WO2010124569A1 - 用户接入控制方法和系统 - Google Patents

用户接入控制方法和系统 Download PDF

Info

Publication number
WO2010124569A1
WO2010124569A1 PCT/CN2010/071934 CN2010071934W WO2010124569A1 WO 2010124569 A1 WO2010124569 A1 WO 2010124569A1 CN 2010071934 W CN2010071934 W CN 2010071934W WO 2010124569 A1 WO2010124569 A1 WO 2010124569A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
base station
home base
identification information
network side
Prior art date
Application number
PCT/CN2010/071934
Other languages
English (en)
French (fr)
Inventor
周娜
霍玉臻
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2010124569A1 publication Critical patent/WO2010124569A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W74/00—Wireless channel access, e.g. scheduled or random access
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/26—Network addressing or numbering for mobility support

Definitions

  • the present invention relates to the field of mobile communications, and in particular, to a user access control method and system.
  • a home base station is a small, low-power base station deployed in indoor places such as homes and offices.
  • the main function is to provide users with higher service rates and lower the cost of using high-speed services. Insufficient coverage of distributed cellular wireless communication systems.
  • the advantages of home base stations are affordable, convenient, low power output, plug and play, and more.
  • the home base station can access the core network through the logical network element of the home base station gateway, as shown in FIG. 1 and FIG.
  • the main functions of the home base station gateway are: verifying the security of the home base station, and processing the registration of the home base station,
  • the base station performs operation and maintenance management, configures and controls the home base station according to the operator's requirements, and is responsible for exchanging data of the core network and the home base station.
  • the home base station gateway may be set up with the access gateway or may be set separately; or there may be no home base station gateway, and the home base station directly connects with the access gateway.
  • the mobility management entity in Figure 2 is responsible for the control plane, such as mobility management, non-access stratum signaling processing, and user mobility management context management.
  • the authentication authorization server is responsible for storing the core database of the user data information of the home network, and storing the user's authentication information, service information, and the like.
  • the home base station can also directly connect to the core network without going through the home base station gateway, as shown in FIG.
  • CSG Closed Subscriber Group
  • the usage modes of the home base station can be classified into a closed mode, a mixed mode, and an open mode. When the home base station is in the closed mode, only the CSG user to which the home base station belongs can access the base station and enjoy the service provided by the base station.
  • the home base station When the home base station is in the open mode, any user can access the base station, and the home base station at this time is equivalent to the macro base station.
  • the home base station When the home base station is in the hybrid mode, it allows both CSG users to access and allows other users to access the service. However, different user types are distinguished according to whether the user belongs to the CSG list, and differentiated service quality processing is implemented. CSG users are using a hybrid home When using a base station, it has a higher service priority and has better quality of service and service categories.
  • the user data server on the network side transmits a list of closed user groups that are allowed to access to the home base station.
  • the closed mode home base station uses the list to perform access control on the user, and the closed mode home base station will reject unauthorized users from accessing the network;
  • the hybrid mode home base station according to the list to the user category (eg, CSG) Users and non-CSG users are differentiated to facilitate operations such as differentiated billing and quality of service authorization.
  • the operation of the home base station to determine whether the user belongs to the CSG list is collectively referred to as access control.
  • the home base station checks whether the user belongs to the CSG list according to the user identifier sent by the terminal.
  • the home base station gateway and the access gateway are combined as an example to describe the home base station performing the access control process (as shown in FIG. 4).
  • Step 401 The terminal requests to negotiate an authentication capability, such as an authentication policy of the user, and completes capability negotiation work with the base station and the access gateway.
  • Step 402 The access gateway sends a user identity request to the home base station, and the home base station forwards the request to the terminal.
  • Step 403 After receiving the user identification request message, the terminal returns a response message to the home base station, and carries user identification information, such as a NAI (Network Access Identifier), an IMSI (International Mobile Subscriber Identification Number, an international mobile client i) Only another ll code) or MAC ID (Media Access Control ID).
  • Step 404 The home base station performs access control on the user according to the user identification information.
  • the closed mode home base station checks whether the user exists in the CSG list, and if yes, allows the user to access, and proceeds to step 405; otherwise, the user access is denied, and the user release process may be initiated.
  • the hybrid mode home base station checks whether the user exists in the CSG list, and if so, informs the access gateway that the user is a CSG user in the subsequent process, and if not, in the subsequent process, informs the access gateway that the user is a non-CSG. user.
  • Step 405 The home base station returns a user identifier to the access gateway. This step and step 404 are in no particular order and can occur in parallel with them.
  • Step 406 Perform a user authentication process. The authentication and authorization server completes the review of the legality of the user.
  • Step 407 continuing to perform other processes related to user access.
  • the above process shows that the home base station checks whether the user belongs to the CSG list according to the user identifier carried by the terminal (step 404), but in the response replied by the terminal in step 403, the terminal may encapsulate the user's real identity into the authentication protocol, for example, in consideration of security considerations, such as The EAP (Extensible Authentication Protocol) encapsulation, in which the home base station needs to parse the authentication encapsulation protocol, resulting in increased operation burden and efficiency of the base station node. In the case where the terminal encrypts and transmits the real identity, the home base station is incompetent.
  • EAP Extensible Authentication Protocol
  • Parsing and obtaining the user identification information even if the terminal transmits the user identifier in plain text, and is not encapsulated by the authentication message, the user identifier is not verified by the authentication authority server, thereby failing to ensure the correctness of the user identifier, and there is a security risk of the wireless communication system .
  • the present invention provides a user access control method, including: a network side entity transmitting real user identification information to a home base station; the home base station receiving the user identification information, and according to the user identification information, The user performs an access control operation.
  • the method further includes: the home base station transmitting an indication of the real user identity or the home base station mode to the network side entity via the intermediate network element.
  • the network side entity In the step of the network side entity transmitting the real user identification information to the home base station, the network side entity discovers that the home base station needs to obtain the real user identifier or finds that the home base station is in the closed or mixed mode, and carries the user true in the return message.
  • the identification information of the user; or the network side entity does not make any judgment, and directly carries the real identity of the user in the return message.
  • the network side entity is an authentication authorization server, and the network side entity is directed to the home base station.
  • the authentication authorization server sends the user identification information to the home base station by using an authentication response message in the authentication process of the access process, where the authentication response message is
  • the authentication authorization server is sent to the home base station through the access gateway, or through the mobility management entity and the home base station gateway; or the network side entity is an anchor authentication function entity of the access gateway, and the network side entity
  • the anchor authentication party sends the user identification information to the location update response message through the paging controller and the anchor paging controller in the process of the location update.
  • the home base station; or, the network side entity is an access gateway, where the network side entity sends the real user identification information to the home base station, the access gateway uses the key change indication message or the authentication result message to Sending the user identification information to the home base station; or
  • the network side entity is a mobility management entity.
  • the network side entity in the step of the network side entity transmitting the real user identification information to the home base station, the network side entity sends the encrypted real user identification information to the home base station; the user base station receives the user identification information, and accesses the user.
  • the home base station decrypts the information after receiving the encrypted real user identification information, and performs an access control operation on the user according to the real user identification information.
  • the access control operation refers to: the home base station checks whether the user exists in the closed user group CSG list, and if yes, allows the user to access, otherwise denies the user access; in the hybrid mode, The access control operation means that the home base station checks whether the user exists in the CSG list, and if so, informs the access gateway that the user is a CSG user, and if not, informs the access gateway that the user is a non-CSG user.
  • the user identification information is one or more of the following information: a network access identifier NAI, an international mobile client identifier IMSI, a medium access control identifier MAC ID, and a user telephone number.
  • the present invention provides a user access control system, the system package The network side entity and the home base station connected to the network side entity, where: the network side entity is configured to: send real user identification information to the home base station; the home base station is configured to: receive the user sent by the network side entity Identification information, and performing an access control operation according to the user identification information.
  • the network side entity is an authentication authorization server, an access gateway or a mobility management entity.
  • the access gateway is further configured to: save user identification information;
  • the mobility management entity is further configured to: save the user identification information.
  • the home base station is further configured to: transmit an indication that the real user identifier is obtained or the home base station mode to the network side entity via the intermediate network element; the network side entity is further configured to: when the home base station is found to need to acquire the real user When the home base station is identified or found to be in the closed or mixed mode, the user's real identity information is carried in the return message; or the user does not make any judgment, and the user's real identity is directly carried in the return message.
  • the network side entity is further configured to: send the encrypted real user identification information to the home base station; the home base station is further configured to: receive the encrypted real user identification information sent by the network side entity, and decrypt the The encrypted real user identifier is described, and the access control operation is performed according to the real user identification information.
  • the network side entity is an authentication authorization server, an access gateway or a mobility management entity.
  • the authentication authorization server is further configured to: encrypt the real user identification information; when the network side entity is an access gateway, the access gateway further Set to: save the encrypted user identification information;
  • the mobility management entity is further configured to: save the encrypted user identification information.
  • the access control operation refers to: the home base station checks whether the user exists in the closed user group CSG list, and if yes, allows the user to access, otherwise denies the user access; in the hybrid mode, The access control operation means that the home base station checks whether the user exists in the CSG list, and if so, informs the access gateway that the user is a CSG user, and if not, informs the access gateway that the user is a non-CSG user.
  • the user identification information is one or more of the following information: a network access identifier NAI, an international mobile customer identifier IMSI, a medium access control identifier MAC ID, and a user telephone number.
  • the present invention provides a network side entity supporting user access control, including a sending module, and the sending module is configured to: send real user identification information to a home base station, so that the home base station according to the user identifier The information is used to perform access control operations on the user.
  • the sending module is further configured to: send the encrypted real user identification information to the home base station.
  • the user access control method and the system in the user access control method and the system perform the access control operation on the user according to the real user identification information, so as to provide the correctness of the user identity, eliminate the security risk, and alleviate the security problem of the home base station. Handling the burden.
  • the real user identification information is encrypted and transmitted between the network side and the home base station, which improves the security of transmitting the real user identification information.
  • FIG. 1 is a schematic diagram of a home base station network connection in the prior art
  • FIG. 2 is a schematic diagram of another home base station network connection in the prior art
  • 3 is a schematic diagram of another home base station network connection in the prior art
  • FIG. 4 is a flow chart of a prior art home base station user access process
  • FIG. 5 is a flowchart of a first embodiment of a user access control method according to the present invention
  • FIG. 6 is a flowchart of a second embodiment of a user access control method according to the present invention
  • FIG. 7 is a flowchart of a third embodiment of a user access control method according to the present invention
  • Flow chart of the fourth embodiment
  • the user access control method and system of the present invention performs an access control operation on the user according to the authenticated and real user identification information to provide correctness of the user identity. Eliminate security risks and reduce the processing burden on home base stations.
  • the user access control method of the present invention includes the following steps: Step 1: The network side entity sends the authenticated and real user identification information to the home base station.
  • the implementation of the step has the following implementation manners: The right authorization server, the user identification information is sent by the access authorization server to the home base station by using an authentication response message in the authentication process of the access process.
  • the network side entity is an authentication authorization server, and the user identification information is sent by the mobility management entity and the home base station gateway to the home base station by using the authentication response message in the authentication process of the access process.
  • the third mode is that the network side entity is an anchor authentication function entity of the access gateway, and the user identification information is that the anchor authentication party is in the process of location update, after the paging controller and the anchor paging controller The location update response message is sent to the home base station, as shown in FIG.
  • the access gateway or mobility management entity may also serve as the network side entity of the present invention.
  • the user identification information mentioned in the present invention indicates the user's real identity, such as NAI (Network Access Identifier), IMSI (International Mobile Subscriber Identification Number) or MAC ID (Media). Access Control ID, Media Access Control ID) or user phone number.
  • the access control operation means that the home base station checks whether the user exists in the CSG list, and if so, allows the user to access, otherwise denies the user access; in the hybrid mode, the access control operation refers to the home base station check Whether the user exists in the CSG list, if yes, informs the access gateway that the user is a CSG user, and if not, informs the access gateway that the user is a non-CSG user.
  • the home base station gateway and the access gateway are combined as an example to describe the process of performing the access control by the home base station.
  • the specific steps are as follows: Step 501: The terminal requests to negotiate an authentication capability, such as an authentication policy of the user, and connects with the base station. The gateway completes the capability negotiation work. Step 502: The access gateway sends a user identity request to the home base station, and the home base station forwards the request to the terminal. Step 503: After receiving the user identity request message, the terminal passes the home base station and the access gateway.
  • the authentication authorization server sends user identification information to the authentication authorization server, the authentication authorization server performs the user authentication process, completes the audit of the user's legality, and authorizes the user to perform the service; although the user identification information sent by the terminal includes the real and fake NAI, the household The base station does not need to parse the message sent by the terminal, so the real and fake NAL cannot be obtained at this time. Further, the home base station may transmit an indication for acquiring the real user identifier or the home base station mode (eg, closed mode, mixed mode) to the authentication authorization server in the authentication request message, so that the authentication authorization server determines whether it is needed. Returns the user ID.
  • the home base station mode eg, closed mode, mixed mode
  • Step 504 the connection authentication process, the authentication authorization server returns the authentication success to the access gateway, and carries the real identity information of the user, such as the real UI, IMSI, user phone number or MAC ID.
  • the access gateway will save the user identification information. If there is a fake user identifier, the access gateway saves the correspondence between the user's fake identifier and the real identifier. The save of the real user identifier information can be used when the terminal exits the idle state.
  • the home base station provides the access control information.
  • the authentication authorization server may, according to the information in step 503, find that the real user identifier needs to be obtained or the home base station is in the closed or mixed mode, and the user's real identifier is carried in the step. Information; The authentication authority server may also carry the user's real identity directly in this step without making any judgment.
  • Step 505 The access gateway forwards the authentication success to the home base station, and carries the user identification information (the user identification information here is the real user identification information returned by the authentication authorization server), such as the NAI, IMSL user phone number or MAC ID;
  • the authentication response message is forwarded to the home base station via the home base station gateway, and carries the user identification information, such as the NAI, IMSL user phone number or MAC ID.
  • the home base station carries the message according to step 505.
  • the user identification information is used to perform access control on the user; the closed mode home base station checks whether the user identifier exists in the CSG list, and if yes, allows the user to access, and proceeds to step 507; otherwise, the user access is denied, and the user release process may be initiated. ;
  • FIG. 6 is a flow chart of a home base station user access procedure provided on the basis of the home base station system of FIG. In this embodiment, the home base station gateway and the access gateway are combined as an example to describe the process of performing the access control by the home base station.
  • Step 601 The terminal requests to negotiate an authentication capability, such as an authentication policy of the user, and connects with the base station.
  • the gateway completes the capability negotiation work
  • Step 602 The access gateway sends a user identity request to the home base station, and the home base station forwards the request to the terminal;
  • the step may be initiated by the home base station instead of the access gateway.
  • Step 603 After receiving the user identification request message, the terminal sends the user identification information to the authentication authorization server through the home base station and the access gateway, and the authentication authorization server performs The user authentication process completes the audit of the user's legality and authorizes the user to conduct business.
  • the home base station may transmit an indication for acquiring the real user identifier or the home base station mode (eg, closed mode, mixed mode) to the authentication authorization server in the authentication request message, so that the authentication authorization server determines whether it is needed. Returns the user ID.
  • the home base station mode eg, closed mode, mixed mode
  • Step 604 the authentication authorization server returns an authentication response to the access gateway, carrying the authentication result and the user identification information, such as the real NAI, IMSI, user phone number or MAC ID; the access gateway forwards the authentication response to the home base station, The home base station forwards the authentication response message to the terminal; in the case that the home base station gateway is unique, the authentication response message will be forwarded to the home base station via the home base station gateway; the access gateway will save the user identification information; if there is a fake user identifier The access gateway saves the correspondence between the user's fake identifier and the real identifier.
  • the user identification information such as the real NAI, IMSI, user phone number or MAC ID
  • the authentication authorization server may, according to the information in step 603, find that the real user identifier needs to be obtained or the home base station is in the closed or mixed mode, and the authentication response message sent to the access gateway in this step carries the user's real
  • the authentication information may be carried by the authentication authorization server, and the authentication response message sent to the access gateway in this step directly carries the real identifier of the user.
  • the authentication response is forwarded, The home base station cannot parse the authentication response message, so the authentication result is not obtained.
  • step 605 the home base station separately obtains the authentication result.
  • the key change indication message is generated by the access gateway, and carries key related information, an authentication result, and user identification information. In the case where the home base station gateway is unique, the message will be forwarded to the home base station via the home base station gateway, carrying user identification information such as NAI, IMSL user telephone number or MAC ID.
  • Step 606 The home base station performs access control on the user according to the user identification information carried in the message in step 605. If the key change indication is used, the home base station parses the key change indication to obtain the user identification information therein.
  • the closed mode home base station checks whether the user identity exists in the CSG list, and if yes, allows the user to access, and proceeds to step 607; otherwise, the user access is denied, and the user release process may be initiated.
  • the hybrid mode home base station checks whether the user identity exists in the CSG list. If yes, the user is notified to the access gateway as the CSG user in the subsequent process. If not, the access gateway is notified to the access gateway in the subsequent process. CSG users.
  • Step 607 The home base station responds to the key change response message. When the user identification information is notified to the home base station when the key change indication is used, the above steps occur.
  • FIG. 7 is a flow chart of a home base station user access procedure provided by the home base station system of FIG. 2 according to the present invention.
  • the home base station gateway and the access gateway are respectively set as an example to describe a home base station to perform an access control process, and specific steps are described as follows:
  • Step 701 The user needs to establish an RRC (Radio Resource Control) connection as a signaling message or a bearer of the service data before performing the communication.
  • Step 702 The user triggers by initializing a NAS (Network Access Server) message.
  • RRC Radio Resource Control
  • the registration process may be an attach message, a location update message, a service request message, etc.;
  • Step 703 The home base station finds that there is no context identifier information of the user, sends a registration request message to the home base station gateway, and registers the user information to the home base station gateway.
  • the message content includes information such as the type of registration, the user identifier, and the identity of the home base station; the home base station gateway performs a capability check on the user accessing the home base station, and if the user is allowed to use the resources provided by the home base station, then the registration is accepted.
  • Step 704 The home base station sends a Connect (Connect) message to the home base station gateway; Step 705, the home base station gateway sends Connection establishment message, will also send a NAS message to the mobility management entity; Further, the home base station may indicate the acquired real user identity or home base station mode
  • Step 706 The mobility management entity replies to the connection establishment response.
  • Step 707 The mobility management entity starts the authentication and the security process to authenticate the user. Further, the mobility management entity may obtain the indication of the real user identifier or the home base station mode. (such as closed mode, mixed mode) is transmitted to the authentication authority server in this step, so that the authentication authority server determines whether it is necessary to return the user identity.
  • Step 708 The authentication authorization server sends an authentication response to the mobility management entity, and carries the user's real identity information, such as the real NAI, IMSI, user phone number, or MAC ID, and the access gateway saves the user identity information, if there is a fake The user identifier, the access gateway saves the correspondence between the user's fake identifier and the real identifier. Further, the authentication and authorization server may find that it is necessary to obtain the true according to the information in step 707. The real user identifier or the home base station is in the closed or mixed mode, and the user's real identification information is carried in this step; the authentication and authorization server may also carry the user's real identity directly in the step without any judgment.
  • the user's real identity information such as the real NAI, IMSI, user phone number, or MAC ID
  • Step 709 The mobility management entity forwards the authentication response, and the message is transmitted to the home base station via the home base station gateway, and carries real user identification information, such as NAI, IMSI, user phone number, or MAC ID, if there is no home base station gateway (ie, In the case of 3), the mobility management entity forwards the authentication response message to the home base station, and carries the real user identification information, such as the NAI, IMSL user phone number or MAC ID.
  • the user base station carries the user according to the message in step 709.
  • the identification information is used to perform access control on the user.
  • the closed mode home base station checks whether the user identifier exists in the CSG list.
  • step 711 If yes, the user is allowed to access, and the process proceeds to step 711; otherwise, the user access is denied, and the user release process may be initiated.
  • the hybrid mode home base station checks whether the user identity exists in the CSG list. If yes, in step 711, the mobility management entity is notified that the user is a CSG user. If not, the mobility management entity is notified in the process of step 711. This user is a non-CSG user. In step 711, the other processes related to user access are continued.
  • FIG. 8 is a flowchart of a home base station user performing location update according to the home base station system of FIG.
  • a home base station gateway and an access gateway are combined as an example to describe a home base station performing an access control procedure, where the paging controller, the anchor paging controller, and the anchor authentication party (an anchor authentication party).
  • the authenticator which stores the authentication information, belongs to the functional entity of the access gateway, and the paging controller and the home base station belong to the access service network of the service.
  • the specific steps are as follows: Step 801: The terminal sends a ranging request to the home base station, and carries an idle mode location update indication.
  • Step 802 The home base station requests the paging controller to perform location update, and carries the paging group information. Further, the home base station may transmit an indication of obtaining the real user identity or the home base station mode (eg, closed mode, mixed mode) to the paging controller in this step, so as to finally transmit to the anchor authenticator to determine whether it needs to return.
  • User ID User ID.
  • Step 803 The paging controller sends a location update request to the anchor paging controller. Further, the step may carry an indication of obtaining a real user identifier or a home base station mode (eg, closed mode, mixed mode), so as to be finally transmitted to the anchor.
  • the authentication authority determines whether it needs to return the user ID.
  • Step 804 The anchor paging controller requests the anchor authenticator to send the context information, and the anchor authenticator returns the context information, and carries the real user identifier information, such as the real NAI, IMSI, user phone number or MAC ID;
  • the anchor paging controller may transmit an indication of obtaining a real user identity or a home base station mode (eg, closed mode, mixed mode) to the anchor authenticator in this step, so as to anchor the authenticator to determine whether it needs to return. User's true identity.
  • the anchoring authentication party may request the real information in the information message according to the step, and if the user needs to obtain the real user identifier or find that the home base station is in the closed or mixed mode, the response message in the step carries the real user.
  • the anchor authentication party may also carry the user's real identity directly in the response message of the step without any judgment.
  • Step 805 The anchor paging controller returns a paging controller location update response, and carries the user identifier information.
  • Step 806 The paging controller responds to the home base station with a location update response, and carries the user identifier information.
  • the anchor paging controller is in direct contact with the home base station, and step 806 is optional.
  • Step 807 the home base station performs access control on the user according to the user identification information carried in the message in step 806; the closed mode home base station checks whether the user identity exists in the CSG list, and if so, allows the user to access, and proceeds to step 808; Otherwise, the user is denied access, and the user can be released. Cheng.
  • the hybrid mode home base station checks whether the user identity exists in the CSG list. If yes, the user is notified to the access gateway as the CSG user in the subsequent process. If not, the access gateway is notified to the access gateway in the subsequent process. CSG users.
  • Step 808 The home base station authenticates the ranging request message, and returns a terminal ranging response message.
  • Step 809 The home base station sends a location update confirmation to the paging controller.
  • Step 810 The paging controller sends a location update confirmation message to the anchor paging controller.
  • Step 811 If the anchor paging controller receives the key information , the key update process should be performed. In the above procedure, if there are no steps 802, 806 and 809, the anchored paging controller will directly interact with the home base station.
  • the authentication authorization server may encrypt the real user identification information and transmit the information to the home base station via the intermediate network element. After receiving the ciphertext, the home base station decrypts the corresponding real user identifier to perform the access control operation of the user. Therefore, for the foregoing embodiment, the authentication authorization server needs to encrypt and transmit the real user identification information, but after the home base station decrypts the encrypted real user identifier to obtain the real user identifier, the home base station
  • the access control mode of the user is the same as that of the above embodiment, and does not affect the description of the present invention, so the description is not repeated here.
  • the message is carried in the message 504 to the access gateway, and if there is a fake user identifier, the access gateway saves the access gateway. Corresponding relationship between the user's fake identifier and the ciphertext; carrying the ciphertext in the message of step 505 and transmitting the ciphertext to the home base station.
  • the message is carried in the message 604 to the access gateway, if there is a fake user.
  • the identifier, the access gateway saves the correspondence between the user's fake identifier and the ciphertext; and the message is carried in step 605 to the home base station.
  • the message is carried in the message 708 to the mobility management entity, and if there is a user identifier of 4 ⁇ , the mobility management is performed.
  • the entity stores the correspondence between the user's fake identifier and the ciphertext; and the message is carried in step 709 to the home base station.
  • the ciphertext carrying the real user identifier is transmitted in the message of step 804, step 805 and step 806.
  • the foregoing process provides a method for performing access control on a user, and the user identification information is returned through the authentication process, and the home base station performs an access control operation according to the information, thereby providing correctness of the user identity to reduce the home base station network element.
  • the processing burden reduces the security risks of the home base station system.
  • the real user identification information in the above method is encrypted and transmitted between the network side and the home base station, which improves the security of transmitting the real user identification information.
  • the foregoing embodiment uses the application scenario when the user accesses as an example to describe the manner in which the home base station performs access control, and other implementation scenarios, such as the user re-entering the network process or exiting the idle state process, without performing the authentication process.
  • the real user identification information is notified by the access gateway or the mobility management entity to the home base station, instead of the authentication authorization server transmitting the user identity to the home base station via the access gateway or the mobility management entity, and the home base station is connected according to the situation.
  • the user ID provided by the gateway or the mobility management entity performs access control.
  • the process is very similar to the embodiment described in FIG. 5, FIG. 6, and FIG. 7 above, and does not affect the description of the present invention, so it is not repeated here. description.
  • the access control mode of the home base station to the user is very similar to the above embodiment, and does not affect the description of the present invention, so it is no longer Repeat the description.
  • the home base station performs an access control operation on the user according to the authenticated and real user identification information returned by the network side entity.
  • the network side entity may be an authentication authorization server, an access gateway, or a mobility management entity.
  • the access control operation is an operation for the home base station to determine whether the user belongs to the CSG list, for example, the closed mode home base station checks whether the user exists in the CSG list, and if so, allows the user to pick up Enter, otherwise reject the user access; the hybrid mode home base station checks whether the user exists in the CSG list, and if so, informs the access gateway that the user is a CSG user, and if not, informs the access gateway that the user is a non-CSG user.
  • the present invention further provides a user access control system, where the system includes a network side entity and a home base station connected to the network side entity, wherein the network side entity is configured to: send a real user identifier to the home base station Information;
  • the network side entity may also be configured to: transmit encrypted real user identification information to the home base station.
  • the network side entity is an authentication authorization server
  • the user identification information is sent by the access authorization server to the home base station by using an authentication response message in the authentication process of the access process; Or the user identification information is sent by the authentication authority to the home base station by using the authentication response message by the mobility management entity and the home base station gateway in the authentication process of the access process.
  • the network side entity is an anchor authentication function entity of the access gateway
  • the user identification information is an anchor authentication party in the process of location update, after paging controller, anchor paging control
  • the device sends the message to the home base station through a location update response message.
  • the network side entity may be an authentication authorization server, an access gateway or a mobility management entity.
  • the access gateway is further configured to: save user identification information; when the network side entity is a mobility management entity, the mobility management entity is further configured to : Save user identification information. If the network side entity is configured to send the encrypted real user identification information to the home base station, when the network side entity is the authentication authorization server, the authentication authorization server is further configured to: encrypt the real user identifier. Information; when the network side entity is an access gateway, the access gateway is further configured to: save the encrypted user identification information; when the network side entity is a mobility management entity, the mobility The management entity is also configured to: save the encrypted user identification information.
  • the home base station is configured to: receive user identification information sent by the network side entity, and according to The user identification information performs an access control operation.
  • the home base station is further configured to: receive the encrypted real user identification information sent by the network side entity, and decrypt the encrypted real user. The identification, and the access control operation according to the real user identification information.
  • the home base station is further configured to: transmit an indication that the real user identifier is obtained or the home base station mode to the network side entity by using the intermediate network element; the network side entity is further configured to: when the home base station is found to need to obtain the real user identifier or the discovery When the home base station is in the closed or mixed mode, the user sends the real identification information of the user in the return message; or does not make any judgment, and directly carries the true identifier of the user in the return message.
  • the network side entity supporting the user access control implemented by the present invention includes a sending module, and the sending module is configured to: send real user identification information to the home base station, so that the home base station performs access control on the user according to the user identification information. operating.
  • the sending module may be further configured to: send the encrypted real user identification information to the home base station.
  • the user identification information mentioned in the present invention all represents the real identity of the user, such as NAI.
  • the access control operation means that the home base station checks whether the user exists in the CSG list, and if so, allows the user to access, otherwise denies the user access; in the hybrid mode, the access control operation refers to the home base station check Whether the user exists in the CSG list, if yes, informs the access gateway that the user is a CSG user, and if not, informs the access gateway that the user is a non-CSG user.
  • the home base station performs an access control operation on the user according to the real user identification information, which can provide correctness of the user identity, eliminate security risks, and reduce the processing burden of the home base station.
  • the real user identification information in the above system is on the network side and home. The use of encrypted transmission between base stations improves the security of transmitting real user identification information.
  • the invention is not limited to any specific combination of hardware and software.
  • the above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.
  • the present invention provides a user access control method and system.
  • the home base station performs an access control operation on the user according to the real user identification information, which can provide correctness of the user identity, eliminate security risks, and reduce the processing load of the home base station.
  • the real user identification information in the above system can be encrypted and transmitted between the network side and the home base station, which improves the security of transmitting real user identification information.

Description

用户接入控制方法和系统
技术领域 本发明涉及移动通信领域， 具体涉及一种用户接入控制方法及系统。
背景技术 家用基站是一种小型、低功率的基站，部署在家庭及办公室等室内场所， 主要作用是为了给用户提供更高的业务速率并降低使用高速率服务所需要的 费用， 同时弥补已有分布式蜂窝无线通信系统覆盖的不足。 家用基站的优点 是实惠、 便捷、 低功率输出、 即插即用等。 家用基站可以通过家用基站网关这个逻辑网元接入到核心网络， 如图 1 和图 2所示， 其中， 家用基站网关主要功能为： 验证家用基站的安全性， 处 理家用基站的注册， 对家用基站进行运行维护管理， 根据运营商要求配置和 控制家用基站， 负责交换核心网和家用基站的数据。 图 1中家用基站网关可 以与接入网关合设、也可以单独设置；也可以有不存在家用基站网关的情况， 此时家用基站直接与接入网关进行连接。 图 2中移动性管理实体负责移动性 管理、 非接入层信令的处理和用户移动管理上下文的管理等控制面的相关工 作。 鉴权授权服务器负责存储归属地网络的用户数据信息的核心数据库， 存 放着用户的认证信息、 业务信息等等。 另外， 家用基站也可以不经过家用基 站网关， 直接连接到核心网， 如图 3所示。 在家用基站系统中存在闭合用户组（CSG, Closed Subscriber Group ) 的 概念， 允许用户接入一个或多个访问受限的 CSG Cell。 家用基站的使用模式 可分为闭合模式、 混合模式和开放模式。 当家用基站是闭合模式的时候， 只 有该家用基站所属 CSG用户可以接入该基站并享受基站提供的业务。当家用 基站是开放模式的时候， 任何用户都可以接入该基站， 此时的家用基站等同 于宏基站使用。 当家用基站是混合模式的时候， 既允许 CSG用户接入， 同时 也允许其他用户接入使用，不过会根据用户是否属于 CSG列表来区分不同用 户类型、 实现差异化的服务质量处理，也就是说 CSG的用户在使用混合型家 用基站的时候具有更高的业务优先级， 拥有更好的服务质量和业务类别。 网络侧的用户数据服务器将允许接入的闭合用户组列表发送到家用基 站。 用户接入时， 闭合模式的家用基站会利用该列表对用户进行接入控制， 闭合模式家用基站将拒绝未授权的用户接入网络； 混合模式的家用基站根据 该列表对用户类别 （如， CSG用户、 非 CSG用户 )进行区分， 便于实施差 异化计费、 服务质量授权等操作。 为了简化描述， 以下将家用基站判断用户 是否属于 CSG列表的操作统称为接入控制。 家用基站根据终端发送的用户标识检查该用户是否属于 CSG列表，以图 1家用基站网关与接入网关合设为例描述家用基站执行接入控制流程（如图 4 所示） ， 具体步骤如下： 步骤 401 , 终端请求协商认证能力， 如用户的认证策略等， 并与基站、 接入网关完成能力协商工作。 步骤 402 , 接入网关向家用基站发送用户标识请求， 家用基站将该请求 转发给终端。 步骤 403 , 在收到用户标识请求消息后， 终端向家用基站回复响应消息， 携带用户标识信息，如 NAI ( Network Access Identifier,网络接入标识）、 IMSI ( International Mobile Subscriber Identification Number,国际移动客户 i只另 ll码 ) 或 MAC ID ( Media Access Control ID , 介质访问控制标识 ) 。 步骤 404, 家用基站根据该用户标识信息对用户进行接入控制。 闭合模式家用基站检查该用户是否存在于 CSG列表中，如果存在， 则允 许用户接入， 继续步骤 405; 否则拒绝用户接入， 可以发起用户释放流程。 混合模式家用基站检查该用户是否存在于 CSG列表中，如果存在， 则在 后续流程中告知接入网关该用户为 CSG用户，如果不存在， 则在后续流程中 告知接入网关该用户为非 CSG用户。 步骤 405 , 家用基站向接入网关返回用户标识。 该步骤与步骤 404不分 先后顺序， 可以与其并列发生。 步骤 406 , 执行用户鉴权流程。 鉴权授权服务器完成对用户合法性的审 核， 并授权用户进行业务。 步骤 407 , 继续执行用户接入相关的其他流程。 上述流程可见， 家用基站根据终端携带的用户标识检查该用户是否属于 CSG列表（步骤 404 ) , 但是在步骤 403终端回复的响应中， 鉴于安全考虑， 终端可能将用户真实标识进行认证协议封装， 如 EAP ( Extensible Authentication Protocol, 扩展认证协议）封装， 此时家用基站需要解析认证 封装协议， 导致基站节点运作负担增加、 效率降低； 在终端对真实身份标识 进行加密传送的情况下， 家用基站更是无从解析并获取用户标识信息； 即便 终端通过明文传送用户标识， 不经认证消息封装， 则该用户标识未经过鉴权 授权服务器的验证， 从而无法保证该用户标识的正确性， 存在无线通信系统 安全隐患。
发明内容 本发明要解决的技术问题是提供一种用户接入控制方法及系统， 以提供 用户标识正确性保障， 消除安全隐患， 减轻家用基站的处理负担。 为了解决上述技术问题， 本发明提供一种用户接入控制方法， 包括： 网络侧实体向家用基站发送真实的用户标识信息； 所述家用基站接收所述用户标识信息， 并根据该用户标识信息对用户进 行接入控制操作。 优选地， 在所述网络侧实体向家用基站发送真实的用户标识信息前， 所 述方法还包括： 所述家用基站将获取真实用户标识的指示或者家用基站模式 经中间网元传送给网络侧实体； 在网络侧实体向家用基站发送真实的用户标识信息的步骤中， 网络侧实 体发现所述家用基站需要获取真实的用户标识或发现家用基站为闭合或混合 模式时， 在返回消息中携带用户真实的标识信息； 或网络侧实体不进行任何 判断， 直接在返回消息中携带用户的真实标识。 优选地， 所述网络侧实体是鉴权授权服务器， 在网络侧实体向家用基站 发送真实的用户标识信息的步骤中， 所述鉴权授权服务器在接入过程的鉴权 流程中利用鉴权响应消息将所述用户标识信息发送给家用基站， 所述鉴权响 应消息由所述鉴权授权服务器经过接入网关， 或经过移动性管理实体和家用 基站网关发送给所述家用基站； 或， 所述网络侧实体是接入网关的锚定鉴权方功能实体， 在网络侧实体向家 用基站发送真实的用户标识信息的步骤中，锚定鉴权方在位置更新的流程中， 经过寻呼控制器、 锚定寻呼控制器通过位置更新响应消息将所述用户标识信 息发送给家用基站； 或， 所述网络侧实体是接入网关， 在网络侧实体向家用基站发送真实的用户 标识信息的步骤中， 所述接入网关通过密钥改变指示消息或鉴权结果消息将 所述用户标识信息发送给所述家用基站； 或，
所述网络侧实体是移动性管理实体。 优选地， 在网络侧实体向家用基站发送真实的用户标识信息的步骤中， 网络侧实体向家用基站发送加密的真实的用户标识信息； 在家用基站接收所述用户标识信息，对用户进行接入控制操作的步骤中， 所述家用基站接收所述加密的真实的用户标识信息后解密所述信息， 并根据 所述真实的用户标识信息对用户进行接入控制操作。 优选地， 闭合模式下， 所述接入控制操作指， 家用基站检查该用户是否 存在于闭合用户组 CSG列表中， 如果存在， 则允许用户接入， 否则拒绝用户 接入； 混合模式下， 所述接入控制操作指， 家用基站检查该用户是否存在于 CSG列表中， 如果存在， 则告知接入网关该用户为 CSG用户， 如果不存在， 则告知接入网关该用户为非 CSG用户。 优选地， 所述用户标识信息是如下信息中的一种或多种： 网络接入标识 NAI、 国际移动客户识别码 IMSI、 介质访问控制标识 MAC ID、 用户电话号 码。
为了解决上述技术问题， 本发明提供一种用户接入控制系统， 该系统包 括网络侧实体及与网络侧实体连接的家用基站， 其中： 所述网络侧实体设置成： 向家用基站发送真实的用户标识信息； 所述家用基站设置成： 接收所述网络侧实体发送的用户标识信息， 以及 根据所述用户标识信息进行接入控制操作。 优选地， 所述网络侧实体是鉴权授权服务器、 接入网关或移动性管理实 体，
当所述网络侧实体是接入网关时， 所述接入网关还设置成： 对用户标识 信息进行保存；
当所述网络侧实体是移动性管理实体时，所述移动性管理实体还设置成： 对用户标识信息进行保存。 优选地， 所述家用基站还设置成： 将获取真实用户标识的指示或者家用 基站模式经中间网元传送给网络侧实体； 网络侧实体还设置成： 当发现所述家用基站需要获取真实的用户标识或 发现家用基站为闭合或混合模式时，在返回消息中携带用户真实的标识信息； 或不进行任何判断， 直接在返回消息中携带用户的真实标识。 优选地， 所述网络侧实体还设置成： 向家用基站发送加密的真实的用户 标识信息； 所述家用基站还设置成： 接收所述网络侧实体发送的加密的真实的用户 标识信息， 解密所述加密的真实的用户标识， 以及才艮据所述真实的用户标识 信息进行接入控制操作。 优选地， 所述网络侧实体是鉴权授权服务器、 接入网关或移动性管理实 体，
当所述网络侧实体是鉴权授权服务器时，所述鉴权授权服务器还设置成： 加密所述真实的用户标识信息； 当所述网络侧实体是接入网关时， 所述接入网关还设置成： 对所述加密 的用户标识信息进行保存； 当所述网络侧实体是移动性管理实体时，所述移动性管理实体还设置成： 对所述加密的用户标识信息进行保存。 优选地， 闭合模式下， 所述接入控制操作指， 家用基站检查该用户是否 存在于闭合用户组 CSG列表中， 如果存在， 则允许用户接入， 否则拒绝用户 接入； 混合模式下， 所述接入控制操作指， 家用基站检查该用户是否存在于 CSG列表中， 如果存在， 则告知接入网关该用户为 CSG用户， 如果不存在， 则告知接入网关该用户为非 CSG用户。 优选地， 所述用户标识信息如下信息中的一种或多种： 网络接入标识 NAI、 国际移动客户识别码 IMSI、 介质访问控制标识 MAC ID、 用户电话号 码。 为了解决上述技术问题， 本发明提供一种支持用户接入控制的网络侧实 体， 包括发送模块， 所述发送模块设置成： 向家用基站发送真实的用户标识信息， 以使家用 基站根据该用户标识信息对用户进行接入控制操作。 优选地， 所述发送模块还设置成： 向家用基站发送加密的真实的用户标 识信息。
相较于现有技术， 本发明用户接入控制方法和系统中家用基站根据经过 真实的用户标识信息对用户进行接入控制操作，以提供用户标识正确性保障， 消除安全隐患， 减轻家用基站的处理负担。 此外， 通过本发明所述方法和系 统， 真实用户标识信息在网络侧和家用基站之间加密传送， 提高了传递真实 用户标识信息的安全性。
附图概述 图 1为现有技术的一种家用基站网络连接示意图； 图 2为现有技术的另一种家用基站网络连接示意图； 图 3为现有技术的另一种家用基站网络连接示意图； 图 4为现有技术的家用基站用户接入过程流程图； 图 5为本发明用户接入控制方法的第一实施方式的流程图； 图 6为本发明用户接入控制方法的第二实施方式的流程图； 图 7为本发明用户接入控制方法的第三实施方式的流程图； 图 8为本发明用户接入控制方法的第四实施方式的流程图。
本发明的较佳实施方式 本发明用户接入控制方法和系统的主要思想是， 家用基站根据经过鉴权 的、 真实的用户标识信息对用户进行接入控制操作， 以提供用户标识正确性 保障， 消除安全隐患， 减轻家用基站的处理负担。 本发明用户接入控制方法 包括以下步骤： 步骤一、 网络侧实体向家用基站发送经过鉴权的、真实的用户标识信息； 实现该步骤有以下几种实现方式： 方式一、 网络侧实体是鉴权授权服务器， 所述用户标识信息是鉴权授权 服务器在接入过程的鉴权流程中经过接入网关利用鉴权响应消息发送给家用 基站的。 方式二、 网络侧实体是鉴权授权服务器， 所述用户标识信息是鉴权授权 服务器在接入过程的鉴权流程中经过移动性管理实体和家用基站网关利用鉴 权响应消息发送给家用基站的， 如图 7所示。 方式三、 网络侧实体是接入网关的锚定鉴权方功能实体， 所述用户标识 信息是锚定鉴权方是在位置更新的流程中， 经过寻呼控制器、 锚定寻呼控制 器通过位置更新响应消息发送给家用基站的， 如图 8所示。
当然在其他应用场景 （如用户重入网流程、 退出空闲态流程、 寻呼区更 新、 路由更新、 跟踪区更新等） 下， 也可以由接入网关或移动性管理实体充 当本发明的网络侧实体向家用基站发送真实的用户标识信息。 步骤二、 家用基站接收所述用户标识信息， 并根据该用户标识信息对用 户进行接入控制操作。 本发明提到的用户标识信息均表示用户真实的身份标识， 如 NAI ( Network Access Identifier, 网络接入标 i只） 、 IMSI ( International Mobile Subscriber Identification Number, 国际移动客户识别码 )或 MAC ID ( Media Access Control ID, 介质访问控制标识 )或用户电话号码。 闭合模式下，接入控制操作指， 家用基站检查该用户是否存在于 CSG列 表中， 如果存在， 则允许用户接入， 否则拒绝用户接入； 混合模式下，接入控制操作指， 家用基站检查该用户是否存在于 CSG列 表中， 如果存在， 则告知接入网关该用户为 CSG用户， 如果不存在， 则告知 接入网关该用户为非 CSG用户。 下面结合附图和具体实施例对本发明所述技术方案作进一步的详细描 述， 以使本领域的技术人员可以更好的理解本发明并能予以实施， 但所举实 施例不作为对本发明的限定。 第一实施方式 图 5是本发明在图 1家用基站系统的基础上， 提供的家用基站用户接入 过程流程图。 本实施例以家用基站网关与接入网关合设为例描述家用基站执 行接入控制流程， 具体步骤描述如下： 步骤 501 , 终端请求协商认证能力， 如用户的认证策略等， 并与基站、 接入网关完成能力协商工作； 步骤 502 , 接入网关向家用基站发送用户标识请求， 家用基站将该请求 转发给终端； 步骤 503 , 在收到用户标识请求消息后， 终端通过家用基站、 接入网关 向鉴权授权服务器发送用户标识信息， 鉴权授权服务器执行用户鉴权流程， 完成对用户合法性的审核， 并授权用户进行业务； 尽管终端发送的用户标识信息包括真实的以及假的 NAI, 家用基站无需 解析该终端发送的消息， 故此时不能获取到真实的以及假的 NAL 进一步地， 家用基站可以将获取真实用户标识的指示或者家用基站模式 (如闭合模式、 混合模式）在鉴权请求消息中经接入网关传送给鉴权授权服 务器， 以便鉴权授权服务器判断是否需要返回用户标识。 步骤 504, 接续鉴权流程一鉴权授权服务器向接入网关返回鉴权成功， 携带用户真实的标识信息， 如真实的 ΝΑΙ、 IMSI、 用户电话号码或 MAC ID。 接入网关将保存该用户标识信息； 如果存在假的用户标识， 则接入网关会保 存用户假标识与真实标识的对应关系， 该真实用户标识信息的保存可用于在 终端退出空闲态过程中为家用基站作接入控制提供信息； 进一步地， 鉴权授权服务器可以根据步骤 503的信息， 发现需要获取真 实的用户标识或者发现家用基站为闭合或混合模式， 则在该步骤中携带用户 真实的标识信息； 鉴权授权服务器也可以不进行任何判断， 直接在该步中携 带用户的真实标识。
步骤 505 , 接入网关向家用基站转发鉴权成功， 携带用户标识信息 （这 里的用户标识信息是鉴权授权服务器返回的真实的用户标识信息），如 NAI、 IMSL 用户电话号码或 MAC ID; 在家用基站网关独设的情况下， 鉴权响应 消息将经由家用基站网关转发给家用基站， 携带用户标识信息， 如 NAI、 IMSL 用户电话号码或 MAC ID; 步骤 506, 家用基站根据步骤 505消息中携带的用户标识信息对用户进 行接入控制； 闭合模式家用基站检查该用户标识是否存在于 CSG列表中， 如果存在， 则允许用户接入， 继续步骤 507; 否则拒绝用户接入， 可以发起用户释放流 程；
混合模式家用基站检查该用户标识是否存在于 CSG列表中， 如果存在， 则在步骤 508流程中告知接入网关该用户为 CSG用户，如果不存在，则在步 骤 508流程中告知接入网关该用户为非 CSG用户； 步骤 507 , 家用基站转发鉴权响应消息给终端； 步骤 508 , 继续执行用户接入相关的其他流程。 第二实施方式 图 6是本发明在图 1家用基站系统的基础上， 提供的家用基站用户接入 过程流程图。 本实施例以家用基站网关与接入网关合设为例描述家用基站执 行接入控制流程， 具体步骤描述如下： 步骤 601 , 终端请求协商认证能力， 如用户的认证策略等， 并与基站、 接入网关完成能力协商工作； 步骤 602, 接入网关向家用基站发送用户标识请求， 家用基站将该请求 转发给终端；
该步骤也可以由家用基站发起， 而非接入网关； 步骤 603 , 在收到用户标识请求消息后， 终端通过家用基站、 接入网关 向鉴权授权服务器发送用户标识信息， 鉴权授权服务器执行用户鉴权流程， 完成对用户合法性的审核， 并授权用户进行业务。
进一步地， 家用基站可以将获取真实用户标识的指示或者家用基站模式 (如闭合模式、 混合模式）在鉴权请求消息中经接入网关传送给鉴权授权服 务器， 以便鉴权授权服务器判断是否需要返回用户标识。
步骤 604, 鉴权授权服务器向接入网关返回鉴权响应， 携带鉴权结果及 用户标识信息， 如真实的 NAI、 IMSI、 用户电话号码或 MAC ID; 接入网关 向家用基站转发鉴权响应， 家用基站转发鉴权响应消息给终端； 在家用基站网关独设的情况下， 鉴权响应消息将经由家用基站网关转发 给家用基站； 接入网关将保存该用户标识信息； 如果存在假的用户标识， 则 接入网关会保存用户假标识与真实标识的对应关系。 进一步地， 鉴权授权服务器可以根据步骤 603的信息， 发现需要获取真 实的用户标识或者发现家用基站为闭合或混合模式， 则在该步骤发往接入网 关的鉴权响应消息中携带用户真实的标识信息； 鉴权授权服务器也可以不进 行任何判断， 直接在该步骤发往接入网关的鉴权响应消息中携带用户的真实 标识。 步骤 605 , 接入网关向家用基站通知鉴权结果或者密钥改变指示消息， 携带鉴权结果、 用户标识信息， 如 NAI、 IMSL 用户电话号码或 MAC ID; 步骤 604中， 转发鉴权响应时， 家用基站无法解析鉴权响应消息， 所以 得不到鉴权结果， 步骤 605中家用基站单独获取鉴权结果。 密钥改变指示消息是由接入网关生成的， 其中携带密钥相关信息、 鉴权 结果和用户标识信息。 在家用基站网关独设的情况下， 该消息将经由家用基站网关转发给家用 基站， 携带用户标识信息， 如 NAI、 IMSL 用户电话号码或 MAC ID。 步骤 606, 家用基站根据步骤 605消息中携带的用户标识信息对用户进 行接入控制； 如果釆用密钥改变指示， 家用基站对密钥改变指示进行解析以获取其中 的用户标识信息。 闭合模式家用基站检查该用户标识是否存在于 CSG列表中， 如果存在， 则允许用户接入， 继续步骤 607; 否则拒绝用户接入， 可以发起用户释放流 程。 混合模式家用基站检查该用户标识是否存在于 CSG列表中， 如果存在， 则在后续流程中告知接入网关该用户为 CSG用户，如果不存在， 则在后续流 程中告知接入网关该用户为非 CSG用户。 步骤 607, 家用基站响应密钥改变应答消息； 釆用密钥改变指示时向家用基站通知用户标识信息时， 发生以上步骤
607。 步骤 608 , 继续执行用户接入相关的其他流程。 第三实施方式 图 7是本发明在图 2家用基站系统的基础上， 提供的家用基站用户接入 过程流程图。 本实施例以家用基站网关与接入网关分设为例描述家用基站执 行接入控制流程， 具体步骤描述如下： 步骤 701 , 用户在进行通信前需要建立 RRC ( Radio Resource Control, 无线资源控制）连接作为信令消息或者业务数据的承载； 步骤 702 , 用户通过初始化 NAS ( Network Access Server, 网络接入服务 器） 消息触发注册过程， 消息类型可以为附着消息、 位置更新消息、 业务请 求消息等； 步骤 703 , 家用基站发现没有该用户的上下文标识信息， 向家用基站网 关发送注册请求消息， 将用户信息注册到家用基站网关上， 消息内容包括注 册的类型、 用户标识以及家用基站标识等信息； 家用基站网关对接入这个家 用基站的用户进行能力方面的检验， 如果允许该用户使用家用基站提供的资 源， 那么就接受注册， 建立用户上下文并在向家用基站回复的注册响应消息 中携带用户上下文标识信息； 步骤 704, 家用基站向家用基站网关发送连接 ( Connect ) 消息； 步骤 705 , 家用基站网关发起连接建立消息， 同时也将 NAS消息发至移 动性管理实体； 进一步地， 家用基站可以将获取真实用户标识的指示或者家用基站模式
(如闭合模式、 混合模式）在该步中传送给移动性管理实体， 以便最终传送 给鉴权授权服务器使其判断是否需要返回用户标识。 步骤 706, 移动性管理实体回复连接建立响应； 步骤 707 , 移动性管理实体开启鉴权以及安全流程， 对用户进行验证； 进一步地， 移动性管理实体可以将获取真实用户标识的指示或者家用基 站模式（如闭合模式、 混合模式）在该步中传送给鉴权授权服务器， 以便鉴 权授权服务器判断是否需要返回用户标识。 步骤 708 , 鉴权授权服务器向移动性管理实体发送鉴权响应， 携带用户 真实标识信息， 如真实的 NAI、 IMSI、 用户电话号码或 MAC ID, 接入网关 将保存该用户标识信息， 如果存在假的用户标识， 则接入网关会保存用户假 标识与真实标识的对应关系； 进一步地， 鉴权授权服务器可以根据步骤 707的信息， 发现需要获取真 实的用户标识或者发现家用基站为闭合或混合模式， 则在该步骤中携带用户 真实的标识信息； 鉴权授权服务器也可以不进行任何判断， 直接在该步中携 带用户的真实标识。 步骤 709, 移动性管理实体转发鉴权响应， 该消息经由家用基站网关传 送至家用基站， 携带真实用户标识信息， 如 NAI、 IMSI、 用户电话号码或 MAC ID, 如果不存在家用基站网关（即图 3 )的情况， 则移动性管理实体将 转发鉴权响应消息给家用基站， 携带真实用户标识信息， 如 NAI、 IMSL 用 户电话号码或 MAC ID; 步骤 710, 家用基站根据步骤 709消息中携带的用户标识信息对用户进 行接入控制； 闭合模式家用基站检查该用户标识是否存在于 CSG列表中， 如果存在， 则允许用户接入， 继续步骤 711 ; 否则拒绝用户接入， 可以发起用户释放流 程。 混合模式家用基站检查该用户标识是否存在于 CSG列表中， 如果存在， 则在步骤 711流程中告知移动性管理实体该用户为 CSG用户， 如果不存在， 则在步骤 711流程中告知移动性管理实体该用户为非 CSG用户。 步骤 711 , 继续执行用户接入相关的其他流程。
第四实施方式 图 8是本发明在图 1家用基站系统的基础上， 提供的家用基站用户进行 位置更新的流程图。 本实施例以家用基站网关与接入网关合设为例描述家用 基站执行接入控制流程， 其中， 寻呼控制器、 锚定寻呼控制器和锚定鉴权方 (锚定鉴权方作为鉴权者 authenticator,存放鉴权信息）均属于接入网关的功 能实体， 寻呼控制器与家用基站属于服务的接入服务网络。 具体步骤描述如 下： 步骤 801 , 终端向家用基站发送测距请求， 携带空闲模式位置更新指示； 步骤 802, 家用基站请求寻呼控制器进行位置更新， 携带寻呼组信息； 进一步地， 家用基站可以将获取真实用户标识的指示或者家用基站模式 (如闭合模式、 混合模式）在该步骤传送给寻呼控制器， 以便最终传送给锚 定鉴权方使其判断是否需要返回用户标识。 步骤 803 , 寻呼控制器向锚定寻呼控制器发送位置更新请求； 进一步地，该步可以携带获取真实用户标识的指示或者家用基站模式（如 闭合模式、 混合模式） ， 以便最终传送给锚定鉴权方使其判断是否需要返回 用户标识。 步骤 804, 锚定寻呼控制器请求锚定鉴权方发送上下文信息， 锚定鉴权 方返回上下文信息， 携带真实的用户标识信息， 如真实的 NAI、 IMSI、 用户 电话号码或 MAC ID; 进一步地， 锚定寻呼控制器可以将获取真实用户标识的指示或者家用基 站模式（如闭合模式、 混合模式）在该步中传送给锚定鉴权方， 以便锚定鉴 权方判断是否需要返回用户真实标识。 进一步地，锚定鉴权方可以根据该步请求上下文信息消息中携带的信息， 发现需要获取真实的用户标识或者发现家用基站为闭合或混合模式， 则在该 步骤的响应消息中携带用户真实的标识信息； 锚定鉴权方也可以不进行任何 判断， 直接在该步的响应消息中携带用户的真实标识。 步骤 805 , 锚定寻呼控制器回复寻呼控制器位置更新响应， 携带用户标 识信息； 步骤 806, 寻呼控制器向家用基站回应位置更新响应， 携带用户标识信 息；
无寻呼控制器的情况下， 锚定寻呼控制器与家用基站直接联系， 则步骤 806可选。 步骤 807, 家用基站根据步骤 806消息中携带的用户标识信息对用户进 行接入控制； 闭合模式家用基站检查该用户标识是否存在于 CSG列表中， 如果存在， 则允许用户接入， 继续步骤 808; 否则拒绝用户接入， 可以发起用户释放流 程。 混合模式家用基站检查该用户标识是否存在于 CSG列表中， 如果存在， 则在后续流程中告知接入网关该用户为 CSG用户，如果不存在， 则在后续流 程中告知接入网关该用户为非 CSG用户。 步骤 808 , 家用基站对测距请求消息进行认证， 并回复终端测距响应消 息；
步骤 809, 家用基站发送位置更新确认给寻呼控制器； 步骤 810, 寻呼控制器向锚定寻呼控制器发送位置更新确认消息； 步骤 811 , 如果锚定寻呼控制器接收到密钥信息， 则应执行密钥更新过 程。 上述流程中， 如果无步骤 802、 806和 809, 则锚定的寻呼控制器将与家 用基站直接交互。
第五实施方式 鉴权授权服务器可以将真实的用户标识信息进行加密后， 经中间网元传 送给家用基站。 在收到该密文后， 家用基站对其解密得到相应的真实用户标 识， 以便进行用户的接入控制操作。 因此， 对于上述实施例， 需要鉴权授权 服务器在传送真实的用户标识信息时对该信息进行加密传送， 但家用基站解 密所述加密的真实用户标识从而得到所述真实用户标识后， 家用基站对于用 户的接入控制方式与上述实施例相同， 不会对阐述本发明造成影响， 故在此 不再重复描述。 对于第一实施方式的情况， 鉴权授权服务器将真实的用户标识信息进行 加密后， 在步骤 504消息中携带该密文传送给接入网关， 如果存在假的用户 标识， 则接入网关会保存用户假标识与该密文的对应关系； 在步骤 505消息 中携带该密文传送给家用基站。 对于第二实施方式的情况， 鉴权授权服务器将真实的用户标识信息进行 加密后， 在步骤 604消息中携带该密文传送给接入网关， 如果存在假的用户 标识， 则接入网关会保存用户假标识与该密文的对应关系； 在步骤 605消息 中携带该密文传送给家用基站。 对于第三实施方式的情况， 鉴权授权服务器将真实的用户标识信息进行 加密后， 在步骤 708消息中携带该密文传送给移动性管理实体， 如果存在 4叚 的用户标识， 则移动性管理实体会保存用户假标识与该密文的对应关系； 在 步骤 709消息中携带该密文传送给家用基站。 对于第四实施方式的情况， 在步骤 804、 步骤 805和步骤 806消息中携 带真实的用户标识的密文进行传送。 上述流程提供了一种对用户进行接入控制的方法， 通过鉴权流程返回用 户标识信息， 家用基站根据该信息进行接入控制操作， 从而提供了用户标识 正确性保障， 以减轻家用基站网元的处理负担， 降低家用基站系统的安全隐 患。此外，上述方法中真实用户标识信息在网络侧和家用基站之间加密传送， 提高了传递真实用户标识信息的安全性。 为了简化描述， 上述实施例以用户接入时的应用场景为例来说明家用基 站执行接入控制的方式， 其他实现场景， 如用户重入网流程或者退出空闲态 流程， 在不执行鉴权过程的情况下， 真实的用户标识信息由接入网关或者移 动性管理实体告知家用基站， 而不是鉴权授权服务器将用户标识经接入网关 或移动性管理实体发送至家用基站， 此时家用基站根据接入网关或移动性管 理实体提供的用户标识进行接入控制， 该流程与上述图 5、 图 6、 图 7所述实 施例极为相似， 不会对阐述本发明造成影响， 故在此不再重复描述。 此外， 对于其他实现场景， 如寻呼区更新、 路由更新、 跟踪区更新， 家 用基站对于用户的接入控制方式与上述实施例极为相似， 不会对阐述本发明 造成影响， 故在此不再重复描述。 另外， 家用基站根据网络侧实体返回的经过鉴权的、 真实的用户标识信 息对用户进行接入控制操作。 其中， 网络侧实体可以是鉴权授权服务器、 接 入网关或移动性管理实体。 接入控制操作为家用基站判断用户是否属于 CSG列表的操作，如， 闭合 模式家用基站检查该用户是否存在于 CSG列表中，如果存在，则允许用户接 入， 否则拒绝用户接入； 混合模式家用基站检查该用户是否存在于 CSG列表 中， 如果存在， 则告知接入网关该用户为 CSG用户， 如果不存在， 则告知接 入网关该用户为非 CSG用户。本专利中提到的用户标识均表示用户真实的身 份标识。 为了实现以上方法， 本发明还提供了一种用户接入控制系统， 该系统包 括网络侧实体及与网络侧实体连接的家用基站， 其中， 网络侧实体设置成： 向家用基站发送真实的用户标识信息； 网络侧实体还可设置成： 向家用基站发送加密的真实的用户标识信息。 如上所述， 当该网络侧实体是鉴权授权服务器时； 所述用户标识信息是 鉴权授权服务器在接入过程的鉴权流程中经过接入网关利用鉴权响应消息发 送给家用基站的； 或所述用户标识信息是鉴权授权服务器在接入过程的鉴权 流程中经过移动性管理实体和家用基站网关利用鉴权响应消息发送给家用基 站的。 当所述网络侧实体是接入网关的锚定鉴权方功能实体时， 所述用户标识 信息是锚定鉴权方是在位置更新的流程中， 经过寻呼控制器、 锚定寻呼控制 器通过位置更新响应消息发送给家用基站的。 所述网络侧实体可以是是鉴权授权服务器、接入网关或移动性管理实体。 当所述网络侧实体是接入网关时， 所述接入网关还设置成： 对用户标识 信息进行保存； 当所述网络侧实体是移动性管理实体时， 所述移动性管理实 体还设置成： 对用户标识信息进行保存。 如果网络侧实体设置成向家用基站发送加密的真实的用户标识信息，则： 当所述网络侧实体是鉴权授权服务器时， 所述鉴权授权服务器还设置成： 加 密所述真实的用户标识信息； 当所述网络侧实体是接入网关时， 所述接入网 关还设置成： 对该加密的用户标识信息进行保存； 当所述网络侧实体是移动 性管理实体时， 所述移动性管理实体还设置成： 对该加密的用户标识信息进 行保存。 家用基站设置成： 接收所述网络侧实体发送的用户标识信息， 以及根据 所述用户标识信息进行接入控制操作。 如果网络侧实体设置成向家用基站发送加密的真实的用户标识信息， 则 所述家用基站还设置成： 接收所述网络侧实体发送的加密的真实用户标识信 息， 解密所述加密的真实的用户标识， 以及才艮据所述真实的用户标识信息进 行接入控制操作。 所述家用基站还设置成： 将获取真实用户标识的指示或者家用基站模式 经中间网元传送给网络侧实体； 网络侧实体还设置成： 当发现所述家用基站 需要获取真实的用户标识或发现家用基站为闭合或混合模式时， 在返回消息 中携带用户真实的标识信息； 或不进行任何判断， 直接在返回消息中携带用 户的真实标识。 本发明实施的支持用户接入控制的网络侧实体， 包括发送模块， 所述发送模块设置成： 向家用基站发送真实的用户标识信息， 以使家用 基站根据该用户标识信息对用户进行接入控制操作。 所述发送模块还可设置成：向家用基站发送加密的真实的用户标识信息。 本发明提到的用户标识信息均表示用户真实的身份标识， 如 NAI
( Network Access Identifier, 网络接入标 i只） 、 IMSI ( International Mobile Subscriber Identification Number, 国际移动客户识别码 )或 MAC ID ( Media Access Control ID, 介质访问控制标识 )或用户电话号码。 闭合模式下，接入控制操作指， 家用基站检查该用户是否存在于 CSG列 表中， 如果存在， 则允许用户接入， 否则拒绝用户接入； 混合模式下，接入控制操作指， 家用基站检查该用户是否存在于 CSG列 表中， 如果存在， 则告知接入网关该用户为 CSG用户， 如果不存在， 则告知 接入网关该用户为非 CSG用户。
本发明用户接入控制方法及系统中家用基站根据真实的用户标识信息对 用户进行接入控制操作， 可以提供用户标识正确性保障， 消除安全隐患， 减 轻家用基站的处理负担。 此外， 上述系统中真实用户标识信息在网络侧和家 用基站之间加密传送， 提高了传递真实用户标识信息的安全性。 显然， 本领域的技术人员应该明白， 上述的本发明的各模块或各步骤可 以用通用的计算装置来实现， 它们可以集中在单个的计算装置上， 或者分布 在多个计算装置所组成的网络上， 可选地， 它们可以用计算装置可执行的程 序代码来实现， 从而， 可以将它们存储在存储装置中由计算装置来执行， 或 者将它们分别制作成各个集成电路模块， 或者将它们中的多个模块或步骤制 作成单个集成电路模块来实现。 这样， 本发明不限制于任何特定的硬件和软 件结合。 以上所述仅为本发明的优选实施例而已， 并不用于限制本发明， 对于本 领域的技术人员来说， 本发明可以有各种更改和变化。 凡在本发明的精神和 原则之内， 所作的任何修改、 等同替换、 改进等， 均应包含在本发明的保护 范围之内。
工业实用性 本发明提供一种用户接入控制方法和系统， 家用基站根据真实的用户标 识信息对用户进行接入控制操作， 可以提供用户标识正确性保障， 消除安全 隐患， 减轻家用基站的处理负担。 此外， 上述系统中真实用户标识信息可以 在网络侧和家用基站之间加密传送，提高了传递真实用户标识信息的安全性。

Claims

权 利 要 求 书
1、 一种用户接入控制方法， 包括： 网络侧实体向家用基站发送真实的用户标识信息； 所述家用基站接收所述用户标识信息， 并根据该用户标识信息对用户进 行接入控制操作。
2、 如权利要求 1所述的方法， 其中： 在所述网络侧实体向家用基站发送真实的用户标识信息前， 所述方法还 包括： 所述家用基站将获取真实用户标识的指示或者家用基站模式经中间网 元传送给网络侧实体； 在网络侧实体向家用基站发送真实的用户标识信息的步骤中， 网络侧实 体发现所述家用基站需要获取真实的用户标识或发现家用基站为闭合或混合 模式时， 在返回消息中携带用户真实的标识信息； 或网络侧实体不进行任何 判断， 直接在返回消息中携带用户的真实标识。
3、 如权利要求 1所述的方法， 其中： 所述网络侧实体是鉴权授权服务器， 在网络侧实体向家用基站发送真实 的用户标识信息的步骤中， 所述鉴权授权服务器在接入过程的鉴权流程中利 用鉴权响应消息将所述用户标识信息发送给家用基站， 所述鉴权响应消息由 所述鉴权授权服务器经过接入网关， 或经过移动性管理实体和家用基站网关 发送给所述家用基站； 或， 所述网络侧实体是接入网关的锚定鉴权方功能实体， 在网络侧实体向家 用基站发送真实的用户标识信息的步骤中 ,锚定鉴权方在位置更新的流程中 , 经过寻呼控制器、 锚定寻呼控制器通过位置更新响应消息将所述用户标识信 息发送给家用基站； 或， 所述网络侧实体是接入网关， 在网络侧实体向家用基站发送真实的用户 标识信息的步骤中， 所述接入网关通过密钥改变指示消息或鉴权结果消息将 所述用户标识信息发送给所述家用基站； 或， 所述网络侧实体是移动性管理实体。
4、 如权利要求 1所述的方法， 其中： 在网络侧实体向家用基站发送真实的用户标识信息的步骤中， 网络侧实 体向家用基站发送加密的真实的用户标识信息； 在家用基站接收所述用户标识信息，对用户进行接入控制操作的步骤中， 所述家用基站接收所述加密的真实的用户标识信息后解密所述信息， 并根据 所述真实的用户标识信息对用户进行接入控制操作。
5、 如权利要求 1至 4中任一项所述的方法， 其中： 闭合模式下， 所述接入控制操作指， 家用基站检查该用户是否存在于闭 合用户组 CSG列表中， 如果存在， 则允许用户接入， 否则拒绝用户接入； 混合模式下， 所述接入控制操作指， 家用基站检查该用户是否存在于 CSG列表中， 如果存在， 则告知接入网关该用户为 CSG用户， 如果不存在， 则告知接入网关该用户为非 CSG用户。
6、 如权利要求 1至 4中任一项所述的方法， 其中： 所述用户标识信息是如下信息中的一种或多种： 网络接入标识 NAI、 国 际移动客户识别码 IMSI、 介质访问控制标识 MAC ID、 用户电话号码。
7、一种用户接入控制系统，该系统包括网络侧实体及与网络侧实体连接 的家用基站， 其中： 所述网络侧实体设置成： 向家用基站发送真实的用户标识信息； 所述家用基站设置成： 接收所述网络侧实体发送的用户标识信息， 以及 根据所述用户标识信息进行接入控制操作。
8、 如权利要求 7所述系统， 其中: 所述网络侧实体是鉴权授权服务器、 接入网关或移动性管理实体， 当所述网络侧实体是接入网关时， 所述接入网关还设置成： 对用户标识 信息进行保存； 当所述网络侧实体是移动性管理实体时，所述移动性管理实体还设置成： 对用户标识信息进行保存。
9、 如权利要求 7所述的系统， 其中： 所述家用基站还设置成： 将获取真实用户标识的指示或者家用基站模式 经中间网元传送给网络侧实体； 网络侧实体还设置成： 当发现所述家用基站需要获取真实的用户标识或 发现家用基站为闭合或混合模式时，在返回消息中携带用户真实的标识信息； 或不进行任何判断， 直接在返回消息中携带用户的真实标识。
10、 如权利要求 7所述系统， 其中： 所述网络侧实体还设置成：向家用基站发送加密的真实的用户标识信息； 所述家用基站还设置成： 接收所述网络侧实体发送的加密的真实的用户 标识信息， 解密所述加密的真实的用户标识， 以及才艮据所述真实的用户标识 信息进行接入控制操作。
11、 如权利要求 10所述系统， 其中： 所述网络侧实体是鉴权授权服务器、 接入网关或移动性管理实体， 当所述网络侧实体是鉴权授权服务器时，所述鉴权授权服务器还设置成： 加密所述真实的用户标识信息； 当所述网络侧实体是接入网关时， 所述接入网关还设置成： 对所述加密 的用户标识信息进行保存； 当所述网络侧实体是移动性管理实体时，所述移动性管理实体还设置成： 对所述加密的用户标识信息进行保存。
12、 如权利要求 7至 11中任一项所述的系统， 其中： 闭合模式下， 所述接入控制操作指， 家用基站检查该用户是否存在于闭 合用户组 CSG列表中， 如果存在， 则允许用户接入， 否则拒绝用户接入； 混合模式下， 所述接入控制操作指， 家用基站检查该用户是否存在于 CSG列表中， 如果存在， 则告知接入网关该用户为 CSG用户， 如果不存在， 则告知接入网关该用户为非 CSG用户。
13、 如权利要求 7至 11中任一项所述的系统， 其中： 所述用户标识信息如下信息中的一种或多种： 网络接入标识 NAI、 国际 移动客户识别码 IMSI、 介质访问控制标识 MAC ID、 用户电话号码。
14、 一种支持用户接入控制的网络侧实体， 包括发送模块， 所述发送模块设置成： 向家用基站发送真实的用户标识信息， 以使家用 基站根据该用户标识信息对用户进行接入控制操作。
15、 如权利要求 14所述的网络侧实体， 其中： 所述发送模块还设置成： 向家用基站发送加密的真实的用户标识信息。
PCT/CN2010/071934 2009-04-29 2010-04-20 用户接入控制方法和系统 WO2010124569A1 (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN200910138305 2009-04-29
CN200910138305.8 2009-04-29
CN200910204530.7 2009-10-02
CN2009102045307A CN101877852B (zh) 2009-04-29 2009-10-02 用户接入控制方法和系统

Publications (1)

Publication Number Publication Date
WO2010124569A1 true WO2010124569A1 (zh) 2010-11-04

Family

ID=43020295

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2010/071934 WO2010124569A1 (zh) 2009-04-29 2010-04-20 用户接入控制方法和系统

Country Status (2)

Country Link
CN (1) CN101877852B (zh)
WO (1) WO2010124569A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106714157A (zh) * 2015-08-12 2017-05-24 中国电信股份有限公司 鉴权方法、宏基站、移动管理实体及系统
CN111918291A (zh) * 2020-09-02 2020-11-10 中国联合网络通信集团有限公司 一种接入方法及装置

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103249044B (zh) * 2012-02-14 2016-03-30 中国移动通信集团公司 一种终端通过MiFi接入自有业务的方法、系统和装置
US8874103B2 (en) 2012-05-11 2014-10-28 Intel Corporation Determining proximity of user equipment for device-to-device communication
TWI573484B (zh) * 2012-05-11 2017-03-01 英特爾股份有限公司 藉由機器型通信使用者設備用於由演進型節點b提供之無線單元的選擇性連接

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1331524A (zh) * 2000-06-29 2002-01-16 重庆邮电学院 码分多址系统中的混沌扩频地址码方法
CN101047954A (zh) * 2006-03-28 2007-10-03 中兴通讯股份有限公司 一种phs网络中呼叫建立请求的方法
CN101400106A (zh) * 2007-09-27 2009-04-01 华为技术有限公司 一种家用基站接入控制的方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1331524A (zh) * 2000-06-29 2002-01-16 重庆邮电学院 码分多址系统中的混沌扩频地址码方法
CN101047954A (zh) * 2006-03-28 2007-10-03 中兴通讯股份有限公司 一种phs网络中呼叫建立请求的方法
CN101400106A (zh) * 2007-09-27 2009-04-01 华为技术有限公司 一种家用基站接入控制的方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106714157A (zh) * 2015-08-12 2017-05-24 中国电信股份有限公司 鉴权方法、宏基站、移动管理实体及系统
CN106714157B (zh) * 2015-08-12 2020-02-07 中国电信股份有限公司 鉴权方法、宏基站、移动管理实体及系统
CN111918291A (zh) * 2020-09-02 2020-11-10 中国联合网络通信集团有限公司 一种接入方法及装置
CN111918291B (zh) * 2020-09-02 2022-08-12 中国联合网络通信集团有限公司 一种接入方法及装置

Also Published As

Publication number Publication date
CN101877852B (zh) 2013-08-07
CN101877852A (zh) 2010-11-03

Similar Documents

Publication Publication Date Title
Cao et al. A survey on security aspects for 3GPP 5G networks
KR102345932B1 (ko) 네트워크 보안 관리 방법 및 장치
AU2005236981B2 (en) Improved subscriber authentication for unlicensed mobile access signaling
JP4864094B2 (ja) 通信制御システム
CN102111766B (zh) 网络接入方法、装置及系统
KR101068424B1 (ko) 통신시스템을 위한 상호동작 기능
US8509440B2 (en) PANA for roaming Wi-Fi access in fixed network architectures
US8611859B2 (en) System and method for providing secure network access in fixed mobile converged telecommunications networks
JP6512111B2 (ja) 通信システム、ネットワーク及びｕｅ並びにそれらの通信方法
KR101002799B1 (ko) 이동통신 네트워크 및 상기 이동통신 네트워크에서 이동 노드의 인증을 수행하는 방법 및 장치
JP2016530733A (ja) プロキシミティベースサービス通信に関するセキュアディスカバリ
JP2016526805A (ja) セキュアシステム、及び、セキュア通信を行う方法
KR102119586B1 (ko) 통신 네트워크를 통해 데이터를 릴레이하는 시스템 및 방법
CN101336000B (zh) 协议配置选项传输方法及系统、用户终端
WO2008125062A1 (fr) Procédé de détermination d'admission et de radiomessagerie d'utilisateur dans un système de communication mobile, système et dispositif apparentés
WO2022067841A1 (zh) 一种安全通信方法、装置及系统
CN102223634A (zh) 一种用户终端接入互联网方式的控制方法及装置
WO2010130118A1 (zh) 一种对家用基站用户实施鉴权的系统及方法
WO2014183535A1 (zh) 一种用于mtc设备组的小数据安全传输方法和系统
JP2005534265A (ja) ワイヤレスローカルネットワークをｕｍｔｓ端末局に接続するための方法およびデータシステム
WO2010124569A1 (zh) 用户接入控制方法和系统
WO2022175538A1 (en) A method for operating a cellular network
WO2006079953A1 (en) Authentication method and device for use in wireless communication system
JP6861285B2 (ja) 緊急アクセス中のパラメータ交換のための方法およびデバイス
WO2010124608A1 (zh) 紧急业务的实现方法及家用基站

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10769258

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 10769258

Country of ref document: EP

Kind code of ref document: A1