WO2011029296A1 - 向机器到机器设备提供机器通信身份模块的系统及方法 - Google Patents

向机器到机器设备提供机器通信身份模块的系统及方法 Download PDF

Info

Publication number
WO2011029296A1
WO2011029296A1 PCT/CN2010/071216 CN2010071216W WO2011029296A1 WO 2011029296 A1 WO2011029296 A1 WO 2011029296A1 CN 2010071216 W CN2010071216 W CN 2010071216W WO 2011029296 A1 WO2011029296 A1 WO 2011029296A1
Authority
WO
WIPO (PCT)
Prior art keywords
m2me
operator
network operator
uicc
registration
Prior art date
Application number
PCT/CN2010/071216
Other languages
English (en)
French (fr)
Inventor
余万涛
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2011029296A1 publication Critical patent/WO2011029296A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/35—Protecting application or service provisioning, e.g. securing SIM application provisioning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Definitions

  • the present invention relates to a machine to machine (M2M) communication technology, and in particular to a machine to a machine (Machine to Machine Equipmen, M2ME) providing a Machine Communication Identity Module (MCIM). System and method.
  • M2M machine to machine
  • M2ME Machine to Machine Equipmen
  • MCIM Machine Communication Identity Module
  • M2M communication is a general term for a series of technologies and combinations that implement wireless communication technology to realize data communication and communication between machines and machines, machines and people.
  • M2M has two meanings: The first layer is the machine itself, which is called smart device in the embedded field.
  • the second layer means the connection between the machine and the machine, connecting the machines together through the network.
  • Machine-based communication is used in a wide range of applications, such as intelligent measurement, remote monitoring, tracking, medical, etc., to make human life more intelligent.
  • M2M equipment M2M equipment (M2ME) has a large number of applications and a wide range of applications, which has great market prospects.
  • M2M In M2M communication, the main long-distance connection technologies include GSM/GPRS/UMTS, and the short-distance connection technologies mainly include 802.1 lb/g, Bluetooth, Zigbee, and RFID.
  • M2M is a device-oriented service. Because M2M integrates wireless communication and information technology, it can be used for two-way communication, such as collecting information, setting parameters and sending commands over long distances, thus enabling different application scenarios, such as security monitoring, vending, Cargo tracking, etc. Almost all the equipment involved in daily life is likely to become a potential customer. M2M provides a simple means of establishing real-time data between devices, between remote devices, or with individuals.
  • a MCIM application refers to a group of M2M security data and functions that are connected to a 3GPP network (which may also be an IMS network).
  • the MCIM can be located on the UICC (Universal Integrated Circuit Card) or in a TRE.
  • UICC Universal Integrated Circuit Card
  • TRE refers to the Trusted environment provided by M2ME.
  • a TRE can be authenticated by an authorized external agent whenever needed.
  • the MCIM can be installed in the TRE, and the M2ME provides hardware and software protection and isolation for the MCIM through the TRE.
  • M2ME provides M2M services in two ways: based on UICC or based on TRE functional entities.
  • the UICC determines the home network operator after the release
  • the initial provision of the MCIM to the UICC is a problem to be solved.
  • the operator can be changed by changing the IMSI (International Mobile Subscriber Identity) so that M2ME can be easily managed.
  • IMSI International Mobile Subscriber Identity
  • this solution involves the transmission of IMSI between different mobile operator networks, thereby increasing the security risk of M2ME subscription data.
  • UICC may interrupt the connection with any operator.
  • the technical problem to be solved by the present invention is to provide a system and method for providing MCIM to M2ME, which can provide MCIM remotely for M2ME and ensure secure storage of MCIM.
  • the present invention provides a method for providing a Machine Communication Identity Module (MCIM) to a Machine to Machine (M2ME), comprising:
  • the M2ME establishes a connection with the visited network operator through a trusted environment (TRE) unit on the Universal Integrated Circuit Card (UICC), and establishes a connection with the registered operator through the IP connection provided by the visited network operator, the registration
  • TRE trusted environment
  • UICC Universal Integrated Circuit Card
  • the UICC is located on the M2ME, and the TRE unit is located on the UICC.
  • the step of establishing a connection between the M2ME and the visited network operator by using the TRE unit on the UICC, and establishing a connection with the registration operator by using the IP connection provided by the visited network operator includes:
  • the M2ME sends an attach message to the visited network operator through the TRE unit on the UICC, and carries the temporary connection identity of the M2ME, and the visited network operator receives the temporary connection identity of the M2ME and connects to the registration operator, and connects to the registered carrier.
  • the temporary connection identity is sent to the registration operator, and the registration operator generates a set of authentication vectors according to the temporary connection identity, and returns the generated authentication vector to the visited network operator, where the visited network operator
  • the authentication vector is used to authenticate with the M2ME.
  • the M2ME is assigned an IP address.
  • the M2ME then connects to the registered carrier through the TRE unit on the UICC using the IP connection provided by the visited network provider.
  • the method further includes: sending, by the M2ME, the home network operator information selected by the subscription user to the registration operator;
  • the registration operator In the step of the registration operator discovering the home network operator of the M2ME, the registration operator discovers the home network operator of the M2ME according to the home network operator information, and registers with the home network operator at the home network operator. Said M2ME.
  • the method further includes: The business request platform verification authority authenticates the M2ME.
  • the present invention provides a system for providing a Machine Communication Identity Module (MCIM) to a Machine to Machine (M2ME), including an M2ME, a visited network operator, a registered carrier, a home network operator, and a platform authentication authority. Center; where:
  • the M2ME includes a universal integrated circuit card (UICC), and the UICC includes a trusted environment TRE unit;
  • UICC universal integrated circuit card
  • the M2ME establishes a connection with the visited network operator through the TRE unit on the UICC, and establishes a connection with the registration operator by visiting the IP connection provided by the network operator, and also installs the downloaded MCIM to the UICC;
  • the visited network operator provides an IP connection to the registered operator for the M2ME after establishing a connection with the M2ME;
  • the registration operator After the connection with the M2ME, the registration operator discovers the home network operator of the M2ME; and after the platform verification authorization center successfully authenticates the M2ME, the MCIM is downloaded to the M2ME by the authorization of the home network operator;
  • the platform verifies the authorization center to verify the M2ME.
  • the M2ME also sends an attach message to the visited network operator through the TRE unit on the UICC, where the M2ME carries the temporary connection identity identifier; and the M2ME also uses the TRE unit on the UICC to use the visited network operator.
  • the IP connection is connected to the registration operator; the visited network operator also connects to the registration operator after receiving the temporary connection identity of the M2ME, and sends the temporary connection identity to the registration operator; and receives the registration operation.
  • the M2ME is authenticated after a set of authentication vectors returned by the quotient, and the IP address is assigned to the M2ME after the authentication succeeds;
  • the registration operator also generates a set of authentication vectors after receiving the temporary connection identity, and returns the generated authentication vector to the visited network operator.
  • the system can also have the following features:
  • the home network operator information selected by the subscription user is sent to the registration operator;
  • the registration operator also discovers the home network operator according to the home network operator information, and registers the M2ME with the home network operator.
  • the system can also have the following features:
  • the home network operator After the M2ME registers with the home network operator, the home network operator requests the platform verification authorization center to verify the M2ME;
  • the platform verification authority further verifies the authenticity and integrity of the M2ME after receiving the authentication request, and returns the authentication result to the home network operator.
  • the present invention provides a system and method for providing MCIM to M2ME, which can combine the function of TRE on M2ME with the security of UICC, and ensure remote provision and secure storage of MCIM.
  • FIG. 1 is a schematic diagram of an M2ME architecture based on UICC (TRE on UICC) according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of a UICC-based M2M system architecture according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of remote initial provision of MCIM according to an embodiment of the present invention. Preferred embodiment of the invention
  • the present invention proposes a system and method for providing MCIM to M2ME.
  • M2ME combines the initial connection provided by the TRE unit on the M2ME and the high security of the UICC to provide the MCIM remotely to the M2ME and ensure the security of the MCIM.
  • FIG. 1 is a schematic diagram of a UICC-based M2ME architecture according to the present invention.
  • the UICC is located in the M2ME, and the UICC includes a TRE unit.
  • This embodiment provides a system for providing MCIM to an M2ME.
  • the system includes an M2ME, a Visited Network Operator (VNO), a Register Operator (RO, a Registration Operator), and a home network operator.
  • VNO Visited Network Operator
  • RO Register Operator
  • SHO Selected Home Operator and Platform Validation Authority
  • M2ME includes UICC, that is, UICC is located on M2ME;
  • UICC includes TRE unit, that is, TRE function is integrated on UICC.
  • the M2ME uses the Provisional Connectivity Identity (PICD) as its private identifier, and the PCID for the M2ME registration to the 3GPP network unrelated to the future selected home carrier is installed in the TRE on the UICC.
  • the format of the PCID is the same as the IMSI.
  • TRE refers to the trusted environment provided by M2ME, which provides protection and isolation for the provision, storage, execution and management of MCIM, integrates the functions of TRE into UICC, and enhances the security of TRE unit through UICC.
  • the secure storage, retrieval and use of PCID is implemented by the TRE unit.
  • the TRE unit on the UICC can be authenticated by an authorized external agent when needed.
  • the M2ME establishes a connection with the visited network operator through the TRE unit on the UICC, and establishes a connection with the registered operator by visiting the connection provided by the network operator, and also installs the downloaded MCIM to the UICC;
  • the registration operator after the M2ME connects to the registration operator, discovers the home network operator of the M2ME; and after the platform verification authorization center successfully authenticates the M2ME, the MCIM is downloaded to the M2ME by the authorization of the home network operator; specifically,
  • the registered carrier includes the MCIM Download and Provisioning Function (DPF, MCIM Download and Provisioning Function), the Discovery and Registration Function (DRF), and the Initial Connectivity Function (ICF); that is: the registered carrier's
  • the ICF receives the attach message sent by the M2ME and establishes a connection with the M2ME; the DPF of the registered carrier downloads the MCIM to the M2ME.
  • the M2ME establishes a connection with the visited network operator through the TRE unit on the UICC.
  • the M2ME sends an attach message to the visited network operator through the TRE unit on the UICC, which carries the M2ME's Provisional Connectivity Identity (PICD); PCID
  • PICD Provisional Connectivity Identity
  • the visiting network operator also connects to the registration operation after receiving the temporary connection identity of the M2ME. And send the temporary connection identity to the registration operator; and receive a set of authentication vectors returned by the registry operator to authenticate with the M2ME, and also assign an IP address to the M2ME after the authentication succeeds; the registry operator is still receiving Temporarily connecting an identity identifier to generate a set of authentication vectors, and returning the generated authentication vector to the visited network operator;
  • the M2ME connects to the registered carrier through the TRE unit on the UICC using the IP connection provided by the visited network operator.
  • the home network operator information selected by the subscription user is sent to the registration operator;
  • the registration operator also discovers the home network operator according to the home network operator information, and registers the M2ME with the home network operator; the registration operator helps the M2ME to discover its home network operator or DRF for the M2ME to discover its home network through the DRF. Operator.
  • the home network operator After the M2ME is registered with the home network operator, the home network operator requests the platform to verify the authorization center to verify the M2ME, and after the verification succeeds, notifies the registration operator to verify the M2ME successfully, and authorizes the registration operator to provide the MCIM to the M2ME;
  • the registry operator downloads the MCIM to the M2ME upon receipt of the authorization notice.
  • the platform verification authority authenticates the M2ME; the platform verification authority verifies the authenticity and integrity of the M2ME after receiving the authentication request, and the platform verification authority returns the authentication result to the home network operator.
  • the MCIM refers to the USIM/ISIM.
  • the USIM/ISIM For convenience of description, in the present invention, for M2ME, whether or not the MCIM is located on the UICC, only the MCIM is used for description, and the USIM/ISIM is not described.
  • the embodiment provides a method for providing MCIM to the M2ME.
  • the UICC integrated with the TRE unit is located on the M2ME.
  • MCIM machine communication identity module
  • the M2ME subscriber is selected by the M2ME subscriber, and then the M2ME establishes an IP connection with the RO through the TRE, and the RO registers the M2ME with the SHO.
  • the authorized RO provides the MCIM to the M2ME.
  • the M2ME downloads the MCIM, it supplies the MCIM to the UICC.
  • the specific supply process includes Next steps:
  • Step 301 The M2ME decodes the network information through standard GSM/UMTS principles and attaches to any VNO.
  • the M2ME establishes an initial connection with the visited network operator through the UICC, that is, the UICC sends an attach message to the VNO, which carries a temporary connection identity (PCID) of the M2ME; that is, through the TRE unit on the UICC. Realize the connection with the visiting network operator.
  • PCID temporary connection identity
  • Step 302 After receiving the PCID of the M2ME, the VNO establishes a connection with the RO and sends the PCID to the RO (ICF function).
  • the RO can be located at the VNO.
  • Step 303 After receiving the PCID of the M2ME, the RO (ICF function) generates a set of authentication vectors (AVs) for the PCID.
  • AVs authentication vectors
  • Step 304 The RO sends the generated authentication vector (AVs) to the VNO.
  • Step 305 The VNO uses the authentication vector to authenticate the PCID/M2ME, which may be, but is not limited to, AKA (Authentication and Key Agreement) authentication.
  • AKA Authentication and Key Agreement
  • Step 306 After the authentication succeeds, the VNO provides the M2ME with an IP connection to the RO, that is, assigns an IP address to the M2ME, and sends the assigned IP address to the M2ME.
  • Step 307 The M2ME is connected to the RO through an IP connection provided by the VNO network.
  • Step 308 The RO helps the M2ME discover its SHO, or the RO itself discovers its SHO for the M2ME.
  • the RO needs to know the SHO of the M2ME before discovering the SHO of the M2ME.
  • the M2ME may send the information of the SHO selected by the signing user to the RO after establishing the connection with the RO (the information of the SHO may be the name of the SHO, etc.) .
  • SHO's discovery process can be, but is not limited to, using OMA (Open Mobile Alliance) BOOTSTRAP (Bootstrap Protocol).
  • Step 309 The RO connects to the SHO and registers the M2ME to be connected to the SHO network at the SHO.
  • Step 310 The SHO requests the PVA (or the SHO to request the PVA through the RO) to verify the authenticity and integrity of the M2ME.
  • the SHO requests the PVA through the RO.
  • the SHO notifies the RO to verify the M2ME.
  • the RO After receiving the notification, the RO requests the PVA to verify the authenticity and integrity of the M2ME.
  • Step 311 The PVA verifies the authenticity and integrity of the M2ME.
  • Step 312 The PVA sends the verification result to the SHO.
  • Step 313 If the verification is successful, the SHO contacts the RO (DPF function) and authorizes the RO (DPF function) to provide the MCIM to the M2ME.
  • Step 314 RO (DPF function) Download MCIM to M2ME.
  • Step 315 The M2ME installs the downloaded MCIM to the UICC.
  • Step 316 The M2ME reports the MCIM success/failure status information to the RO (DPF function).
  • Step 317 The RO (DPF function) reports the MCIM success/failure status information to the SHO.
  • the invention provides a system and a method for providing a machine communication identity module to a machine to a machine device, which can combine the function of the TRE on the M2ME with the security of the UICC, and ensure the remote provision and secure storage of the MCIM. .

Abstract

本发明公开了一种向机器到机器设备提供机器通信身份模块的系统及方法，所述方法包括：所述M2ME通过UICC上的 TRE单元与拜访网络运营商建立连接，并通过所述拜访网络运营商提供的IP连接与注册运营商建立连接，所述注册运营商发现所述M2ME的归属网络运营商，当平台验证授权中心对所述M2ME进行验证成功后，所述归属网络运营商授权所述注册运营商将MCIM下载到所述M2ME，所述M2ME将下载的MCIM安装至所述UICC；其中，所述UICC位于M2ME上， 所述TRE单元位于UICC上。本发明可实现将M2ME上的TRE的功能与UICC的安全性很好的结合在一起，保证了MCIM的远程提供和安全存储。

Description

向机器到机器设备提供机器通信身份模块的系统及方法
技术领域
本发明涉及机器到机器（M2M, Machine to Machine )的通讯技术， 特别 地， 涉及一种向机器到机器设备（Machine to Machine Equipmen, M2ME )提 供机器通信身份模块（ Machine Communication Identity Module , MCIM ) 的 系统及方法。
背景技术
M2M通信是指应用无线通信技术， 实现机器与机器、机器与人之间的数 据通信和交流的一系列技术及其组合的总称。 M2M有两层含义： 第一层是机 器本身， 在嵌入式领域称为智能设备。 第二层意思是机器和机器之间的连接， 通过网络把机器连接在一起。 机器类通信的应用范围非常广泛， 例如智能测 量、 远程监控、 跟踪、 医疗等， 使人类生活更加智能化。 与传统的人与人之 间的通信相比， M2M设备 ( M2ME )数量巨大， 应用领域广泛， 具有巨大的 市场前景。
在 M2M通信中， 主要的远距离连接技术包括 GSM/GPRS/UMTS, 近距 离连接技术主要有 802.1 lb/g、 蓝牙、 Zigbee、 RFID等。 M2M属于针对设备 的业务， 由于 M2M整合了无线通信和信息技术， 可用于双向通信， 如远距 离收集信息、 设置参数和发送指令， 因此可实现不同的应用方案， 如安全监 测、 自动售货、 货物跟踪等。 几乎所有日常生活中涉及到的设备都有可能成 为潜在的服务对象。 M2M提供了设备实时数据在系统之间、 远程设备之间、 或与个人之间建立无线连接的简单手段。
M2M通信的一个挑战是部署的 M2M设备的远程安全管理。 为此， 需要 解决如何为 M2ME远程提供签约数据即 MCIM(机器通信身份模块， Machine Communication Identity Module ) , 并防止 MCIM在供应过程中被攻击者获得 并使用。 MCIM应用是指一组为接入 3GPP 网络（也可以是 IMS 网络） 的 M2M安全数据和功能。 MCIM可以位于 UICC (通用集成电路卡）上， 也可 以位于一个 TRE中。当 MCIM位于 UICC上时， MCIM即是指 USIM或 ISIM。 TRE是指 M2ME提供的可信环境（The Trusted environment ) , 一个 TRE可 以在任何需要的时候被授权的外部代理验证。 MCIM 可以安装在 TRE 中， M2ME通过 TRE为 MCIM提供软硬件保护和隔离。
目前， M2ME提供 M2M服务通常釆用两种方式：基于 UICC或基于 TRE 功能实体。
当 M2ME基于 UICC来提供 M2M服务时， 如何远程提供签约数据， 即 远程提供 MCIM给 UICC, ^^于 UICC的 M2ME需要解决的一个问题。
目前， 已经有的基于 UICC的 M2ME在提供 M2M服务时， 有两种解决 方案。 一种是不能改变远程提供和签约数据的 UICC解决方案， 另一种是可 以改变签约数据的基于 UICC的解决方案。 前一种解决方案可以很方便的为 M2ME提供 M2M服务， 但是， 当 M2M服务签约用户想改变 M2M服务的运 营商时， 必须更换 UICC, 这使得 M2M设备的维护非常困难， 即使可能， 也 是代价高昂， 因此这种方法无法实现对 M2M设备的 MCIM的远程管理。 第 二种方案， 当 UICC发布时就确定归属网络运营商的话， 不存在 MCIM的初 始提供问题， 但当 UICC 在发布后再确定归属网络运营商的话， 初始提供 MCIM给 UICC是需要解决的问题。 另外通过改变 IMSI ( International Mobile Subscriber Identity, 国际移动用户识别码）的方式来改变运营商， 这样可以方 便地管理 M2ME。 但这种方案涉及 IMSI在不同移动运营商网络之间的传递， 从而增加了 M2ME签约数据的安全风险。 同时在改变 IMSI的过程中， UICC 可能中断与任何运营商的连接。
对于 MCIM远程提供给 M2ME上的 TRE的情形， 已经有解决方案。 在 基于 TRE的 MCIM远程提供方案中， 通过 TRE提供的初始连接， 将远程提 供的 MCIM安装在 TRE中。 这个方案的缺点是 MCIM的保护有赖于 TRE的 安全性， 由于 TRE是 M2ME上实现， 使得 TRE的安全性比 UICC要低。 因 此 MCIM在 TRE中的安全性并不高。
发明内容
本发明要解决的技术问题是提供一种向 M2ME提供 MCIM的系统及方 法， 可实现为 M2ME远程提供 MCIM , 并保证了 MCIM的安全存储。 为了解决上述技术问题， 本发明提供一种向机器到机器设备 ( M2ME ) 提供机器通信身份模块（MCIM ) 的方法， 包括：
所述 M2ME通过通用集成电路卡（ UICC )上的可信环境（ TRE )单元与 拜访网络运营商建立连接， 并通过所述拜访网络运营商提供的 IP连接与注册 运营商建立连接， 所述注册运营商发现所述 M2ME的归属网络运营商， 当平 台验证授权中心对所述 M2ME进行验证成功后， 所述归属网络运营商授权所 述注册运营商将 MCIM下载到所述 M2ME, 所述 M2ME将下载的 MCIM安 装至所述 UICC;
其中， 所述 UICC位于 M2ME上， 所述 TRE单元位于 UICC上。
所述方法还可具有以下特点：
所述 M2ME通过 UICC上的 TRE单元与拜访网络运营商建立连接，并通 过所述拜访网络运营商提供的 IP连接与注册运营商建立连接的步骤包括：
M2ME通过 UICC上的 TRE单元向拜访网络运营商发送附着消息，携带 所述 M2ME的临时连接身份标识， 所述拜访网络运营商收到 M2ME的临时 连接身份标识后连接到注册运营商， 并将所述临时连接身份标识发送至注册 运营商， 所述注册运营商根据所述临时连接身份标识生成一组认证向量， 并 将生成的所述认证向量返回至拜访网络运营商， 所述拜访网络运营商使用认 证向量与 M2ME进行认证， 认证成功后为 M2ME分配 IP地址， 之后所述 M2ME通过 UICC上的 TRE单元使用拜访网络提供商提供的 IP连接与注册 运营商连接。
所述方法还可具有以下特点：
在所述 M2ME与注册运营商建立连接的步骤之后，还包括： 所述 M2ME 将签约用户选择的归属网络运营商信息发送至注册运营商；
在所述注册运营商发现所述 M2ME的归属网络运营商的步骤中， 所述注 册运营商根据归属网络运营商信息发现所述 M2ME的归属网络运营商， 并在 所述归属网络运营商注册所述 M2ME。
所述方法还可具有以下特点：
在所述归属网络运营商注册所述 M2ME之后， 还包括： 所述归属网络运 营商请求平台验证授权中心对所述 M2ME进行验证。
为了解决上述技术问题， 本发明提供一种向机器到机器设备 ( M2ME ) 提供机器通信身份模块（MCIM ) 的系统， 包括 M2ME、 拜访网络运营商、 注册运营商、 归属网络运营商及平台验证授权中心； 其中：
所述 M2ME包括通用集成电路卡（UICC ) , 所述 UICC包括可信环境 TRE单元；
所述 M2ME通过 UICC上的 TRE单元与拜访网络运营商建立连接，以及 通过拜访网络运营商提供的 IP 连接与注册运营商建立连接， 还将下载的 MCIM安装至所述 UICC;
所述拜访网络运营商， 在与所述 M2ME建立连接后为 M2ME提供到注 册运营商的 IP连接；
所述注册运营商， 在与所述 M2ME连接后， 发现 M2ME的归属网络运 营商； 以及当平台验证授权中心对 M2ME验证成功后， 经所述归属网络运营 商的授权， 向 M2ME下载 MCIM;
所述平台验证授权中心 , 对所述 M2ME进行验证。
所述系统还可具有以下特点：
所述 M2ME还在通过 UICC上的 TRE单元向所述拜访网络运营商发送附 着消息， 其中携带所述 M2ME 的临时连接身份标识； 以及， M2ME还通过 UICC上的 TRE单元使用拜访网络运营商提供的 IP连接与注册运营商连接； 所述拜访网络运营商还在收到 M2ME的临时连接身份标识后连接到注册 运营商， 并将所述临时连接身份标识发送至注册运营商； 以及收到注册运营 商返回的一组认证向量后与 M2ME进行认证， 还在认证成功后为 M2ME分 配 IP地址；
所述注册运营商还在收到临时连接身份标识后生成一组认证向量， 并将 生成的所述认证向量返回至拜访网络运营商。
所述系统还可具有以下特点：
所述 M2ME还在连接至注册运营商后，将签约用户选择的归属网络运营 商信息发送至注册运营商； 所述注册运营商还根据归属网络运营商信息发现该归属网络运营商， 并 在所述归属网络运营商注册所述 M2ME。
所述系统还可具有以下特点：
所述归属网络运营商还在所述 M2ME注册到归属网络运营商后，请求平 台验证授权中心对 M2ME进行验证；
所述平台验证授权中心还在收到所述认证请求后验证所述 M2ME的真实 性和完整性， 以及， 还将认证结果返回至归属网络运营商。
综上所述，本发明提供了一种向 M2ME提供 MCIM的系统及方法，可实 现将 M2ME上的 TRE的功能与 UICC的安全性很好的结合在一起， 保证了 MCIM的远程提供和安全存储。 附图概述
图 1本发明实施例的基于 UICC ( TRE在 UICC上 ) 的 M2ME架构示意 图；
图 2 本发明实施例的基于 UICC的 M2M系统架构示意图；
图 3 本发明实施例的远程初始提供 MCIM的流程示意图。 本发明的较佳实施方式
本发明提出了一种向 M2ME提供 MCIM 的系统及方法， M2ME结合 M2ME上的 TRE单元提供的初始连接和 UICC的高安全性，来实现将 MCIM 远程提供给 M2ME , 并保证 MCIM的安全性。
图 1是根据本发明的基于 UICC的 M2ME架构示意图， UICC位于 M2ME, UICC包括 TRE单元。
本实施例提供一种向 M2ME提供 MCIM的系统，如图 2所示，该系统包 括 M2ME、 拜访网络运营商 （VNO, Visited Network Operator ) 、 注册运营 商 （RO , Registration Operator ) 、 归属网络运营商 （ SHO , Selected Home Operator )及平台验证授权中心 （PVA, Platform Validation Authority ) ； 其中， M2ME包括 UICC, 即 UICC位于 M2ME上； UICC包括 TRE单 元， 即 UICC 上集成有 TRE 功能。 M2ME 以临时连接身份标识（PICD, Provisional Connectivity Identity )作为其私有标识， 用于 M2ME注册到与将来 选择的归属运营商无关的 3GPP网络的 PCID安装在 UICC上的 TRE中。 PCID 的格式与 IMSI相同。
TRE是指 M2ME提供的可信环境， 其为供应、 存储、 执行和管理 MCIM 提供了保护和隔离， 将 TRE的功能集成在 UICC, 可以通过 UICC使得 TRE 单元的安全性得到增强。 PCID的安全存储、 检索和使用都由 TRE单元实现。 UICC上的 TRE单元可以在需要的时候被授权的外部代理验证。
M2ME通过 UICC上的 TRE单元与拜访网络运营商建立连接 , 以及通过 拜访网络运营商提供的连接与注册运营商建立连接， 还将下载的 MCIM安装 至 UICC;
拜访网络运营商， 在与 M2ME建立连接后， 为 M2ME提供到注册运营 商的连接；
注册运营商， 在 M2ME连接到注册运营商后发现 M2ME的归属网络运 营商； 以及当平台验证授权中心对 M2ME验证成功后， 经所述归属网络运营 商的授权， 向 M2ME下载 MCIM; 具体地，
注册运营商包括 MCIM的下载和提供功能（ DPF , MCIM Download and Provisioning Function ) 、 发现和注册功能 ( DRF, Discovery and Registration Function )及初始连接功能 ( ICF, Initial Connectivity Function )； 即： 注册运 营商的 ICF接收 M2ME发来的附着消息并与 M2ME建立连接； 注册运营商 的 DPF向 M2ME下载 MCIM。
M2ME通过 UICC 上的 TRE单元与拜访网络运营商建立连接是指， M2ME通过 UICC上的 TRE单元向拜访网络运营商发送附着消息， 其中携带 M2ME的临时连接身份标识（PICD, Provisional Connectivity Identity )； PCID 的格式与 IMSI相同。
拜访网络运营商还在收到 M2ME的临时连接身份标识后连接到注册运营 商， 并将临时连接身份标识发送至注册运营商； 以及收到注册运营商返回的 一组认证向量后与 M2ME进行认证，还在认证成功后为 M2ME分配 IP地址； 注册运营商还在收到临时连接身份标识后生成一组认证向量， 并将生成 的认证向量返回至拜访网络运营商；
M2ME通过 UICC上的 TRE单元使用拜访网络运营商提供的 IP连接与 注册运营商连接。
M2ME还在连接至注册运营商后， 将签约用户选择的归属网络运营商信 息发送至注册运营商；
注册运营商还根据归属网络运营商信息发现该归属网络运营商， 并在归 属网络运营商注册所述 M2ME; 注册运营商是通过 DRF帮助 M2ME发现其 归属网络运营商或 DRF为 M2ME发现其归属网络运营商。
归属网络运营商还在当 M2ME注册到归属网络运营商后，请求平台验证 授权中心对 M2ME进行验证， 以及当验证成功后通知注册运营商对 M2ME 验证成功 , 并授权注册运营商提供 MCIM给 M2ME;
注册运营商是在收到授权通知后将 MCIM下载至 M2ME。
平台验证授权中心， 对 M2ME进行验证； 平台验证授权中心是在收到认 证请求后验证 M2ME的真实性和完整性， 平台验证授权中心还将认证结果返 回至归属网络运营商。
当 MCIM位于 UICC上时， MCIM即是指 USIM/ISIM。 为了描述方便， 在本发明中， 针对 M2ME, 无论 MCIM是否位于 UICC上， 都只使用 MCIM 进行描述， 而不用 USIM/ISIM进行描述。
本实施例提供一种向 M2ME提供 MCIM的方法， 如图 3所示， 集成有 TRE单元的 UICC位于 M2ME上 , 当 M2ME初次使用时 ,如果 UICC上没有 预置 MCIM (机器通信身份模块）， 需要通过 M2ME签约用户选择 M2M归 属运营商 ,之后 M2ME通过 TRE与 RO建立 IP连接， RO在 SHO注册 M2ME。 在 SHO通过 PVA验证 M2ME的真实性和完整性后 ,授权 RO向 M2ME提供 MCIM。 M2ME下载 MCIM后将 MCIM供应给 UICC。 具体供应流程包括以 下步骤：
步骤 301 : M2ME通过标准的 GSM/UMTS原则来解码网络信息并且附着 到任意一个 VNO。
具体为， M2ME通过 UICC与拜访网络运营商建立初始连接， 即， UICC 向 VNO发送附着消息， 其中携带 M2ME的一个临时连接身份标识（PCID, Provisional Connectivity ID )； 即通过在 UICC上的 TRE单元来实现与拜访网 络运营商的连接。
步骤 302: VNO收到 M2ME的 PCID后， 与 RO建立连接， 并将 PCID 发送给 RO ( ICF功能） 。 在某些情况下， RO可以位于 VNO。
步骤 303: RO ( ICF功能）收到 M2ME的 PCID之后， 针对该 PCID生 成一组认证向量（AVs ) 。
步骤 304: RO将生成的认证向量（AVs )发送给 VNO。
步骤 305： VNO使用认证向量对 PCID/M2ME进行认证， 可以但不限于 釆用 AKA (认证和密钥协商 )认证。
步骤 306:认证成功后， VNO为 M2ME提供到 RO的 IP连接，即为 M2ME 分配 IP地址， 并将分配的 IP地址发送至 M2ME。
步骤 307: M2ME通过 VNO网络提供的 IP连接与 RO连接。
步骤 308: RO帮助 M2ME发现其 SHO, 或者， RO自己为 M2ME发现 其 SHO。
该步骤中 , RO在发现 M2ME的 SHO前需要先获知 M2ME的 SHO , M2ME 可以是在与 RO建立连接后将其签约用户选择的 SHO的信息发送至 RO( SHO 的信息可以是 SHO 的名称等） 。 SHO 的发现过程可以但不限于使用 OMA ( Open Mobile Alliance, 开放的移动联盟 ) BOOTSTRAP ( Bootstrap Protocol, 引导协议） 。
步骤 309: RO连接 SHO并在 SHO注册要连接 SHO网络的 M2ME。 步骤 310: SHO请求 PVA (或 SHO通过 RO请求 PVA )验证 M2ME的 真实性和完整性。 SHO通过 RO请求 PVA是指， SHO通知 RO对 M2ME进行验证， RO 收到该通知后请求 PVA验证 M2ME的真实性和完整性。
步骤 311 : PVA验证 M2ME的真实性和完整性。
步骤 312: PVA将验证结果发送给 SHO。
步骤 313: 如果验证成功， SHO联系 RO ( DPF功能）， 并授权 RO ( DPF 功能 )提供 MCIM给 M2ME。
步骤 314: RO ( DPF功能） 下载 MCIM到 M2ME。
步骤 315： M2ME将下载的 MCIM安装到 UICC。
步骤 316: M2ME向 RO ( DPF功能 ) 告供应 MCIM成功 /失败状态信 息。
步骤 317: RO ( DPF功能）向 SHO报告供应 MCIM成功 /失败状态信息。
尽管本发明结合特定实施例进行了描述， 但是对于本领域的技术人员来 说， 可以在不背离本发明的精神或范围的情况下进行修改和变化。 这样的修 改和变化被视作在本发明的范围和附加的权利要求书范围之内。
工业实用性
本发明提供一种向机器到机器设备提供机器通信身份模块的系统及方 法， 可实现将 M2ME上的 TRE的功能与 UICC的安全性很好的结合在一起， 保证了 MCIM的远程提供和安全存储。

Claims

权 利 要 求 书
1、 一种向机器到机器设备 ( M2ME )提供机器通信身份模块（ MCIM ) 的方法， 包括：
所述 M2ME通过通用集成电路卡（ UICC )上的可信环境（ TRE )单元与 拜访网络运营商建立连接， 并通过所述拜访网络运营商提供的 IP连接与注册 运营商建立连接， 所述注册运营商发现所述 M2ME的归属网络运营商， 当平 台验证授权中心对所述 M2ME进行验证成功后， 所述归属网络运营商授权所 述注册运营商将 MCIM下载到所述 M2ME, 所述 M2ME将下载的 MCIM安 装至所述 UICC;
其中， 所述 UICC位于 M2ME上， 所述 TRE单元位于 UICC上。
2、 如权利要求 1所述的方法， 其中：
所述 M2ME通过 UICC上的 TRE单元与拜访网络运营商建立连接，并通 过所述拜访网络运营商提供的 IP连接与注册运营商建立连接的步骤包括：
M2ME通过 UICC上的 TRE单元向拜访网络运营商发送附着消息，携带 所述 M2ME的临时连接身份标识， 所述拜访网络运营商收到 M2ME的临时 连接身份标识后连接到注册运营商， 并将所述临时连接身份标识发送至注册 运营商， 所述注册运营商根据所述临时连接身份标识生成一组认证向量， 并 将生成的所述认证向量返回至拜访网络运营商， 所述拜访网络运营商使用认 证向量与 M2ME进行认证， 认证成功后为 M2ME分配 IP地址， 之后所述 M2ME通过 UICC上的 TRE单元使用拜访网络提供商提供的 IP连接与注册 运营商连接。
3、 如权利要求 1所述的方法， 其中：
在所述 M2ME与注册运营商建立连接的步骤之后，还包括： 所述 M2ME 将签约用户选择的归属网络运营商信息发送至注册运营商；
在所述注册运营商发现所述 M2ME的归属网络运营商的步骤中， 所述注 册运营商根据归属网络运营商信息发现所述 M2ME的归属网络运营商， 并在 所述归属网络运营商注册所述 M2ME。
4、 如权利要求 3所述的方法， 其中：
在所述归属网络运营商注册所述 M2ME之后， 还包括： 所述归属网络运 营商请求平台验证授权中心对所述 M2ME进行验证。
5、 一种向机器到机器设备 ( M2ME )提供机器通信身份模块 ( MCIM ) 的系统， 包括 M2ME、 拜访网络运营商、 注册运营商、 归属网络运营商及平 台验证授权中心； 其中：
所述 M2ME包括通用集成电路卡（UICC ) , 所述 UICC包括可信环境 TRE单元；
所述 M2ME通过 UICC上的 TRE单元与拜访网络运营商建立连接，以及 通过拜访网络运营商提供的 IP 连接与注册运营商建立连接， 还将下载的 MCIM安装至所述 UICC;
所述拜访网络运营商， 在与所述 M2ME建立连接后为 M2ME提供到注 册运营商的 IP连接；
所述注册运营商， 在与所述 M2ME连接后， 发现 M2ME的归属网络运 营商； 以及当平台验证授权中心对 M2ME验证成功后， 经所述归属网络运营 商的授权， 向 M2ME下载 MCIM;
所述平台验证授权中心 , 对所述 M2ME进行验证。
6、 如权利要求 5所述的系统， 其中：
所述 M2ME还在通过 UICC上的 TRE单元向所述拜访网络运营商发送附 着消息， 其中携带所述 M2ME 的临时连接身份标识； 以及， M2ME还通过 UICC上的 TRE单元使用拜访网络运营商提供的 IP连接与注册运营商连接； 所述拜访网络运营商还在收到 M2ME的临时连接身份标识后连接到注册 运营商， 并将所述临时连接身份标识发送至注册运营商； 以及收到注册运营 商返回的一组认证向量后与 M2ME进行认证， 还在认证成功后为 M2ME分 配 IP地址；
所述注册运营商还在收到临时连接身份标识后生成一组认证向量， 并将 生成的所述认证向量返回至拜访网络运营商。
7、 如权利要求 5所述的系统， 其中：
所述 M2ME还在连接至注册运营商后，将签约用户选择的归属网络运营 商信息发送至注册运营商；
所述注册运营商还根据归属网络运营商信息发现该归属网络运营商， 并 在所述归属网络运营商注册所述 M2ME。
8、 如权利要求 7所述的系统， 其中：
所述归属网络运营商还在所述 M2ME注册到归属网络运营商后，请求平 台验证授权中心对 M2ME进行验证；
所述平台验证授权中心还在收到所述认证请求后验证所述 M2ME的真实 性和完整性， 以及， 还将认证结果返回至归属网络运营商。
PCT/CN2010/071216 2009-09-14 2010-03-23 向机器到机器设备提供机器通信身份模块的系统及方法 WO2011029296A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2009101732010A CN102026193A (zh) 2009-09-14 2009-09-14 向机器到机器设备提供机器通信身份模块的系统及方法
CN200910173201.0 2009-09-14

Publications (1)

Publication Number Publication Date
WO2011029296A1 true WO2011029296A1 (zh) 2011-03-17

Family

ID=43731960

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2010/071216 WO2011029296A1 (zh) 2009-09-14 2010-03-23 向机器到机器设备提供机器通信身份模块的系统及方法

Country Status (2)

Country Link
CN (1) CN102026193A (zh)
WO (1) WO2011029296A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012169945A1 (en) * 2011-06-08 2012-12-13 Telefonaktiebolaget L M Ericsson (Publ) Subscription information managing apparatus and control method therefor

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102186214B (zh) * 2011-05-27 2014-02-05 中国电信股份有限公司 QoS业务申请方法、系统及控制设备
US9286100B2 (en) * 2011-12-29 2016-03-15 Telefonaktiebolaget L M Ericsson (Publ) Virtual machine migration using 3GPP MCIM
US9693178B2 (en) * 2015-03-18 2017-06-27 Intel IP Corporation Procedures to provision and attach a cellular internet of things device to a cloud service provider
CN106487776B (zh) * 2015-09-02 2020-10-27 中兴通讯股份有限公司 一种保护机器类通信设备的方法、网络实体及系统
CN105338657B (zh) * 2015-10-16 2019-01-01 中国联合网络通信集团有限公司 eUICC卡与管理平台的连接方法和eUICC卡

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101217809A (zh) * 2008-01-18 2008-07-09 中兴通讯股份有限公司 不同网络协议间实现用户注册的方法

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB0423301D0 (en) * 2004-10-20 2004-11-24 Fujitsu Ltd User authorization for services in a wireless communications network

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101217809A (zh) * 2008-01-18 2008-07-09 中兴通讯股份有限公司 不同网络协议间实现用户注册的方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project, Technical Specification Group Services and System Aspects, Feasibility Study on Remote Management of USIM Application on M2M Equipment", 3GPP TR 33.812 V1.3.0 (RELEASE 9), 17 March 2009 (2009-03-17) *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012169945A1 (en) * 2011-06-08 2012-12-13 Telefonaktiebolaget L M Ericsson (Publ) Subscription information managing apparatus and control method therefor

Also Published As

Publication number Publication date
CN102026193A (zh) 2011-04-20

Similar Documents

Publication Publication Date Title
WO2011035572A1 (zh) 一种m2m设备归属网络运营商变更的方法和系统
EP2466759B1 (en) Method and system for changing a selected home operator of a machine to machine equipment
KR102406757B1 (ko) 보안 모듈의 가입자 프로파일 프로비저닝 방법
CN103155614B (zh) 漫游网络中接入终端身份的认证
US20090253409A1 (en) Method of Authenticating Home Operator for Over-the-Air Provisioning of a Wireless Device
US20160301529A1 (en) Method and apparatus for managing a profile of a terminal in a wireless communication system
US20090217038A1 (en) Methods and Apparatus for Locating a Device Registration Server in a Wireless Network
AU2016247689A1 (en) Technique for managing profile in communication system
EP3605995A1 (en) Method and apparatus for discussing digital certificate by esim terminal and server
WO2013067772A1 (zh) 一种mtc设备与uicc绑定的方法、装置及系统
WO2007091699A2 (en) Method, system and apparatus for indirect access by communication device
WO2009092115A2 (en) Method and apparatus for enabling machine to machine communication
EP2548390A1 (en) Facilitating authentication of access terminal identity
CN104871511A (zh) 通过标签加注进行设备认证
US11838752B2 (en) Method and apparatus for managing a profile of a terminal in a wireless communication system
US11422786B2 (en) Method for interoperating between bundle download process and eSIM profile download process by SSP terminal
KR20180039061A (ko) 디바이스의 피처들의 세트의 사용을 위한 인가를 검증
WO2011029296A1 (zh) 向机器到机器设备提供机器通信身份模块的系统及方法
WO2013071707A1 (zh) 移动用户身份识别卡与机器类通信设备绑定的方法及装置
US20120102207A1 (en) Registration of ad-hoc group members into an infrastructure network
WO2012075814A1 (zh) 一种mtc组设备的应用密钥管理方法及系统
WO2011029308A1 (zh) 一种m2m设备归属网络运营商变更的方法和系统
US9747432B1 (en) Remotely enabling a disabled user interface of a wireless communication device
WO2011029297A1 (zh) 向机器到机器设备提供机器通信身份模块的系统及方法
WO2010124569A1 (zh) 用户接入控制方法和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10814898

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 10814898

Country of ref document: EP

Kind code of ref document: A1