WO2007112692A1

WO2007112692A1 - A communication method in the user network and a system thereof

Info

Publication number: WO2007112692A1
Application number: PCT/CN2007/001074
Authority: WO
Inventors: Yongfeng Zhong; Ling Zhang; Ling Liu
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-04-04
Filing date: 2007-04-03
Publication date: 2007-10-11
Also published as: KR20090006110A; CN101317390A; CN101051967A; JP2009532959A; KR101076332B1; WO2007112692A8

Abstract

A communication method in the user network and a system thereof include: before the point-to-point connection is created, two UEs in the user network request the management entity for the security authentication of the corresponding UE via the access network, and the point-to-point connection is created until the certification of the corresponding UE is passed. The management entity may provide the key to the certificated UE to ensure the security of the data transmission. If two UEs are in the same personal area network, the point-to-point connection is the direct connection in the personal area network range. If two UEs are not in the same personal area network, the point-to-point connection is the remote connection created by the respective access network. By using the invention, the security of the data transmission among the UEs in the user network is ensured.

Description

Communication method and system in user network This application claims priority to Chinese patent application filed on April 4, 2006, Chinese Patent Office, application number 200610025438.0, and the invention name "communication system and method of user equipment in user network" The entire contents of which are incorporated herein by reference. Technical field

The present invention relates to the field of communications, and in particular to a communication technology between user equipments in a user network. Background technique

In recent years, with the development of technology and the increasing demand for high-tech products, people have more and more peripheral devices. Users may not only have multiple laptops, mobile phones, etc. at the same time, but may also need to own PCs. Connect the peripherals such as printers, scanners, and modems to the machine, and sometimes plug in the USB port to transfer and store the photos in the digital camera to the hard disk. Frequent insertion and removal of a certain interface, the various cables entangled after the PC, allow users to experience the new technology to enjoy, but also have to endure some inconvenience. In addition, the information transfer between the staff in various departments within the enterprise also puts forward higher requirements for the mobilization of information transmission in modern enterprises. In a limited office environment, the local area network can realize information sharing and device sharing (printer, scanning). Instrument, etc.), but the dense wiring is inconvenient. In response to this phenomenon, the academic community has proposed a new concept: Personal Area Network (PAN,). The PAN network is oriented to a specific group in a space with a small radius of activity and a rich business type. A mobile communication network that implements a wireless connection. This is a wireless network that is juxtaposed with a wide area network and a local area network but has a small range.

The core idea of the PAN network is to replace the traditional wired cable with radio or infrared, to realize the intelligent interconnection of personal information terminals, and to build a personalized information network. From the perspective of computer networks, the PAN network is a local area network; from the perspective of the telecommunication network, the PAN network is an access network, so some people refer to the PAN network as the "last metre" solution of the telecommunication network. The PAN network is targeted at home and small office applications. Its main application areas include: voice communication gateway, data communication gateway, information electrical interconnection and automatic information exchange.

The implementation technologies of PAN network mainly include: Bluetooth (Bluetooth), Infrared Data Association (Infrared Data Association, "IRDA") infrared communication technology. Through the PAN network, all user equipments (User Equipments, referred to as "UEs") of the same user can be managed and exchanged. However, the network range of the PAN is small, such as mobile phones with strong mobility such as mobile phones. It may be limited to one PAN network. In order to facilitate the user to manage all the UEs it owns, we will group the UEs belonging to the same user into a user network, which may contain multiple physical UEs. Or a PAN network composed of UEs.

In the prior art, communication between UEs in the same user network includes two situations. First, both UEs performing communication are in the same PAN network of the same user network, that is, the UE communicates with each other in close proximity. In this case, wireless technology can be used, such as wireless technology such as Bluetooth or infrared communication, or wired technology, such as wired technology including USB cable, to directly perform point-to-point communication between UEs. No need to manage through the carrier network. That is to say, the UEs of the communication do not need to go through the core network, and only communicate directly through the short-distance connection within the PAN network. As shown in FIG. 1, the communication mode between UE1 and UE2 is the same.

Second, for UEs that are not in the same access network, that is, in the same PAN network, UE1 and UE3 in Figure 1, because of the need for long-distance communication, communication between them needs to be provided through the switching center provided by the operator. The exchange is performed, that is, when UE1 needs to communicate with UE2, UE1 initiates a request through its access network A, and then passes through the switching center and access network B to reach UE3. In addition to some control signaling, the data transmission of UE1 also needs to pass through access network A, switching center and access network B in order to be transmitted to UE3.

In practical applications, the security of communication between UEs in the same user network cannot be guaranteed by using the above solution, and the communication between UEs occupies the switching center resources to a large extent.

Since the UEs in the same PAN network in the same user network use peer-to-peer communication, that is, the two communicating UEs do not need to go through the core network, and only the PAN network directly establishes a connection for communication, and there is no security authentication measure, which cannot be guaranteed. The security of communication. When the UEs communicating in the same user network are not in the same PAN network, the two communication parties must communicate through the switching center, occupying a large amount of resources of the switching center. Summary of the invention

Embodiments of the present invention provide a communication system for a user equipment in a user network, and a method thereof. The communication information between UEs in the user network can be secured.

An embodiment of the present invention provides a communication method for a user network, including the following steps: When two user equipments belonging to the same user need to communicate, the first user equipment sends a communication request to the user equipment registration information. Management entity requesting to establish a connection with the second user equipment;

The management entity performs security authentication on the first and second user equipments according to the communication request and the saved registration information;

After the authentication succeeds, the first user equipment directly establishes a point-to-point connection with the second user equipment.

An embodiment of the present invention provides a user network communication system, which has at least two user equipments belonging to the same user and an access network thereof, and the system includes:

a management entity, configured to save registration information of the user equipment and perform security authentication on the user equipment;

When the first user equipment needs to establish communication with the second user equipment, the communication request is sent to the management entity, and the management entity performs the first and second user equipment according to the communication request and the saved registration information. safety certificate;

In summary, in the technical solution provided by the embodiment of the present invention, before establishing a point-to-point connection, two UEs in the user network first request security authentication of the relevant UE from the access entity through the access network, only in the relevant UE. A point-to-point connection is established when authentication passes. By increasing the security authentication before the connection, the unauthorized UE is prevented from unauthorized access to the UE in the user network. The management entity can also guarantee the security of data transmission by providing a key to the UE that successfully authenticates.

When two UEs belonging to the same user need to communicate, the two parties in the user network perform security authentication on both sides of the communication to ensure the legality of both parties. After the authentication is passed, the management entity further provides the communication parties with a secret. The key ensures the security of data transmission between the two parties.

If two UEs are not in the same personal area network, the point-to-point connection is a remote connection established through the respective access network. Because the point-to-point connection between the two UEs does not go through the switching center, It can save resources of the switching center when it is far away from communication. DRAWINGS

1 is a schematic diagram of communication of a UE in a same user network in the prior art; FIG. 2 is a structural diagram of a communication system of a UE in a user network according to a first embodiment of the present invention; FIG. 3 is a second embodiment of the present invention. FIG. 4 is a flowchart of a communication method of a UE in a user network according to a third embodiment of the present invention; FIG. detailed description

The present invention will be further described in detail below with reference to the accompanying drawings.

The communication system of the UE in the user network according to the first embodiment of the present invention will be described below based on the principle of the present invention.

As shown in FIG. 2, the communication system of the UE in the user network includes at least two UEs belonging to the same user and their access networks, and a management entity for storing and authenticating the registration information of the UEs. Each of the UEs belonging to the same user is located in the same PAN network, and interacts with its management entity through the same access network.

Specifically, a plurality of UEs belonging to the same user in the system register in advance in their management entities before communication is required, and the management entity stores registration information of each UE that is registered. Thereafter, when the UE1 of the user needs to establish communication with the UE2 that belongs to the user, the UE1 first sends a communication request to the management entity through its common access network A, requesting communication with the UE2, where the communication request includes the UE1 itself. Registration information and the device identification number of UE2. After receiving the request, the management entity performs security authentication on the UE1 and the UE2 according to the previously stored registration information. For example, the management entity compares the registration information of the UE1 in the communication request with the saved registration information, and determines to initiate the communication. Whether the requested UE1 is legal, and whether the UE2 has been registered or the like according to the identification number of the UE2, performs security authentication on the UE1 and the UE2. If the authentication is successful, the management entity sends a request message for communication to the UE2, where the request message includes the device identification number of the UE1. After receiving the request message, UE2 decides whether to agree to communicate with ΌΈ1, and sends corresponding feedback information to the management entity according to the decision. The management entity determines the received feedback information. If the UE2 accepts the request for communication with the UE1, the management entity further generates a temporary key for the UE1 and the UE2, and sends the key to the UE1. And UE2, at the same time, the management entity sends an acknowledgement message that UE2 accepts the current communication to UE1. After receiving the key, UE1 and UE2 establish a direct connection within the scope of the PAN network, and after the connection is established, communicate through the temporary key provided by the management entity.

The second embodiment of the present invention is substantially the same as the first embodiment. As shown in FIG. 3, the communication system of the UE in the user network in the second embodiment includes at least two UEs belonging to the same user and their access networks, and is used for The management entity that stores the registration information of these UEs and performs security authentication is different only in that the systems belonging to the same user in the system of the second embodiment are not located in the same PAN network, and each UE passes through its own access network. The management entity interacts, and both UEs that need to communicate establish a remote connection through their respective access networks after the security authentication succeeds.

For example, the same user has multiple UEs, where UE1 and UE3 are not in the same PAN network, UE1 is connected to access network A, and UE3 is connected to access network B. When the UE1 needs to communicate with the UE3, the UE1 sends a communication request to the management entity to communicate with the UE3 through the access network A, where the communication request includes the registration information of the UE1 itself and the device identification number of the UE3. The management entity performs security authentication on UE1 and UE3 according to the received request message and the saved registration information. If the security authentication is successful, the communication request message including the device identification number of UE1 is sent to ΌΕ3. The UE3 receives the request message from the management entity through the access network B, decides whether to agree to communicate with the UE1, and sends corresponding feedback information to the management entity according to the decision. If the management entity receives the feedback information that the UE3 agrees to perform the current communication, the UE further generates a temporary key for the UE1 and the UE3, and sends the key to the UE1 and the UE3, respectively, and the management entity accepts the confirmation of the current communication by the UE2. The message is sent to UE1. After receiving the key, UE1 and UE3 establish a remote connection through access network A and access network B respectively, and then communicate through the temporary key after the connection is established.

In the communication method of the UE in the user network according to the third embodiment of the present invention, as shown in FIG. 4, in step 410, when the UE1 needs to communicate with the UE 2 belonging to the same user, the UE1 sends a communication request to the management entity to communicate with the ΌΈ2. Specifically, UE1 and UE2 belonging to the same user may be located in the same PAN network, or may be located in different PAN networks. If UE1 and UE2 are located in the same PAN network, UE1 needs to communicate with UE2 when it needs to communicate with UE2. The common access network sends a communication request to the management entity to communicate with the UE2; if the UE1 and the UE2 are located in different PAN networks, the UE1 needs to access the UE2 when it needs to communicate with the UE2. The network sends a communication request to the management entity to communicate with the UE2. The communication request includes the registration information of the UE1 and the device identification number of the UE2.

Next, proceeding to step 420, after receiving the communication request from UE1, the management entity performs security authentication on UE1 and UE2 according to the information therein.

Specifically, each UE belonging to the same user needs to register in the management entity in advance, and the management entity also needs to save the registration information of the registered UE. Therefore, when the management entity receives the communication request from the UE1, it can perform security authentication on the UE1 and the UE2 according to the information in the communication request and the registration information held by itself.

Next, proceeding to step 430, the management entity determines whether UE1 and UE2 have passed the security authentication, and if yes, proceeds to step 450, and if not, proceeds to step 440;

In step 440, the management entity returns a message to the UE1 that the communication request failed. The management entity continues the communication request only when both UEs that need to communicate pass the security authentication, thereby effectively preventing the unauthorized UE from accessing the UE in the user network, thereby ensuring the security of both parties.

In step 450, the UE1 and the UE2 pass the security authentication, and the management entity sends a request message for the communication to the UE2, where the message includes the device identification number of the UE1.

Next, proceeding to step 460, UE2 receives the request message from the management entity, and determines whether to agree to perform the current communication according to the device identification number of UE1. Similarly, if UE1 and UE2 are located in the same PAN network, UE2 receives the request message from the management entity through its common access network, and decides whether to agree to perform the current communication; if UE1 and UE2 are located in different PAN networks, The UE 2 receives the request message from the management entity through the access network to which it belongs, and decides whether or not to agree to perform the current communication. If the UE2 agrees to perform the current communication, the feedback message of the current communication is sent to the management entity, and the process proceeds to step 480. Otherwise, the process proceeds to step 470. In step 470, the UE2 sends a feedback message rejecting the current communication to the management entity. After receiving the rejection message, the management entity further notifies UE1 that the communication request failed.

In step 480, since the UE2 agrees to communicate with the UE1, the management entity generates a temporary key for the current communication, and transmits the temporary key to the UE1 and the UE2, respectively, and the management entity accepts the confirmation of the current communication by the UE2. The message is sent to UE1. Since the temporary key is temporarily generated when the UE needs to communicate with each other, it has strong randomness and real-time performance, and is not easily Unscrupulous user cracking, the communication parties communicate through the temporary key, which ensures the security of data transmission during the communication process.

Next, proceeding to step 490, UE1 and UE2 establish a point-to-point connection to communicate after receiving the temporary key. Specifically, if UE1 and UE2 are in the same PAN network, both UEs establish a direct connection within the scope of their PAN network, and after the connection is established, communicate through the temporary key provided by the management entity; if UE1 and UE2 do not Within the same PAN network, UE1 and UE2 establish remote connections through their respective access networks, and also communicate through the temporary key after the connection is established.

Since the UEs of the communication no longer need to pass through the switching center when performing remote communication, the resources of the switching center are greatly saved, and the resources can be more rationally utilized.

While the invention has been illustrated and described with reference to the preferred embodiments embodiments The spirit and scope of the invention are not departed.

Claims

Rights request

A user network communication system, having at least two user equipments belonging to the same user and an access network thereof, wherein the system comprises:

When the first user equipment needs to establish communication with the second user equipment, the communication request is sent to the management entity through the access network, and the management entity performs the first, according to the communication request and the saved registration information. The second user equipment performs security authentication. After the authentication succeeds, the first user equipment directly establishes a point-to-point connection with the second user equipment.

2. The communication system according to claim 1, wherein the communication relies on carrying registration information of the first user equipment and a device identification number of the second user equipment.

The communication system according to claim 1, wherein the management entity sends a communication request message carrying the first user equipment identification number to the second user equipment after the authentication is successful, according to the The feedback information of the user equipment determines that the second user equipment accepts the current request, the management entity generates a temporary key, and sends the key to the first and second user equipments.

The communication system according to claim 3, wherein the management entity sends a notification message to the first user equipment according to the feedback information of the second user equipment, if the second user equipment accepts the current The request, the management entity sends an acknowledgement message allowing the current communication to the first user equipment, and the first and second user equipments establish a point-to-point connection using the key.

The communication system according to any one of claims 1 to 4, wherein the first and second user equipments are located in the same personal area network, and the same access network and the management entity Interacting, the point-to-point connection is a direct connection within the scope of the personal domain network.

The communication system according to any one of claims 1 to 4, wherein the first and second user equipments are located in different personal area networks or are independently connected to the access network, and are connected by respective The network access interacts with the management entity, and the point-to-point connection is a remote connection established through a respective access network.

A communication method for use in a user network, comprising the steps of: when two user equipments belonging to the same user need to communicate, the first user equipment sends a communication request through the access network to save The management entity of the user equipment registration information requests to establish a connection with the second user equipment;

The communication method according to claim 7, wherein the communication request carries registration information of the first user equipment and a device identification number of the second user equipment.

The communication method according to claim 7, further comprising the steps of: the first and second user equipments are registered in the management entity in advance, and the management entity saves the first and second User device registration information.

The communication method according to claim 7, wherein the establishing, by the first user equipment, the point-to-point connection directly with the second user equipment comprises the following steps:

After the authentication is successful, the second user equipment receives a request message from the management entity that carries the first user equipment identification number, and returns to the management entity whether to accept the request. Feedback message;

If the management entity receives the feedback message that the second user equipment accepts the current request, generates a temporary key, sends the key to the first and second user equipments, and sends the key to the first user. The device sends a confirmation message allowing this communication;

The first and second user equipment establish a point-to-point connection using the key.