WO2009155812A1

WO2009155812A1 - Terminal access method, access management method, network equipment and communication system

Info

Publication number: WO2009155812A1
Application number: PCT/CN2009/071856
Authority: WO
Inventors: 王绍斌; 张宁; 位继伟; 尹瀚
Original assignee: 华为技术有限公司
Priority date: 2008-06-23
Filing date: 2009-05-19
Publication date: 2009-12-30

Abstract

An accessing method of user terminal is provided in the present invention embodiment, which includes that: acquiring the user identification from the user terminal; judging whether the user terminal is legal based on the user identification, if no, refusing the user terminal access, if yes, transmitting the access authentication request carried with the equipment identification and encryption data of the user identification to the network element of the core network; receiving the information from the network unit of the core network, the information includes the access admittance message or the access refused message for the access authentication of the user terminal generated by the network element of the core network according to the equipment identification and the encryption data of the user identification.

Description

Terminal access method, access management method, network device, and communication system The present application claims to be submitted to the Chinese Patent Office on June 23, 2008, the application number is 200810029121.3, and the invention name is "terminal access method, access management method network device, and The priority of the Chinese Patent Application for the communication system is hereby incorporated by reference in its entirety. Technical field

The present invention relates to the field of communications, and in particular, to a user terminal access method, an access management method, a communication system, an access device, and a network device. Background technique

In the wireless network communication system, with the development of the Internet (Internet) and the wide application of various wireless services, on the one hand, users have higher demands on the bandwidth, convenience, and cost of the wireless network. On the other hand, from the perspective of operators, it is necessary to make full use of the resources of existing networks, expand capacity, reduce costs, and better serve users.

In order to fully meet the above requirements and the development needs of the network, a home base station (HNB) is proposed. Home NodeB is a home-based micro base station. Users can arrange such base stations in hotspot coverage areas such as homes and offices, and access the mobile communication network through the Internet, so that users can obtain higher bandwidth and more reliable quality indoors than indoors. And more economical wireless communication services. The introduction of Home Node B solves the bottleneck problem of the wireless port of the wireless data service, enabling users to enjoy high-speed, high-bandwidth network services.

For the traditional macro base station with a large coverage area (hereinafter referred to as the macro Node B), the arrangement of the network nodes is mostly planned by the operator in advance, and the network arrangement is completed according to the planned content. Therefore, the time, location, and configuration of the access time of the macro Node B are known to the current wireless network. Therefore, when the macro Node B requests access, it only needs to configure corresponding data according to the data specified by the network. By accessing the parameters, the access of the macro Node B can be completed without special control mechanism. For the network node of the same carrier, the registered mobile phone users in the network can establish a wireless link through the base station. It is only necessary to perform access control of the user equipment UE (User Equipment) on the core network side.

In the process of implementing the present invention, the inventor has found that the prior art has at least the following drawbacks: Since the HNB service is generally a personal application of a home or business user, from the perspective of the user, the HNB is generally a private device, and does not wish to be Used by others. From the operator's point of view, under normal circumstances, the HNB coverage is more favorable than the macro network, and it is desirable to judge and limit the personnel who use the HNB. In the prior art, the UE's admission judgment is judged by the core network element, which is aggravated. The core network element handles the burden, and there is a possibility that the illegal UE attacks the core network through the access request.

Summary of the invention

The embodiments of the present invention provide an access method, an access management method, an access device, and a network device of a user terminal, which implements effective verification of the legitimacy of the user accessing the core network through the access device, and effectively ensures the user. And the interests of the operators.

An embodiment of the present invention provides a method for accessing a user terminal, including:

Obtaining a user identifier from the user terminal; determining, according to the user identifier, whether the user terminal is legal. If the determination is negative, the user terminal is denied access. If the determination is yes, sending the device identifier to the core network element And an access authentication request for the encrypted data of the user identifier;

Receiving a message from the network element of the core network, the message includes the access permission message generated by the core network element according to the identifier of the local device and the encrypted data of the user identifier, and the generated access admission message or Access denied message.

The embodiment of the invention further provides an access management method for a user terminal, including:

Receiving an authentication request from a user terminal of the access device that carries the device identifier of the access device and the encrypted data of the user identifier of the user terminal;

Obtaining a corresponding decryption key according to the device identifier of the access device, and decrypting the encrypted data of the user identifier of the user terminal by using the decryption key. If the decryption fails, the access authentication fails.

Correspondingly, an embodiment of the present invention provides an access device, including: a storage unit, configured to store a user identifier of a user terminal that is configured to be permitted to access; a user identifier obtaining unit, configured to acquire a user identifier from the user terminal;

a determining unit, configured to determine whether the storage unit stores the user identifier of the user terminal, and an authentication processing unit, configured to: when the determining unit determines to be no, the access of the user terminal is denied, when the determining When the unit determines that the unit is YES, it sends an access authentication request carrying the encrypted data of the device identifier and the user identifier to the core network element;

a receiving unit, configured to receive a message from the core network element, where the message includes: the core network element performs access authentication on the user terminal according to the local device identifier and the encrypted data of the user identifier, and generates Access access message or access reject message.

And a network device, including:

An authentication request receiving unit, configured to receive a user terminal accessing an authentication request from the access device that carries the device identifier of the access device and the encrypted data of the user identifier of the user terminal;

The authentication unit is configured to obtain a corresponding decryption key according to the device identifier of the access device, and decrypt the encrypted data of the user identifier of the user terminal by using the decryption key. If the decryption fails, the access authentication fails. In addition, the embodiment of the present invention further provides a communication system, including an access device and a network device, where:

The access device is configured to obtain a user identifier from the user terminal, determine, according to the user identifier, whether the user terminal is legal, and if the determination is no, the user terminal is denied access, and if the determination is yes, the The network device sends an access authentication request that carries the encrypted data of the device identifier and the user identifier, and receives a message from the core network element, where the message includes the network device according to the local device identifier and the The access admission message or the access reject message generated by the user terminal performing the access authentication by the encrypted data of the user identifier.

The network device is configured to receive a user terminal access authentication request from the access device that carries the device identifier of the access device and the encrypted data of the user identifier of the user terminal; and obtain the corresponding according to the device identifier of the access device The decryption key is used to decrypt the encrypted data of the user identifier of the user terminal with the decryption key. If the decryption fails, the access authentication fails. In the embodiment of the present invention, the access device obtains the user identifier of the user terminal, and determines whether the user terminal is legal according to the user identifier. If the determination is no, the user terminal is denied access. If the determination is yes, the access to the core network is performed. The network element (eg, the HLR) sends an access authentication request carrying the encrypted data of the device identifier and the user identifier; after receiving the access request message, the core network element receives the access device identifier and the location Encrypting data of the user identifier performs access authentication on the user terminal, determines whether the user terminal is permitted to be accessed by the access device, and returns the determined grant access or denial access message to the access device, thereby implementing The access device effectively verifies and manages the identity of the accessed user terminal, ensuring the interests of the access device owner and the operator. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor.

1 is a schematic flowchart of a method for accessing a user terminal according to an embodiment of the present invention;

2 is a schematic flowchart of a method for access management of a user terminal according to an embodiment of the present invention; FIG. 3 is a schematic diagram of an interaction process of admission control of a user terminal according to an embodiment of the present invention;

4 is a schematic diagram of the composition of a communication system according to an embodiment of the present invention;

5 is a schematic structural diagram of an access device according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of the composition of a network device according to an embodiment of the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention. In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention will be further described in detail with reference to the accompanying drawings.

In the following embodiments, the access device may be a base station, a home base station, a digital subscriber access multiplexer DLSAM, a set top box STB, a modem, a home gateway, a customer premises equipment, a user terminal such as a mobile phone or a personal computer, and the like. The following embodiment illustrates an example in which the access device is a Home NodeB (HNB).

In the following embodiments, the core network element may be a home location register (HLR) or an access device home register (AHR).

FIG. 1 is a schematic flowchart of a method for accessing a user terminal according to an embodiment of the present invention, including:

101. Obtain a user identifier from the user terminal. The user identifier of the user terminal may be: when the user terminal is switched from the macro base station to the coverage area of the HNB according to the embodiment of the present invention, or when the coverage area of the HNB is powered on, the host station sends a reservation request to the HNB; After the residing request, the user terminal sends a user identity acquisition request to the user terminal; after receiving the acquisition request, the user terminal sends its own user identifier to the HNB. The user identifier of the user terminal is a unique identifier of the identity of the user terminal, and may be an IMSI (International Mobile Subscriber Identification Number) or an MSISDN (Mobile Station International Integrated Service Digital Network Number). ISDN number).

102. Determine, according to the user identifier, whether the user terminal is legal. If the determination is no, the user terminal is denied access. If the determination is yes, the device carries the device identifier and the user identifier. Encrypted data access authentication request.

In the embodiment of the present invention, a TPM (Trusted Platform Module) is configured on the HNB, and the TPM is a microcontroller based on the TCG (Trustworthy Computing Organization) industry standard specification. The TPM defined in the TCG Trusted Platform Module Specification is a microcontroller that stores keys, passwords, and digital certificates, and provides strong cryptographic functions that can be integrated on the HNB device board. The TPM contains cryptographic components and storage components embedded in the computing platform, similar to smart card chips. As The components of the Trusted Platform, the components of the TPM are trusted to work properly. The TCG software stack specification is a standard API software specification for accessing the TPM. The Trusted Computing Platform has three main characteristics: Protected Capabilities, Attestation, Integrity Measurement Logging and Reporting. Determining whether the user terminal is legal according to the user identifier, determining whether the user identifier exists in the user terminal access list stored by the device based on the trusted platform module configuration, and if the determination is no, the user terminal illegal. In the embodiment of the present invention, encrypting the user identifier to generate the encrypted data of the user identifier may be implemented as follows: According to the asymmetric encryption mechanism, the access device is maintained by the trusted platform module corresponding to the device. The platform identity authentication key signs the user identifier to generate user identification signature data; or may be based on a symmetric encryption mechanism, and the access device shares the core network element with the trusted platform module corresponding to the device. The key encrypts the user identifier to generate user identification encrypted data. Whether based on a symmetric encryption mechanism or an asymmetric encryption mechanism, the storage and maintenance of the key are maintained by the TPM to ensure data integrity and security.

In the embodiment of the present invention, the access terminal list of the user terminal for storing the user identity of the user terminal that is permitted to access is configured in the HNB, and the access authentication network element device located in the core network corresponding to the HNB is simultaneously saved to the HNB. Corresponding user identification list of a user terminal, wherein the user terminal access list stores a user identifier of a user terminal that is allowed to use the HNB device to access the core network, and the user can use the user service to authenticate the user terminal. The user ID saved in the list can be modified by adding, replacing, or deleting. You can also modify the user terminal access list by logging in to the customer service website through the user name and user password. Similarly, you can also provide the password through the customer service phone or on the HNB device. The key access mechanism modifies the user terminal access list. Based on the security platform provided by the TPM, the user terminal accessing the authentication request for transmitting the encrypted data carrying the device identifier and the user identifier to the core network element may be: saving the platform identity authentication key pair by using the HNB device The user identifier is signed, the user identifier signature data is generated, and the user terminal access authentication request carrying the device identifier and the user identifier signature data is sent to the core network element.

103. Receive a message from the core network element, where the message includes the core network element according to The access identification message or the access rejection message generated by the access authentication of the user equipment and the encrypted data of the user identifier.

When the core network element performs access authentication for the user terminal according to the serial number of the device and the user identifier of the user terminal, the core network element sends an access admission message to the HNB, and notifies the HNB that the user terminal is legal. The user, the access is allowed, and optionally, the HNB can further send an access admission message to the user terminal, and notify the user that the terminal can access the core network through the HNB. When the core network element fails to perform access authentication on the user terminal according to the serial number of the device and the user identifier of the user terminal, the core network element sends an access reject message to the HNB, notifying the HNB that the user terminal belongs to an illegal user. The access terminal does not have access rights and refuses to access. Optionally, the HNB may further send an access reject message to the user terminal, informing the user that the terminal is denied access to the core network through the HNB.

In this embodiment, the access device (HNB) obtains the user identifier of the user terminal, and determines whether the user terminal is legal according to the user identifier. If the determination is negative, the user terminal is denied access. If the determination is yes, The core network element (HLR) sends an access authentication request carrying the encrypted data of the device identifier and the user identifier. After receiving the access request message, the core network element receives the device identifier according to the access device. The encrypted data of the user identifier performs access authentication on the user terminal, determines whether the user terminal is permitted to be accessed by the access device (HNB), and returns a determined access admission message or an access rejection message to the user terminal. The access device, in turn, enables the access device (HNB) to effectively verify and manage the identity of the accessed user terminal, thereby ensuring the interests of the access device (HNB) owner and the operator.

FIG. 2 is a schematic flowchart of a method for accessing a user terminal according to an embodiment of the present invention, including: 201. A user that receives encrypted data of a device identifier of an access device and a user identifier of a user terminal from an access device. The terminal accesses the authentication request. In a specific implementation, the encryption of the user identifier to generate the encrypted data of the user identifier may be implemented as follows: According to the asymmetric encryption mechanism, the access device uses the platform identity maintained by the trusted platform module corresponding to the device. The authentication key is used to sign the user identifier to generate the user identification signature data. The authentication device may also be based on a symmetric encryption mechanism, and the access device maintains the core network based on the trusted platform module corresponding to the device. The shared key of the network element encrypts the user identifier to generate user identity encrypted data.

202. Acquire a corresponding decryption key according to the device identifier of the access device, and decrypt the encrypted data of the user identifier of the user terminal by using the decryption key. If the decryption fails, the access authentication fails.

In this step 202, if the decryption fails, the encryption key of the user identifier of the user terminal is encrypted, which does not match the decryption key, that is, the identity of the HNB is not trusted, and thus the access authentication fails. If the decryption is successful, the identity of the HNB is trusted, so it can be considered that the access authentication is passed. In order to further ensure the reliability of the authentication, if the decryption is successful, the device identifier of the access device may be used to find and determine whether the user identifier is saved in the user terminal access list corresponding to the access device. If the determination is yes, the access authentication to the user terminal is passed, and the user terminal is denied access. The step of acquiring the corresponding decryption key according to the device identifier of the access device, and decrypting the encrypted data of the user identifier of the user terminal by using the decryption key, according to the asymmetric encryption mode, includes: The device identifier of the access device is an index, and the decryption public key corresponding to the platform identity authentication key is retrieved and obtained; the user identity signature data is verified by the decryption public key, and the user identifier is obtained by decryption. The step of acquiring the corresponding decryption key according to the device identifier of the access device, and decrypting the encrypted data of the user identifier of the user terminal with the decryption key, according to the symmetric encryption mode, includes: acquiring the And a shared key of the access device and the core network element, and decrypting the encrypted data of the user identifier of the user terminal by using the shared key. The core network element device may be a network device such as a location home register HLR.

203. Send an access admission message or an access rejection message to the access device.

In this embodiment, the core network element receives the user terminal access authentication request from the access device that carries the device identifier of the access device and the encrypted data of the user identifier, according to the device identifier of the access device and the The encrypted data of the user identity performs access authentication on the user terminal, determines whether the user terminal is permitted to be accessed by the access device (HNB), and returns the determined access admission message or access rejection message to the access. The device, in turn, implements effective verification and management control of the identity of the accessed user terminal by the access device (HNB), and ensures the owner and operation of the access device (HNB). The interests of business.

Referring to FIG. 3, FIG. 3 is a schematic diagram of an interaction process of user terminal admission control according to an embodiment of the present invention. In this example, a UE is used as a user terminal, and an HNB is an access device, and the HLR is used in the core network to authenticate an authentication request from the HNB. The network element device (of course, it can also be another network element device with similar capabilities). When implemented, the method includes:

301. The UE sends a camping request to the HNB, where the UE switches from the macro base station to the HNB coverage area, or the UE sends a camping request to the HNB when the HNB coverage area is powered on.

302. After receiving the camping request, the HNB sends a user identity obtaining request to the UE.

303. The UE sends a user identifier to the HNB, where the user identifier is a unique identifier of the user terminal identity, and may be an IMSI (International Mobile Subscriber Identification Number) or an MSISDN (Mobile Station International ISDN Number). Taiwan International ISDN number).

304. The HNB obtains the user identifier, and uses the user identifier as an index to query the UE admission list of the HNB secure storage, and determines whether the user identifier exists in the admission list. When it is determined that the user identifier exists, the user identifier is signed. Generate user identification signature data, and execute 305, otherwise execute 306.

In the embodiment of the present invention, the user terminal access list for storing the user identity of the user terminal that is permitted to access is configured on the HNB, and the access authentication network element located in the core network corresponding to the HNB is also saved. A user terminal access list corresponding to the HNB, where the user terminal access list stores the user identifier of the user terminal that is allowed to use the HNB device to access the core network, and the user can use the user service mode to the user terminal. The user ID saved in the list can be modified by adding, replacing, or deleting. You can also modify the user terminal access list by logging in to the customer service website through the user name and user password. Similarly, you can also provide the password through the customer service phone or on the HNB device. The key access mechanism modifies the user terminal access list. Based on the security platform provided by the TPM, the HNB signs the user identifier with a platform identity authentication key stored in the TPM to generate user identity signature data. When it is determined that the user identifier does not exist in the user identifier list of the user terminal, The user corresponding to the user identifier is a user who is not allowed to access, and performs 306.

305. The HNB sends an access authentication request that carries the HNB device identifier and the user identifier signature data to the HLR.

306. The HNB sends an access prohibition message to the UE.

307. The HLR obtains the HNB device identifier and the user identifier signature data, uses the HNB device identifier as an index, searches a database, finds a corresponding decryption public key, and decrypts the user identifier signature data by using the decryption public key. If the decryption succeeds, the user identifier is obtained, and the user terminal access list corresponding to the HNB device saved by the HLR is obtained by using the HNB device identifier as an index, and it is determined whether the user identifier exists in the user terminal admission list, and the determination is yes. Then, the authentication transmits the access admission message by granting access, otherwise the authentication fails to reject the access, and the access rejection message is sent.

308. The HLR sends an access admission message or an access rejection message to the HNB.

309. The HNB sends an access admission message or an access rejection message to the UE.

In this embodiment, the access device obtains the user identifier of the user terminal, determines whether the user identifier is saved, and denies the access of the user terminal when it is determined that the user identifier is not saved. When it is determined that the user identifier is saved, the access network The network element sends a user terminal access authentication request carrying the device identifier and the user identifier of the user terminal, and after receiving the access request message, the core network element receives the access device identifier and the user terminal according to the access device identifier The user identifier performs access authentication on the user terminal, determines whether the user terminal is permitted to be accessed by the access device, and returns the determined access admission message or access rejection message to the access device, thereby implementing The access device effectively verifies and manages the identity of the accessed user terminal, ensuring the interests of the access device owner and the operator.

Referring to FIG. 4, it is a schematic diagram of a composition of a communication system according to an embodiment of the present invention. The communication system includes an access device 1 and a network device 2, where the access device 1 is configured to acquire a user identifier from a user terminal. The user identifier determines whether the user terminal is legal. If the determination is no, the user terminal is denied access. If the determination is yes, the device sends the encrypted data carrying the device identifier and the user identifier. Receiving a message from the network device 2, the message including the number of encryptions of the network device according to the local device identifier and the user identifier An access admission message or an access rejection message generated by performing access authentication on the user terminal. Referring to FIG. 5, it is a schematic diagram of a configuration of an access device 1 according to an embodiment of the present invention. The access device 1 in this example may be used to perform a method for accessing a user terminal according to an embodiment of the present invention. 1 includes: a storage unit 13, a user identification acquisition unit 11, a determination unit 12, an authentication processing unit 15, and a reception unit 16.

The storage unit 13 is configured to store a user identifier of the user terminal that is configured to permit access; the storage unit 13 may include:

a user identifier storage unit 131, configured to store, in a trusted manner of the core network element, a user identifier of a user terminal that is allowed to access;

The key storage unit 132 is configured to store, in a manner trusted by the core network element, a platform identity authentication key transmitted with the core network element metadata or a shared key with a core network element.

In this embodiment, a TPM (Trusted Platform Module) is configured on the access device, and the user identifier storage unit 131 and the key storage unit 132 are maintained based on the specification defined by the TPM. a security storage mechanism and a key storage mechanism defined by the TPM specification, where the user identifier storage unit 131 configured in the access device stores the configured user identifier of the user terminal that is permitted to access and the key storage unit 132 stores and stores the The platform identity authentication key of the core network metadata transmission or the shared key with the core network element may be considered trusted by the core network element.

The user identifier obtaining unit 11 is configured to obtain the user identifier from the user terminal. In a specific embodiment, the user identifier obtaining unit 11 may include:

a resident request receiving unit 111, configured to receive a resident request from the user terminal;

The user identifier obtaining request 112 is configured to send a user identifier obtaining request to the user terminal, and the user identifier receiving unit 113 is configured to receive the user identifier from the user terminal.

The determining unit 12 is configured to determine whether the storage unit 13 saves the user identifier of the user terminal.

The authentication processing unit 15 is configured to reject the user end when the determining unit 12 determines to be no The access of the terminal, when the determining unit 12 determines YES, sends an access authentication request carrying the encrypted data of the device identifier and the user identifier to the core network element. In a specific embodiment, the certificate processing unit 15 may include:

The rejecting unit 151 is configured to reject the access of the user terminal when the determining unit 12 determines to be no;

The encryption unit 152 is configured to sign the user identifier by using the platform identity authentication key stored in the key storage unit 132, generate user identification signature data, or store the information in the key storage unit 132. The shared key with the core network element encrypts the user identifier, and generates user identifier encrypted data;

The authentication request sending unit 153 is configured to send, to the core network element, a user terminal access authentication request carrying the device identifier and the user identifier signature data or the user identifier encrypted data.

The receiving unit 16 is configured to receive a message from the core network element, where the message includes the core network element performing access authentication generation on the user terminal according to the local device identifier and the encrypted data of the user identifier. Access access message or access reject message.

Optionally, the access device 1 in this embodiment may further include:

The access prohibition message transmitting unit 14 is configured to send an access prohibition message to the user terminal when the determining unit 12 determines to be no.

Optionally, the access device 1 in this embodiment may further include:

The access admission message sending unit 17 is configured to send an access admission message to the user terminal when the receiving unit 16 receives the access admission message from the core network element;

The access reject message sending unit 18 is configured to send an access reject message to the user terminal when the receiving unit 16 receives the access reject message from the core network element.

In this embodiment, the access device (HNB) obtains the user identifier of the user terminal, and determines whether the user terminal is legal according to the user identifier. If the determination is negative, the user terminal is denied access. If the determination is yes, The core network element (HLR) sends an access authentication request carrying the encrypted data of the device identifier and the user identifier; after receiving the access request message, the core network element receives the The access device device identifier and the encrypted data of the user identifier perform access authentication on the user terminal, determine whether the user terminal is permitted to be accessed by the access device (HNB), and determine the access access. The message or the access denial message is returned to the access device, thereby implementing effective verification and management control of the identity of the accessed user terminal by the access device (HNB), ensuring the access device (HNB) owner and the operator. interest.

The network device 2 is configured to receive a user terminal access authentication request from the access device 1 carrying the device identifier of the access device and the encrypted data of the user identifier of the user terminal; according to the device identifier of the access device, Obtaining a corresponding decryption key, and decrypting the encrypted data of the user identifier of the user terminal with the decryption key, and if the decryption fails, the access authentication fails. Referring to FIG. 6, FIG. 6 is a schematic diagram of the composition of the network device 2 according to the embodiment of the present invention. The network device 2 in the embodiment of the present invention may be a location-origin register HLR or the like. The network device 2 in this example may be used to perform the access management method of the two user terminals in the embodiment of the present invention. When the network device 2 is implemented, the network device 2 includes: an authentication request receiving unit 21, a storage unit 22, and an authentication unit 23, Unit 24.

The authentication request receiving unit 21 is configured to receive a user terminal access authentication request from the access device 1 that carries the device identifier of the access device and the encrypted data of the user identifier of the user terminal;

The storage unit 22 is configured to save a user terminal access list corresponding to the access device;

The authentication unit 23 is configured to obtain a corresponding decryption key according to the device identifier of the access device 1, and decrypt the encrypted data of the user identifier of the user terminal by using the decryption key, and if the decryption fails, the authentication is performed. The authentication unit 23 may include:

The key obtaining unit 231 is configured to retrieve and obtain a corresponding decryption public key or a shared key with the access device 1 by using the device identifier of the access device 1 as an index;

The decryption unit 232 is configured to decrypt the encrypted data of the user identifier of the user terminal according to the decryption public key acquired by the key obtaining unit 231 or the shared key of the access device;

The authentication execution unit 233 is configured to determine that the access authentication fails when the decryption unit 232 fails to decrypt, and directly determines whether the access authentication passes or according to the device identifier of the access device when the decryption unit resolves the 232 secret successfully. Finding and determining the corresponding to the access device stored by the storage unit 22 Whether the user identifier is saved in the user terminal access list, and if the determination is yes, the access authentication of the user terminal is passed, otherwise, the user terminal is denied access.

The sending unit 24 is configured to send an access admission message or an access rejection message to the access device.

In this embodiment, the core network element receives a user terminal access authentication request from the access device that carries the device identifier of the access device and the encrypted data of the user identifier of the user terminal, according to the access device device identifier and The encrypted data of the user identifier performs access authentication on the user terminal, determines whether the user terminal is permitted to be accessed by the access device (HNB), and returns a determined access admission message or an access rejection message to the user terminal. The access device, in turn, enables the access device (HNB) to effectively verify and manage the identity of the accessed user terminal, thereby ensuring the interests of the access device (HNB) owner and the operator.

In summary, the implementation of the embodiment of the present invention, the access device (HNB) obtains the user identifier of the user terminal, and determines whether the user terminal is legal according to the user identifier, and if the determination is no, the user terminal is denied access. If the determination is yes, the core network element (HLR) sends an access authentication request carrying the encrypted data of the device identifier and the user identifier; after receiving the access request message, the core network element receives the access request message according to the Encrypting data of the device device identifier and the user identifier is used for access authentication of the user terminal, determining whether the user terminal is permitted to be accessed by the access device (HNB), and determining the granted access or denying access The message is returned to the access device, which in turn enables the access device (HNB) to effectively verify and manage the identity of the accessed user terminal, thereby ensuring the interests of the access device (HNB) owner and the operator.

A person skilled in the art can understand that all or part of the process of implementing the above embodiment method can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium. In execution, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

The above is only the preferred embodiment of the present invention, and the scope of the present invention is not limited thereto. Therefore, equivalent changes made in accordance with the claims of the present invention are still covered by the present invention. One ς\一

S8l.0/600ZN3/X3d ZT8SSl/600Z OAV

Claims

Claim

A method for accessing a user terminal, comprising:

Obtaining a user identifier from the user terminal;

Determining whether the user terminal is legal according to the user identifier, and if yes, transmitting an access authentication request carrying the encrypted data of the device identifier and the user identifier to the core network element;

The method according to claim 1, wherein the step of determining whether the user terminal is legal according to the user identifier comprises:

The user terminal is determined to be in the user terminal access list stored by the device based on the configuration of the trusted platform module. If the determination is no, the user terminal is invalid. If the determination is yes, the user terminal is legal.

The method of claim 1, wherein the sending an access authentication request that carries the encrypted data of the device identifier and the user identifier to the core network element includes:

The user identifier is signed by the platform identity authentication key that is maintained by the trusted platform module, and the user identifier signature data is generated, and the device identifier and the user identifier signature data are sent to the core network element. The user terminal accesses the authentication request.

The method of claim 1, wherein the sending an access authentication request to the core network element carrying the encrypted data of the device identifier and the user identifier comprises:

Encrypting the user identifier with the shared key of the core network element maintained by the trusted platform module corresponding to the device, generating the user identifier encrypted data, and sending the device identifier and the user to the core network element The user terminal that identifies the encrypted data accesses the authentication request.

The method of claim 2, wherein before the obtaining the user identifier from the user terminal, the method further includes:

Storing a user identifier for storing a user terminal permitted to access based on the trusted platform module configuration User terminal access list.

The method of claim 1, wherein the obtaining the user identifier from the user terminal comprises:

Receiving a resident request from a user terminal;

Sending a user terminal identity acquisition request to the user terminal;

Receive the user ID from the user terminal.

The method according to claim 1, wherein after receiving the message from the core network element, the method further includes:

An access admission message or an access rejection message is sent to the user terminal.

The method according to any one of claims 1 to 7, wherein the type of the user identifier of the user terminal comprises:

International Mobile Subscriber Identity or Mobile International ISDN number.

The method according to any one of claims 1 to 7, wherein the type of the core network element includes:

Home location register or access device home register.

A method for access management of a user terminal, comprising:

Receiving a user terminal access authentication request from the access device, where the request carries the device identifier of the access device and the encrypted data of the user identifier of the user terminal;

The method of claim 10, wherein if the decryption is successful, searching for and determining whether the user terminal access list corresponding to the access device is saved according to the device identifier of the access device The user identifier is determined. If the determination is yes, the access authentication to the user terminal is passed.

The method according to claim 10, wherein the encrypted data of the user identifier of the user terminal is used by the access device to sign the user identifier based on the platform identity authentication key maintained by the trusted platform module, and generate User identification signature data; the device identifier according to the access device, Obtaining a corresponding decryption key, and decrypting the encrypted data of the user identifier of the user terminal by using the decryption key includes:

Retrieving and acquiring a decryption public key corresponding to the platform identity authentication key by using the device identifier of the access device as an index;

The user identification signature data is verified by the decryption public key, and the user identification is decrypted.

The method according to claim 10, wherein the encrypted data of the user identifier of the user terminal is a shared key of the access device and the core network element maintained by the trusted platform module, and the user identifier is And performing the encryption, the generated user identifier is encrypted data; the step of acquiring the corresponding decryption key according to the device identifier of the access device, and decrypting the encrypted data of the user identifier of the user terminal by using the decryption key comprises:

Obtaining a shared key of the access device and the core network element, decrypting the user identifier encrypted data by using the shared key, and acquiring the user identifier.

14. An access device, comprising:

a storage unit, configured to store a user identifier of a user terminal configured to permit access;

a user identifier obtaining unit, configured to acquire a user identifier from the user terminal;

a determining unit, configured to determine whether the storage unit stores the user identifier of the user terminal, and the authentication processing unit is configured to send, when the determining unit determines that the device identifier is An access authentication request for the encrypted data of the user identifier;

The access device according to claim 14, wherein the storage unit comprises: a user identifier storage unit, configured to store, in a trusted manner of the core network element, a user terminal configured to permit access User ID;

a key storage unit, configured to store and communicate with the core network network in a trusted manner by the core network element The platform identity authentication key for metadata transmission or the shared key with the core network element.

The access device according to claim 15, wherein the authentication processing unit comprises: an encryption unit, configured to pair the user with the platform identity authentication key stored in the key storage unit The identifier is signed, the user identifier signature data is generated, or the user identifier is encrypted by using the shared key with the core network element stored in the key storage unit, and the user identifier encrypted data is generated; the authentication request sending unit uses The user terminal accessing the authentication request carrying the device identifier and the user identifier signature data or the user identifier encrypted data is sent to the core network element.

The access device according to claim 16, wherein the user identifier obtaining unit comprises:

a resident request receiving unit, configured to receive a resident request from the user terminal;

a user identifier obtaining request, configured to send a user identifier obtaining request to the user terminal, and a user identifier receiving unit, configured to receive a user identifier from the user terminal.

The access device of claim 14, further comprising:

The access prohibition message sending unit is configured to send an access prohibition message to the user terminal when the determining unit determines to be no.

The access device of claim 14, further comprising:

An access admission message sending unit, configured to send an access admission message to the user terminal when the receiving unit receives an access admission message from the core network element;

And an access reject message sending unit, configured to send an access reject message to the user terminal when the receiving unit receives the access reject message from the core network element.

20. A network device, comprising:

The authentication unit is configured to obtain a corresponding decryption key according to the device identifier of the access device, and decrypt the encrypted data of the user identifier of the user terminal by using the decryption key. If the decryption fails, the access authentication fails.

The device according to claim 20, wherein the authentication unit comprises: a key obtaining unit, configured to retrieve and acquire a corresponding decryption public key or with the device identifier of the access device as an index The shared key of the access device;

a decrypting unit, configured to decrypt the encrypted data of the user identifier of the user terminal according to the decrypted public key acquired by the key obtaining unit or the shared key with the access device;

The authentication execution unit is configured to: when the decryption unit fails to decrypt, determine that the access authentication fails, and when the decryption unit decrypts successfully, directly determine whether the access authentication passes or according to the device identifier of the access device, finds and determines Whether the user identifier is saved in the user terminal access list corresponding to the access device, and if the determination is yes, the access authentication of the user terminal is passed.

The device according to claim 20 or 21, further comprising:

And a sending unit, configured to send an access admission message or an access rejection message to the access device.

A communication system, comprising: an access device and a network device, wherein: the access device is configured to acquire a user identifier from the user terminal; and determine, according to the user identifier, whether the user terminal is legal, if If the determination is yes, the device sends an access authentication request carrying the encrypted data of the device identifier and the user identifier to the network device, and receives a message from the core network element, where the message includes the network device according to the An access admission message or an access rejection message generated by the user equipment performing the access authentication by using the device identifier and the encrypted data of the user identifier.

The network device is configured to receive a user terminal access authentication request from the access device that carries the device identifier of the access device and the encrypted data of the user identifier of the user terminal; and obtain the corresponding according to the device identifier of the access device The decryption key decrypts the encrypted data of the user identifier of the user terminal with the decryption key, and if the decryption fails, the access authentication fails.

The communication system according to claim 23, wherein the type of the access device comprises: a base station, a home base station, a digital user access multiplexer DLSAM, a set top box STB, a modem, a home gateway, and a user premises equipment. , cell phone or personal computer.

The communication system according to claim 23, wherein the type of the network device comprises: a home location register or an access device home location register.