security authentication means Cannot guarantee communication security. If no UEs communicating in the same user network are in the same PAN, they must communicate through a switch center where considerable resources are occupied.

  Embodiments of the present invention provide a communication system and method for a user equipment in a user network, which can guarantee communication security between UEs in the user network.

  Embodiments of the present invention provide a communication method for use in a user network, where the first user device and the second user device belonging to the same user need to communicate with each other. The user device transmits a communication request to the management entity that stores the registration information of the user device and establishes a connection with the second user device, and the management entity sets the connection based on the communication request and the stored registration information. Security authentication of the first and second user devices is performed, and after successful authentication, the first user device and the second user device establish a point-to-point connection.

  Embodiments of the present invention provide a user network communication system having an access network and at least two user devices belonging to the same user, the system stores registration information of the user device and performs security authentication of the user device When the first user equipment needs to communicate with the second user equipment, the first user equipment sends a communication request to the management entity, and the management entity sends a communication request According to the stored registration information, security authentication of the first and second user devices is performed, and after successful authentication, the first user device and the second user device directly establish a point-to-point connection.

  In summary, according to an embodiment of the present invention, before two UEs in a user network establish a point-to-point connection, first request the security authentication of the corresponding UE to the management entity via the access network, and A point-to-point connection is established only when the UE passes authentication. By adding the security authentication before establishing the connection, it is possible to prevent an invalid UE from performing unauthorized access to the UE in the user network. The management entity can also improve the security of data transmission by providing a key to a UE that has been successfully authorized.

  When two UEs belonging to the same user require communication, the management entity performs security authentication in the user network for the two UEs and guarantees the validity of both UEs. After passing the authentication, a key is also given to both UEs by the management entity to ensure the security of data transmission between the communicating parties.

  If the two UEs are not in the same personal area network, the point-to-point connection is a remote connection established via each access network. Since the point-to-point connection between two UEs does not go through the switch center, the switch center resources can be reserved for remote communication.

  In order to clarify the objects, technical solutions and advantages of the present invention, a more detailed description of the present invention will be given below with reference to the drawings.

  A UE communication system in a user network according to the first embodiment of the present invention will be described below.

  As shown in FIG. 2, the communication system of the UE in the user network includes at least two UEs belonging to the same user, an access network, a management entity, which management entity is configured to store registration information of the UE, Perform UE security authentication. UEs belonging to the same user are arranged in the same PAN and exchange information with the management entity through the same access network.

  Specifically, before a plurality of UEs belonging to the same user establish communication in the communication system, the plurality of UEs register with the management entity in advance, and at the same time, the management entity registers registration information of the plurality of UEs. save. When the user UE1 needs to communicate with the UE2 belonging to the same user, the UE1 first transmits a communication request with the UE2 to the management entity via the common access network A. This communication request includes registration information of UE1 and a device identification number of UE2. After receiving the communication request, the management entity performs security authentication of UE1 and UE2 according to the stored registration information. For example, the management entity compares the registration information of UE1 included in the communication request with the stored registration information to determine whether UE1 that is the source of the communication request is valid. UE1 and UE2 are subjected to security authentication by determining whether they are registered according to the device identification number. When the authentication is successful, the management entity transmits a communication request message including the device identification number of UE1 to UE2. After receiving the request message, UE2 decides whether to communicate with UE1 and sends corresponding feedback information to the management entity according to the decision result. The management entity analyzes the feedback information, and if UE2 agrees to communicate with UE1, the management entity further creates temporary secret keys for UE1 and UE2, and transmits this secret key to each of UE1 and UE2. At the same time, the management entity sends an acknowledgment message to UE1 indicating that UE2 has agreed to communicate. After receiving the key, UE1 and UE2 establish a direct connection within the PAN and communicate with each other via a secret key over the established connection.

  The second embodiment of the present invention is basically the same as the first embodiment. As shown in FIG. 3, the communication system of the UE in the user network of the second embodiment includes at least two UEs belonging to the same user, an access network, and a management entity. The management entity is configured to store UE registration information and performs security authentication of the UE. The only difference is that in the communication system of the second embodiment, each UE belonging to the same user is not in the same PAN, and each UE exchanges information with the management entity via the respective access network. A UE that requires communication establishes a remote connection through each access network after passing security authentication.

  For example, the same user has a plurality of UEs, UE1 and UE3 are not in the same PAN, UE1 is connected to access network A, and UE3 is connected to access network B. When the UE1 needs to communicate with the UE3, the UE1 transmits a communication request for communicating with the UE3 to the management entity via the access network A. This communication request includes registration information of UE1 and a device identification number of UE3. The management entity performs security authentication of UE1 and UE3 according to the received request message and stored registration information. When the security authentication is successful, the entity transmits a communication request message including the device identification number of UE1 to UE3. The UE 3 receives this request message from the management entity via the access network B, decides whether to agree to the communication with the UE 1, and sends corresponding feedback information to the management entity according to this decision. When the management entity receives feedback information indicating that UE3 agrees to this communication, it further creates temporary keys for UE1 and UE3, and transmits this key to each of UE1 and UE3. At the same time, the management entity sends an acknowledgment message to UE1 indicating that UE2 has accepted this communication. After receiving the key, UE1 and UE3 establish a remote connection through each of access network A and access network B, and communicate with each other with a temporary key after the connection is established.

  A UE communication method in a user network according to the third embodiment of the present invention is shown in FIG. In step 410, when UE1 needs to communicate with UE2 belonging to the same user, UE1 transmits a communication request for communicating with UE2 to the management entity. Specifically, UE1 and UE2 belonging to the same user may be in the same PAN or in different PANs. If UE1 and UE2 are in the same PAN, when UE1 needs to communicate with UE2, UE1 sends a communication request to communicate with UE2 to the management entity via the common access network. If UE1 and UE2 are in different PANs, when UE1 needs to communicate with UE2, UE1 transmits a communication request for communicating with UE2 to the management entity via the access network to which UE1 belongs. This communication request includes registration information of UE1 and a device identification number of UE2.

  In step 420, after receiving the communication request from UE1, the management entity performs security authentication of UE1 and UE2 according to the information in the communication request.

  Specifically, each UE belonging to the same user must first register with the management entity, and the management entity also needs to store registration information of the registered UE. Therefore, when the management entity receives a communication request from UE1, security authentication of UE1 and UE2 can be performed according to the information of the communication request and the registration information stored by itself.

  In step 430, the management entity determines whether UE1 and UE2 pass the security authentication. If they pass, the process proceeds to step 450; otherwise, the process proceeds to step 440.

  In step 440, the management entity returns a message to UE1 indicating that this communication request has failed. The management entity continues this communication request only when both UEs that require communication pass the security authentication, thus effectively avoiding unauthorized access to UEs in the user network from invalid UEs. The security of the party communicating with is guaranteed.

  In step 450, UE1 and UE2 pass the security authentication, and the management entity sends a communication request message including the device identification number of UE1 to UE2.

  In step 460, UE2 receives the request message from the management entity and decides whether to agree to this communication according to the device identification number of UE1 in the message. Again, if UE1 and UE2 are in the same PAN, UE2 receives a request message from the management entity via a common access network and decides whether to agree to this communication. If UE1 and UE2 are in different PANs, UE2 receives a request message from the management entity via the access network to which it belongs and decides whether to agree to this communication. If UE2 agrees to this communication, UE2 sends a feedback message indicating that it agrees to this communication to the management entity and proceeds to step 480. If not, go to step 470.

  In step 470, UE2 sends a feedback message rejecting this communication to the management entity, which informs UE1 of the failure of this communication request after receiving the reject message.

  In step 480, since UE2 has agreed to communicate with UE1, the management entity creates a temporary key for this communication and sends it to each of UE1 and UE2. At the same time, the management entity sends an acknowledgment message to UE1 indicating that UE2 has accepted this communication. Since the temporary key is temporarily created when both UEs need to communicate, it is random and real-time and may not be acquired by invalid users. The security of data transmission during communication is guaranteed to both parties that communicate using a temporary key.

  In step 490, UE1 and UE2 establish a point-to-point connection for communication after receiving the temporary key. Specifically, if UE1 and UE2 are in the same PAN, these UEs establish a direct connection within the PAN and communicate with a temporary key provided by the management entity after the establishment of this connection. If UE1 and UE2 are not in the same PAN, UE1 and UE2 establish a remote connection via their access networks, respectively, and communicate with a temporary key after this connection is established.

  Since the communicating UE performs remote communication without passing through the switch center, a considerable amount of resources of the switch center can be reserved, thereby making it possible to use resources more reasonably.

  While the invention has been illustrated and described with reference to certain preferred embodiments thereof, those skilled in the art will recognize that various modifications and equivalents may be made in form and detail without departing from the spirit or scope of the invention. You will understand that they can be replaced.

  This application is a Chinese patent entitled “System and Method for Communication of User Device in User Network” filed with the Chinese Patent Office on April 4, 2006. Claiming priority of application number 200610025438.0, the entire disclosure of which is hereby incorporated by reference.

FIG. 2 is a schematic diagram illustrating communication between UEs in the same user network in the prior art. It is the schematic which shows the communication system of UE in the user network based on the 1st Embodiment of this invention. It is the schematic which shows the communication system of UE in the user network based on the 2nd Embodiment of this invention. It is a flowchart which shows the communication method of UE in the user network based on the 3rd Embodiment of this invention.

Claims (10)

A user network communication system having an access network and at least two user devices belonging to the same user,
A management entity configured to store registration information of the user device and to perform security authentication of the user device;
When the first user equipment needs to communicate with the second user equipment, the first user equipment sends a communication request to the management entity via the access network, and the management entity sends the communication request. And security authentication of the first and second user devices based on the stored registration information, and the first user device and the second user device establish a point-to-point connection directly after authentication,
Communications system.   The communication system according to claim 1, wherein the communication request includes registration information of the first user device and a device identification number of the second user device.   The management entity transmits a communication request message including an identification number of the first user device to the second user device after the authentication is successful, and the second user device agrees with the communication request. 2. The communication system according to claim 1, wherein upon determination, a temporary secret key is created based on feedback information from the second user apparatus, and the secret key is transmitted to the first and second user apparatuses. .   The management entity sends a notification message to the first user device based on feedback information from the second user device, and if the second user device agrees to a communication request, the management entity 4. The communication system according to claim 3, wherein an acknowledgment message agreeing to a communication request is transmitted to the first user device, and the first and second user devices establish a point-to-point connection with the secret key.   The first and second user equipment are in the same personal area network and exchange information with the management entity via a single access network, and the point-to-point connection is a direct connection within the personal area network The communication system according to any one of claims 1 to 4.   The point-to-point connection wherein the first and second user equipment are in different personal area networks or are connected to separate access networks and exchange information with the management entity via separate access networks The communication system according to any one of claims 1 to 4, wherein is a remote connection established via the separate access network. A communication method used in a user network,
When the first user device and the second user device belong to the same user, and the first user device needs to communicate with the second user device, the first user device Sending a communication request for establishing a connection with the user equipment to a management entity storing registration information of the first user equipment via an access network;
The management entity performs security authentication of the first and second user devices based on a communication request and stored registration information;
Establishing a point-to-point connection between the first user device and the second user device after security authentication;
Communication method.   The communication method according to claim 7, wherein the communication request includes registration information of the first user device and a device identification number of the second user device. The first and second user devices pre-register with the management entity;
The management entity stores registration information of the first and second user devices;
The communication method according to claim 7, further comprising: Establishing the point-to-point connection;
After successful authentication, the second user equipment receives a request message including the identification number of the first user equipment from the management entity and returns a feedback message indicating whether to accept the communication request to the management entity. ,
If the management entity receives a feedback message indicating that the second user equipment has accepted the communication request, it creates a temporary secret key and uses the secret key as the first and second users. Transmitting to the first user device an acknowledgment message that the communication request has been accepted,
Establishing a point-to-point connection between the first and second user equipment with the secret key;
Including that,
The communication method according to claim 7.

Images