TWI641271B - Access authentication method, UE and access equipment - Google Patents

Abstract

The invention provides an access authentication method, a user terminal and an access device. The method may include: the user terminal sends a temporary identification to the access network, so that the access network sends the temporary identification to a network function, The network function determines whether the UE is authenticated according to the temporary identification.

Description

Access authentication method, UE and access equipment

The present invention belongs to the field of communication technology, and particularly relates to an access authentication method, a user terminal (User Equipment, UE), and an access device.

In a communication system, the UE often needs to connect to the core network through different access networks in different situations or scenarios. For example, after the UE is connected to the core network through one access network, the UE is connected to the core network through another access network. However, in current communication systems, each time the UE connects to the core network through the access network, it needs to perform an authentication process. And each time there is an interaction of signaling in the authentication process, there will be a problem of wasting signaling.

An object of the present invention is to provide an access authentication method, a UE, and an access device to solve the problem of signal waste.

In order to achieve the above object, an embodiment of the present invention provides an access authentication method, including: the UE sends a temporary identification to the access network, so that the access network sends the temporary identification to a network function, and the network function according to the The temporary identification determines whether the UE is authenticated.

Optionally, the temporary identifier is a temporary identifier assigned by the network function to the UE when the UE connects to the core network through another access network.

Optionally, the method further includes: if the UE is not authenticated, the UE performs an authentication process initiated by the network function, wherein the UE is not authenticated as the network function has not found the context of the UE according to the temporary identity.

Optionally, the UE also sends security verification information to the access network, and the access network also sends the security verification information to the network function, so that the network function judges that the UE is legal based on the security verification information Sex.

Optionally, the security verification information includes one or more of the following: an encrypted identification, an encrypted request message, or a signature.

Optionally, the method further includes: if the verification fails, the UE performs an authentication process initiated by the network function; or if the verification fails, the UE receives the network function through an access network to which the UE is already connected The new identification sent; or if the verification fails, the user terminal receives a rejection message returned by the network function.

An embodiment of the present invention further provides an access authentication method, including: an access device receives a temporary identification sent by the UE; the access device sends the temporary identification to a network function, so that the network function determines the temporary identification based on the temporary identification. Whether the UE is authenticated.

Optionally, the temporary identifier is a temporary identifier assigned to the UE by the network function when the UE is connected to the core network through another access network, wherein the other access network does not include the access device.

Optionally, the method further includes: if the network function finds the context of the UE according to the temporary identifier, it indicates that the UE is authenticated, and the access device receives the authentication information of the UE sent by the network function. .

Optionally, the access device further receives security verification information sent by the UE, And the access network also sends the security verification information to the network function, so that the network function authenticates the UE according to the security verification information.

Optionally, the security verification information includes one or more of the following: an encrypted identification, an encrypted request message, or a signature.

An embodiment of the present invention further provides a UE, including: a sending module, configured to send a temporary identification to an access network, so that the access network sends the temporary identification to a network function, and the network function according to the temporary identification Determine whether the UE is authenticated.

Optionally, the temporary identifier is a temporary identifier assigned by the network function to the UE when the UE connects to the core network through another access network.

Optionally, the UE further includes: a first execution module configured to perform an authentication process initiated by the network function if the UE is not authenticated, wherein the UE is not authenticated as the network function is not found according to the temporary identifier To the context of this UE.

Optionally, the UE also sends security verification information to the access network, and the access network also sends the security verification information to the network function, so that the network function judges that the UE is legal based on the security verification information Sex.

Optionally, the security verification information includes one or more of the following: an encrypted identification, an encrypted request message, or a signature.

Optionally, the UE further includes: a second execution module for performing an authentication process initiated by the network function if the verification fails, or a first receiving module for receiving the verification if the verification fails A new identification sent by the network function through the access network to which the UE is already connected; or a second receiving module for receiving a rejection message returned by the network function if the authentication fails.

An embodiment of the present invention further provides an access device, including: a first receiving module, A receiving module is used to receive a temporary identification sent by the UE; a sending module is used to send the temporary identification to a network function, so that the network function judges whether the UE is authenticated according to the temporary identification.

Optionally, the temporary identifier is a temporary identifier assigned to the UE by the network function when the UE is connected to the core network through another access network, wherein the other access network does not include the access device.

Optionally, the access device further includes a second receiving module configured to, if the network function finds the context of the UE according to the temporary identifier, it indicates that the UE is authenticated and receives the network function sent by the network function. UE certified prompt information.

Optionally, the access device further receives the security verification information sent by the UE, and the access network also sends the security verification information to the network function, so that the network function sends the security verification information to the UE according to the security verification information. For certification.

Optionally, the security verification information includes one or more of the following: an encrypted identification, an encrypted request message, or a signature.

An embodiment of the present invention further provides a user terminal, including a processor, a transceiver, a memory, a user interface, and a bus interface. The processor is configured to read a program in the memory and execute the following processes: The transceiver sends a temporary identification to the access network, so that the access network sends the temporary identification to the network function, and the network function judges whether the user terminal is authenticated according to the temporary identification; the transceiver is used for Receive and send data under the control of the processor.

An embodiment of the present invention further provides an access device, including a processor, a transceiver, a memory, a user interface, and a bus interface. The processor is configured to read a program in the memory and execute the following processes: The transceiver receives a temporary identification sent by the UE; the temporary identification is sent to the network function through the transceiver, so that the network function judges the use according to the temporary identification Whether the user terminal has been authenticated; the transceiver is used to receive and send data under the control of the processor.

The above technical solution of the present invention has at least the following beneficial effects. In the embodiment of the present invention, the UE sends a temporary identification to the access network, so that the access network sends the temporary identification to a network function, and the network function determines whether the UE is authenticated according to the temporary identification. In this way, the UE only needs to send a temporary identification to the access network, and the network function can determine whether the UE is authenticated based on the temporary identification, thereby avoiding the need for the UE to perform an authentication process every time it connects to the core network through an access network. To reduce signaling waste.

201, 701-702 ‧‧‧ steps

800‧‧‧UE

801‧‧‧ sending module

802‧‧‧The first execution module

803‧‧‧Second executive module

804‧‧‧First receiving module

805‧‧‧Second receiving module

1100‧‧‧Access equipment

1101‧‧‧First receiving module

1102‧‧‧Send Module

1103‧‧‧Second receiving module

1300, 1400‧‧‧ processors

1310, 1410‧‧‧ Transceiver

1320, 1420‧‧‧Memory

1330, 1430‧‧‧ User Interface

FIG. 1 is a schematic diagram of a network structure applicable to an embodiment of the present invention; FIG. 2 is a schematic flowchart of an access authentication method provided by an embodiment of the present invention; and FIG. 3 is a flowchart of another access authentication method provided by an embodiment of the present invention 4 is a schematic diagram of another access authentication method provided by an embodiment of the present invention; FIG. 5 is a schematic diagram of another access authentication method provided by an embodiment of the present invention; FIG. 6 is another storage method provided by an embodiment of the present invention A schematic diagram of an authentication method; FIG. 7 is a schematic flowchart of another access authentication method according to an embodiment of the present invention; FIG. 8 is a schematic structural diagram of a UE according to an embodiment of the present invention; A structural schematic diagram of a UE; FIG. 10 is a structural schematic diagram of another UE provided by an embodiment of the present invention; FIG. 11 is a structural schematic diagram of an access device provided by an embodiment of the present invention; FIG. 12 is another structural example provided by the embodiment of the present invention Structural diagram of access equipment; FIG. 13 is a schematic structural diagram of another UE according to an embodiment of the present invention; and FIG. 14 is a structural schematic diagram of another access device according to an embodiment of the present invention.

In order to make the technical problems, technical solutions, and advantages of the present invention clearer, the following describes in detail with reference to the accompanying drawings and specific embodiments.

Referring to FIG. 1, FIG. 1 is a schematic diagram of a network structure to which an embodiment of the present invention can be applied. As shown in FIG. 1, it includes a UE, a non-3GPP access network entity, and a non-3GPP Access Stratum Function. N3ASF), control plane functions (CP functions), user plane functions (UP functions), application functions (AF) and data network (DN). Among them, Y1 represents the interface between the UE and a non-3GPP access network (eg, WLAN) entity, Y2 represents the interface between the UE and a N3ASF entity, and Y4 represents the interface between the N3ASF entity and the non-3GPP access network entity Interface, NG1 indicates the interface between the UE and the control plane function, and NG2 indicates the interface between the N3ASF control plane function. It can also be understood as the interface between the Radio Access Network (RAN) and the control plane function. , NG3 indicates the interface between N3ASF and user-side functions, which can also be understood as the interface between RAN and user-surface functions, NG4 indicates the interface between control-plane functions and user-surface functions, and NG5 indicates the control-plane interface. Interface between surface function and AF, NG6 represents the interface between user plane function and DN. In addition, the above N3ASF is a logical component of the access network, which terminates the NG2 or NG3 interface. The protocol used between the UE and the N3ASF is N3-AS, which can be used to transparently transmit NAS messages, user plane-borne information, and security information between the UE and the core network. Of course, the above network structure may also include other entities such as 3GPP access network entities. Other access to the network entity is not limited in comparison with the embodiment of the present invention. It should be noted that the embodiments of the present invention are not limited to be implemented in the above network structure, and the above network structure is only an example.

In addition, the UE may be a mobile phone, a tablet personal computer, a laptop computer, a personal digital assistant (PDA), a mobile Internet device (MID), or a wearable device. It should be noted that terminal-side equipment such as a wearable device is not limited to a specific type of UE in the embodiment of the present invention.

Referring to FIG. 2, an embodiment of the present invention provides an access authentication method. As shown in FIG. 2, the method includes the following steps: 201. The UE sends a temporary identifier to the access network, so that the access network sends the Temporary identification. The network function determines whether the UE is authenticated according to the temporary identification.

In the embodiment of the present invention, the UE can send the temporary identifier to the access network through the above steps, and then the network function can determine whether the UR is authenticated based on the temporary identifier. For example, the network function can find out through the temporary identifier. The context of the above UE indicates that the UE has been authenticated, which means that the UE has been connected to the core network through another access network. And after the network function determines that the UE has been authenticated, there is no need to initiate an authentication process to the UE. Therefore, the foregoing steps can be implemented to avoid performing multiple authentication processes when the UE is connected to the core network through different access networks to reduce signaling waste.

In the embodiment of the present invention, the network function may be a control plane function.

Optionally, the temporary identifier is a temporary identifier assigned by the network function to the UE when the UE connects to the core network through another access network.

In this embodiment, the temporary identifier is that the UE connects to the core through another access network. Temporary ID assigned by the network function when the network is connected. The other access network may be an access network different from the access network in step 201. For example, the access network in step 201 is a 3GPP access network, and the other access networks may be It is an access network other than the 3GPP access network, such as a non-3GPP access network.

Optionally, the method further includes: if the UE is not authenticated, the UE performs an authentication process initiated by the network function, wherein the UE is not authenticated as the network function has not found the context of the UE according to the temporary identity.

In this implementation manner, if the network function determines that the UE is not authenticated according to the temporary identifier, for example: before the UE performs step 201, the UE is not connected to the core network through another access network, the network function can report to the above The UE initiates an authentication process, that is, the UE performs the authentication process initiated by the network function.

Optionally, the UE also sends security authentication information to the access network, and the access network (access network in step 201) also sends the security authentication information to the network function, so that the network The function judges the legitimacy of the UE according to the security verification information.

The security verification information may be sent together with the temporary identification. For example, a message carrying the security verification information and the temporary identification is sent to the access network. In addition, after the access network receives the security verification information, it also sends the security verification information to the network function, so that the network function can determine the legitimacy of the UE according to the security verification information. In this way, a situation in which a malicious terminal intercepts the identity of the UE and pretends that the UE is connected to the core network can be avoided. In addition, the security verification information may be pre-negotiated by the UE and the network function, or the security verification information may be pre-designated by the network function, and so on.

Optionally, the above security verification information includes one or more of the following: encrypted Identification, encrypted request message or signature.

The request message may be an attach request or a request to connect to a core network. If the security verification information includes the request message, the network function may be to check the integrity of the request message using the integrity key in the context of the UE. And using the key in the above context to decrypt the request message, if the decryption is successful, it is determined that the verification is passed, that is, it is determined that the UE is legitimate.

The identifier may be an International Mobile Subscriber Identification Number (IMSI) or an International Mobile Equipment Identity (IMEI). If the security verification information includes the identifier, the network function may be to use the security information in the context of the UE to decrypt the identifier. If the decryption is successful, it is determined that the verification is passed, that is, the UE is determined to be legitimate.

The signature may be a digital signature. The network function may be to use the signature in the context of the UE to match the signature in the security verification information. If the matching is successful, it is determined that the verification is passed, that is, the UE is determined to be legitimate.

Optionally, the above method further includes: if the verification fails, the UE performs an authentication process initiated by the network function; or if the verification fails, the UE receives the network function through an access network to which the UE is already connected The new identity sent; or if the verification fails, the UE receives a rejection message returned by the network function.

In this embodiment, if the verification fails, the UE can perform an authentication process initiated by a network function. Or if the verification fails, the UE receives a new identity sent by the network function through the access network to which the UE is already connected, so that the UE can use the new identity for authentication. In addition, if the verification fails, if you receive a rejection message from the network function, it means that the network function is rejected. The UE is connected to the core network through the above access network, so that a situation in which a malicious terminal intercepts the identity of the UE and pretends that the UE is connected to the core network can be avoided.

Optionally, the UE may send the temporary identifier to the access network through an RRC message, and the RRC message further includes an attach request. For example: the access network in step 201 is a 3GPP access network, and the UE has connected to the core network through a non-3GPP access network, as shown in FIG. 3, and includes the following steps: Step 1. The UE sends to the 3GPP access network RRC message. The RRC message includes an attachment request and a temporary identification. The attachment request may be an encrypted attachment request. Step 2. The 3GPP access network obtains the network function assigned the temporary identification according to the temporary identification, and sends the network function to the network function. NG2 interface message, the message includes the attachment request and the temporary identification; Step 3. The network function finds the context of the UE according to the temporary identification, and uses the security information in the context to determine the security of the attachment request. If the attachment request is secure (such as using The integrity key checks the integrity of the message, and the key can be used to successfully decrypt the attach request), then the network function stores a new access network in the context of the UE (that is, the 3GPP access network to which the 3GPP access network entity belongs) ) Information, and then return the NG2 interface message to the 3GPP access network, the message includes an attachment acceptance message; Step 4, the 3GPP access network returns an RRC message to the UE, and the message includes an attachment By the message.

In addition, the UE may also send the temporary identifier to the access network through the connection establishment message. For example, the message parameter of the connection establishment message includes the temporary identifier. For example, the access network in step 201 is a non-3GPP access network, and the UE has connected to the core network through the 3GPP access network, as shown in FIG. 4, including the following steps: Step 1. The UE sends a connection establishment message to the non-3GPP access network. The message parameters include the temporary identifier assigned by the network function when the UE connects to the core network through 3GPP access. Step 2. The non-3GPP access network sends the N3ASF. Connection request message. The message parameter is a temporary identifier provided by the UE. It should be noted that this step is not performed if N3ASF and non-3GPP access network are combined; step 3, N3ASF sends the NG2 interface message to the network function, the message parameters include the access technology and the temporary identification provided by the UE; step 4 The network function finds the context of the UE according to the UE's temporary identity. It is found that the UE has connected to the core network through the 3GPP access network. The network function sends an NG2 interface message to the N3ASF. The message carries the certified prompt information. Step 5. The N3ASF sends a connection reply message to the non-3GPP access network, and the message carries the authentication prompt information. It should be noted that if the N3ASF and the non-3GPP access network are combined, this step is not performed; step 6, the non-3GPP access network sends a connection establishment completion message to the UE.

In addition, in this embodiment, the connection establishment message may further include an encrypted identification or signature. For example, in this embodiment, the UE may also use the security context to encrypt the IMSI or IMEI of the UE, and encrypt the IMSI or IMEI after encryption. The IMEI is sent to the non-3GPP access network entity through step 1. That is, in the foregoing embodiment, the messages in steps 1, 2 and 3 also carry the encrypted IMSI or IMEI, or a signature. In step 3, the network function uses the temporary identity to find the context of the UE, and then uses the security information in the context to decrypt the IMSI and IMEI, or verify the signature. If the UE's IMSI and IMEI can be decrypted or the signature is correct, then This indicates that the UE is a correct UE. If the decrypted identity is different from the IMSI or IMEI in the context of the UE, Or the signature is incorrect, it means that the UE is posing as a malicious terminal.

In addition, in this embodiment, since a connection establishment message and a connection completion message are transmitted between the UE and the access network, the protocol between the UE and the non-3GPP access network can be extended.

In addition, the UE may also send the temporary identification to the access network through an Extensible Authentication Protocol (EAP) response message. For example, the access network in step 201 may be a non-3GPP access network, and the UE has been connected to the core network through the 3GPP access network, as shown in FIG. 5, and includes the following steps: Step 1. The UE and the non-3GPP access network Establish a connection between them; Step 2, the non-3GPP access network sends an EAP-REQ / Identity message to the UE to initiate the EAP authentication process; step 3, the UE returns an EAP-RSP / Identity message to the non-3GPP access network, the message carries UE's temporary identity; Step 4. The non-3GPP access network sends the EAP-RSP / Identity message to N3ASF. It should be noted that if N3ASF and non-3GPP access network are combined, this step will not be performed. Step 5. N3ASF will The EAP-RSP / Identity message is sent to the network function. Step 6. The network function finds that the UE has connected to the core network through 3GPP access. The network function does not perform the authentication process on the UE again, it returns an EAP-Success message to the N3ASF. Step 7. The N3ASF returns an EAP-Success message to the non-3GPP access network. It should be noted that if N3ASF and the non-3GPP access network are combined, this step is not performed. Step 8. The non-3GPP access network returns to the UE. EAP-Success message.

Among them, in order to ensure that the UE is a legitimate UE, the UE may also perform EAP-RSP / Identity The message carries the encrypted IMSI, IMEI, or signature.

In addition, in this embodiment, there is no need to extend the protocol between the UE and the non-3GPP access network.

The UE may also send the temporary identification to the access network through an agreement request message. For example, the access network in step 201 may be an access network including N3ASF. The UE has connected to the core network through the 3GPP access network, as shown in the figure. As shown in Figure 6, it includes the following steps: Step 1. The UE sends an N3-AS request message to the N3ASF. The message includes the temporary identifier assigned by the network function when the UE accesses the core network through 3GPP. Step 2. The N3ASF obtains the temporary identifier based on the temporary identifier. Allocate the network function of the temporary identity, and then send an NG2 interface message to the network function, which includes the access technology and the temporary identity; Step 3. The network function finds the context of the UE based on the temporary identity, which indicates that the UE has passed 3GPP The access has performed the authentication process, which returns an NG2 interface message to the N3ASF, which includes the authenticated prompt information. Step 4. The N3ASF returns a N3-AS reply message to the UE, which includes the authenticated prompt information. In addition, to ensure that the UE is For legitimate UEs, the messages in steps 1 and 2 may also include the encrypted IMSI, IMEI, or signature.

It should be noted that among the various optional implementation modes described in the embodiments of the present invention, they may be implemented in combination with each other or separately, which is not limited in this embodiment of the present invention.

In the embodiment of the present invention, the UE sends a temporary identification to the access network, so that the access network sends the temporary identification to the network function, and the network function determines whether the UE is based on the temporary identification. No Certified. In this way, the UE only needs to send a temporary identification to the access network, and the network function can determine whether the UE is authenticated based on the temporary identification, thereby avoiding the need for the UE to perform an authentication process every time it connects to the core network through an access network. To reduce signaling waste.

Please refer to FIG. 7. FIG. 7 is another access authentication method provided by an embodiment of the present invention. As shown in FIG. 7, it includes the following steps: 701, the access device receives a temporary identification sent by the UE; 702, the access device sends to the network The channel function sends the temporary identification, so that the network function determines whether the UE is authenticated according to the temporary identification.

It should be noted that the above access device may be the access device in the access network in step 201 in the embodiment shown in FIG. 2, wherein the access network in step 201 in the embodiment shown in FIG. 2 Any implementation manner can implement the access device entity, and details are not described herein.

Optionally, the temporary identifier is a temporary identifier assigned to the UE by the network function when the UE is connected to the core network through another access network, wherein the other access network does not include the access device.

Optionally, the method further includes: if the network function finds the context of the UE according to the temporary identifier, it indicates that the UE is authenticated, and the access device receives the authentication information of the UE sent by the network function. .

Optionally, the access device further receives the security verification information sent by the UE, and the access network also sends the security verification information to the network function, so that the network function sends the security verification information to the UE according to the security verification information. For certification.

Optionally, the security verification information includes one or more of the following: an encrypted identification, an encrypted request message, or a signature.

It should be noted that this embodiment is an implementation manner of the access network corresponding to the embodiment shown in FIG. 2-6 (the access network in step 201). For a specific implementation manner, refer to FIG. 2-6. The related descriptions of the illustrated embodiments are not repeated in this embodiment to avoid repetitive descriptions. In this embodiment, signaling waste can also be reduced.

Please refer to FIG. 8, which shows a UE structure. As shown in FIG. 8, the UE 800 includes the following modules: a sending module 801 configured to send a temporary identification to the access network to make the access network to the network The network function sends the temporary identification, and the network function determines whether the UE is authenticated according to the temporary identification.

Optionally, the temporary identifier is a temporary identifier assigned by the network function to the UE when the UE connects to the core network through another access network.

Optionally, as shown in FIG. 9, the UE 800 further includes: a first execution module 802 configured to perform an authentication process initiated by the network function if the UE is not authenticated, wherein the UE is not authenticated as the network The function does not find the context of the UE according to the temporary identity.

Optionally, the UE also sends security verification information to the access network, and the access network also sends the security verification information to the network function, so that the network function judges that the UE is legal based on the security verification information Sex.

Optionally, the security verification information includes one or more of the following: an encrypted identification, an encrypted request message, or a signature.

Optionally, as shown in FIG. 10, the UE 800 further includes: a second execution module 803 for performing an authentication process initiated by the network function if the verification fails, or a first receiving module 804 for If the verification fails, receiving a new identity sent by the network function through the access network to which the UE is already connected; or a second receiving module 805 for receiving the verification if the verification fails Reject message returned by network function.

It should be noted that the above-mentioned UE 800 in this embodiment may be a UE in any of the method embodiments in the embodiments of the present invention, and any embodiment of the UE in the method embodiments in the embodiments of the present invention may be used in this embodiment. The above-mentioned UE 800 is implemented, and the same beneficial effects are achieved, which will not be repeated here.

Referring to FIG. 11, an embodiment of the present invention provides an access device. As shown in FIG. 11, the access device 1100 includes the following modules: a first receiving module 1101 for receiving a temporary identifier sent by the UE; and a sending module 1102. Send the temporary identification to a network function, so that the network function determines whether the UE is authenticated according to the temporary identification.

Optionally, the temporary identifier is a temporary identifier assigned to the UE by the network function when the UE is connected to the core network through another access network, wherein the other access network does not include the access device.

Optionally, as shown in FIG. 12, the access device 1100 further includes: a second receiving module 1103, configured to, if the network function finds the context of the UE according to the temporary identifier, it indicates that the UE is authenticated and receives The authentication information sent by the network function that the UE has been authenticated.

Optionally, the access device further receives the security verification information sent by the UE, and the access network also sends the security verification information to the network function, so that the network function sends the security verification information to the UE according to the security verification information. For certification.

Optionally, the security verification information includes one or more of the following: an encrypted identification, an encrypted request message, or a signature.

It should be noted that the access device 1100 in this embodiment may be an access device in any implementation manner of the method embodiment in the embodiment of the present invention. The method in the embodiment of the present invention Any implementation manner of the access device in this embodiment can be implemented by the above-mentioned access device 1100 in this embodiment, and the same beneficial effects are achieved, and details are not described herein again.

Referring to FIG. 13, a structure of a UE is shown. The UE includes: a processor 1300, a transceiver 1310, a memory 1320, a user interface 1330, and a bus interface, where the processor 1300 is configured to read memory. The program in 1320 executes the following process: sending a temporary identification to the access network through the transceiver 1310, so that the access network sends the temporary identification to the network function, and the network function determines whether the UE is based on the temporary identification verified. The transceiver 1310 is configured to receive and send data under the control of the processor 1300.

In FIG. 13, the bus architecture may include any number of interconnected buses and bridges. Specifically, one or more processors represented by the processor 1300 and various circuits of the memory represented by the memory 1320 are connected together. The bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art, and therefore, they will not be further described herein. The bus interface provides an interface. The transceiver 1310 may be a plurality of elements, including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. For different user equipments, the user interface 1330 may also be an interface capable of externally connecting internally required devices. The connected devices include, but are not limited to, a keypad, a display, a speaker, a microphone, a joystick, and the like.

The processor 1300 is responsible for managing the bus architecture and general processing, and the memory 1320 can store data used by the processor 1300 when performing operations.

Optionally, the temporary identifier is a temporary identifier assigned by the network function to the UE when the UE connects to the core network through another access network.

Optionally, the processor 1300 is further configured to: if the UE is not authenticated, execute the network The authentication process initiated by the network function, wherein the UE is not authenticated as the network function has not found the context of the UE according to the temporary identity.

Optionally, the processor 1300 also sends the security verification information to the access network through the transceiver 1310, and the access network also sends the security verification information to the network function, so that the network function is based on the security verification Information to determine the legitimacy of the UE.

Optionally, the security verification information includes one or more of the following: an encrypted identification, an encrypted request message, or a signature.

Optionally, the processor 1300 is further configured to: if the verification fails, execute the authentication process initiated by the network function; or if the verification fails, receive the network function sent by the access network to which the UE is already connected. A new identity; or if the verification fails, the UE's request to connect to the core network through the access network is rejected by the network function.

It should be noted that the UE in this embodiment may be a UE in any of the method embodiments in the embodiments of the present invention, and any embodiment of the UE in the method embodiments in the embodiments of the present invention may be used in this embodiment. The above-mentioned UE achieves and achieves the same beneficial effects, and is not repeated here.

Referring to FIG. 14, a structure of an access device is shown. The access device includes: a processor 1400, a transceiver 1410, a memory 1420, a user interface 1430, and a bus interface. The processor 1400 is used for Read the program in the memory 1420 and execute the following process: receiving a temporary identification sent by the UE through the transceiver 1410; sending the temporary identification to the network function through the transceiver 1410, so that the network function judges the Whether the UE is authenticated. The transceiver 1410 is configured to receive and send data under the control of the processor 1400.

In Figure 14, the bus architecture can include any number of interconnected buses And the bridge, specifically one or more processors represented by the processor 1400 and various circuits of the memory represented by the memory 1420 are connected together. The bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art, and therefore, they will not be further described herein. The bus interface provides an interface. The transceiver 1410 may be multiple elements, including a transmitter and a receiver, providing a unit for communicating with various other devices over a transmission medium. For different user devices, the user interface 1430 may also be an interface capable of externally connecting and connecting the required devices. The connected devices include, but are not limited to, a keypad, a display, a speaker, a microphone, a joystick, and the like.

The processor 1400 is responsible for managing the bus architecture and general processing, and the memory 1420 can store data used by the processor 1400 when performing operations.

Optionally, the temporary identifier is a temporary identifier assigned to the UE by the network function when the UE is connected to the core network through another access network, wherein the other access network does not include the access device.

Optionally, the processor 1400 is further configured to: if the network function finds the context of the UE according to the temporary identifier, it means that the UE is authenticated, and receive prompt information that the UE is authenticated and sent by the network function.

Optionally, the processor 1400 also receives the security verification information sent by the UE through the transceiver 1410, and further sends the security verification information to the network function through the transceiver 1410, so that the network function is based on the security verification information. The UE is authenticated.

Optionally, the security verification information includes one or more of the following: an encrypted identification, an encrypted request message, or a signature.

It should be noted that the access device in this embodiment may be an implementation of the present invention. The access device in any of the method embodiments in the example, any implementation method of the access device in the method embodiment in the embodiment of the present invention can be implemented by the above access device in this embodiment, and achieve the same benefits The effect is not repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed methods and devices may be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner. For example, multiple units or elements may be combined or integrated. To another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, which may be electrical, mechanical or other forms.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be separately physically included, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware, or in the form of hardware plus software functional units.

The integrated unit implemented in the form of a software functional unit may be stored in a computer-readable storage medium. The software functional unit is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute part of the steps of the transmitting and receiving method of each embodiment of the present invention. The foregoing storage medium includes: a portable disk, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc. Coded media.

The above is a preferred embodiment of the present invention, and it should be noted that for the present technology For those of ordinary skill in the art, without departing from the principles described in the present invention, several improvements and retouches can be made, and these improvements and retouches should also be regarded as the protection scope of the present invention.

Claims (22)

An access authentication method includes: a user terminal sends a temporary identification to an access network, so that the access network sends the temporary identification to a network function, and the network function determines whether the user terminal is based on the temporary identification Authenticated; and if the network function finds the context of the user terminal according to the temporary identification, it means that the user terminal has been authenticated, and the network function does not initiate an authentication process to the user terminal. The access authentication method according to claim 1, wherein the temporary identifier is a temporary identifier assigned by the network function to the user terminal when the user terminal connects to the core network through another access network. The access authentication method according to claim 1, wherein the method further comprises: if the network function does not find the context of the user terminal according to the temporary identifier, it indicates that the user terminal is not authenticated, and the user The terminal performs the authentication process initiated by the network function. The access authentication method according to any one of claims 1 to 3, wherein the user terminal further sends security authentication information to the access network, and the access network also sends the network function to the network function. Security authentication information, so that the network function judges the legitimacy of the user terminal according to the security authentication information. The access authentication method according to claim 4, wherein the security verification information includes one or more of the following: an encrypted identification, an encrypted request message, or a signature. The access authentication method according to claim 4, further comprising: if the verification fails, the user terminal executes an authentication process initiated by the network function; or if the verification fails, the user terminal Receiving a new identification sent by the network function through an access network to which the user terminal is already connected; or if the verification fails, the user terminal receives a rejection message returned by the network function. An access authentication method includes: an access device receives a temporary identification sent by a user terminal; the access device sends the temporary identification to a network function, so that the network function determines whether the user terminal is based on the temporary identification Authenticated; and if the network function finds the context of the user terminal according to the temporary identification, it indicates that the user terminal is authenticated, and the access device receives a prompt that the user terminal is authenticated sent by the network function Information. The access authentication method according to claim 7, wherein the temporary identifier is a temporary identifier assigned by the network function to the user terminal when the user terminal connects to the core network through another access network, and the other identifier is The access network does not include the access device. The access authentication method according to claim 7 or 8, wherein the access device further receives security verification information sent by the user terminal, and the access network also sends the security verification information to the network function To enable the network function to authenticate the user terminal based on the security verification information. The access authentication method according to claim 9, wherein the security verification information includes one or more of the following: an encrypted identification, an encrypted request message, or a signature. A user terminal includes: a sending module for sending a temporary identification to an access network, so that the access network sends the temporary identification to a network function, and the network function judges the user based on the temporary identification Whether the terminal is authenticated; if the network function finds the context of the user terminal according to the temporary identification, it indicates that the user terminal has been authenticated, and the network function does not initiate an authentication process to the user terminal. The user terminal according to claim 11, wherein the temporary identifier is a temporary identifier assigned by the network function to the user terminal when the user terminal connects to the core network through another access network. The user terminal according to claim 11, wherein the user terminal further comprises: a first execution module for indicating that if the network function fails to find the context of the user terminal according to the temporary identifier, The user terminal is not authenticated, and the user terminal performs an authentication process initiated by the network function. The user terminal according to any one of claims 11 to 13, wherein the user terminal further sends security authentication information to the access network, and the access network also sends the security to the network function. Authentication information, so that the network function judges the legitimacy of the user terminal based on the security authentication information. The user terminal according to claim 14, wherein the security verification information includes one or more of the following: an encrypted identification, an encrypted request message, or a signature. The user terminal according to claim 14, wherein the user terminal further comprises: a second execution module for performing an authentication process initiated by the network function if the verification fails; or a first receiving module For receiving a new identification sent by the network function through an access network to which the user terminal is connected if the verification fails, or a second receiving module for receiving the network if the verification fails Reject message returned by the function. An access device includes: a first receiving module for receiving a temporary identification sent by a user terminal; and a sending module for transmitting the temporary identification to a network function so that the network function is based on the temporary identification Judging whether the user terminal is authenticated; and a second receiving module configured to, if the network function finds the context of the user terminal according to the temporary identification, it indicates that the user terminal is authenticated to receive the network function The authentication prompt information sent by the user terminal. The access device according to claim 17, wherein the temporary identification is a temporary identification allocated by the network function to the user terminal when the user terminal connects to the core network through another access network, and the other storage Network access does not include the access device. The access device according to claim 17 or 18, wherein the access device further receives security verification information sent by the user terminal, and the access network also sends the security verification information to the network function, So that the network function authenticates the user terminal based on the security verification information. The access device according to claim 19, wherein the security verification information includes one or more of the following: an encrypted identification, an encrypted request message, or a signature. A user terminal includes: a processor, a transceiver, a memory, a user interface, and a bus interface. The processor is used to read a program in the memory and execute the following process: to the access network through the transceiver Sending a temporary identification so that the access network sends the temporary identification to the network function, and the network function determines whether the user terminal is authenticated based on the temporary identification; and if the network function finds out based on the temporary identification The context of the user terminal indicates that the user terminal has been authenticated, and the network function does not initiate the authentication process to the user terminal; the transceiver is used to receive and send data under the control of the processor. An access device includes: a processor, a transceiver, a memory, a user interface, and a bus interface. The processor is used to read a program in the memory and execute the following process: receiving the A temporary identification; sending the temporary identification to the network function through the transceiver so that the network function judges whether the user terminal is authenticated based on the temporary identification; and if the network function finds the user based on the temporary identification The context of the terminal means that the user terminal is authenticated, and the access device receives the prompt information that the user terminal has been authenticated sent by the network function; the transceiver is used to receive and send data under the control of the processor.