WO2009043262A1

WO2009043262A1 - A method and device of accessing control

Info

Publication number: WO2009043262A1
Application number: PCT/CN2008/072401
Authority: WO
Inventors: Xiaohan Liu; Min Huang
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-09-27
Filing date: 2008-09-18
Publication date: 2009-04-09
Also published as: CN101669327A; CN101400106A; CN101669327B

Abstract

A method and a device of accessing control is provided. This method is for the network with Home Node Base station HNB, comprising : receiving request of modifying access control list with UE's first identity; modifying the access control list, which includes the first identity and UE's second identity, according to the said request, and then the access of UE is controlled according to the modified access control list. Users will use and collocate ACL expediently through the invention to control the access of UE.

Description

Method and apparatus for performing access control The present application claims priority to Chinese patent application filed on September 27, 2007 by the Chinese Patent Office, application number 200710077386.6, and entitled "A method for access control of home base stations" The entire contents of which are incorporated herein by reference. Technical field

The present invention relates to a method for access control in the field of communications, and in particular, to a method and apparatus for performing access control. Background technique

With the rapid development of Internet (Internet) services and the wide application of broadband access networks and wireless networks, high-speed and convenient access to the network is the goal pursued by people. In order to make better use of the resources of existing networks and protect the cost of network equipment operators, 3GPP began research work on home base stations (HNBs). HNB refers to a small, small base station for home or office use. It may be completely private. It can also be opened to the public for use with different priorities and permissions. Its ownership is private, not government or operation. Business; its use of objects may be a small range of users, but also a wide range of users. HNB is used to implement wireless access, which can better utilize existing network resources, save more network equipment operators' costs, and combine the advantages of mobile access networks and fixed access networks.

From the user's point of view, HNB is a private device that does not require outsiders to use it without the owner's permission. From the perspective of the operator, the tariff covered by HNB is more favorable than the macro network, and it is desirable to limit the UEs that use HNB. Therefore, the HNB needs to provide access control functions to judge and limit the UEs trying to access the HNB. Only the access of the authorized UE is accepted, and the camping of the unlicensed UE is rejected, and the normal use of the unlicensed UE in the macro cell cannot be affected at the same time. Currently, the concept of Closed Subscriber Group (CSG) is proposed in the 3GPP standard. A CSG may contain one HNB cell and may also contain multiple HNB cells. Each CSG corresponds to an access control list. The UEs in the incoming control list can use all HNBs in the CSG, and other UEs will be denied access.

When a friend comes to the house, the owner of the HNB may wish to add the friend's UE to the access control list and delete the UE after the friend leaves, which will result in the change of the access control list. Will be more frequent. Users can change the access control list through the Web, HNB, and other means. Since the International Mobile Subscriber Identity (IMSI) is confidential information, the user cannot obtain it at all, so that the user can only use the mobile station integrated service digital network (MS-ISDN) of the UE, that is, The mobile phone number of the UE is used to modify the access control list.

The access control can be performed on the network side or in the HNB. Because there are too many signalings involved in access control on the network side, access control needs to be performed in the HNB, because the user usually uses temporary mobility. Temporary Mobile Station Identity (TMSI), so the implementation of access control can only use TMSI, and IMSI is rarely needed.

However, how to use the above access control list to restrict access to the HNB UE, how to join the access control list, how to delete the user from the access control list, and how to use the MS-ISDN to configure the access control list. There is no related solution in the prior art. Summary of the invention

In view of this, an embodiment of the present invention provides a method and an apparatus for performing access control, where the network for a home base station HNB includes: receiving a modify access control list request, and modifying the access control list request The first identifier of the user equipment UE is included; the access control list is modified according to the modified access control list, where the access control list includes the first identifier and the second identifier of the UE; The access control list performs access control on the UE.

The embodiment of the present invention further provides an apparatus for performing access control, which is used for performing access control on a UE, where the apparatus includes: a messaging module, an information storage module, and an access control module, where the message transceiver module For receiving a modify access control list request, the modified access control list requesting to carry the first identifier of the UE; the information storage module, configured to store an access control list, and receive according to the message receiving and receiving module The modified access control list is requested to modify the access control list, where the access control list includes the first identifier and a second identifier of the UE; the access control module is configured to The access control list performs access control on the UE.

A method for performing access control according to an embodiment of the present invention provides a specific configuration and usage method of an access control list when using a device for performing access control, for example, a user can access the HNB at home, by inputting an MS-ISDN Alternatively, you can register, modify, or delete the authorized UE by setting the MS-ISDN through the customer service hotline or the WEB webpage provided by the operator. And gives specific details on how to use The scheme is used to restrict the UE from accessing the entity in which the device is located, that is, the entity may perform access control on the UE according to the IMSI, TMSI or other identifier and access control list of the UE. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are incorporated in the claims Other drawings may also be obtained from these drawings without the inventive labor.

1 is a schematic flowchart of a user configuring an access control list according to an embodiment of the present invention; FIG. 2 is a schematic flowchart of an HHSS access control list update according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of a process for updating an access control list saved by an HNB by an HHSS according to an embodiment of the present invention; FIG.

4 is a schematic flow chart of updating an access control list saved by an HNB by an SGSN according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an HNB according to an embodiment of the present invention. detailed description

The embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

In the present invention, the intermediate node between the HNB, or the GPRS GPRS Support Node (SGSN), or the HNB and the Core Network (CN) performs access control on the UE (hereinafter, the HNB is taken as an example). The HNB determines whether the accessed UE is legal according to the IMSI (or other identifier) and the TMSI of the UE. Therefore, the access control list maintained by the HNB includes the IMSI (or other identifier) and the TMSI of the UE, as shown in Table 1 and Table. 2, an embodiment of an access control list saved for HNB:

Table 1

UE3 IMSI3 TMSI3

The access control list saved by the HNB may further include a new identifier defined by the HHSS according to the IMSI to the UE, as shown in Table 2.

Table 2

The HNB performs access control on the UE according to the foregoing access control list, that is, the UE is allowed to access only when there is related information of the UE in the access control list saved by the HNB. The access control list in the HNB needs to be updated in time. The entity that controls the access control list in the HNB to update may be an HNB Home Subscriber Server (HHSS), or an HSS, or a GPRS service support node (Severing GPRS Support). Node, SGSN), that is, when the access control list information in the HHSS or HSS or SGSN changes, the HNB is notified to modify its access control list. The following describes the methods for controlling the HNB to update the access control list. Of course, if the entity that performs access control on the UE is the SGSN, the other entity that performs the update control on the access control list in the SGSN may be an HSS or an HHSS.

Embodiment 1

Embodiment 1 of the present invention provides a method for updating an access control list of an HNB by an HHSS or an HSS.

The first case occurs when the user configures the access control list using the MS-ISDN of the UE. The HHSS on the network side stores the HNB subscription information, including: security information, HNB identifier, CSG identity (CSG ID) of the HNB, and UE access control list for each CSG.

A CSG may contain one or more HNBs. For multiple HNBs, the access control list may be the same. Therefore, an access control list can be maintained for each CSG on the HHSS, that is, each access control list is identified by a different CSG ID. HHSS does not have to have all HNBs belonging to one CSG To maintain its access control list, just maintain the access control list of the CSG. Alternatively, an access control list may be maintained for each HNB on the HHSS. For example, Table 3 lists the access control list of each HNB saved in the HHSS:

table 3

In the table, in addition to saving the IMSI of the UE, the HHSS may also be configured to define a new identifier for the UE according to the IMSI, and the identifier may be the sequence number of the UE, or may be other forms, but the UE may be uniquely identified, as shown in Table 4. .

Table 4

As shown in FIG. 1 , a flow chart when a user configures an access control list by using an MS-ISDN of the UE, includes:

Step 101: The HHSS receives the modified access control list request for adding or deleting the MS-ISDN of the UE.

In this step, the user sends an MS-ISDN request to add or delete the UE to the HHSS through the receiving station, or through the WEB webpage provided by the operator, or by setting or deleting the MS-ISDN of the UE in the OM interface of the HNB.

Step 102: The HHSS receives the request message of the MS-ISDN added or deleted by the UE, and sends an IMSI query request message to the HSS to which the UE belongs. The query message carries the MS-ISDN of the UE.

Step 103: The HSS queries the corresponding information of the UE according to the received MS-ISDN.

Step 104: The HSS sends an IMSI query response message to the HHSS, where the message carries the IMSI of the UE. Step 105: The HHSS modifies the access control list according to the received IMSI information, that is, adds or deletes the IMSI of the UE in the access control list saved by the HHSS.

Step 106: The HHSS sends a modify access control list response message to the requester that adds or deletes the MS-ISDN.

When the user requests to add the MS-ISDN of the UE in step 101, the HHSS may also define a new identifier for the UE according to the received IMSI in step 105, and add the IMSI of the UE and the new one in the saved access control list. Logo.

The HSS in the above process can also save the access control list information. Currently, the 3GPP standard has proposed that the CSG information related to the CSG to be stored in the UE may be included in the UE, or may include the CSG ID of the CSG that the UE is allowed to access, or the UE may not be connected. The CSG ID of the incoming CSG, which belongs to the UE's subscription information, is also stored in the HSS. The correspondence between CSG and HHSS is also stored in the HSS, that is, which CSGs are included in an HHSS.

After the HHSS access control list is updated, the HNB is notified to modify its saved access control list. The specific process will be analyzed in detail later.

The update of the access control list of the HHSS may also be after the UE Service Identity Module (USIM) is lost. The reissued USIM card will retain the original MS-ISDN, but the IMSI has changed. When the user reissues the USIM card, the operator needs to update the original IMSI corresponding to the MS-ISDN on the HSS, and update the corresponding information of the IMSI in the access control list on the HHSS. The HSS keeps the subscription information of the UE, including the CSG ID of the CSG that the UE is allowed to access or the CSG ID of the CSG that the UE does not allow access to. The HSS also stores the correspondence between the CSG and the HHSS, that is, which HHSS is included in the HSS. CSG. Each CSG-related user access control list is stored in the HHSS. Based on the above information stored on the HHSS and HSS, the access control information on the HHSS can be updated. Figure 2 is a schematic diagram of the process of refreshing the access control list saved by the HHSS in the above situation, including:

Step 201: The HSS searches for the corresponding original IMSI according to the MS-ISDN of the UE, and searches for the CSG to which the UE belongs and the HHSS to which the CSG belongs according to the IMSI, and then updates the original IMSI.

Step 202: The HSS sends a request to the HHSS to modify an IMSI request message, where the message carries the original IMSI and the updated IMSI.

Step 203: The HHSS searches for the access control list corresponding to the CSG according to the original IMSI, and updates the original IMSI in the access control list to a new IMSI. Step 204: The HHSS sends an IMSI modification response message to the HSS.

If the access control list on the HHSS further saves the new identifier defined by the HHSS to the UE, step 203 becomes:

Step 2031: The HHSS searches for the access control list corresponding to the CSG according to the received old IMSI, updates the original IMSI in the access control list to a new IMSI, and defines a new identifier for the UE according to the new IMSI.

In both cases, if the HNB subscription information is stored in the HSS, the above process can be implemented directly between the user and the HSS. In this case, the entity HHSS is optional.

The above describes two cases in which the access control list changes on the HHSS or the HSS. When the access control lists on the two entities change, they notify the HNB to update the access control list saved by the HNB, so that the HNB can The latest information to access control the UE.

The following describes how HHSS or HSS controls the HNB to update the access control list.

Figure 3 is a schematic diagram of the process of updating the access control list in the HNB by the HHSS, including the following steps:

Step 301: The HHSS modifies its saved access control list.

Step 302: The HHSS sends a modify access control list request message to the HNB, where the message carries

The information of the UE includes the IMSI of the UE, or the original IMSI of the UE and the updated IMSI.

Step 303: The HNB modifies its saved access control list according to the IMSI.

The access control list saved by the HNB in the foregoing step 303 may be added or deleted.

The IMSI of the UE, or update the original IMSI to the new IMSI.

Step 304: The HNB sends a modify access control list acknowledgement message to the HHSS.

If the access control list saved on the HHSS and the HNB saves the new identifier defined by the HHSS to the UE, step 302 and step 303 are respectively changed to:

Step 3021: The HHSS sends a modify access control request message to the HNB, where the message carries the information of the UE, including the new identifier defined by the HHSS to the UE, or the original new identifier of the UE and the updated new identifier.

Step 3031: The HNB modifies its saved access control list.

In the foregoing step 3031, the HNB modifies the saved access control list to add or delete a new identity of the UE for the HNB, or update the original new identity to a new new identity.

In the flow of FIG. 3, if the subscription information of the HNB is stored in the HSS, the HNB is controlled by the HSS. Update the access control list.

The embodiment of the present invention provides a specific method for performing access control on the HNB. By performing access control on the HNB, a large number of signaling processes during access control on the network side can be avoided, and the signaling load of the SGSN is reduced.

The access control can also be performed in the SGSN. At this time, the SGSN stores the access control information as shown in Table 5. The information of the UE is obtained from the HHSS and the HSS, or other databases according to the identity of the UE and the identity of the HNB itself. The UE information maintained by the SGSN may further include a new identity of the UE defined by the HHSS according to the IMSI.

table 5

When the SGSN performs the access control, the process is the same as the process of the first embodiment of the present invention, that is, the HHSS or the HSS updates the access control information saved by the SGSN.

Embodiment 2

The second embodiment of the present invention provides a method for performing access control on a UE by using an IMSI or a TMSI of an UE and an access control list, including:

When the UE is in the idle state, the access control on the HNB is performed after the radio resource control (RRC) connection is successfully established. When the UE is in the active state, the access control on the HNB is Performed after the switch request. The HNB obtains the UE identity (IMSI or TMSI, etc.) information from the UE, and compares it with the access control list stored in the HNB to determine whether the UE is allowed to access, thereby implementing access control to the UE.

The IMSI is used only when the UE performs initial network attach (Attach) after power-on, and uses TMSI for communication in the subsequent communication process for security reasons. Each time the UE shuts down or the location is updated, the network will re-allocate the TMSI to the UE. When the access control is performed on the HNB, the HNB needs to perform access control on the UE according to the TMSI of the UE. Therefore, the SGSN needs to update the TMSI saved on the HNB in time. The TMSI is constantly changing, and the efficiency is very low if the TMSI changes of the UE are synchronized to the HNB each time. In the embodiment of the present invention, when the TMSI of the UE is updated, and the UE is close to the HNB, the TMSI saved on the HNB is updated, thereby implementing access control on the HNB. The SGSN determines, according to the access control information stored in Table 5, whether the routing area (RA) to which the macro cell belongs is adjacent to the RA to which the subscribed HNB belongs.

FIG. 4 is a schematic flowchart of an SGSN updating an access control list saved by an HNB according to an embodiment of the present disclosure, which specifically includes:

Step 401: The SGSN determines that the TMSI of the UE changes. The SGSN obtains the following information according to the subscription information of the UE and the related information list of the HNB: 1) the HNB ID of the HNB that the UE subscribes to and the RA ID of the HNB; A list of RAs adjacent to the RA. The SGSN determines whether the current RA of the UE is adjacent to the RA where the HNB of the UE is located according to the foregoing information. If yes, step 402 is performed, and if no, the process ends.

Step 402: The SGSN sends a modify access control list request message to the HNB that is subscribed by the UE, where the UE information carried in the message includes the IMSI of the UE and the changed TMSI.

Step 403: The HNB modifies the corresponding information in the access control list according to the foregoing UE information.

Step 404: The HNB returns a modify access control list acknowledgement message to the SGSN, where the message carries the modification success or the modification failure information.

If the access control list on the SGSN further stores the new identifier defined by the HHSS to the UE, step 402 and step 403 are respectively:

Step 4021: The SGSN sends a modify access control list request message to the HNB, where the message carries the UE information, including the new identifier of the UE and the changed TMSI.

Step 4031: The HNB modifies the corresponding information in the access control list according to the foregoing UE information. In addition to the application scenarios described in the foregoing embodiments, in some special cases, for example, after the UE is powered off or powered off, the movement across the RA may occur. If the method of the second embodiment is still used, there is a problem. Because if the UE is shut down or powered off, it just enters the HNB across the adjacent RA of the HNB. Since the TMSI is not sent to the HNB when the UE is powered off or powered off, the access control list on the HNB is not new according to the UE. The TMSI is updated in a timely manner so that a legitimate UE cannot access the HNB.

In the above scenario, the access control may be performed on the HNB by using the following schemes, including: if the UE is normally shut down, the UE sends a disconnection request to the SGSN, and after receiving the detach request, the SGSN sends a modified access control list to the HNB. A request message carrying the IMSI of the UE and the TMSI when the UE is disconnected from the network. If the UE is shut down abnormally, for example, when the power is off, when the location update timer of the UE expires, the SGSN will set the state of the UE to the detach state. Sending a modified access control list request message to the HNB, where the message carries the IMSI of the UE and the TMSI when the UE disconnects from the network. The network side may adjust the location update timer period of the UE according to the distance of the UE from the HNB that is allowed to access, and notify the UE to perform corresponding adjustment. After the UE accesses the HNB, the network side adjusts the location update timer period of the UE to a normal value, and notifies the UE to perform adjustment.

This embodiment provides a method for updating the access control list saved by the HNB when the TMSI of the UE is changed, and updating based on the two judgments in the embodiment, which can improve the update efficiency and reduce the signaling process. save resources.

Embodiment 3

The embodiment of the present invention further provides an apparatus for performing access control, where the apparatus may be located in an intermediate node between the HNB, or the SGSN, or the HNB and the CN, for performing access control on the UE, where the apparatus includes a message transceiver module. 501, an information storage module 502, an access control module 503, wherein

The messaging module 501: is configured to receive a modified access control list request sent by the HHSS or the HSS or the SGSN; if the device is in the SGSN, the module is only used to receive the modified access control list request from the HHSS or the HSS.

The modified access control list request carries the information of the UE required to modify the list, and the information may carry the IMSI and TMSI of the UE, or the new identifier defined by the HHSS to the UE.

The information storage module 502 is configured to store access control information, and is used to update information of the information storage module.

The access control module 503 is configured to perform access control on the UE according to the access control information stored in the information storage module 502.

The foregoing is a detailed description of a method for access control of an HNB provided by the present invention. The principles and embodiments of the present invention are described herein by using specific examples. The description of the above embodiments is only for helping to understand the present invention. The method and its core idea; at the same time, those skilled in the art, according to the idea of the present invention, there will be changes in the specific embodiments and application scope. In summary, the contents of this specification should not be construed as Limitations of the invention.

Claims

Rights request

A method for performing access control, where the method is used in a network with a home base station HNB, the method includes:

Receiving a request for modifying an access control list, where the request for modifying the access control list includes a first identifier of the user equipment UE;

Modifying an access control list according to the modified access control list, where the access control list includes the first identifier and a second identifier of the UE;

Performing access control on the UE according to the modified access control list.

2. The method according to claim 1, wherein the second identifier of the UE is a temporary mobile station identifier TMSI of the UE.

The method according to claim 1 or 2, wherein the receiving the modify access control list request comprises:

Receiving the modified access control list request sent by the home base station user home server HHSS; or receiving the modified access control list request sent by the user home server HSS; or receiving the service sent by the serving general wireless packet service support node SGSN Modify the access control list request.

4. The method according to claim 3, wherein the receiving the modify access control list request further comprises:

The HHSS or the HSS receives a request to add or delete a UE in the access control list, where the request carries the mobile station integrated service digital network number MS-ISDN of the UE;

The HHSS or the HSS adds or deletes the first identifier of the UE corresponding to the MS-ISDN of the UE in the respective saved access control list;

The HHSS or HSS sends the modify access control list request.

The method according to claim 4, after the HHSS receives the request to add or delete the UE in the access control list, the method further includes: modifying the page (Article 19 of the Treaty) The HHSS sends an International Mobile Station Identity IMSI Query Request to the HSS, where the query request carries the MS-ISDN of the UE;

The HHSS receives the query response from the HSS, where the query response carries the IMSI of the UE corresponding to the MS-ISDN of the UE;

The HHSS adds or deletes the IMSI of the UE in its saved access control list;

The first identifier of the UE is the IMSI of the UE.

The method of claim 4, after the HHSS receives the request to add or delete the UE in the access control list, the method further includes:

The HHSS sends an MSI query request to the HSS, where the query request carries the MS-ISDN of the UE;

The HHSS receives a query response from the HSS, where the query response carries an IMSI of the UE corresponding to the MS-ISDN of the UE;

Determining, by the HHSS, a new identifier to the UE according to the IMSI, and adding or deleting the SI and the new identifier in an saved access control list;

The first identifier of the UE is the new identifier.

The method according to claim 3, wherein the receiving the modified access control list request sent by the HHSS further includes:

The HSS updates the IMSI of the UE according to the MS-ISDN of the UE;

The HSS sends a modified IMSI request message to the HHSS, where the modified IMSI request message carries the original IMSI of the UE and the updated new IMSI;

The HHSS updates the original IMSI in the saved access control list to a new IMSI;

The first identifier of the UE is the original IMSI and the new IMSI of the UE.

The method of claim 7, wherein the updating, by the HHSS, the original IMSI in the saved access control list to the new MSI further includes:

The HHSS defines a new identifier for the UE according to the new IMSI;

The first identifier of the UE is the new identifier. Revision page (Article 19 of the Treaty)

The method of claim 3, wherein before receiving the request for the access control list sent by the SGSN, the method further includes:

Obtaining, by the SGSN, status information of the UE;

The status information of the UE includes: the UE is in an ON state, and the Temporary Mobile Station Identity (TMSI) of the UE is changed, and the routing area RA where the UE is currently located is adjacent to the RA where the UE is subscribed to the HB, or the UE is powered off or Off state.

10. The method of claim 9 wherein:

The first identifier of the UE is an IMSI of the UE and a changed TMSI;

Or,

If the access control list in the SGSN and the HNB both hold the new identifier defined by the HHSS to the UE, the first identifier of the UE is the new identifier and the changed TMSI.

The method according to any one of claims 1 to 10, wherein the performing access control on the UE according to the modified access control list comprises:

The intermediate node between the HNB, or the SGSN, or the HNB and the core network CN performs access control on the UE according to the modified access control list.

12. An apparatus for performing access control, the apparatus comprising: a messaging module, an information storage module, and an access control module, where

The message sending and receiving module is configured to receive a request for modifying an access control list, where the modified access control list request carries a first identifier of the UE;

The information storage module is configured to store an access control list, and request to modify the access control list according to the modified access control list received by the message sending and receiving module, where the access control list includes the a first identifier and a second identifier of the UE;

The access control module is configured to perform access control on the UE according to the access control list.

13. Apparatus according to claim 12 wherein:

The messaging module is further configured to receive an IMSI whose first identifier is a UE, or a new identifier defined by the HHSS for the UE, or a TMSI of the new identifier and the UE, or an original IMSI and an update modification page (Treaty 19) The new IMSI is modified to access the control list request.

The device according to claim 12 or 13, wherein the information storage module is further configured to store an access control list including a TMSI whose second identifier is a UE.

The apparatus according to any one of claims 12-14, wherein the apparatus is located in an intermediate node between the HNB, or the SGSN, or the HNB and the CN.

Amendment page (Article 19 of the Treaty)