WO2011060709A1

WO2011060709A1 - Method and device for checking binding relationship of international mobile subscriber identity and international mobile equipment identity

Info

Publication number: WO2011060709A1
Application number: PCT/CN2010/078785
Authority: WO
Inventors: 周成; 曲爱妍
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-11-23
Filing date: 2010-11-16
Publication date: 2011-05-26
Also published as: CN102075909A; CN102075909B

Abstract

The present invention discloses a checking method for the binding relationship of an International Mobile Subscriber Identity (IMSI) and an International Mobile Equipment Identity (IMEI). The method includes: inquiring the corresponding relationship of the IMSI and the IMEI according to the acquired IMEI of a terminal and the IMSI which is being used by the terminal, and checking the binding relationship of the IMEI of the terminal and the IMSI which is being used by the terminal according to the inquiry result. The present invention also discloses a checking device for the binding relationship of the IMSI and the IMEI. The checking device can identify and check the binding relationship of the IMSI and the IMEI.

Description

Verify international mobile subscriber identity and international mobile device identity code

Method and device for binding relationship

The present invention relates to user identification and terminal identification technologies in the field of communications, and in particular, to a method and apparatus for verifying the binding relationship between an International Mobile Subscriber Identity (IMSI) and an International Mobile Equipment Identity (IMEI). Background technique

In order to maintain the competitiveness of the third generation mobile communication system in the field of communication, the 3GPP (3rd Generation Partnership Project) standard working group is working on the evolution of the Evolved Packet System (EPS). The existing EPS system is shown in Figure 1. It mainly includes the Evolved Universal Terrestrial Radio Access Network (E-UTRAN) and the Evolved Packet Core (EPC). The system's EPC is capable of supporting users' access from the GSM EDGE Radio Access Network (GERAN, GSM EDGE Radio Access Network) and the Universal Terrestrial Radio Access Network (UTRAN). The EPC mainly includes a Mobility Management Entity (MME), a S-GW (Serving Gateway), a Packet Data Network Gateway (P-GW), and a Home Subscriber Server (HSS, Home Subscriber Server), Policy and Charging Rules Function (PCRF), Supporting GPRS Supporting Node (SGSN) and other supporting nodes.

In Figure 1, the HSS is the permanent storage location of the user subscription data, located in the home network that the user subscribes to; the MME is the location where the user subscription data is stored in the current network, and is responsible for the non-access stratum of the terminal to the network (NAS, Non-Access Stratum). ) signaling management, tracking in user idle mode and Paging management function and bearer management; S-GW is the gateway from the core network to the wireless system, responsible for user plane bearer from the terminal to the core network, data buffer in the idle mode of the terminal, function of initiating service request on the network side, legal eavesdropping and grouping Data routing and forwarding function; P-GW is the gateway of EPS and external network of the system, responsible for terminal IP address allocation, charging function, packet filtering, policy application, etc.; PCRF is a policy and charging rule function entity, it The receiving interface Rx is connected to the service network protocol (IP, Internet Protocol) to obtain service information. In addition, it can be connected to the gateway device in the network through the Gx interface, and is responsible for initiating the establishment of the IP bearer and ensuring the service data. Quality of Service (QoS), and charge control.

In addition, the EPC also includes user equipment (UE, User Equipment), machine type communication server (MTC Server), MTC device (MTC Device, Machine Type Communication Device) and device i only ll register (EIR, Equipment Identity Register) and so on. The UE includes a Universal Integrated Circuit Card (UICC) and a mobile terminal (ME, Mobile Equipment), and the uppermost layer of the protocol stack with the MME is NAS; the MTC Server is mainly responsible for management and data storage of the MTC device/ The MTC device is similar to the UE. It also includes the UICC and the ME. It is usually responsible for collecting information of several collectors and accessing the core network through the RAN (Radio Access Network) node and interacting with the MTC Server. EIR is a database that stores device identification codes for MEs, and implements operations such as identification, monitoring, and blocking of MEs.

In the existing Long Term Evolution (LTE) network, only the authentication of the identity of the ordinary mobile user is supported, that is, the user's International Mobile Subscriber Identity (IMSI, International Mobile Subscriber Identity) is authenticated, and the IMSI is stored. They are identified in the Universal Subscriber Identity Module (USIM) and as the user's identity. Even if the EIR network is deployed, only the device's International Mobile Equipment Identity (IMEI) is checked for legality. The IMEI is globally unique to each UE and MTC device. With the introduction of machine-to-machine (M2M) communication, especially the speciality of MTC devices, such as unattended outdoor MTC devices, it is usually required that the IMEI of an MTC device uniquely corresponds to the IMSI of the inserted device, or It is limited to correspond to several specified IMSIs; conversely, an IMSI is also limited to one or several specified IMEIs. Therefore, the relationship between the IMSI and the IMEI needs to be stored in the network to limit the illegal device and the USIM to access the network, thereby implementing anti-theft. However, existing LTE networks are not able to meet this demand. Summary of the invention

In view of this, the main object of the present invention is to provide a method and apparatus for verifying the binding relationship between IMSI and IMEI, so as to implement identification and verification of the binding relationship between IMSI and IMEI.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

The present invention provides a method for verifying the binding relationship between the IMSI and the IMEI. The method includes: querying the correspondence between the IMSI and the IMEI according to the obtained IMEI of the terminal and the IMSI being used by the terminal, and according to the query result, The IMEI of the terminal is checked against the IMSI that the terminal is using.

The correspondence between the IMSI and the IMEI includes: an IMSI-signed IMEI list and an IMEI-signed IMSI list.

The query corresponds to the relationship, and the binding relationship between the IMEI of the terminal and the IMSI that the terminal is using is verified according to the query result, which is specifically:

Querying the IMSI list of the IMEI subscription of the terminal, and the IMEI list of the IMSI subscription that the terminal is using, if the IMSI in the IMSI list is in use, and the terminal exists in the IMEI list IMEI, then determine the verification of the binding relationship;

If the IMSI of the terminal is not in the IMSI list, and/or the IMEI of the terminal does not exist in the IMEI list, it is determined that the verification of the binding relationship fails;

If the IMSI subscription IMSI list of the terminal is empty, and the terminal is in use If the IMEI list of the IMSI contract is also empty, the checksum of the binding relationship is determined to pass; if the IMSI list of the IMEI subscription of the terminal is empty, and the IMEI list of the IMSI subscription that the terminal is using is not empty, the binding relationship is determined. The verification failed;

If the IMEI list of the IMSI subscription being used by the terminal is empty, and the IMSI list of the IMEI subscription of the terminal is not empty, it is determined that the verification of the binding relationship has not passed.

The query corresponds to the relationship, and the binding relationship between the IMEI of the terminal and the IMSI being used by the terminal is verified according to the query result, and further includes:

When querying the IMSI list of the IMEI subscription of the terminal, and the IMEI subscription IMEI list that the terminal is using, identifying whether the IMEI of the terminal is a general IMEI according to the identifier of the header of the IMSI list, according to The identifier of the header of the IMEI list identifies whether the IMSI being used by the terminal is a general IMSI;

If the IMEI of the terminal is a general IMEI, and/or the IMSI being used by the terminal is a general IMSI, it is determined that the verification of the binding relationship is passed; otherwise, the binding relationship verification is continued as described in claim 3. .

The correspondence between the IMSI and the IMEI includes: an IMSI contracted group identifier and an IMEI contracted group identifier.

Querying the group identifier of the IMEI that is signed by the terminal, and the group identifier of the IMSI that the terminal is using, and determining whether the group IDs that are queried are consistent. If they are consistent, the binding of the binding relationship is determined; if not, it is determined. The checksum of the binding relationship failed.

If the IMEI of the terminal and the IMSI being used by the terminal do not have the subscription group identifier, it is determined that the verification of the binding relationship is passed;

If only one of the IMEIs of the terminal and the IMSI being used by the terminal does not have a subscription group identifier, it is determined that the verification of the binding relationship has not passed. The query corresponds to the relationship, and according to the query result, the IMEI of the terminal and the terminal are being used.

IMSI performs binding relationship verification, and further includes:

Querying the group identifier of the IMEI of the terminal, and whether the IMSI that the terminal is using is a general IMEI, and identifying whether the IMSI being used by the terminal is a general IMSI according to the identifier of the group identifier of the IMSI contract;

If the IMEI of the terminal is a general IMEI, and/or the IMSI being used by the terminal is a general IMSI, it is determined that the verification of the binding relationship is passed; otherwise, the binding relationship verification is continued as described in claim 6. .

The present invention also provides an apparatus for verifying the binding relationship between the IMSI and the IMEI, the apparatus comprising: an information acquisition module, configured to acquire an IMEI of the terminal and an IMSI that the terminal is using;

The query insurance module is configured to query the correspondence between the IMSI and the IMEI according to the obtained IMEI and the IMSI, and perform binding verification on the IMEI of the terminal and the IMSI that the terminal is using according to the query result.

The querying the insurance module is further configured to: query an IMSI list of the IMEI subscription of the terminal, and an IMEI list of the IMSI subscription that the terminal is using, if the IMSI in the IMSI list is in use by the terminal, and If the IMEI of the terminal exists in the IMEI list, it is determined that the verification of the binding relationship is passed;

If the IMSI of the terminal is not present in the IMSI list, and/or the IMEI of the terminal does not exist in the IMEI list, it is determined that the school insurance of the binding relationship fails;

If the IMSI list of the IMEI subscription of the terminal is empty, and the IMEI list of the IMSI subscription that the terminal is using is also empty, it is determined that the verification of the binding relationship is passed;

If the IMSI of the terminal's IMEI subscription is empty, and the IMSI subscription of the terminal is being used If the IMEI list is not empty, it is determined that the check of the binding relationship has not passed;

The querying the insurance module is further configured to: when querying the IMSI list of the IMEI subscription of the terminal, and the IMEI list of the IMSI contracted by the terminal, identifying the identifier according to the identifier of the header of the IMSI list Whether the IMEI of the terminal is a general IMEI, and if the IMEI of the terminal is a general IMEI, and/or the IMSI being used by the terminal is a general IMSI, it is determined that the binding relationship is verified; otherwise, according to the claims The binding relationship check is continued as described in 10.

The querying the insurance module is further configured to: query the group identifier signed by the IMEI of the terminal, and the group identifier signed by the IMSI that the terminal is using, and determine whether the group IDs that are queried are consistent, and if they are consistent, determine the binding relationship. If the check is inconsistent, it is determined that the check of the binding relationship has not passed;

If only one of the IMEIs of the terminal and the IMSI being used by the terminal does not have a signed group identifier, it is determined that the check of the binding relationship has not passed.

The querying the insurance module is further configured to: when querying the group identifier of the IMEI contracted by the terminal, and the group identifier of the IMSI that the terminal is using, identifying the terminal according to the identifier of the group identifier of the IMEI subscription Whether the IMEI is a general IMEI, if the IMEI of the terminal is contracted according to the IMSI, and/or the IMSI being used by the terminal For the general IMSI, it is determined that the verification of the binding relationship is passed; otherwise, the binding relationship verification is continued as described in claim 13.

The method and device for verifying the binding relationship between the IMSI and the IMEI provided by the present invention, according to the obtained IMEI of the terminal and the IMSI being used by the terminal, query the correspondence between the IMSI and the IMEI, and compare the IMEI of the terminal according to the query result. Binding relationship verification with the IMSI that the terminal is using. Through the invention, the identification and verification of the binding relationship between the IMSI and the IMEI is realized; and the access authentication according to different levels is realized, and the terminal of the M2M type or the terminal of the common type can be applied. DRAWINGS

1 is a schematic structural diagram of an EPS system in the prior art;

2 is a flowchart of a method for verifying a binding relationship between an IMSI and an IMEI according to the present invention; FIG. 3 is a flowchart of an EPS attachment according to Embodiment 1 of the present invention;

4 is a flowchart of an EPS attachment according to Embodiment 2 of the present invention;

FIG. 5 is a flowchart of an EPS attachment according to Embodiment 3 of the present invention; FIG.

FIG. 6 is a schematic diagram showing the structure of a verification apparatus for binding relationship between IMSI and IMEI according to the present invention. detailed description

The technical solutions of the present invention are further elaborated below in conjunction with the accompanying drawings and specific embodiments. The method for verifying the binding relationship between the IMSI and the IMEI provided by the present invention, as shown in FIG. 2, mainly includes the following steps:

Step 201: Query the correspondence between the IMSI and the IMEI according to the obtained IMEI of the terminal and the IMSI that the terminal is using.

Step 202: Perform a binding relationship check between the IMEI of the terminal and the IMSI used by the terminal according to the query result. In the present invention, the correspondence between the IMSI and the IMEI needs to be maintained, and the correspondence may be in two maintenance forms. The correspondence between the first maintenance mode includes: an IMSI-signed IMEI list and an IMEI-signed IMSI list. The IMSI-signed IMEI list may contain one or more IMEIs, indicating that an IMSI has been contracted to allow the use of one or more IMEI-compliant devices; if the IMEI list is empty, it indicates that the IMSI corresponding to the IMEI list has not signed any IMEIs. The IMSI can use any device that has not subscribed to the IMSI. Similarly, the IMSI-signed IMSI list may include one or more IMSIs, indicating that an IMEI has been contracted to allow one or more IMSIs to be used; if the IMSI list is empty, it indicates that the IMEI corresponding to the IMSI list has not signed any IMSI, The IMEI can use any IMSI that has not subscribed to the IMEI.

For the first correspondence, the operation mode of the query and binding relationship check is:

A. Query the IMSI list of the IMEI subscription of the terminal, and the IMEI list of the IMSI subscription that the terminal is using. If there is an IMSI that the terminal is using in the IMSI list, and the IMEI of the terminal exists in the IMEI list, the binding relationship check is determined. Pass

B. If there is no IMSI in the IMSI list, and the IMEI of the terminal does not exist in the IMEI list, it is determined that the verification of the binding relationship has not passed;

C. If the IMSI list of the IMEI subscription of the terminal is empty, and the IMEI list of the IMSI subscription that the terminal is using is also empty, it is determined that the verification of the binding relationship is passed;

D. If the IMSI list of the IMEI subscription of the terminal is empty, and the IMEI list of the IMSI subscription that the terminal is using is not empty, it is determined that the verification of the binding relationship fails.

E. If the IMEI list of the IMSI subscription that the terminal is using is empty, and the IMSI list of the IMEI subscription of the terminal is not empty, it is determined that the verification of the binding relationship has not passed.

The correspondence between the second maintenance modes includes: the group identity of the IMSI contract and the group identifier of the IMEI contract. That is, IMSI and IMEI sign a global unique group identity, and the corresponding relationship stores the group identity of each IMSI and its contract, and the group identity of each IMEI and its contract.

For the second correspondence, the operation mode of the query and binding relationship check is: a. Querying the group identifier of the IMEI that the terminal is subscribed to, and the group identifier of the IMSI that the terminal is using, and determining whether the group IDs that are queried are consistent. If they are consistent, the binding of the binding relationship is determined; if not, Then, it is determined that the verification of the binding relationship has not passed;

b. If the IMEI of the terminal and the IMSI being used by the terminal do not have the subscription group identifier, the verification of the binding relationship is determined to pass;

c. If only one of the IMEIs of the terminal and the IMSI being used by the terminal does not have a subscription group identifier, it is determined that the verification of the binding relationship has not passed.

It should be noted that the present invention can record the contracted IMEI list for each contracted IMSI in the database of the HSS, and record the IMSI list of the contracted IMEI for each application binding contract, that is, the HSS adopts the above-mentioned A maintenance method that stores and maintains the correspondence between IMSI and IMEI. Of course, the EIR can also use the first maintenance method described above to store and maintain the correspondence between IMSI and IMEI. Then, correspondingly, the operation mode of the above query and binding relationship verification can be performed by HSS or EIR. In addition, since the IMEI of the terminal and the IMSI being used by the terminal are originally collected by the MME, the operation mode of the foregoing query and binding relationship check may also be performed by the MME, but only the HSS is required to provide the IMSI for the MME. Correspondence query service with IMEI.

The second maintenance mode can also be used in the HSS database to store and maintain the group ID of the IMSI contract and the group ID of the IMEI contract. Then, correspondingly, the operation mode 2 of the above query and binding relationship insurance can be performed by the HSS. In addition, since the IMEI of the terminal and the IMSI being used by the terminal are originally collected by the MME, the operation mode 2 of the foregoing query and binding relationship check may also be performed by the MME, but only the HSS is required to provide a group for the MME. Identification of the query service.

The above-mentioned IMSI and IMEI binding relationship insurance method will be further elaborated below in conjunction with specific embodiments.

In the first embodiment of the present invention, the IMEI is verified in the MME according to the method shown in FIG. 2. Binding relationship with the IMSI, determining whether to allow access, and finally completing the process of EPS attachment, as shown in FIG. 3, mainly includes the following steps:

Step 301: The terminal initiates an initial attach, and sends an attach request message to the evolved base station (eNB, evolved NodeB). The message contains the end user's IMSI or the old Global Unique Temporary Identity (GUTI).

Step 302: The eNB selects an MME according to the GUTI in the attach request message, or selects an MME according to the network topology, and sends the attach request message to the selected new MME.

Step 303: If the old GUTI is carried in the attach request message, and the current new MME is not the MME when the terminal is last attached, the new MME needs to obtain the authentication vector and the key that are not used by the IMSL from the old MME/SGSN. And the identity information, and the integrity check of the attach request message according to the obtained identity information.

Step 304: If the terminal does not record in the new MME or the old MME/SGSN, the new MME acquires the IMSI from the terminal. That is, the new MME sends an identity request to the terminal, and the terminal sends the IMSI to the new MME in the identity response.

Step 305: If the terminal does not have context information in the new MME, the old MME/SGSN, or if the attach request message in step 301 does not have integrity protection, or if the attach request does not pass the integrity check, the new MME must The HSS sends an authentication data request message. The authentication data request message includes the IMSI of the end user.

Step 306: The HSS first searches for the user subscription data corresponding to the IMSI in the authentication data request message. If no subscription is found or the IMSI is blacklisted, the HSS returns an authentication data response to the new MME and carries the appropriate The cause of the error; if the user subscription data corresponding to the IMSI is found, the HSS returns an authentication data response message to the new MME, where the response message includes an authentication vector.

Step 307, if steps 305 and 306 are performed, the authentication process must be performed between the new MME and the terminal to verify the validity of the terminal IMSI, and the security mode process is executed to enable the security. Fully connected.

Step 308: In the initial attached scenario, the new MME sends a device identifier request message to the terminal, requesting to acquire the IMEI of the terminal; and the terminal returns a device identifier response message to the new MME to inform the new MME of the IMEI of the terminal. Since the secure connection is established, the identification code request message and the identification code response message are encrypted and transmitted.

Step 309: If the EIR is deployed on the network, the MME may choose to query the EIR for the validity of the IMEI of the terminal.

Step 310: The new MME sends a location update request message to the HSS, where the request message includes IMSI and IMEI of the terminal.

Step 311: The HSS returns a location update response message to the new MME.

It should be noted that, if the foregoing operation mode 1 is adopted, the location update response message needs to include the user subscription data of the terminal, the legal IMEI list signed by the IMSI of the user, and the legal IMSI list signed by the IMEI of the terminal; In operation mode 2, the location update response message needs to include the user subscription data of the terminal, the group identifier corresponding to the IMSI of the user, and the group identifier corresponding to the IMEI of the terminal.

Step 312: The new MME performs a binding relationship check between the IMEI of the terminal and the IMSI being used according to the information carried in the location update response message.

If the location update response message returned by the HSS includes the user subscription data of the terminal, the legal IMEI list signed by the IMSI of the user, and the legal IMSI list signed by the IMEI of the terminal, the new MME needs to follow the above operation mode to the IMEI of the pair of terminals. The IMSI being used by the terminal performs binding relationship verification. If the location update response message returned by the HSS includes the user subscription data of the terminal, the group identifier corresponding to the IMSI of the user, and the group identifier corresponding to the IMEI of the terminal, the new MME needs to use the IMEI of the terminal and the terminal in use according to the foregoing operation mode. IMSI performs binding relationship verification.

In step 313, if the verification is passed, the subsequent process of the attach process is continued. Step 314: If the check fails, the new MME rejects the attach request of the terminal, and returns an appropriate cause value to the terminal.

It should be noted that, for the foregoing operation mode 1, according to the needs of the operator, if the IMEI of the terminal or the IMSI used by the terminal is not found in the record of the HSS database, the terminal access may be refused, or may be regarded as the IMEI. Or the IMSI corresponding list is empty; for the foregoing operation mode 2, if the IMEI of the terminal or the IMSI used by the terminal is not found in the record of the HSS database, the terminal access may be refused, or may be regarded as no group. The situation of the logo is handled.

In addition, in order to meet the different levels of access authentication requirements in the actual application, the present invention can extend the header of the IMSI list and the IMEI list by adding the lbit identifier to identify the IMEI of the terminal and the terminal is being used. Whether the IMSI is a general IMEI and IMSI, for example: the identifier location 0 is represented as a normal IMEI or IMSI, the identifier location 1 is represented as a general IMEI or an IMSI; if it is a general IMEI, then the IMEI has absolute authority, and any USIM can be used; In the case of a generic IMSI, the IMSI has absolute authority and any ME can be used.

For the extension of the header, in the process of performing the binding relationship check, when querying the IMSI list of the IMEI subscription of the terminal, and the IMEI list of the IMSI contracted by the terminal, the new MME according to the header of the IMSI list The identifier bit identifies whether the IMEI of the terminal is a general IMEI, and identifies whether the IMSI being used by the terminal is a general IMSI according to the identifier of the header of the IMEI list; if the IMEI of the terminal is a general IMEI, and/or the IMSI being used by the terminal is a general IMSI Then, the verification of the binding relationship is passed; otherwise, the binding relationship verification is continued as described in the foregoing operation mode 1.

In order to meet the requirements of different levels of access authentication in the actual application, the present invention can extend a bit of the group identifier as a type identifier bit to identify whether the IMEI of the terminal and the IMSI being used by the terminal are general IMEIs. And IMSI, for example: Identify location 0 table Shown as a normal IMEI or IMSI, the identification location 1 is represented as a general IMEI or IMSI; if it is a general IMEI, then the IMEI has absolute authority and can use any USIM; if it is a general IMSI, then the IMSI has absolute authority and can be used Any ME.

For the extension of the header, in the process of performing the binding relationship check, when the group identifier of the IMEI that is subscribed to the terminal is queried, and the group identifier of the IMSI that the terminal is using, the group that the new MME subscribes according to the IMEI The identified identifier bit identifies whether the IMEI of the terminal is a general IMEI, and identifies whether the IMSI being used by the terminal is a general IMSI according to the identifier of the group identifier of the IMSI contract; if the IMEI of the terminal is a general IMEI, and/or the IMSI being used by the terminal is The general IMSI, the verification of the binding relationship is passed; otherwise, the binding relationship insurance is continued as described in the foregoing operation mode 2.

In the second embodiment of the present invention, according to the method shown in FIG. 2, the binding relationship between the IMEI and the IMSI is verified in the HSS, the access is allowed, and the process of EPS attachment is finally completed, as shown in FIG. It mainly includes the following steps:

The operations of steps 401-410 are the same as the operations of steps 301-310 in the embodiment shown in FIG.

Step 411: The HSS performs binding relationship verification according to the IMSI and the IMEI carried in the location update request message.

It should be noted that if the database of the HSS adopts the first maintenance mode, the binding relationship check needs to be performed according to the operation mode. If the HSS database adopts the second maintenance mode, it needs to be bound according to the operation mode 2. Determine the relationship check. I will not repeat them here.

Step 412: If the check passes, the HSS returns a location update response message to the new MME, where the response message includes the user's IMSI and user subscription data.

Step 413: If the verification fails, the HSS returns a subscription data error message to the new MME, where the message includes an appropriate error reason.

Step 414, if the new MME receives the location update response message, then the follow-up process The process can continue.

Step 415: If the new MME receives the subscription data error message, the new MME rejects the attachment of the terminal and returns an appropriate cause value to the terminal.

For the extension of the header, in the process of performing the binding relationship check, when querying the IMSI list of the IMEI subscription of the terminal, and the IMEI list of the IMSI contracted by the terminal, the HSS identifies the header according to the header of the IMSI list. The bit identifies whether the IMEI of the terminal is a general IMEI, and if the IMEI of the terminal is a general IMEI, and/or the IMSI being used by the terminal is a general IMSI, the verification of the binding relationship passes; otherwise, continues according to the above operation mode 1. Perform binding relationship verification.

In order to meet the requirements of different levels of access authentication in the actual application, the present invention can extend a bit of the group identifier as a type identifier to identify the IMEI of the terminal. And whether the IMSI being used by the terminal is a general IMEI and an IMSI, for example: the identifier location 0 is represented as a normal IMEI or IMSI, the identifier location 1 is represented as a general IMEI or an IMSI; if it is a general IMEI, the IMEI has absolute authority, Use any USIM; if it is a generic IMSI, then the IMSI has absolute permissions and can use any ME.

For the extension of this header, in the process of performing binding relationship verification, in the query terminal

When the group identifier of the IMEI is signed, and the group identifier of the IMSI contracted by the terminal, the HSS identifies whether the IMEI of the terminal is a general IMEI according to the identifier of the group identifier of the IMEI contract, and identifies the terminal according to the identifier of the group identifier of the IMSI contract. Whether the IMSI being used is a general IMSI; if the IMEI of the terminal is a general IMEI, and/or the IMSI being used by the terminal is a general IMSI, the verification of the binding relationship is passed; otherwise, the binding is continued as described in the above operation mode 2. Determine the relationship check.

In the third embodiment of the present invention, according to the method shown in FIG. 2, the IMEI list for maintaining the IMSI subscription and the IMSI list of the IMEI subscription are stored in the EIR, and the EIR checks the binding relationship between the IMEI and the IMSI for the terminal, and The process of finally completing the EPS attachment, as shown in FIG. 5, mainly includes the following steps:

The operations of the steps 501 to 508 are the same as those of the steps 301 to 308 in the embodiment shown in FIG. 3, and details are not described herein again.

Step 509: The new MME sends a device identifier check request message to the EIR, where the request message includes the IMSI of the user and the IMEI of the terminal.

Steps 510-511, the EIR retrieves its own database to verify the binding relationship between the IMSI and the IMEI sent by the new MME, and returns a device ID check response message to the new MME, where the response message includes the verification result.

The EIR performs binding check verification according to the above operation mode, and details are not described herein again.

Step 512: If the new MME receives the verification result returned by the EIR as the verification, the subsequent process of the attach process may continue to be performed. Step 513: If the new MME receives the check result returned by the EIR, the check fails, the new MME rejects the attach request of the terminal and returns an appropriate cause value.

It should be noted that, for the foregoing operation mode 1, according to the needs of the operator, if the IMEI of the terminal or the IMSI used by the terminal is not found in the record of the EIR database, the terminal access may be refused, or may be regarded as an IMEI. Or the list corresponding to the IMSI is empty to handle.

For the extension of the header, in the process of performing the binding relationship check, when querying the IMSI list of the IMEI subscription of the terminal, and the IMEI list of the IMSI contracted by the terminal, the EIR is based on the identifier of the header of the IMSI list. The bit identifies whether the IMEI of the terminal is a general IMEI, and if the IMEI of the terminal is a general IMEI, and/or the IMSI used by the terminal is a general IMSI, the verification of the binding relationship passes; otherwise, continues according to the above operation mode 1. Perform binding relationship verification.

A method for verifying the above IMSI and IMEI binding relationship, the present invention provides a

The verification device of the binding relationship between the IMSI and the IMEI, as shown in FIG. 6, includes: an information acquisition module 10 and a query verification module 20. The information obtaining module 10 is configured to acquire an IMEI of the terminal and an IMSI that the terminal is using. The query verification module 20 is configured to query the correspondence between the IMSI and the IMEI according to the obtained IMEI and the IMSI, and perform a binding relationship between the IMEI of the terminal and the IMSI used by the terminal according to the query result. The mapping between the IMSI and the IMEI may adopt the first maintenance mode, that is, the IMSI-signed IMEI list and the IMEI-signed IMSI list. Correspondingly, the query verification module 20 can perform the binding relationship verification by using the operation mode, which is specifically:

Querying the IMSI list of the IMEI subscription of the terminal, and the IMEI list of the IMSI subscription that the terminal is using. If the IMSI of the terminal is in use in the IMSI list, and the IMEI of the terminal exists in the IMEI list, the verification of the binding relationship is determined; If the IMSI of the terminal is not present in the IMSI list, and/or the IMEI of the terminal does not exist in the IMEI list, it is determined that the check of the binding relationship fails; if the IMSI list of the IMEI of the terminal is empty, and the terminal is in use If the IMEI list of the IMSI subscription is also empty, it is determined that the binding of the binding relationship is passed; if the IMSI list of the IMEI subscription of the terminal is empty, and the IMEI list of the IMSI subscription that the terminal is using is not empty, the binding relationship is determined. The verification fails. If the IMEI list of the IMSI subscription that the terminal is using is empty, and the IMSI list of the IMEI subscription of the terminal is not empty, it is determined that the verification of the binding relationship has not passed.

Preferably, when the IMSI list of the IMEI subscription of the terminal is queried, and the IMEI list of the IMSI contracted by the terminal, the identifier of the header of the IMSI list is used to identify whether the IMEI of the terminal is a general IMEI, according to the header of the IMEI list. The identifier bit identifies whether the IMSI being used by the terminal is a general IMSI; if the IMEI of the terminal is a general IMEI, and/or the IMSI being used by the terminal is a general IMSI, it is determined that the binding relationship is verified; otherwise, according to the operation mode The binding relationship check is continued as described in .

The mapping between the IMSI and the IMEI can be performed in the second maintenance mode, that is, the IMSI contracted group identifier and the IMEI contracted group identifier. Correspondingly, the query verification module 20 can perform the binding relationship check in the operation mode 2, specifically: querying the group identifier of the IMEI signed by the terminal, and the group identifier signed by the IMSI that the terminal is using, and determining the queried query. Whether the group IDs are consistent. If they are consistent, the checksum of the binding relationship is determined. If they are inconsistent, the checksum of the binding relationship is not passed. If the IMEI of the terminal and the IMSI being used by the terminal are not signed, The identifier is determined to pass the verification of the binding relationship. If only one of the IMEIs of the terminal and the IMSI being used by the terminal does not have the subscription group identifier, it is determined that the verification of the binding relationship fails.

Preferably, when the group identifier signed by the IMEI of the terminal is queried, and the group identifier of the IMSI that the terminal is using, the identifier of the group identifier of the IMEI is identified as whether the IMEI of the terminal is a general IMEI, and the IMEI is contracted according to the IMSI. The identifier of the group identifier identifies whether the IMSI being used by the terminal is a general IMSI; if the IMEI of the terminal is a general IMEI, and/or the IMSI being used by the terminal is a general IMSI, it is determined that the binding relationship is verified; otherwise, according to the operation The binding relationship check is continued as described in mode 2.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

Claim

A method for verifying a binding relationship between an International Mobile Subscriber Identity (IMSI) and an International Mobile Equipment Identity (IMEI), the method comprising:

According to the obtained IMEI of the terminal and the IMSI that the terminal is using, the correspondence between the IMSI and the IMEI is queried, and the binding relationship between the IMEI of the terminal and the IMSI being used by the terminal is verified according to the query result.

The method for verifying the binding relationship between the IMSI and the IMEI according to claim 1, wherein the correspondence between the IMSI and the IMEI comprises: an IMSI subscription IMEI list and an IMEI subscription IMSI list.

The method for verifying the binding relationship between the IMSI and the IMEI according to claim 2, wherein the query correspondence relationship is performed on the IMEI of the terminal and the terminal according to the query result.

IMSI performs binding relationship verification, which is specifically as follows:

Querying the IMSI list of the IMEI subscription of the terminal, and the terminal being used by the terminal

An IMSI-signed IMEI list, if the IMSI is in use in the IMSI list, and the IMEI of the terminal exists in the IMEI list, it is determined that the binding relationship is verified;

If the IMSI list of the IMEI subscription of the terminal is empty, and the IMEI list of the IMSI subscription that the terminal is using is not empty, it is determined that the verification of the binding relationship fails.

4. The method for verifying the binding relationship between an IMSI and an IMEI according to claim 3, characterized in that The querying the relationship, and performing the binding relationship check between the IMEI of the terminal and the IMSI used by the terminal according to the query result, further includes:

The method for verifying the binding relationship between the IMSI and the IMEI according to claim 2, wherein the correspondence between the IMSI and the IMEI comprises: an IMSI-signed group identifier and an IMEI-signed group identifier.

The method for verifying the binding relationship between the IMSI and the IMEI according to claim 5, wherein the query corresponds to the relationship, and the binding relationship between the IMEI of the terminal and the IMSI being used by the terminal is verified according to the query result. Specifically:

The method for verifying the binding relationship between the IMSI and the IMEI according to claim 6, wherein the query corresponds to the relationship, and the binding relationship between the IMEI of the terminal and the IMSI used by the terminal is verified according to the query result. Further includes: Querying the group identifier of the IMEI of the terminal, and whether the IMSI signed by the terminal is a general IMEI, and identifying, according to the identifier of the group identifier of the IMSI contract, whether the IMSI being used by the terminal is a general IMSI;

A device for verifying the binding relationship between the IMSI and the IMEI, the device comprising: an information acquisition module, configured to acquire an IMEI of the terminal and an IMSI that the terminal is using;

The apparatus for verifying the binding relationship between the IMSI and the IMEI according to claim 8, wherein the correspondence between the IMSI and the IMEI comprises: an IMSI subscription IMEI list and an IMEI subscription IMSI list.

The apparatus for verifying the binding relationship between the IMSI and the IMEI according to claim 9, wherein the querying the insurance module is further configured to query the IMSI list of the IMEI subscription of the terminal, and the terminal is in use If the IMSI of the IMSI is in the IMSI list, if the IMSI of the terminal is in the IMSI list, and the IMEI of the terminal exists in the IMEI list, it is determined that the verification of the binding relationship is passed;

The apparatus for verifying the binding relationship between the IMSI and the IMEI according to claim 10, wherein the querying the insurance module is further configured to query the IMSI list of the IMEI subscription of the terminal, and the terminal is When the IMSI-signed IMEI list is used, it is determined whether the IMEI of the terminal is a general IMEI according to the identifier of the header of the IMSI list, according to if the IMEI of the terminal is a general IMEI, and/or the terminal If the IMSI being used is a general IMSI, it is determined that the verification of the binding relationship is passed; otherwise, the binding relationship verification is continued as described in claim 10.

12. The apparatus for verifying the binding relationship between the IMSI and the IMEI according to claim 8, wherein the correspondence between the IMSI and the IMEI comprises: an IMSI-signed group identifier and an IMEI-signed group identifier.

The apparatus for verifying the binding relationship between the IMSI and the IMEI according to claim 12, wherein the querying the insurance module is further configured to: query the group identifier of the IMEI signed by the terminal, and the IMSI used by the terminal. The group ID of the contract is determined, and it is determined whether the group IDs are consistent. If they are consistent, the binding of the binding relationship is determined; if not, the verification of the binding relationship is not passed;

The apparatus for verifying the binding relationship between the IMSI and the IMEI according to claim 13, wherein the querying the insurance module is further configured to query the group identifier of the IMEI signed by the terminal, And determining, according to the identifier of the group identifier of the IMEI subscription, whether the IMEI of the terminal is a general IMEI, and if the IMEI of the terminal is contracted according to the IMSI, the IMEI is a general IMEI. And/or the IMSI being used by the terminal is a general IMSI, and then the verification of the binding relationship is determined to pass; otherwise, the binding relationship verification is continued as described in claim 13.