WO2009074082A1

WO2009074082A1 - Access controlling method?system and device

Info

Publication number: WO2009074082A1
Application number: PCT/CN2008/073256
Authority: WO
Inventors: Mu Zhao
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-12-03
Filing date: 2008-11-28
Publication date: 2009-06-18
Also published as: CN101453394A; CN101453394B

Abstract

A method for access controlling to the UE in WPAN is provide, which includes setting in advanced in the accessing device of WPAN the corresponding relationship of UE ID and affair service ID of the remote server's affair service which shared with the UE, the accessing device receiving the accessing request sent by the UE in WPAN, wherein the accessing request taking the UE ID and affair service ID, when the UE ID and the affair service ID taken in the accessing request is agree with the corresponding relationship stored in the accessing device, passing the access authority verification, the accessing device sending the accessing request to the remote server corresponding with the affair service ID A system and accessing device for access controlling to the UE in WPAN also is provided.

Description

Access control method, system and device

[1] Technical field

[2] The present invention relates to network communication technologies, and in particular, to an access control method, system and device.

[3] Background of the invention

Wireless Personal Area Network (Wireless Personal Area Network.

WPAN) is a network of multiple devices that are close together. After the user equipment in the WPAN communicates with the equipment in the external carrier network, it is usually necessary to perform access control on the user equipment, for example, allowing certain authorized user equipments to access one server in the operator network, but rejecting Authorized user equipment access. In the prior art, the process of performing access control on the user equipment in the WPAN is as follows: After the user equipment in the WPAN obtains the access key in advance, the user equipment in the WPAN identifies the user equipment and the obtained access key. The access device that is sent to the WPAN in the access request, the access device in the WPAN sends the user equipment identifier and the access key carried in the access request to the authentication server, and the authentication server receives the access according to the The key authenticates the access authority of the user equipment. After the authentication succeeds, the access device in the WPAN performs address translation and protocol conversion on the access request, and sends the processed access request to the corresponding external operator. The remote server, the corresponding remote server of the external operator provides the corresponding service service to the user equipment in the WPAN.

[5] It can be seen that in the prior art, after performing access control on the user equipment in the WPAN, the access authority is verified according to the access key sent by the user equipment, and thus, the user equipment must be Obtain the access key in advance. After obtaining the access key, the user equipment in the WPAN must use the wireless transmission resource of the WPAN to send a request message to the key generation server in the external carrier network, and send the access password returned by the key generation server to the user. The device 吋 also needs to occupy the wireless transmission resources of the WPAN. Moreover, if there are multiple user equipments to be accessed, each need to obtain an access key separately, and more wireless transmission resources are occupied. Since WPAN is a personal network with wireless transmission mode, its wireless transmission resources are very limited. The prior art practice requires a large amount of WPAN wireless transmission resources, thus increasing the burden of WPAN.

[6] Summary of the invention [7] The purpose of the embodiments of the present invention is to provide a method and system for performing access control on a user equipment in a WPAN, and an access device, so as to reduce occupation of wireless transmission resources in the WPAN.

[8] In order to achieve the above object, the technical solution of the embodiment of the present invention is implemented as follows:

[9] A method for performing access control on a user equipment of a WPAN, the method comprising:

[10] Presetting the correspondence between the user equipment identifier in the WPAN and the service service identifier of the service service in the remote server enjoyed by the user equipment in the access device of the WPAN;

[11] The access device receives an access request sent by the user equipment in the WPAN, where the access request carries a user equipment identifier and a service service identifier;

[12] When the user equipment identifier and the service service identifier carried in the access request are consistent with the corresponding relationship maintained by the access device, the access device is authenticated by accessing the user equipment;

[13] The access device sends an access request to a remote server corresponding to the service service identifier.

[14] An access device, the access device comprising:

[15] a storage unit, configured to save a correspondence between the user equipment identifier in the WPAN and the service service identifier of the service service provided by the remote server enjoyed by the user equipment;

[16] The information receiving and processing unit is configured to receive an access request sent by the user equipment in the WPAN, and provide the user equipment identifier and the service service identifier carried in the access request to the access control unit, and receive the access authority verification. After the notification is passed, the access request is sent to the remote server corresponding to the service service identifier carried in the access request;

[17] The access control unit is configured to: after detecting that the user equipment identifier and the service service identifier provided by the information receiving processing unit are consistent with the corresponding relationship saved in the saving unit, notify the information receiving processing unit to pass the access authority verification.

[18] A system for performing access control on a user equipment of a WPAN, the system comprising:

[19] the user equipment, configured to send an access request to the access device in the WPAN, where the access request carries the user equipment identifier and the service service identifier; and the access request according to any one of claims 8-11 Access device.

[20] It can be seen that, in the embodiment of the present invention, after the access control is performed on the user equipment in the WPAN, the access device performs the access authority verification according to the user equipment identifier and the service service identifier in the ACL, so that The user equipment in the WPAN does not need to obtain an access key, which avoids the need to occupy the WPAN in the prior art. The shortcomings of limited transmission resources save the wireless transmission resources of WPAN and reduce the burden of WPAN.

[21] BRIEF DESCRIPTION OF THE DRAWINGS

[22] Figure 1 is a schematic diagram of the networking of WPAN.

2 is a flow chart of performing access control on user equipment in a WPAN in the embodiment of the present invention.

FIG. 3 is a schematic diagram of a first storage form of an ACL in an embodiment of the present invention.

FIG. 4 is a schematic diagram of a second storage form of an ACL in the embodiment of the present invention.

FIG. 5 is a schematic diagram showing the basic structure of an access device of a WPAN in the embodiment of the present invention.

6 is a schematic diagram of an optimized structure of an access device of a WPAN in an embodiment of the present invention.

FIG. 7 is a schematic structural diagram of a system for performing access control on a user equipment in a WPAN in the embodiment of the present invention.

[29] Specific implementation

The embodiments of the present invention will be further described in detail below with reference to the drawings and specific embodiments.

[31] The embodiment of the present invention is mainly at

Corresponding relationship between the user equipment identifier in the WPAN and the service service identifier of the service service in the remote server enjoyed by the user equipment is preset in the access device of the WPAN; the access device receives the access request from the user equipment in the WPAN. After the access request carries the user equipment identifier and the service service identifier, if the user equipment identifier and the service service identifier carried in the access request are consistent with the corresponding relationship maintained by the access device, Authorization verification; The access device sends an access request to the remote server corresponding to the service service identifier.

[32] FIG. 1 is a schematic diagram of networking of a WPAN. Referring to FIG. 1, a WPAN includes a plurality of user equipments and one or more access devices. Each user equipment can directly communicate in the WPAN by means of wireless transmission, that is, data between user equipments does not need to be transmitted through the operator network. Of course, the user equipment in the WPAN can also communicate with the equipment in the external carrier network. Therefore, the communication data needs to be forwarded through the access device in the WPAN. FIG. 2 is a flowchart of performing access control on a user equipment in a WPAN in an embodiment of the present invention. In this embodiment, the user equipment needs to access the remote server 1 in the external carrier network, and the process of performing access control on the user equipment is taken as an example, and specifically includes the following. Steps:

[33] Step 201: The access device in the remote server 1 and the WPAN acquires the same shared key Ku in advance.

[34] The specific implementation process of this step may include: the operator separately sets the shared key Ku in the access device and the remote server 1 manually or in other secure manners; or, the operator manually or in other secure manners Setting a shared key Ku on any one of the access device and the remote server 1, as set on the remote server 1, and then sharing the key in a secure manner, such as by the device provided with the shared key Ku The Ku is sent to another device such as an access device.

[35] Step 202: The access device in the remote server 1 and the WPAN acquires in advance a key generation algorithm corresponding to each of the service services of the remote server 1.

[36] The specific implementation process of the step may include: the operator manually setting a key generation algorithm corresponding to each service service of the remote server 1 in the access device and the remote server 1 manually or in other secure manners; Alternatively, the operator sets a key generation algorithm corresponding to each of the service services of the remote server 1 on any one of the access device and the remote server 1 manually or in another secure manner, such as setting on the remote server 1. Then, the device, which is provided with the key generation algorithm, transmits the key generation algorithm corresponding to each service service of the remote server 1 to another device such as the access device after performing encryption in a secure manner.

[37] In this step, the key generation algorithms corresponding to different service services may be the same or different.

[38] Step 203: The number of service services that the remote server 1 can provide to the user equipment in the WPAN

Generate a random number corresponding to each service service, and send the random number corresponding to each service service to the access device.

[39] Step 204: For each service service that can be provided, the remote server 1 generates a access secret corresponding to the service service by using the shared key Ku, a key generation algorithm corresponding to the service service, and a random number. Key

[40] For example, the remote server 1 can provide n (n is a natural number) business service to the user equipment in the WPAN, then, in step 202, generate n random numbers, which are recorded as Randl, Rand2, ..... ., Randn.

[41] In this step 203, the access keys generated by the remote server 1 corresponding to each type of service service may be respectively recorded as Kl=hl(Ku, Randl), K2=h2(Ku, Rand2), , Kn. =hn(Ku, Randn).

[42] Step 205: For each service service that the remote server 1 can provide, the access device utilizes the shared key Ku, a key generation algorithm corresponding to the service service and a random number, generates an access key corresponding to the service service.

[43] Here, the access key generated by the access device corresponding to each service service is the same as the remote server 1, and can be respectively recorded as Kl=hl(Ku, Randl), K2=h2(Ku, Rand2). , , Kn=hn(Ku,

Randn).

[44] Executing this step, an access key corresponding to each service service of the remote server 1 is obtained on the access device in the remote server 1 and the WPAN, respectively. The specific embodiment of the correspondence is: the identifier of each type of service service, such as the name or code, and the correspondence relationship with the access key.

[45] Step 206: The access device generates and saves an access control list (ACL) by using an identifier of the service service in the remote server 1 that the user equipment can be set in advance, and an access key corresponding to each service service. ).

[46] In the access device, the identity of the service service in the remote server 1 that the user device can enjoy can be pre-set using the service subscription information provided by the remote server 1.

[47] Here, the ACL reflects the correspondence between the user equipment identifier, the service service identifier, and the access key of the service service. The storage form of the correspondence between the three is the storage form of the ACL, including but not limited to the following two types:

[48] Form of preservation

[49] In this step 206, the access device may store the correspondence between the user equipment identifier, the service service identifier, and the access key in the same ACL. Referring to the ACL shown in Figure 3, one record in the ACL is the correspondence between the user equipment 2, the service service 5, and the access key corresponding to the service service 5 in the WPAN, and the other record is the user equipment 2 in the WPAN. The correspondence between the service service 9 and the access key corresponding to the service service 9 . If a user equipment in the WPAN, such as the user equipment n, cannot enjoy the service of any remote server, the ACL shown in FIG. 3 also needs to establish a record for the user equipment n, where the user equipment in the record The service service identifier and access key corresponding to n are all empty tags.

[50] Form of preservation

[51] In this step 206, the access device may store the correspondence between the user equipment identifier and the service service identifier and the correspondence between the service service identifier and the access key in different ACLs. See AC shown in Figure 4. Each of the records in the ACL1 is the mapping between the user equipment identifier and the service service identifier. Each record in the ACL2 is a correspondence between the service service identifier and the access key. If a user equipment in the WPAN, such as the user equipment n, cannot enjoy the service of any one of the remote servers, then only one record needs to be established for the user equipment n in the ACL1 shown in FIG. 4, where the user equipment n The corresponding business service identifier is an empty tag.

[52] Step 207: When a service service that can be provided to the user equipment is added to the remote server 1, the access key corresponding to the new service service is obtained on the remote server 1 and the access device respectively.

[53] In this step, the access key corresponding to the new service service is obtained on the remote server 1 and the access device, and the access key corresponding to any one of the service services in the foregoing steps 202 to 205 is obtained. The way is the same.

[54] Step 208: When it is necessary to modify a service service, such as the access key corresponding to the service service 1, modify the access key of the service service 1 on the remote server 1 and the access device respectively.

[55] Here, the process of modifying the access key of the service service 1 on the remote server 1 and the access device respectively is similar to the process of newly generating the access key corresponding to the service service in the above steps, including: the remote server 1 Generating a new random number, and the remote server 1 regenerates the access key corresponding to the service service 1 by using the shared key Ku, the key generation algorithm corresponding to the service service 1, and the new random number, and uses the re-generation The access key replaces the access key corresponding to the saved service service 1; and the remote server 1 transmits the generated new random number to the access device, and the access device utilizes the shared key Ku, corresponding to the service service 1 The key generation algorithm and the new random number regenerate an access key corresponding to the service service 1, and replace the stored access key corresponding to the service service 1 with the regenerated access key.

[56] Step 209: After a service service in the remote server 1 is canceled, the remote server 1 carries the identifier of the canceled service service in the cancel notification message and sends it to the access device.

[57] Step 210: The access device deletes the access key corresponding to the service service according to the identifier of the service service carried in the cancellation notification message.

[58] In the foregoing steps 207 to 210, when the access device adds a service service and its corresponding access key, modifies a service service and its corresponding access key, and deletes a service service and its corresponding The access key must be modified correspondingly, that is, a record is added to the ACL, a record is deleted, and a record is deleted. In other words, when a new type of remote server can be added to the user device The service provider 吋, the access device adds an access key of the newly added service service, a correspondence between the user equipment identifier and the newly added service service identifier in the ACL; The access key of the service service, the access device modifies the access key corresponding to the identifier of the service service in the ACL; when a service service in the remote server is canceled, the access device is in the AC L The correspondence between the identifier of the service service, the user equipment identifier, and the access key is deleted.

[59] In addition, from the implementation process of the foregoing steps 207 to 210, it can be seen that after the ACL in the access device is formed, only the remote server 1 has the right to send a command to modify the ACL, that is, the access device is triggered in the ACL. Add, modify, and delete a record. The reason that the remote server 1 triggers a new record in the ACL, that is, the process corresponding to the foregoing step 207, may be: The user equipment in the WPAN subscribes to the newly added service service of the remote server 1 in some manner. The reason that the remote server 1 triggers the deletion of a record in the ACL, that is, the process corresponding to the foregoing steps 209 to 210 may be: The user equipment in the WPAN cancels the service of the remote server 1 in some way, or the remote server discovers the user. The business service subscribed to by the device has expired.

[60] Step 211: When the user equipment in the WPAN needs to enjoy a service service in the remote server 1, the user equipment sends an access request of the remote server 1 identifier, the user equipment identifier, and the service service identifier to the WPAN. Access device.

[61] In this embodiment, the remote server identifier may also be combined with the service identifier, that is, the identifier of the remote server may be included in the service identifier field. Correspondingly, the service service identifier field saved in the access device may also include the identifier of the remote server.

[62] Step 212: The access device in the WPAN uses the remote server 1 identifier, the user equipment identifier, and the service service identifier extracted from the received access request to search for the saved ACL, and determines whether the user equipment has the ACL according to the ACL. Access rights, if yes, go to step 214, otherwise, go to step 213.

[63] Here, the process of determining whether the user equipment has the access right according to the ACL is: determining whether the correspondence between the user equipment identifier and the service service identifier extracted from the access request can be found in the ACL, if If found, it is determined that the user equipment has access rights, otherwise, it is determined that the user equipment does not have access rights. If the ACL is saved in the form shown in Figure 3, you only need to search in the table in this step. When the ACL is saved in the form shown in Figure 4, this step is performed. Need to find in ACL1. [64] Step 213: The access device sends a reject access notification message to the user equipment in the WPAN, and ends the current process.

[65] Step 214: The access device carries the address of the remote server 1, the service service identifier, and the access key corresponding to the service service identifier that is found according to the ACL, and is sent to the remote server 1 in the access request.

[66] Here, the address of the remote server 1 carried in the access request includes, but is not limited to, an IP address.

Preferably, the specific implementation manner of carrying the access key in the access request may be to encapsulate the access key in the access request.

[68] Step 215: The remote server 1 extracts the service service identifier and the access key from the received access request, and determines whether the access key is correct. If yes, step 217 is performed; otherwise, step 216 is performed. .

[69] Here, the remote server 1 determines whether the access key is correct: the remote server 1 searches for the access corresponding to the service service identifier saved by itself according to the service service identifier extracted from the received access request. The key is used to determine whether the access key extracted in the access request is the same as the found access key. If they are the same, the access key may be determined to be correct. Otherwise, the access key is determined to be incorrect.

[70] Step 216: The remote server sends the access key error message to the access device, and the access device sends a reject access notification message to the user equipment in the WPA N, and the current process ends.

[71] Step 217: The remote server 1 provides the corresponding service service to the user equipment in the WPAN through the access device.

[72] It should be noted that, in the foregoing process shown in FIG. 2, a corresponding access key is generated for each service service that the remote server 1 can provide, but only one embodiment is avoided in the embodiment of the present invention. After the access key of the service service is stolen, it affects a better processing method of other service services. In the actual service implementation, the number of service services that the remote server 1 can provide can also be disregarded. All service services share a key generation algorithm and a random number, that is, all service services correspond to one shared access secret. key. The specific implementation process is similar to the process shown in Figure 2 above.

In the embodiment of the present invention, the remote server refers to a device in the external carrier network that can provide or control the user equipment in the WPAN through the access device in the WPAN. Among them, the external network includes but is not limited to the Internet, an IP network or a wireless network. Also, access devices in the WPAN include, but are not limited to, gateway devices or access points.

[74] Moreover, in the embodiment of the present invention, the identifier of the user equipment in the WPAN may be the IEEE of the user equipment. Address or other inherent information about the user device.

[75] It should be noted that, in this embodiment, the access device obtains the access key by using the shared key Ku, the key generation algorithm, and the random number. However, the method by which the access device obtains the access key is not limited thereto. For example, the remote server may encrypt the access key and send it to the access device by using a point-to-point key shared with the access device, or may obtain the access key through other secure methods, and then manually access the access key. Set the access key on the device. In addition, the access device stores the correspondence between the user identifier and the service service identifier, and other forms may be used in addition to the ACL.

[76] According to the flow of the embodiment of the present invention shown in FIG. 3, in the embodiment of the present invention, the access device may be first authenticated by the access device in the WPAN, and then again by the remote server. The correctness of the access key is verified, and the double verification process further ensures the security of user equipment access. Of course, the operator's trust mechanism for the access device can also be set in advance. After the access authority is verified, the remote server can provide the service service without performing access key verification. In the case that the access key authentication is not required, the access device can only store the correspondence between the service service identifier and the user equipment identifier, and does not need to save the correspondence between the service service identifier and the access key. According to the flow of the embodiment of the present invention shown in FIG. 2, in the embodiment of the present invention, the entire access control process does not need the dedicated key generation server and the dedicated authentication server in the prior art, and the function of generating a key and The authentication function can be completed by the remote server and the access device respectively, so that the operator does not need to set a dedicated key generation server and a dedicated authentication server in the network, thereby reducing the cost of the operator. Moreover, there is no need for a process of information interaction with a dedicated key generation server and a dedicated authentication server in the prior art; after multiple users need to obtain a service service, it is not necessary for multiple users to interact with the external carrier network, only The access device needs to interact with the external carrier network. Therefore, the embodiment of the present invention also simplifies the process of access control.

[77] It will be understood that, although the above embodiments have used a sequential description of the steps of the method for ease of understanding, it should be noted that the order of the above steps is not strictly limited.

[78] It is also understood by those skilled in the art that all or part of the steps in the above embodiments may be implemented by a program to instruct related hardware, and the program may be stored in a computer readable storage medium. The storage medium may be a ROM/RAM, a magnetic disk, an optical disk, or the like.

Correspondingly, an embodiment of the present invention further provides an access device. Figure 5 is a WPA in an embodiment of the present invention A basic structure diagram of an access device of N. Referring to FIG. 5, the access device includes:

[80] a saving unit, configured to save a correspondence between the user equipment identifier in the WPAN and the service service identifier of the service service in the remote server enjoyed by the user equipment;

[81] The information receiving and processing unit is configured to receive an access request sent by the user equipment in the WPAN, and provide the user equipment identifier and the service service identifier carried in the access request to the access control unit, and receive the access right. After verifying the passed notification, sending an access request to the remote server corresponding to the service identifier carried in the access request;

[82] The access control unit is configured to: after detecting that the user equipment identifier and the service service identifier provided by the information receiving processing unit are consistent with the corresponding relationship saved in the saving unit, notify the information receiving processing unit to pass the access authority verification.

[83] Preferably, the saving unit is configured to save the correspondence between the user equipment identifier and the identifier of the service service in an ACL.

[84] In order to further implement the verification of the access key by the subsequent remote server, the saving unit is further configured to save a correspondence between the identifier of each service service and the access key in the remote server;

[85] The access control unit further determines, according to the correspondence between the identifier of each service service and the access key stored in the storage unit, an access key corresponding to the service service identifier provided by the information receiving processing unit. Transmitting, to the information receiving and processing unit, the determined access key;

[86] The information receiving processing unit further includes the received access key in the access request before transmitting the access request to the remote server.

[87] Preferably, the access device further includes an access key obtaining unit, where

[88] The information receiving and processing unit further provides the random number corresponding to each service service sent by the remote server to the access key acquiring unit;

[89] an access key obtaining unit, configured to acquire a key Ku and a key generation algorithm corresponding to each service service of the remote server, using a key Ku, a key generation algorithm corresponding to each type of service service Corresponding relationship between the identifier of each service service and the access key in the remote server is obtained, and the correspondence is saved in the saving unit.

[90] Preferably, the correspondence between the user equipment identifier and the service service identifier in the access device and the correspondence between the identifier of each service service and the access key are saved in the ACL. Saving order The method for saving the element may be: storing the correspondence between the user equipment identifier, the service service identifier, and the access key in the same ACL; or, the correspondence between the user equipment identifier and the service service identifier, and the service service identifier The correspondence with the access key is stored in a different ACL.

Correspondingly, an embodiment of the present invention further provides a system for performing access control on a user equipment. FIG. 7 is a schematic structural diagram of a system for performing access control on a user equipment in a WPAN according to an embodiment of the present invention. See Figure 7. The system includes:

[92] The user equipment is configured to send an access request to the access device in the WPAN, where the access request carries the user equipment identifier and the service service identifier.

[93] An access device, which may be the access device described in the above specific embodiments.

[94] It will be understood that the figures or embodiments are merely illustrative and represent logical structures in which the units shown as separate components may or may not be physically separate, displayed as a unit. Components may or may not be physical units, ie they may be located in one place or distributed over several network elements.

In summary, the above description is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

[1] A method for performing access control on a user equipment of a wireless personal area network WPAN, the method comprising:

Corresponding relationship between the user equipment identifier in the WPAN and the service service identifier of the service service in the remote server enjoyed by the user equipment is preset in the access device of the WPAN;

The access device receives an access request sent by the user equipment in the WPAN, where the access request carries the user equipment identifier and the service service identifier;

And when the user equipment identifier and the service service identifier carried in the access request are consistent with the corresponding relationship saved by the access device, the access device is authenticated by accessing the user equipment;

The access device sends an access request to a remote server corresponding to the service service identifier.

[2] The method according to claim 1, wherein the correspondence between the service service identifier of the service service in the remote server and the access key is preset in the access device.

[3] The method according to claim 2, characterized in that

The step of the access device sending an access request to the remote server corresponding to the saved service service identifier includes: determining, by the access device, the information carried in the access request according to the correspondence between the service service identifier and the access key The access key corresponding to the service service identifier is sent to the remote server corresponding to the service service identifier, where the access request includes the determined access key.

[4] The method according to claim 3, wherein, after the access device sends an access request to the remote server corresponding to the service service identifier, the method further includes: when the access request is carried The service service identifier and the access key are consistent with the corresponding relationship stored in the remote server, and the remote server provides the user equipment with a service service corresponding to the service service identifier carried in the access request.

[5] The method according to claim 2, wherein the method for the access device to preset the correspondence between the service service identifier of the service service and the access key in the remote server comprises: The ingress device obtains an access key corresponding to each service service according to a key Ku from the remote server and a key generation algorithm and a random number corresponding to each service service of the remote server; Set the correspondence between the service service identifier and the access key of each service service.

[6] The method according to claim 2, wherein the service service identification field includes an identifier of the remote server.

[7] The method according to any one of claims 2 to 6, wherein the correspondence between the user equipment identifier and the service service identifier and the correspondence between the service service identifier and the access key are used for access control. The form of the list ACL is saved in the access device.

[8] The method according to claim 7, wherein the remote server is in the access device

The ACL is updated and maintained.

[9] The method according to claim 6, wherein the correspondence between the user equipment identifier, the service service identifier and the access key is saved in the same ACL;

Or,

The corresponding relationship between the user equipment identifier and the service service identifier and the correspondence between the service service identifier and the access key are stored in different ACLs.

[10] An access device, where the access device includes:

a storage unit, configured to save a correspondence between the user equipment identifier in the WPAN and the service service identifier of the service service provided by the remote server by the user equipment;

The information receiving and processing unit is configured to receive an access request sent by the user equipment in the WPAN, and provide the user equipment identifier and the service service identifier carried in the access request to the access control unit, and receive the notification that the access authority is verified And sending an access request to the remote server corresponding to the service service identifier carried in the access request;

The access control unit is configured to: after detecting that the user equipment identifier and the service service identifier provided by the information receiving processing unit are consistent with the corresponding relationship saved in the saving unit, the notification information receiving processing unit passes the access authority verification.

[11] The access device according to claim 10, wherein the saving unit is further configured to save a correspondence between a service service identifier of the service service in the remote server and an access key.

[12] The access device according to claim 10 or 11, wherein the access control unit further determines and receives the information according to the correspondence between the service service identifier and the access key stored in the storage unit. The access key corresponding to the service service identifier provided by the processing unit is connected to the information Receiving processing unit provides the determined access key;

The information receiving processing unit is further configured to: carry the determined access key in the access request to send to a remote server.

[13] The access device according to claim 12, wherein the saving unit saves the correspondence between the user equipment identifier, the service service identifier, and the access key in the same ACL; or The correspondence between the user equipment identifier and the service service identifier and the correspondence between the service service identifier and the access key are stored in different ACLs.

[14] A system for performing access control on a user equipment of a WPAN, wherein the system comprises:

a user equipment, configured to send an access request to the access device in the WPAN, where the access request carries the user equipment identifier and the service service identifier; and the access according to any one of claims 10-13 device.