WO2010075644A1 - 实现终端设备锁网的方法、系统及终端设备 - Google Patents

实现终端设备锁网的方法、系统及终端设备 Download PDF

Info

Publication number
WO2010075644A1
WO2010075644A1 PCT/CN2008/002162 CN2008002162W WO2010075644A1 WO 2010075644 A1 WO2010075644 A1 WO 2010075644A1 CN 2008002162 W CN2008002162 W CN 2008002162W WO 2010075644 A1 WO2010075644 A1 WO 2010075644A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
lock
lock network
terminal device
authentication
Prior art date
Application number
PCT/CN2008/002162
Other languages
English (en)
French (fr)
Inventor
刘晓鹏
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to CN2008801306572A priority Critical patent/CN102113358B/zh
Priority to EP08879260.1A priority patent/EP2384038B1/en
Priority to US13/138,018 priority patent/US8732458B2/en
Priority to ES08879260.1T priority patent/ES2609922T3/es
Priority to PCT/CN2008/002162 priority patent/WO2010075644A1/zh
Publication of WO2010075644A1 publication Critical patent/WO2010075644A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys

Definitions

  • the invention relates to a network security protection mechanism of a terminal device product in a wireless network communication, in particular to a security protection mechanism of a WiMAX (World Interoperability for Microwave Access) network terminal device product, a method, a system and a terminal device for realizing a terminal device lock network.
  • WiMAX Worldwide Interoperability for Microwave Access
  • the purpose of the terminal device is as follows: 1) Prevent the terminal device from accessing the fake base station. Some hackers can establish a fake base station to induce network terminal devices to access, thereby stealing personal information and even destroying terminal devices. 2) Prevent access to networks of other operators.
  • the current communications market is fierce, and major operators have taken various plans to attract new customers and retain old customers.
  • One of the solutions for attracting new customers is the sales model in which terminal devices such as mobile phones/online cards are bundled with services. In this solution, the actual selling price of the terminal device such as the mobile phone/network card is lower than the market price.
  • the operator does not want the user to use the terminal device in the network of other operators after the service ends, but hopes that the user can still use the terminal device.
  • the service provided by the user in order to retain the old customer, the need to add a lock function to the terminal device has emerged. This function can bind the terminal device to the operator, thereby limiting the user's use of the terminal device to use other devices.
  • the services provided by the operator can be used to provide the services.
  • the operator can also unlock the terminal device to adapt to various needs, such as after-sales maintenance, and in special cases, the user is charged a certain fee to allow the user to unlock.
  • the technical problem to be solved by the present invention is to provide a method, a system and a terminal device for realizing a network lock of a terminal device, so as to implement a lock network function.
  • the present invention provides a method for implementing a network lock of a terminal device, where the method includes a network lock process during network access, that is, a lock network configuration verification is performed during the network access authentication process. If the authentication of the lock network is successful, the authentication certificate is allowed to be verified. Otherwise, the terminal device is denied access to the network.
  • the network authentication process refers to a process in which the terminal device authenticates the authentication and authorization accounting server, that is, the AAA server, and the lock network configuration verification refers to the lock network string and the terminal in the AAA server authentication certificate.
  • the lock network string saved by the device is compared. If they are the same, the lock network configuration verification is successful.
  • lock network string refers to a network name identifier of an operator that is placed in the CN field of the main body portion of the authentication certificate.
  • the lock network function is determined according to the lock network flag saved by the terminal. If enabled, the lock network string comparison is performed. Otherwise, Perform authentication verification directly.
  • the method further includes an unlocking process, where the process includes: the OTA server acquires and compares the unlocking keys respectively saved by the operator server and the terminal device; if the unlocking keys are the same, the OTA server notifies the terminal device to set the lock
  • the network flag bit is that the lock network function is not enabled and the lock network string is cleared.
  • the method further includes a process of re-locking after the Internet access, the process includes: the OTA server calculates an unlocking key of the terminal device, and notifies the operator server and the terminal device to save the unlocking key; the OTA server Sending a lock network flag bit and a lock network string to the terminal device; the terminal device saves the lock network string and sets the lock network flag bit to enable the lock network function.
  • the present invention further provides a system for implementing a terminal device lock network, which is used for performing lock network configuration verification during the network access authentication process, and if the lock network configuration verification is successful, the verification authentication is allowed. Certificate, otherwise the terminal device is denied access to the network.
  • the system includes an authentication authorization charging server, that is, an AAA server and a terminal device, where
  • the AAA server is configured to send an authentication certificate to the terminal, where the authentication certificate includes a lock network string;
  • the terminal device includes a transceiver module, a lock network module, and an authentication module, where
  • a transceiver module configured to receive the authentication certificate
  • the lock network module is configured to protect the lock network string and the self-protection certificate in the authentication certificate sent by the AAA server.
  • the stored lock network string is used for the authentication of the lock network. If the same, the authentication module is used to authenticate the authentication module.
  • the authentication module is configured to verify the authentication certificate sent by the AAA server according to the certificate saved by the authentication module.
  • the lock network module is further configured to save a lock network flag bit; if the lock network flag bit indicates that the lock network function is not enabled, the lock network module is further configured to directly activate the authentication module for authentication, otherwise Start the lock network string verification.
  • the system further includes an OTA server and an operator server, where the OTA server is configured to verify an unlocking key saved by the operator server and the terminal device, and notify the terminal device to clear the Locking the network string and resetting the lock network flag to implement an unlocking function; the OTA server is further configured to calculate an unlocking key and notify the operator server and the terminal device to save an unlocking key, and notify the The terminal device saves the lock network string and sets the lock network flag bit, and implements the lock function after the Internet access; the lock network module of the terminal device is used for saving and updating according to the notification of the OTA server.
  • the present invention further provides a terminal device, where the terminal device has a lock network function, and the terminal includes a transceiver module, a lock network module, and an authentication module, where
  • the transceiver module is configured to receive an authentication certificate sent by an authentication and authorization accounting server, that is, an AAA server, where the authentication certificate includes a lock network string;
  • the lock network module is configured to perform a lock network verification on the lock network string in the authentication certificate sent by the AAA server and the lock network string saved by the AAA server. If the same, the function is also used to start the authentication module for authentication. ;
  • the authentication module is configured to verify the authentication certificate sent by the AAA server according to the certificate saved by itself.
  • the lock network module is further configured to save a lock network flag bit; if the lock network flag bit indicates that the lock network function is not enabled, the lock network module is further configured to directly activate the authentication module for authentication, otherwise Used to start the lock network string 3 full certificate.
  • the method, the system and the terminal device of the present invention utilize an authentication process, and the terminal device and the server need to uniformly configure a lock network string, which has strong security; and can be implemented through an air interface management through an OTA method.
  • Unlock and lock on the Internet with high flexibility Sex and ease of use, can meet the needs of 4G networks such as WiMAX networks and LTE networks.
  • Figure 1 is a schematic diagram of the content of the X.509 certificate.
  • Figure 2 is a schematic diagram of the X.509 certificate chain.
  • FIG. 3 is a flow chart of the EAP-TLS and EAP-TTLS two-way authentication process.
  • FIG. 4 is a flow chart of the invention for realizing the lock network when the terminal device enters the network.
  • Figure 5 is a flow chart of unlocking the present invention.
  • Figure 6 is a flow chart of the invention after the network is re-locked.
  • the method for implementing the terminal device lock network includes three processes, namely, a lock network process, an unlock process, and a process of locking after entering the network.
  • the lock network process at the time of network access that is, the lock network configuration verification during the network authentication process. If the lock network configuration verification is successful, the authentication certificate is allowed to be verified, otherwise the terminal device is denied access to the network.
  • EAP-TLS and EAP-TTLS authentication use the X.509 certificate as the identity of the AAA server and the terminal device.
  • the X509 certificate includes The subject also includes a subject that can be customized.
  • the operator puts its own network name identifier into the CN field of the part for use in the authentication process of the authentication network.
  • the X.509 certificate format is as shown in FIG. 1 . Show.
  • the X.509 certificate architecture is shown in Figure 2, where the re-level root certificate can be omitted. Due to the signature certificate, this hierarchical certificate is collectively referred to as the certificate chain, as shown in Figure 2.
  • WiMAX terminal devices are divided into: network search, authentication, registration, and establishment of IP connections.
  • the authentication part plays the role of controlling network access.
  • the lock network function is implemented at this stage.
  • the two methods recommended by the WiMAX protocol are the EAP-TLS (Extensible Authentication Protocol - Transport Layer Security) based on the X.509 certificate and the EAP-TTLS (EAP Tunneled Transport Layer Security).
  • the authentication process is basically the same, but the TTLS can select one-way.
  • Device authentication only for AAA server authentication
  • you can also choose two-way device authentication (AAA server authentication for terminal device and terminal device authentication for AAA server device, as shown in Figure 3), or user can be selected.
  • Authentication authentication of users based on username and password).
  • the invention is based on the EAP-TLS and EAP-TTLS network authentication methods, and checks the lock network flag bit and the comparison lock network string in the authentication process. If the lock network flag bit is enabled, then only the lock network string of the AAA server certificate is used. If the lock network string stored by the terminal device is equal, the authentication is allowed. Otherwise, the authentication fails and the network is denied, so as to achieve the purpose of locking the network.
  • the lock network method uses the server certificate to determine whether the current network is a legitimate network in the authentication process. If the authentication fails due to the failure of the legitimate network, the network access fails, thereby achieving the purpose of locking the network.
  • the specific process includes:
  • Step 401 The terminal device receives a certificate chain sent by the server, where the certificate chain includes an AAA server certificate and an intermediate certificate, where the string of the CN field in the server certificate is a lock network string, and is used for performing lock network verification.
  • the string is the name of the operator;
  • Step 402 The terminal device checks the lock network flag bit, if the lock network flag bit indicates that the lock network function is enabled, step 403 is performed, otherwise step 404 is performed;
  • Step 403 The terminal device checks whether the lock network string in the server certificate is the same as the lock network string saved by the terminal device. If yes, step 404 is performed. Otherwise, it is determined that the current network is not a legal network, and the authentication failure is directly returned to the AAA server. Refuse to enter the network, the process ends;
  • Step 404 The terminal device uses the top-level root certificate of the AAA server certificate stored by the local device to verify the received server certificate chain. If the verification succeeds, step 405 is performed. Otherwise, the authentication fails, the network is refused, and the process ends.
  • Step 405 The terminal device sends a device certificate chain (including a device certificate and an intermediate certificate) of the terminal device to the server;
  • Step 406 The AAA server verifies the received device certificate chain by using the stored device certificate root certificate. If the authentication succeeds, the authentication is successful, and the access is allowed. Otherwise, the authentication fails and the access is denied.
  • the method of the invention uses the lock network string for the lock network verification, wherein the lock network string is generally the operator name, and the terminal device can store the value in the EEPROM (Electrically Erasable Programmable Read-Only Memory, electrically erasable and programmable only In the read memory, the enable flag of the lock network function is also stored in the EEPROM.
  • EEPROM Electrically Erasable Programmable Read-Only Memory, electrically erasable and programmable only In the read memory, the enable flag of the lock network function is also stored in the EEPROM.
  • the key control method is used.
  • the device When the device is produced, it generates a device key based on the device ID, master control key, etc. and stores it in the EEPROM.
  • the key corresponds to the device.
  • the key is also handed over to the operator in a secure manner when it is delivered to the operator.
  • the operator stores it in a secure database, and the key can be generated using algorithms such as SHA256.
  • the terminal device After the terminal device proposes the unlocking request and obtains the operator's approval, or meets the lock time limit, or other conditions that meet the unlocking conditions, the terminal device that has enabled the lock network function may use the following method to remove the lock network function to the network connection. Entry restrictions.
  • the carrier server uses the OTA (Over The Air) module to wirelessly manage the terminal equipment.
  • the carrier server stores parameters such as the Mac ID and lock network key of each terminal device.
  • the OTA server reads the unlocking key corresponding to the terminal device, and compares the unlocking key in the device EEPROM through the air interface (OTA) to compare, if the same, sets the unlocking flag bit to FALSE and clears the network locking string. If it is not the same, the unlock will fail.
  • OTA Over The Air
  • Step 501 The OTA server acquires an unlocking key and a terminal device ID of the terminal device saved by the operator server.
  • Step 502 The OTA server acquires an unlocking key saved by the terminal device corresponding to the ID by using an OTA method.
  • Step 503 The OTA server compares the obtained unlocking keys. If they are the same, step 504 is performed. Otherwise, the process ends.
  • Step 504 The OTA server sends an unlock notification to the terminal through the OTA mode to reset the lock network flag to FALSE and clear the lock network string to unlock.
  • Step 601 The terminal reads the lock network flag stored in the device to determine whether it has been locked. If the lock has been locked, the process ends, otherwise step 602 is performed;
  • Step 602 The OTA server on the network side learns that the terminal device is not locked by using the OTA method, and calculates an unlocking key according to parameters such as a Mac address, a current time, and a network ID of the terminal device.
  • Step 603 The OTA server on the network side calculates the unlocking key.
  • the unlocking key is sent to the operator server for storage, and is sent to the terminal device in an OTA manner to update the lock network key in the EEPROM;
  • Step 604 The OTA server on the network side sends a lock notification to the terminal through the OTA mode, where the lock network string and the lock network flag bit (TRUE or FALSE) are carried, and the value of the corresponding field in the EEPROM is updated.
  • TRUE or FALSE lock network flag bit
  • the present invention further provides a system for implementing a network lock of a terminal device, where the system includes an AAA server, an operator server, and a terminal device, where
  • the carrier database is used to save parameters such as the Mac ID and lock network key of the terminal device.
  • AAA server which refers to a network server, which has the functions of authentication, authorization, and accounting, and specifically includes a transceiver module and an authentication module. among them,
  • the transceiver module is configured to receive and send various signaling messages, including sending a certificate chain to the terminal device, receiving a certificate chain sent by the terminal device, and sending an authentication response according to the authentication result, where the certificate chain sent to the terminal device includes a lock Net string,
  • the authentication module is configured to verify the certificate chain sent by the terminal device according to the certificate saved by the terminal device;
  • the terminal device refers to a network product terminal device such as an Internet card or a mobile phone, and includes a transceiver module, an authentication module, and a lock network module.
  • the transceiver module is configured to receive or send various signaling messages, including receiving a certificate chain sent by the AAA server, and sending a certificate chain of the terminal device to the AAA server, and sending the verification result to the AAA server according to the authentication module and the lock network module. Send an authentication response;
  • the authentication module is configured to verify the certificate chain sent by the AAA server according to the certificate saved by the AAA server;
  • the lock network module is configured to save the lock network identification bit and the lock network string, and the lock network identification bit is used to indicate whether the lock network function is enabled. If the lock network flag bit indicates that the lock network function is enabled, the lock network function is also used for receiving the transceiver module.
  • the lock network string in the certificate chain sent by the AAA server is locked with the lock network string saved by itself. If the same, it is also used to start the authentication module for authentication. If the lock network flag indicates that the lock network function is not enabled. It is also used to directly activate the authentication module for authentication.
  • the system of the present invention further includes an OTA server, configured to acquire an unlocking key of the terminal device in the operator server and a saved unlocking key of the corresponding terminal, and also used to compare the obtained unlocking key, if the same, Used to send unlock notifications.
  • an OTA server configured to acquire an unlocking key of the terminal device in the operator server and a saved unlocking key of the corresponding terminal, and also used to compare the obtained unlocking key, if the same, Used to send unlock notifications.
  • the lock network module of the terminal device is configured to provide the saved unlock password and the unlock notification according to the unlocking notification to the OTA server, reset the lock network flag bit, and clear the lock network string.
  • the OTA server is also used to calculate the unlocking key of the terminal device and notify the operator server and the terminal device to save the OTA server, and the OTA server is further configured to send a lock notification to the terminal device, where the lock network logo is carried. Bit and lock network string.
  • the lock network module of the terminal device is configured to determine whether the lock is locked according to the lock network flag bit, and is further configured to set a lock network flag bit and update the lock network string according to the lock network notification sent by the OTA server. Now it is locked after surfing the Internet.
  • the present invention also provides a terminal device, which can implement a lock network function when entering the network, and its specific modular structure is as described above.
  • the use of the lock network identification bit provides a possibility to enable the lock network function, and the operator or the terminal device has the right to select the lock network function, and of course, the lock network identifier bit may not be used.
  • the lock network identifier bit may not be used.
  • the present invention is applicable to the EAP-TTLS mode, regardless of the authentication method, as long as the authentication method for authenticating the server can be used, because authenticating the server means that the lock network string in the server certificate can be read. , and can be compared with the string stored by the terminal device to achieve the purpose of locking the network.
  • the method, the system and the terminal device of the present invention utilize an authentication process, and the terminal device and the server need to uniformly configure a lock network string, which has strong security; and can be implemented through an air interface management through an OTA method.
  • Unlocking and locking after surfing the Internet with high flexibility and ease of use, can meet the needs of 4G networks such as WiMAX networks and LTE networks.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Lock And Its Accessories (AREA)

Description

实现终端设备锁网的方法、 系统及终端设备 技术领域
本发明涉及无线网络通讯中的终端设备产品网络安全保护机制， 尤其是 WiMAX ( World Interoperability for Microwave Access ) 网络终端设备产品的 安全保护机制， 实现终端设备锁网的方法、 系统及终端设备。
背景技术
终端设备接入运营商提供的网络后要进行锁网操作来阻止该终端设备接 入其他网络， 其目的有以下两点： 1 )防止终端设备接入假基站。 某些黑客可 以自己建立一个假基站来诱使网络终端设备接入， 进而盗取个人信息， 甚至 破坏终端设备。 2 )防止接入其他运营商的网络。 当前通讯市场竟争激烈， 各 大运营商都釆取了各种各样的方案来吸引新客户、 留住老客户。 其中手机 /上 网卡等终端设备与服务绑定的销售模式便是吸引新客户的方案之一。 在该方 案中， 手机 /上网卡等终端设备的实际售价低于市场价， 运营商不希望在服务 结束后用户将该终端设备用在其他运营商的网络中， 而是希望用户仍然能够 沿用自己所提供的服务， 以达到留住老客户的目的， 为终端设备添加锁网功 能的需求应运而生， 该功能能够将终端设备与运营商绑定， 从而达到限制用 户利用该终端设备使用其他运营商提供的服务。
同时， 运营商也能够对终端设备解锁以适应各种不同需求， 比如售后维 修， 特殊情况下向用户收取一定费用来允许用户解锁等。
为解决以上技术问题， 本发明提出以下技术方案。 发明内容
本发明要解决的技术问题是， 提供一种实现终端设备锁网的方法、 系统 及终端设备， 以实现锁网功能。
为解决上述技术问题， 本发明提供了一种实现终端设备锁网的方法， 该 方法包括入网时的锁网流程， 即在入网鉴权过程中进行锁网配置验证， 若所 述锁网配置验证成功， 则允许验证鉴权证书， 否则拒绝终端设备入网。
进一步地， 所述入网鉴权过程指终端设备对鉴权授权计费服务器即 AAA 服务器进行鉴权的过程，所述锁网配置验证是指将 AAA服务器鉴权证书中的 锁网字符串与终端设备保存的锁网字符串进行对比， 若相同， 则认为锁网配 置验证成功。
进一步地， 所述锁网字符串是指放入鉴权证书的主体部分 CN字段的运 营商的网络名称标识。
进一步地， 所述锁网配置验证中， 在进行锁网字符串对比前， 先根据终 端保存的锁网标志位判断是否已启用锁网功能， 如已启用， 则进行锁网字符 串对比， 否则直接进行鉴权证书验证。
进一步地， 该方法还包括解锁流程， 该流程包括： OTA服务器获取运营 商服务器及所述终端设备各自保存的解锁密钥并进行对比；若解锁密钥相同 , OTA服务器通知所述终端设备设置锁网标志位为未启用锁网功能及清除所述 锁网字符串。
进一步地， 该方法还包括上网后再加锁流程， 该流程包括： OTA服务器 计算所述终端设备的解锁密钥， 并通知运营商服务器及所述终端设备保存该 解锁密钥； 所述 OTA服务器发送锁网标志位及锁网字符串给所述终端设备； 所述终端设备保存该锁网字符串及设置所述锁网标志位为已启用锁网功能。
为解决上述技术问题， 本发明还提供一种实现终端设备锁网的系统， 该 系统用于在入网鉴权过程中进行锁网配置验证， 若所述锁网配置验证成功， 则允许验证鉴权证书， 否则拒绝终端设备入网。
进一步地， 该系统包括鉴权授权计费服务器即 AAA服务器和终端设备， 其中，
所述 AAA服务器，用于向终端发送鉴权证书， 所述鉴权证书中包括锁网 字符串；
所述终端设备包括收发模块、 锁网模块及鉴权模块， 其中，
收发模块， 用于接收所述鉴权证书；
锁网模块，用于将 AAA服务器发送的鉴权证书中的锁网字符串与自身保 存的锁网字符串进行锁网验证， 若相同， 还用于启动所述鉴权模块进行鉴权； 鉴权模块，用于根据自身保存的证书对 AAA服务器发送的鉴权证书进行 验证。
进一步地， 所述锁网模块， 还用于保存锁网标志位； 若锁网标志位表明 未启用锁网功能， 所述锁网模块还用于直接启动所述鉴权模块进行鉴权， 否 则启动进行锁网字符串验证。
进一步地， 所述系统还包括 OTA服务器及运营商服务器， 所述 OTA服 务器用于对所述运营商服务器和所述终端设备保存的解锁密钥进行验证， 以 及通知所述终端设备的清除所述锁网字符串及重置所述锁网标志位， 实现解 锁功能；所述 OTA服务器还用于计算解锁密钥并通知所述运营商服务器和所 述终端设备保存解锁密钥， 以及通知所述终端设备保存锁网字符串及设置所 述锁网标志位， 实现上网后再加锁功能； 所述终端设备的锁网模块用于根据 OTA服务器的通知进行保存及更新。
为解决上述技术问题， 本发明还提供一种终端设备， 所述终端设备具有 锁网功能， 所述终端包括收发模块、 锁网模块及鉴权模块， 其中，
所述收发模块，用于接收鉴权授权计费服务器即 AAA服务器发送的鉴权 证书， 所述鉴权证书中包括锁网字符串；
所述锁网模块，用于将 AAA服务器发送的鉴权证书中的锁网字符串与自 身保存的锁网字符串进行锁网验证， 若相同， 还用于启动所述鉴权模块进行 鉴权；
所述鉴权模块，用于根据自身保存的证书对 AAA服务器发送的鉴权证书 进行验证。
进一步地， 所述锁网模块， 还用于保存锁网标志位； 若锁网标志位表明 未启用锁网功能， 所述锁网模块还用于直接启动所述鉴权模块进行鉴权， 否 则用于启动锁网字符串 3全证。
与现有技术相比较， 本发明方法、 系统和终端设备利用鉴权过程， 并且 需要终端设备和服务器统一配置锁网字符串， 具有很强的安全性； 且可以通 过 OTA方式经由空中接口管理实现解锁及上网后再加锁，具有很高的高灵活 性和易用性， 能很好的满足 WiMAX网络、 LTE网络等 4G网络的需求。 附图概述
图 1是 X.509证书内容示意图。
图 2是 X.509证书链示意图。
图 3是 EAP-TLS和 EAP-TTLS双向鉴权过程流程图。
图 4是本发明实现终端设备入网时锁网的流程图。
图 5是本发明解锁流程图。
图 6是本发明入网后再加锁流程图。
本发明的较佳实施方式
本发明实现终端设备锁网的方法包括三个流程， 即入网时的锁网流程、 解锁流程及入网后再加锁的流程。 入网时的锁网流程， 即入网鉴权过程中进 行锁网配置验证， 若锁网配置验证成功， 则允许验证鉴权证书， 否则拒绝终 端设备入网。
以下对三个流程分别进行说明：
一、 入网时的锁网流程
EAP-TLS和 EAP-TTLS鉴权釆用 X.509证书作为 AAA服务器和终端设 备的身份标识， X509证书中除了包含版本、 序列号、 签名算法标识符、 签发 人姓名、有效期和公钥外， 还包含可以定制的主体部分 (Subject), 本发明中运 营商将自己的网络名称标识放入该部分的 CN字段中， 供鉴权过程中锁网验 证所用， X.509证书格式如图 1所示。
X.509证书架构如附图 2所示， 其中再次级根证书可以省略。 由于签名 证书， 这种层次结构的证书合称为证书链， 如图 2所示。
根据 802.16e协议， WiMAX终端设备入网过程分为： 搜网、鉴权、 注册、 建立 IP连接几部分。 其中鉴权部分起到了控制网络接入的功能， 本文提出的 锁网功能就是在这个阶段实现的。
WiMAX协议推荐的两种方法是基于 X.509证书的 EAP-TLS ( Extensible Authentication Protocol -Transport Layer Security )和 EAP-TTLS ( EAP Tunneled Transport Layer Security )其鉴权流程基本相同， 只是 TTLS可以选择单向设 备鉴权（仅对 AAA服务器进行鉴权） ， 也可选择双向设备鉴权（AAA服务 器对终端设备鉴权和终端设备对 AAA服务器设备鉴权， 如图 3所示）， 也可 选择对用户鉴权（根据用户名、 密码对用户进行鉴权） 。
本发明基于 EAP-TLS和 EAP-TTLS入网鉴权方法，在鉴权过程中检验锁 网标志位和对比锁网字符串，如果锁网标志位使能，那么只有 AAA服务器证 书的锁网字符串和终端设备存储的锁网字符串相等时才允许通过鉴权， 否则 返回鉴权失败， 拒绝入网， 从而达到锁网的目的。 锁网方法是在鉴权过程中 利用服务器证书判断当前网络是否为合法网络， 如果不是合法网络使鉴权失 败， 引起入网失败， 从而达到锁网的目的。
以下以双向设备鉴权过程为例进行说明：
如图 4所示， 具体流程包括：
步骤 401 : 终端设备接收服务器发送过来的证书链， 该证书链包含 AAA 服务器证书及其中级证书， 其中服务器证书中的 CN字段的字符串为锁网字 符串， 用于进行锁网验证， 该字符串为运营商的名称；
步骤 402: 终端设备检查锁网标志位， 若该锁网标志位表明已经启用锁 网功能， 则执行步骤 403 , 否则执行步骤 404;
步骤 403: 终端设备检验服务器证书中锁网字符串是否与终端设备保存 的锁网字符串相同， 若相同， 则执行步骤 404, 否则判断当前网络不是合法 网络， 直接向 AAA服务器返回鉴权失败， 拒绝入网， 流程结束；
步骤 404: 终端设备用本机存储的 AAA服务器证书的顶级根证书来验证 接收到的服务器证书链， 如果验证通过则执行步骤 405, 否则返回鉴权失败， 拒绝入网， 流程结束；
步骤 405: 终端设备发送终端设备的设备证书链（包含设备证书和中级 证书）给服务器； 步骤 406: AAA服务器用存储的设备证书根证书验证收到的设备证书链， 若验证通过则鉴权成功， 允许接入， 否则鉴权失败， 拒绝接入。
以上流程是以双向终端设备鉴权流程为例进行说明的， 可以理解地， 本 发明方法也适用于单向终端设备鉴权流程中， 实现锁网功能， 相比以上流程， 只是缺少了步骤 405和 406。
本发明方法釆用锁网字符串进行锁网验证， 其中锁网字符串一般为运营 商名字， 终端设备可以将该值存储在 EEPROM(Electrically Erasable Programmable Read-Only Memory, 电可擦写可编程只读存储器）中， 锁网功能 的使能标志位也存储在 EEPROM中。
二、 解锁流程
由于允许用户自己对设备解锁， 所以需要对解锁功能进行控制， 防止未 授权的解锁操作。 这里釆用密钥的控制方式。 设备生产时会根据设备的 ID、 主控制密钥等信息生成一个设备密钥并将其存储在 EEPROM中，该密钥与设 备——对应。 向运营商供货时该密钥也要用安全的方式移交给运营商， 运营 商将其存储在安全的数据库中， 密钥可以釆用 SHA256等算法生成。
当终端设备提出解锁请求并获得运营商批准后， 或满足锁网时限， 或其 他符合解锁的条件后， 对已经使能锁网功能的终端设备， 可以釆用以下方法 去掉锁网功能对网络接入的限制。
运营商服务器利用 OTA (Over The Air,空中接口方式)模块对终端设备的 无线管理功能。 运营商服务器存储每个终端设备的 Mac ID和锁网密钥等参 数。 OTA服务器读取该终端设备对应的解锁密钥， 并通过空中接口 （OTA ) 读取设备 EEPROM中的解锁密钥进行对比，如果相同则将解锁标志位设置为 FALSE并清除锁网字符串， 如果不相同则解锁失败。
如图 5所示， 是运营商服务器或终端设备实现的解锁流程， 包括以下步 骤：
步骤 501 : OTA服务器获取运营商服务器保存的终端设备的解锁密钥及 终端设备 ID; 步骤 502: OTA服务器通过 OTA方式获取对应 ID的终端设备保存的解 锁密钥；
步骤 503: OTA服务器对比所获取的解锁密钥，若相同，则执行步骤 504, 否则， 流程结束；
步骤 504: OTA服务器通过 OTA方式发送解锁通知给终端让其重置锁网 标志位为 FALSE及清除锁网字符串， 实现解锁。
不经过解锁密钥验证， 直接由运营商服务器或终端更改锁网配置也是可 以的， 经过解锁密钥验证只是更加强化了安全性。
三、 入网后再加锁流程
对于已经解锁的设备再重新入网后仍然可以再加锁，由 OTA方式通过空 中接口实现。 设备入网后再加锁的过程如图 6所示， 包括如下步骤：
步骤 601 : 终端读取存储在设备中的锁网标志位来判断是否已加锁， 若 已加锁， 则流程结束， 否则执行步骤 602;
步骤 602: 网络侧的 OTA服务器通过 OTA方式获知终端设备未加锁， 则根据终端设备的 Mac地址、 当前时间、 网络 ID等参数计算解锁密钥； 步骤 603: 网络侧的 OTA服务器将计算出的解锁密钥发送给运营商服务 器存储， 同时以 OTA方式发送给终端设备让其更新其 EEPROM中的锁网密 钥；
步骤 604: 网络侧的 OTA服务器通过 OTA方式发送加锁通知给终端， 其中携带锁网字符串和锁网标志位（ TRUE或者 FALSE ) ,让其更新 EEPROM 中的相应字段的值
为了实现以上方法， 本发明还提供了一种实现终端设备锁网的系统， 该 系统包括 AAA服务器、 运营商服务器和终端设备， 其中，
运营商数据库， 用于保存终端设备的 Mac ID和锁网密钥等参数。
AAA 服务器， 指网络服务器， 具有鉴权 （Authentication ) ， 授权 ( Authorization )和计费（ Accounting )功能， 具体包括收发模块和鉴权模块， 其中，
收发模块用于接收及发送各种信令消息， 包括向终端设备发送证书链、 接收终端设备发送的证书链及根据鉴权结果发送鉴权响应， 所述发送给终端 设备的证书链中包括锁网字符串，
鉴权模块，用于根据自身保存的证书对终端设备发送的证书链进行验证； 终端设备指上网卡、 手机等网络产品终端设备， 包括收发模块、 鉴权模 块和锁网模块，
其中， 收发模块， 用于接收或发送各种信令消息， 包括接收 AAA服务器 发送的证书链及向 AAA服务器发送终端设备的证书链，以及根据鉴权模块及 锁网模块的验证结果向 AAA服务器发送鉴权响应；
若锁网模块锁网验证未通过， 则直接向 AAA服务器返回鉴权失败响应。 鉴权模块，用于根据自身保存的证书对 AAA服务器发送的证书链进行验 证；
锁网模块， 用于保存锁网标识位和锁网字符串， 锁网标识位用于表示是 否启用锁网功能， 若锁网标志位表明已启用锁网功能， 还用于将收发模块接 收的 AAA服务器发送的证书链中的锁网字符串与自身保存的锁网字符串进 行锁网验证， 若相同， 还用于启动鉴权模块进行鉴权， 若锁网标志位表明未 启用锁网功能， 还用于直接启动鉴权模块进行鉴权。
为了实现解锁功能， 本发明系统还包括 OTA服务器， 用于获取运营商服 务器中终端设备的解锁密钥和对应终端的保存的解锁密钥， 还用于对比获取 的解锁密钥， 若相同， 还用于发送解锁通知。
所述终端设备的锁网模块，用于向 OTA服务器提供保存的解锁密码及根 据解锁通知， 重置锁网标志位及清除锁网字符串。
为了实现上网后加锁功能， OTA服务器， 还用于计算终端设备的解锁密 钥及通知运营商服务器及终端设备进行保存， OTA服务器还用于向终端设备 发送加锁通知 , 其中携带锁网标志位及锁网字符串。
所述终端设备的锁网模块， 用于根据锁网标志位判断是否已加锁， 还用 于根据 OTA服务器发送的锁网通知，设置锁网标志位及更新锁网字符串， 实 现上网后加锁功能。
同样地， 本发明也提供了一种终端设备， 该终端设备可以实现入网时的 锁网功能， 其具体的模块化结构如上所述。
以上方法、 系统和终端设备中， 只是利用锁网标识位为启用锁网功能提 供了一种可能， 运营商或终端设备具有选择启动锁网功能的权利， 当然也可 以不用锁网标识位， 为了保证与现有终端设备的衔接， 可以根据设备生产日 期等具有一定说明意义的信息， 确认该终端设备是否具有锁网功能， 再进行 锁网验证。
本发明对于 EAP-TTLS方式来说， 不论哪种鉴权方式， 只要含有对服务 器鉴权的鉴权方法都可以使用， 因为对服务器鉴权就意味着能够读取服务器 证书中的锁网字符串， 进而可以与终端设备存储的字符串进行比较以达到锁 网的目的。
工业实用性
与现有技术相比较， 本发明方法、 系统和终端设备利用鉴权过程， 并且 需要终端设备和服务器统一配置锁网字符串， 具有很强的安全性； 且可以通 过 OTA方式经由空中接口管理实现解锁及上网后再加锁，具有很高的高灵活 性和易用性， 能很好的满足 WiMAX网络、 LTE网络等 4G网络的需求。

Claims

权 利 要 求 书
1、 一种实现终端设备锁网的方法， 其特征在于： 该方法包括入网时的锁 网流程， 即在入网鉴权过程中进行锁网配置验证， 若所述锁网配置验证成功， 则允许验证鉴权证书， 否则拒绝终端设备入网。
2、 如权利要求 1所述的方法， 其特征在于： 所述入网鉴权过程指终端设 备对鉴权授权计费服务器即 AAA服务器进行鉴权的过程，所述锁网配置验证 进行对比， 若相同， 则认为锁网配置验证成功。
3、 如权利要求 2所述的方法， 其特征在于： 所述锁网字符串是指放入鉴 权证书的主体部分 CN字段的运营商的网络名称标识。
4、 如权利要求 2所述的方法， 其特征在于： 所述锁网配置验证中， 在进 行锁网字符串对比前， 先根据终端保存的锁网标志位判断是否已启用锁网功 能， 如已启用， 则进行锁网字符串对比， 否则直接进行鉴权证书验证。
5、 如权利要求 4所述的方法， 其特征在于： 该方法还包括解锁流程， 该 流程包括： OTA服务器获取运营商服务器及所述终端设备各自保存的解锁密 钥并进行对比； 若解锁密钥相同， OTA服务器通知所述终端设备设置锁网标 志位为未启用锁网功能及清除所述锁网字符串。
6、 如权利要求 4所述的方法， 其特征在于： 该方法还包括上网后再加锁 流程， 该流程包括： OTA服务器计算所述终端设备的解锁密钥， 并通知运营 商服务器及所述终端设备保存该解锁密钥；所述 OTA服务器发送锁网标志位 及锁网字符串给所述终端设备； 所述终端设备保存该锁网字符串及设置所述 锁网标志位为已启用锁网功能。
7、 一种实现终端设备锁网的系统， 其特征在于： 该系统用于在入网鉴权 过程中进行锁网配置验证， 若所述锁网配置验证成功， 则允许验证鉴权证书， 否则拒绝终端设备入网。
8、 如权利要求 7所述的系统， 其特征在于： 该系统包括鉴权授权计费服 务器即 AAA服务器和终端设备， 其中，
所述 AAA服务器，用于向终端发送鉴权证书， 所述鉴权证书中包括锁网 字符串；
所述终端设备包括收发模块、 锁网模块及鉴权模块， 其中，
收发模块， 用于接收所述鉴权证书；
锁网模块，用于将 AAA服务器发送的鉴权证书中的锁网字符串与自身保 存的锁网字符串进行锁网验证， 若相同， 还用于启动所述鉴权模块进行鉴权； 鉴权模块，用于根据自身保存的证书对 AAA服务器发送的鉴权证书进行 验证。
9、 如权利要求 8所述的系统， 其特征在于， 所述锁网模块， 还用于保存 锁网标志位； 若锁网标志位表明未启用锁网功能， 所述锁网模块还用于直接 启动所述鉴权模块进行鉴权， 否则启动进行锁网字符串验证。
10、 如权利要求 9所述的系统，其特征在于： 所述系统还包括 OTA服务 器及运营商服务器，所述 OTA服务器用于对所述运营商服务器和所述终端设 备保存的解锁密钥进行验证， 以及通知所述终端设备的清除所述锁网字符串 及重置所述锁网标志位， 实现解锁功能； 所述 OTA服务器还用于计算解锁密 钥并通知所述运营商服务器和所述终端设备保存解锁密钥， 以及通知所述终 端设备保存锁网字符串及设置所述锁网标志位， 实现上网后再加锁功能； 所 述终端设备的锁网模块用于根据 OTA服务器的通知进行保存及更新。
11、 一种终端设备， 其特征在于： 所述终端设备具有锁网功能， 所述终 端包括收发模块、 锁网模块及鉴权模块， 其中，
所述收发模块，用于接收鉴权授权计费服务器即 AAA服务器发送的鉴权 证书， 所述鉴权证书中包括锁网字符串；
所述锁网模块，用于将 AAA服务器发送的鉴权证书中的锁网字符串与自 身保存的锁网字符串进行锁网验证， 若相同， 还用于启动所述鉴权模块进行 鉴权；
所述鉴权模块，用于根据自身保存的证书对 AAA服务器发送的鉴权证书 进行验证。
12、 如权利要求 11所述的终端设备， 其特征在于： 所述锁网模块， 还用 于保存锁网标志位； 若锁网标志位表明未启用锁网功能， 所述锁网模块还用 于直接启动所述鉴权模块进行鉴权， 否则用于启动锁网字符串验证。
PCT/CN2008/002162 2008-12-31 2008-12-31 实现终端设备锁网的方法、系统及终端设备 WO2010075644A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
CN2008801306572A CN102113358B (zh) 2008-12-31 2008-12-31 实现终端设备锁网的方法、系统及终端设备
EP08879260.1A EP2384038B1 (en) 2008-12-31 2008-12-31 Method and system for realizing network locking and unlocking by a terminal device
US13/138,018 US8732458B2 (en) 2008-12-31 2008-12-31 Method, system and terminal device for realizing locking network by terminal device
ES08879260.1T ES2609922T3 (es) 2008-12-31 2008-12-31 Método y sistema para realizar bloqueo y desbloqueo en una red mediante un dispositivo terminal
PCT/CN2008/002162 WO2010075644A1 (zh) 2008-12-31 2008-12-31 实现终端设备锁网的方法、系统及终端设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2008/002162 WO2010075644A1 (zh) 2008-12-31 2008-12-31 实现终端设备锁网的方法、系统及终端设备

Publications (1)

Publication Number Publication Date
WO2010075644A1 true WO2010075644A1 (zh) 2010-07-08

Family

ID=42309752

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2008/002162 WO2010075644A1 (zh) 2008-12-31 2008-12-31 实现终端设备锁网的方法、系统及终端设备

Country Status (5)

Country Link
US (1) US8732458B2 (zh)
EP (1) EP2384038B1 (zh)
CN (1) CN102113358B (zh)
ES (1) ES2609922T3 (zh)
WO (1) WO2010075644A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102075910A (zh) * 2010-12-20 2011-05-25 华为终端有限公司 对终端进行锁网的方法和装置
CN102523575A (zh) * 2011-12-02 2012-06-27 华为终端有限公司 一种simlock解锁的方法及终端
JP2014040588A (ja) * 2012-08-01 2014-03-06 Eternal Chemical Co Ltd 導電性ポリマー複合体並びにその調製及びその使用
CN104735647A (zh) * 2013-12-20 2015-06-24 中兴通讯股份有限公司 无线终端的锁网方法及系统
CN114339489A (zh) * 2021-12-28 2022-04-12 深圳创维数字技术有限公司 Pon系统中终端完成服务器认证的方法、设备及介质

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104519479B (zh) * 2013-09-27 2019-06-11 中兴通讯股份有限公司 一种终端及其锁网和解除锁网的方法
KR20150047920A (ko) * 2013-10-25 2015-05-06 삼성전자주식회사 무선 통신이 가능한 전자장치의 잠금 제어 방법과 장치 및 그 시스템
US9807607B2 (en) * 2014-10-03 2017-10-31 T-Mobile Usa, Inc. Secure remote user device unlock
CN104469736B (zh) * 2014-11-05 2018-01-19 中兴通讯股份有限公司 一种数据处理方法、服务器及终端
US10769315B2 (en) 2014-12-01 2020-09-08 T-Mobile Usa, Inc. Anti-theft recovery tool
EP3082355A1 (en) * 2015-04-17 2016-10-19 Gemalto Sa A method for controlling remotely the permissions and rights of a target secure element
WO2018112829A1 (en) * 2016-12-22 2018-06-28 Telefonaktiebolaget Lm Ericsson (Publ) Radio node calibration
CN113660249A (zh) * 2021-08-11 2021-11-16 国网河北省电力有限公司营销服务中心 用于电力物联网环境下的可信接入系统及方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2007074703A (ja) * 2005-08-12 2007-03-22 Sii Ido Tsushin Kk リモートロックシステム、移動通信端末、リモートロック方法、および通信ネットワーク用サーバー
CN101141731A (zh) * 2007-08-08 2008-03-12 中兴通讯股份有限公司 一种实现终端锁网的方法及装置
CN101253785A (zh) * 2005-08-31 2008-08-27 Sk电信有限公司 用于对移动通信终端的操作进行远程控制的方法和系统

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6314283B1 (en) * 1999-04-28 2001-11-06 Nec America, Inc. Cellular phone subsidy lock
KR100590349B1 (ko) * 1999-12-21 2006-06-15 엘지전자 주식회사 이동통신 단말기의 전화 잠금 제어 방법
JP2002290546A (ja) * 2001-03-28 2002-10-04 Toshiba Corp 移動通信端末とその設定データ変更方法
US20050037732A1 (en) 2003-08-12 2005-02-17 Motorola, Inc. Method and apparatus for locking a wireless communication unit to a selected network
US20060025110A1 (en) * 2004-07-28 2006-02-02 Jun Liu Password protection for mobile phones
US7424284B2 (en) * 2004-11-09 2008-09-09 Telefonaktiebolaget Lm Ericsson (Publ) Secure network/service access
CN101111018A (zh) * 2006-07-21 2008-01-23 中兴通讯股份有限公司 一种对phs手机实现锁网及解锁的方法
US20080148044A1 (en) * 2006-12-19 2008-06-19 Motorola, Inc. Locking carrier access in a communication network
US8064598B2 (en) * 2007-02-26 2011-11-22 Nokia Corporation Apparatus, method and computer program product providing enforcement of operator lock

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2007074703A (ja) * 2005-08-12 2007-03-22 Sii Ido Tsushin Kk リモートロックシステム、移動通信端末、リモートロック方法、および通信ネットワーク用サーバー
CN101253785A (zh) * 2005-08-31 2008-08-27 Sk电信有限公司 用于对移动通信终端的操作进行远程控制的方法和系统
CN101141731A (zh) * 2007-08-08 2008-03-12 中兴通讯股份有限公司 一种实现终端锁网的方法及装置

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102075910A (zh) * 2010-12-20 2011-05-25 华为终端有限公司 对终端进行锁网的方法和装置
US8903361B2 (en) 2010-12-20 2014-12-02 Huawei Device Co., Ltd. Network locking method and apparatus for terminal
CN102523575A (zh) * 2011-12-02 2012-06-27 华为终端有限公司 一种simlock解锁的方法及终端
JP2014040588A (ja) * 2012-08-01 2014-03-06 Eternal Chemical Co Ltd 導電性ポリマー複合体並びにその調製及びその使用
CN104735647A (zh) * 2013-12-20 2015-06-24 中兴通讯股份有限公司 无线终端的锁网方法及系统
CN114339489A (zh) * 2021-12-28 2022-04-12 深圳创维数字技术有限公司 Pon系统中终端完成服务器认证的方法、设备及介质
CN114339489B (zh) * 2021-12-28 2023-11-21 深圳创维数字技术有限公司 Pon系统中终端完成服务器认证的方法、设备及介质

Also Published As

Publication number Publication date
CN102113358B (zh) 2013-06-05
EP2384038A4 (en) 2013-04-03
US8732458B2 (en) 2014-05-20
US20110271101A1 (en) 2011-11-03
ES2609922T3 (es) 2017-04-25
CN102113358A (zh) 2011-06-29
EP2384038A1 (en) 2011-11-02
EP2384038B1 (en) 2016-10-12

Similar Documents

Publication Publication Date Title
WO2010075644A1 (zh) 实现终端设备锁网的方法、系统及终端设备
CN108173822B (zh) 智能门锁管控方法、智能门锁及计算机可读存储介质
US8001615B2 (en) Method for managing the security of applications with a security module
JP5674174B2 (ja) 加入者デバイスのネットワーク個別化のための方法および装置
CN102413224B (zh) 绑定、运行安全数码卡的方法、系统及设备
JP2008521266A (ja) モバイル端末内の設定パラメータの更新方法
US11263558B2 (en) Method for monitoring access to electronically controllable devices
WO2012062067A1 (zh) 运营商解锁移动终端的方法、装置和系统
CN101695022B (zh) 一种服务质量管理方法及装置
JP2016506152A (ja) タグ付けによるデバイスの認証
CN106850680A (zh) 一种用于轨道交通设备的智能身份认证方法及装置
CN109561429B (zh) 一种鉴权方法及设备
CN107135205A (zh) 一种网络接入方法和系统
WO2012171284A1 (zh) 一种三方认证方法、装置及支持双向认证的智能卡
ES2449223T3 (es) Método, estación móvil, sistema y procesador de red para utilizar en comunicaciones móviles
US20080148044A1 (en) Locking carrier access in a communication network
WO2012055297A1 (zh) 移动终端的鉴权方法及装置
WO2011144129A2 (zh) 机卡互锁的方法、用户识别模块卡和终端。
CN114615309B (zh) 客户端接入控制方法、装置、系统、电子设备及存储介质
US20120190340A1 (en) Method for binding secure device to a wireless phone
CN102014385A (zh) 移动终端的认证方法及移动终端
CN114342437A (zh) 物联网设备的反克隆系统
CN101742507A (zh) 一种WAPI终端访问Web应用站点的系统及方法
CN106055966A (zh) 一种认证方法及系统
CN110248363A (zh) 通过代理的安全eap-aka认证

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 200880130657.2

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 08879260

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 13138018

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2008879260

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2008879260

Country of ref document: EP