WO2007051406A1

WO2007051406A1 - A control system and method for terminal using network and device therefore

Info

Publication number: WO2007051406A1
Application number: PCT/CN2006/002908
Authority: WO
Inventors: Shufeng Shi; Xuexia Yan
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2005-10-31
Filing date: 2006-10-30
Publication date: 2007-05-10
Also published as: CN1874595A; CN100459799C

Abstract

A control system for terminal using network includes at least network switch center (NSC) with registered terminal and terminal device identification center in which the authentication information of terminal user registering network is prestored; the NSC received the register information of terminal user and the the authentication information of terminal user requested to the terminal device identification center, and determine whether the terminal should be accessed in the network according to the return result. A control method for terminal using network is provided in the invention, and the relative NSC as well as. In the invention, when terminal registers a network, comparing the relative information of the terminal with the authentication information prestored in the terminal device identification center, and determining whether it is authenticated, which could prevent the unauthentic user to use network effectively.

Description

Control system and control method and device for terminal using network

This application claims priority to Chinese Patent Application No. 200510100913.1, entitled "Control System for Terminal Use Network and Control Method" thereof, filed on October 31, 2005, the entire contents of which are incorporated by reference. Combined in this application.

TECHNICAL FIELD The present invention relates to security technologies in mobile communications, and in particular to a control system and control method and apparatus for a terminal using a network.

Background technique

In mobile communication, the device identification number is used to manage the mobile terminal. For example, a public land mobile network (PLMN) is provided with a functional unit called an Equipment Identity Register (EIR), which is mainly responsible for managing the device identification of mobile terminals in the network. In the GSM (Global System for Mobile Communications) network, the device identifier refers to the International Mobile Equipment Identification (IMEI), in the CDMA (Code Division Multiple Access) network. The device identifier refers to an electronic serial number (ESN). The following is a description of the GSM network as an example.

The IMEI code in the GSM network is a unique identifier of a mobile terminal and is immutable. Its main purpose is to prevent unauthorized (eg, stolen or faulty, non-model-certified) mobile devices from being used in the network. .

A list of three terminal device identifiers is stored in the device identification register: whitelist, blacklist, and graylist. The whitelist stores the terminal identifiers that are allowed to use the network. The blacklist stores the terminal identifiers that are not allowed to use the network. The graylist stores the terminal identifiers that the network may need to track or otherwise process. Is it allowed to use the carrier? Decide.

The network may require IMEI check on the mobile terminal whenever it is needed (including during access or calling), if the device identification register returns the terminal IMEI as an illegal number (If it is in the blacklist or not in the whitelist:), the mobile terminal is denied to use the network.

Figure 1 shows the location of the device identification register in a commonly used mobile network (such as the GSM network) reference model. In the GSM network reference model, the structure mainly includes three parts: a base station subsystem (BSS) 110, a network subsystem (NSS) 120, and an operation support subsystem (OSS). 130. The base station subsystem 110 further includes a plurality of base station transceiver stations (BTS, Base Station Transceiver System) 111 and a base station controller (BSC) 112; the network subsystem 120 includes a mobile service switching center (MSC, Mobile Switching). Center ) / Visited Location Register (VLR, Visited Location Register) 121, Home Location Register (HLR, Home Location Register) / Authentication Center (AUC, Authentication Center) 122, Operation and Maintenance Center (OMC, Operation & Maintenance Center) 123 And an Equipment Identifier Register (EIR) 124; the operation support subsystem 130 includes a Network Management Center (NMC) 131, a Data Post Processing System (DPPS) 132, and a Security Management Center. (SEMC, Security Management Center) 133 and User Identification Center for Subscriber (PCS) 134. The mobile terminal as a mobile station (MS, Mobile Station) 140 can interact with the base transceiver station 111; the mobile service switching center 121 can be connected to a public data network (PDN), a public telephone network (PSTN, Public) Switching Telephone Network) Network 150 such as Integrated Service Digital Network (ISDN).

At present, since the network operator does not verify the IMEI code of the mobile terminal when the user enters the network, there are some cases where the unauthorized user uses the network. For example, after the mobile terminal is stolen, the thief can generally use the card replacement method. The mobile terminal.

There are also some ways to prevent unauthorized mobile terminals (described below as examples of stolen terminals): For example, in an existing method, the whitelist and blacklist in the device identification register The gray list needs to be set by the manager. The user registers the stolen terminal with the management center of the device identification register, and adds the IMEI code of the stolen terminal to the blacklist, thereby preventing the stolen terminal from reusing the network. When a user registers or initiates a call with the stolen terminal, the mobile switching center and the visitor location register can be directed to the mobile station terminal. (eg mobile phone) request IMEI, and send the IMEI code of the request to the device identification register, the device identification register compares the received IMEI code with the white list, the black list and the number in the gray list, and sends the comparison result to The mobile switching center/visitor location register, the mobile switching center/visitor location register determines whether the mobile station device is allowed to access the network based on the result of the comparison, or can track related information of the terminal, such as location information.

In this method, after the terminal is stolen, the original user of the terminal needs to register with the device identification register management center, and the network can prevent the stolen terminal from reusing the network after the stolen terminal is added to the blacklist. If the user loses the terminal and does not go to the device identification register management center for registration, the thief can still use the stolen terminal after the card is exchanged. Therefore, the existing method cannot prevent the unauthorized terminal from using the network completely and timely. .

Summary of the invention

The present invention provides a control system, method and apparatus for a terminal to use a network. When an unauthorized terminal attempts to use the network, the network can automatically detect the unauthorized terminal and prevent it from using the network.

According to an aspect of the present invention, a method for controlling a terminal to use a network includes: transmitting, by a terminal, a terminal device identifier and authentication information of the terminal to a network switching center; and after receiving the foregoing information sent by the terminal, the network switching center The terminal device identification center queries the preset authentication information corresponding to the identifier of the terminal device;

The network switching center allows the terminal to access the network when it is confirmed that the preset authentication information returned by the terminal device identification center matches the authentication information sent by the terminal.

According to another aspect of the present invention, a control system for a terminal using a network includes a network switching center and a terminal device identification center, where the terminal device identification center stores a terminal device identifier and preset authentication information of the network subscription terminal;

The network switching center is configured to receive the terminal device identifier and the authentication information from the terminal, and query the terminal device to query the preset authentication information corresponding to the identifier of the terminal device, where the preset information returned by the terminal device identification center is returned. When the right information matches the authentication information sent by the terminal, the terminal is allowed to access the network.

According to still another aspect of the present invention, a network switching center includes:

An information receiving unit, configured to receive terminal device identifier and authentication information from the terminal; The query unit is configured to: after receiving the foregoing information sent by the terminal, query the terminal device to query the preset authentication information corresponding to the identifier of the terminal device;

The access control unit is configured to allow the terminal to access the network when it is confirmed that the preset authentication information returned by the terminal device identification center matches the authentication information sent by the terminal.

According to still another aspect of the present invention, a terminal includes:

An information sending unit, configured to send, to the network switching center, the terminal device identifier and the authentication information of the terminal;

And a feedback receiving unit, configured to receive a feedback from the network switching center whether access is allowed.

The invention stores relevant information (terminal device identification and authentication information) of the network access terminal in the terminal device identification center in advance, and when the terminal needs to be controlled, the terminal device identification and authentication information of the terminal and the terminal device identification are stored. The relevant information of the center is compared, and the unauthorized terminal can be detected in time and effectively, and the unauthorized terminal (such as the stolen terminal after the card is replaced) is prevented from accessing the network.

DRAWINGS

1 is a schematic diagram of a reference model of a prior art mobile communication network;

Figure 2 is a schematic illustration of a first embodiment of the control system of the present invention;

Figure 3 is a schematic illustration of a second embodiment of the control system of the present invention;

4 is a flow chart of an embodiment of a method for controlling a terminal using a network according to the present invention;

Figure 5 is a block diagram of an embodiment of a network switching center and terminal used in the present invention.

detailed description

The present invention provides a control system and a control method for a terminal using a network, and a corresponding device. When the terminal attempts to access the network, the network can automatically detect whether the terminal is an unauthorized terminal, and if it is an unauthorized terminal, it can prevent its use. The network.

2 is a schematic view of a first embodiment of the present invention. Among them, only one operator's network is schematically drawn. The terminal 210 involved in the embodiment of the present invention refers to a terminal that has a unique terminal device identifier and can obtain a network identifier assigned by an operator, such as with a SIM.

( Subscribers Identity Module , User Identity Module ) Card , USIM ( Universal Subscribers Identity Module ) Card and ISIM ( IP Multimedia Core Network Subsystem Subscribers Identity Module, IMS User Identity Module) Mobile phones such as cards, PDAs (Personal Digital Assistants), laptops and other terminal devices, or even fixed terminals (eg, IMS terminals for next-generation networks). And the network refers to a mobile network, such as a PLMN (Public Land Mobile Network) network (including a GSM network and a CDMA network), and is applicable to TISPAN.

(Telecommunication and Internet Converged Services and Protocols for Advanced Networking, Telecommunications and Internet Convergence Services and Advanced Network Protocol Group) and ITU-T (International Telecommunication Union-Telephone) defined Next Generation Network (NGN) and 3GPP (3 ^rd Generation partnership Project, third Generation partnership ^{Project), 3GPP2 (3 rd Generation partnership} Project 2, third Generation partnership Project 2) defined WCDMA

(WCDMA, Wideband Code Division Multiple Access), CDMA2000 network, etc.

Among them, in the network of the operator, at least one network switching center (only one is shown) 220 is provided, and a terminal device identification center 230 is provided. The network switching center 220 is an entity capable of processing a user's call and performing authentication processing (in the present invention, the network switching center may also be another functional entity capable of session processing), wherein the terminal device identification center 230 Essentially, it is a database that pre-stores the authentication information of the network operator's subscription user. The management of the terminal device identification is similar to the management of the EIR to the terminal device identification. It also has a blacklist and is blacklisted. There are stored terminal device identifiers that are not allowed to access the network.

The interaction between the network switching center 220 and the terminal identification center 230 includes: the network switching center 220 sends the inquiry information to the terminal identification center 230, and the terminal identification center 230 feeds back the inquiry result to the network switching center 220. The interface protocol between the network switching center 220 and the terminal device identification center 230 may be, for example, a MAP protocol, a Diameter protocol, and a Radius protocol. In addition, the terminal device identification center 230 can maintain its internal data through the input device 240.

The authentication information of the network operator subscription user is pre-stored in the terminal device identification center 230. For example, when each user purchases the terminal 210, the network operator is contracted, and the selection is made by The authentication information has been sent to the terminal identification center 230 by the operator of the network for registration. At this time, the authentication information to be registered mainly includes: a terminal device identifier, a network identifier allocated by the subscription network to the user, and the terminal verification authentication information. The terminal device identifier may be stored in the terminal device identification center 230 in advance. For example, when the terminal is shipped from the factory, the terminal device is identified to register with the terminal device. The terminal verification authentication information may be a verification password or other information with biometrics, such as fingerprint information of the user, personal signature information, retina information, and the like. Among them, the verification password is most commonly used. If the password is used, it can be notified by the operator first, or can be set by the user, and the user can change the verification password of the terminal. The manual mode or the automatic mode is used. The manual mode may be changed by using a business hall such as a network operator or a terminal device identification center. The automatic mode may be, for example, an operator or a terminal device identification center provides a voice service for voice dialing. Or the WEB (Web) service provided by it is changed by the login operation interface. The terminal device identification center 230 transparently stores the user network identifier sent by the operator, and the user network identifier may be encrypted by the operator.

In the embodiment shown in Figure 2 above, the terminal identification center 230 can be used to assist in authenticating the terminal devices in the carrier network.

3 is a schematic diagram of a second embodiment of the present invention, which is suitable for unified authentication of all terminal devices in different operator networks. The terminal device identification center 330 is located at an independent third party supervision office. For example, a unified management terminal device identification center can be established for the same network terminal nationwide or globally. Only two carrier networks are shown in the figure, and the present invention is not limited thereto. Similar to the first embodiment, the terminal device identification center 330 pre-stores authentication information of terminals of all carrier networks.

The principle of the embodiment of the present invention is briefly described as follows: A terminal device identification center that can interact with a network switching center in an operator network is set, and authentication information of a contracted terminal user of the network is pre-stored in the terminal device identification center. When the terminal initiates registration with the network, the network switching center authenticates the terminal, compares the related information in the registration information of the terminal with the authentication information stored in the terminal device identification center, to determine whether the terminal can be Allow access to the network. The registration initiated by the terminal to the network includes: registration of the terminal to the network when the terminal is used for the first time; registration of the terminal to the network every time the terminal is turned on; or periodic access to the network during use of the terminal Registration of the network (such as registering with the network every few hours).

The flowchart of the embodiment of the present invention will be described in detail below with reference to FIG.

In the embodiment of the present invention, it is first necessary to register the authentication information of the terminal user with the terminal device identification center (refer to the above description).

In step S30, when a terminal initiates registration in the network, the network switching center obtains the terminal device identifier in the registration information sent by the terminal, and the registration information further carries the network identifier of the terminal.

In step S31, the network switching center transmits the terminal device identifier to the terminal device identification center, and the terminal device identification center determines whether the terminal device identifier is in its blacklist.

If it is determined in step S31 that the terminal device identifier is in its blacklist, a message is returned to the network switching center. After the network switching center learns that the terminal device is blacklisted according to the message, the registration failure process in step 35 is performed. , blocking the device from accessing the network.

It should be noted that, for the terminal that is not registered in the terminal device identification center, the control function is not supported, and the process of not querying the terminal device identifier is performed according to the operator's policy. If the anti-theft function is only used, the terminal authentication should be successfully processed to continue the normal registration process in the original network.

If it is determined in step S31 that the terminal device identifier is not in the blacklist of the terminal device identification center, then in step S33, the terminal device identification center returns the user network identifier and terminal face authentication information corresponding to the terminal stored therein. Give the network switching center.

In step S34, the network switching center compares whether the user network identifier stored in the terminal device identification center and the user network identifier from the terminal registration information report are consistent. If the user network identifier stored in the terminal device identification center is encrypted by the operator, a corresponding decryption operation is also required in the network switching center.

If it is determined in step S34 that the two are consistent, the step proceeds to step S390, and the terminal authentication passes.

If it is determined in step S34 that the two are inconsistent, in step S36, the user is required to input terminal verification authentication information (such as a check password). In other embodiments, the user may be required to input other information such as including biometrics. As a fingerprint, this requires the terminal to have a fingerprint scanning function. And in step S37, the network switching center compares whether the terminal verification authentication information input by the user is the same as the terminal authentication information returned by the terminal device identification center.

If the two terminal verification authentication information is the same in step S37, then go to step 390 to continue the registration process.

If the two terminal verification authentication information is different in step S37, it is determined in step S38 whether the user has input the terminal verification authentication information for a predetermined number of times, if not, then go to step S36 to repeat the comparison terminal verification authentication. The steps of the information.

If the predetermined number of times has been reached, the network switching center considers that the terminal is an illegal terminal, and if the registration fails, the terminal device identifier may be added to the blacklist of the terminal device identification center (step S39).

In the embodiment of the present invention, the terminal device identifies the blacklist of the center, and then determines whether the user network identifier from the terminal device identification center and the user network identifier registered by the terminal are consistent. If not, the network switching center requires the terminal to use. The terminal enters the terminal to verify the authentication information. If the input is correct, the terminal is successfully authenticated. After the authentication succeeds, the subsequent normal registration process is continued; otherwise, the failure occurs. The user is allowed to enter the terminal verification authentication information (for example, three times), and if it fails, the terminal is placed in the blacklist of the terminal identification center (according to the operator policy).

The setting of the terminal verification authentication information here mainly considers that the user temporarily replaces the SIM, USIM, ISIM card with the user network identifier, or replaces the information in the terminal device identification center for a long time, but the terminal device is not updated in time. The user network identifier stored in the identification center and the user network identifier sent from the terminal registration report will be inconsistent, but it is allowed to register successfully through the terminal verification authentication information.

The above process can be performed after or before the original terminal registration process, or it can be merged into the original registration process. The terminal authentication process is only performed when the terminal registers, and does not affect the connection of the normal call of the user.

In summary, the present invention proposes a universal scheme for automatically detecting unauthorized terminals (e.g., stolen terminals after card replacement) and preventing them from using the network, thereby preventing unauthorized terminals from being connected to the network in a timely and effective manner.

Please refer to FIG. 5, which is a block diagram of an embodiment of a network switching center and terminal used in the present invention. The network switching center includes: an information receiving unit 511, configured to receive the terminal device identifier and the authentication information from the terminal; the querying unit 512 is configured to: after receiving the foregoing information sent by the terminal, identify the center query corresponding to the terminal device The preset authentication information of the terminal device identifier; the access control unit 513 is configured to allow the terminal to be connected when it is confirmed that the preset authentication information returned by the terminal device identification center matches the authentication information sent by the terminal Into the network.

In an embodiment, the network switching center further includes a matching confirmation unit 514, configured to determine, in the current network identifier that is allocated to the user by the subscription network in the authentication information sent by the terminal, and the preset authentication information. Whether the network identifier assigned to the user by the pre-stored subscription network is consistent.

Or, in another embodiment, the match confirming unit 514 is configured to determine, in the authentication information sent by the terminal, the current network identifier allocated by the subscription network to the user and the pre-stored subscription in the preset authentication information. Whether the network identifiers assigned to the user by the network are consistent. When the packets are inconsistent, it is determined whether the terminal verification authentication information provided by the terminal and the terminal verification authentication information returned by the terminal identification center are consistent.

In an embodiment, the information receiving unit 511 is a registration message receiving unit, configured to receive a registration message carrying the terminal device identifier and the authentication information.

In the embodiment of the present invention, the terminal includes: an information sending unit 521, configured to send the terminal device identifier and the authentication information of the terminal to the network switching center; and a feedback receiving unit 522, configured to receive whether the network switching center is received from the network switching center Feedback that allows access.

In a specific embodiment, the information sending unit is a registration message sending unit, configured to send a registration message carrying the terminal device identifier and the authentication information.

It should be noted that each of the foregoing units may be an independent logical entity, and may be combined according to actual conditions and requirements, and details are not described herein.

Claims

Rights request

A control method for a terminal using a network, comprising:

The terminal sends the terminal device identifier and the authentication information of the terminal to the network switching center; after receiving the foregoing information sent by the terminal, the network switching center queries the terminal to identify the preset authentication information corresponding to the identifier of the terminal device;

2. The method for controlling a terminal to use a network according to claim 1, wherein the authentication information sent by the terminal is a current network identifier assigned to the user by the subscription network; and the preset authentication information is pre-stored. The network identifier assigned to the user by the contracted network.

The method for controlling a terminal to use a network according to claim 1, wherein the authentication information sent by the terminal is a current network identifier assigned to the user by the subscription network; and the preset authentication information includes pre-stored information. The network identifier and the terminal verification authentication information allocated by the network to the user; the matching of the preset authentication information returned by the terminal identification center and the authentication information sent by the terminal includes: the current distribution of the subscription network to the user The network identifier is consistent with the network identifier assigned to the user by the pre-stored subscription network.

4. The method for controlling a terminal usage network according to claim 3, further comprising:

When the current network identifier assigned to the user by the subscription network is inconsistent with the network identifier assigned to the user by the previously stored subscription network, the network switching center notifies the terminal to provide terminal verification authentication information, and identifies the terminal with the terminal device. The returned terminal verification authentication information is compared; if the comparison result is the same, the preset authentication information returned by the terminal device identification center and the authentication information sent by the terminal are matched;

If the comparison result is different, the network switching center prevents the terminal from accessing the network.

The method for controlling a network for using a terminal according to claim 4, wherein when the comparison result is different, the method further includes:

Determining whether the number of times the terminal provides the terminal to verify the authentication information reaches a preset value;

If the preset value is not reached, the terminal is notified to provide the terminal verification authentication information again; If the preset value is reached, the network switching center prevents the terminal from accessing the network.

The method for controlling a terminal to use a network according to claim 4, wherein when the network switching center blocks the terminal from accessing the network, the method further includes adding the terminal device identifier to the blacklist of the terminal device identification center.

7. The method for controlling a terminal usage network according to claim 3, wherein if the user network identifier returned by the terminal device identification center is encrypted, the network switching center further decrypts the encrypted user network identifier.

The method for controlling a terminal to use a network according to claim 1, wherein the authentication information sent by the terminal is a terminal verification authentication message; and the preset authentication information is a pre-stored terminal verification. The authentication information is: the terminal authentication information returned by the terminal identification center and the authentication information sent by the terminal are matched by: the terminal verification rights message sent by the terminal and the pre-stored terminal verification authentication information Consistent.

The method for controlling a terminal usage network according to any one of claims 3 to 8, wherein the terminal verification authentication information is a verification password or information having biometric characteristics.

The method for controlling a terminal-used network according to any one of claims 1 to 8, wherein the terminal device identifier and the authentication information sent by the terminal are carried in a registration message.

The method for controlling the terminal usage network according to any one of claims 1 to 8, further comprising: after the terminal identification center is queried to the preset authentication information corresponding to the identifier of the terminal device, the method further includes: If the terminal device identifier is already in the blacklist of the terminal device identification center, the terminal device identifies the center return message to the network switching center, and the network switching center blocks the terminal from accessing the network according to the message.

12. A control system for a terminal to use a network, comprising a network switching center and a terminal device identification center, wherein the terminal device identification center stores a terminal device identifier and preset authentication information of the network subscription terminal;

13. The control system for a terminal use network according to claim 12, wherein: The preset authentication information of the subscription terminal includes: a terminal device identifier, a network identifier allocated by the subscription network to the user, and terminal verification authentication information.

The control system of the terminal-use network according to claim 12, wherein the terminal device identification center is provided with a blacklist for storing the terminal device identifier of the terminal that is not allowed to access the network.

The control system of the terminal using the network according to claim 12, wherein the terminal device identifier and the authentication information from the terminal are carried in a registration message.

16. The control system for a terminal-used network according to claim 12, further comprising input means for connecting to said terminal device identification center for modifying information stored by said terminal device identification center.

The control system of the terminal-use network according to any one of claims 12 to 16, wherein the network switching center and the terminal device identification center have an interface using a Map protocol, a Diameter protocol or a Radius protocol.

18. A network switching center, characterized by comprising:

The information receiving unit is configured to receive the terminal device identifier and the authentication information from the terminal, and the querying unit is configured to: after receiving the foregoing information sent by the terminal, identify, to the terminal device, the center to query the preset authentication information corresponding to the identifier of the terminal device ;

The network switching center according to claim 18, further comprising: a matching confirmation unit, configured to determine a current network identifier and the pre-assigned to the user by the subscription network in the authentication information sent by the terminal It is determined whether the pre-stored subscription network in the authentication information is consistent with the network identifier assigned to the user.

The network switching center according to claim 18, further comprising: a matching confirmation unit, configured to determine a current network identifier assigned to the user by the subscription network in the authentication information sent by the terminal, and the pre-determination Whether the network identifiers assigned to the user by the pre-stored subscription network in the authentication information are consistent; if not, the terminal verification authentication information provided by the terminal and the terminal verification authentication information returned by the terminal identification center are consistent. .

The network switching center according to any one of claims 18 to 20, wherein the information receiving unit is a registration message receiving unit, configured to receive a registration message carrying the terminal device identifier and the authentication information.

22. A terminal, comprising:

The terminal according to claim 22, wherein the information sending unit is a registration message sending unit, configured to send a registration message carrying the terminal device identifier and the authentication information.