WO2012062077A1

WO2012062077A1 - Machine type communication device group management method and system based on generic bootstrapping architecture

Info

Publication number: WO2012062077A1
Application number: PCT/CN2011/071938
Authority: WO
Inventors: 余万涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-11-08
Filing date: 2011-03-17
Publication date: 2012-05-18
Also published as: CN102469455B; CN102469455A

Abstract

The present invention discloses a Machine Type Communication (MTC) device group management method based on Generic Bootstrapping Architecture (GBA). The method is applied in a system including the MTC device, a Bootstrapping Sever Function (BSF), and a Machine to Machine Service Center (M2M-SC). The method includes the following steps: when a first MTC device negotiates with the M2M-SC and determines to join the MTC device group with a group identifier G-ID, a first session key is established between the first MTC device and the M2M-SC via a first GBA process between the first MTC device, the BSF and the M2M-SC; the M2M-SC encrypts, with the first session key, the G-ID of the MTC device group and the group key Kg of the MTC device group and then transmits them to the first MTC device. With the present invention, a security management can be performed on group members of the MTC device group.

Description

Method and system for group management of machine type communication equipment based on universal booting architecture

The present invention relates to a mobile communication system and MTC (Machine Type Communication) technology, and in particular, to a MTC device group management method and system based on a universal boot architecture. Background technique

Machine-like communication is a general term for a series of technologies and combinations that implement wireless communication technology to realize data communication and communication between machines and machines, machines and people. M2M (called MTC in 3GPP) involves two levels: the first is the machine itself, called the smart device in the embedded world; the second is the connection between the machine and the machine, connecting the machines together through the network. MTC's range of applications is very broad, such as smart measurements, remote monitoring, tracking, medical, etc., which makes human life more intelligent. Compared with the traditional communication between people, MTC equipment has a large number of applications and a wide range of applications, so it has a huge market prospect.

In machine type communication, long-distance connection technology mainly includes GSM (Global System for Mobile Communications), GPRS (General Packet Radio Service), UMTS (Universal Mobile Phone Communication System), etc.; Close-range connection technology mainly includes 802.1 lb/g, Bluetooth , Zigbee, RFID (Radio Frequency Identification), etc. Because MTC integrates wireless communication technology and information technology, and can be used for two-way communication, such as collecting information remotely, setting parameters, and sending commands, it can implement different application scenarios, such as security monitoring, vending, and goods tracking. It can be seen that almost all the equipment involved in the normal life is likely to become a potential service target.

GBA (Generic Bootstrapping Architecture) defines a common key agreement mechanism between the terminal and the server. As shown in Figure 1, the main network elements in the GBA model are: 1) UE (User Equipment): The UE is a general term for the terminal device and the (U)SIM card; the terminal here may be a mobile terminal of the card (such as a mobile phone), or may be a fixed terminal of the card (such as a set-top box); In this document, a (U)SIM card refers to a SIM card or a USIM (Global Subscriber Identity Module) card;

2) NAF (Network Application Function): The application server is used to implement the business logic function of the application. After completing the authentication of the terminal, the terminal provides the service month service.

3) BSF (Bootstrapping Server Function): The BSF is the core network element of the GBA. The BSF and the UE implement authentication through the AKA (Authentication and Key Agreement) protocol, and negotiate the subsequent use for the UE and The session key for communication between the NAFs. In addition, the BSF can set the lifetime of the session key according to the local policy;

4) HSS (Home Subscriber System): Authentication data in the storage terminal (U) SIM card, such as Ki in the SIM (User Identification Module) card;

5) SLF (Subscriber Locator Function): The BSF obtains the name of the HSS storing the relevant user data by querying the SLF. SLF is not required in a single HSS environment; in addition, SLF is not required when the BSF is configured to use a pre-specified HSS.

After the MTC device is introduced in the mobile communication system, the number of the MTC devices is large. To reduce the network load and save the network resources, the MTC device needs to be managed in a group manner. Thus, the MTC device can be controlled in groups. Management and billing, etc., to meet the needs of operators. At present, it is proposed that the MTC device can be grouped according to whether the area is the same, or whether it has the same MTC feature, or whether it belongs to the same MTC user. In addition, after grouping the MTC devices, the group information needs to be secured. Otherwise, an attacker may pretend to be a group member to obtain group information.

At present, although the proposal of grouping MTC devices by region, MTC feature or MTC user is proposed, there is no specific implementation scheme based on these suggestions. Therefore, how to implement MTC device grouping and secure management of MTC devices in MTC device grouping is issues that need resolving. Summary of the invention

In view of this, the main object of the present invention is to provide a GBA-based MTC device group management method and system, which can perform security management on an MTC device in an MTC device group.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

A GBA-based MTC device group management method, which is applied to a system including an MTC device, a BSF, and an M2M-SC, the method comprising:

When the first MTC device negotiates with the M2M-SC to determine to join the MTC device group whose group identifier is G-ID, the first MTC device and the BSF and the M2M-SC pass the first GBA process, and the first MTC device and the M2M. - establishing a first session key between the SCs;

The M2M-SC encrypts the group identification G-ID and the group key Kg of the MTC device group by the first session key and then sends the same to the first MTC device.

Further, the MTC device group is created by the second MTC device, and the creating process includes:

When the second MTC device negotiates with the M2M-SC to determine that the MTC device group is to be created, the second MTC device and the BSF and the M2M-SC establish a second GBA process between the second MTC device and the M2M-SC. Second session key;

The M2M-SC creates a group identification G-ID and a group key Kg of the MTC device group, and encrypts the created G-ID and Kg by the second session key and sends the same to the second MTC device.

Further, after the G-ID and the KG are created, the method further includes: creating, by the M2M-SC, a correspondence list between the G-ID and the user identity and the device identity of the MTC device, where the correspondence list includes Corresponding relationship between the G-ID and the user identity and device identity of the second MTC device;

After the M2M-SC obtains the first session key, the method further includes: the M2M-SC updating the correspondence list. Further, before updating the correspondence relationship list, the method further includes:

The M2M-SC sends a join request of the first MTC device to the second MTC device, and the second MTC device decides to allow the first MTC device to join according to the received join request, and returns the decision result to the M2M-SC, and the M2M-SC determines according to the decision. As a result, the correspondence between the user identity and the device identity of the first MTC device is added to the correspondence list of the user identity and the device identity of the G-ID and the MTC device to update the correspondence relationship list.

Further, the method further includes: the first MTC device decrypting the received G-ID and Kg by using the first session key, and storing the first integrated circuit in the first MTC device or the first MTC device Card UICC.

Further, the method further includes: the second MTC device decrypting the received G-ID and Kg by using the second session key, and storing the G-ID and the Kg in the second MTC device or the UICC of the second MTC device.

Further, the process in which the first MTC device negotiates with the M2M-SC to determine the MTC device group to be added to the group identifier as the G-ID includes:

The first MTC device sends a negotiation request message to the M2M-SC, where the negotiation request message carries a request for joining the MTC device group with the group identifier G-ID;

The M2M-SC sends a boot initialization message to the first MTC device.

Further, the process in which the second MTC device negotiates with the M2M-SC to determine that the MTC device group is to be created includes:

The second MTC device sends a negotiation request message to the M2M-SC, where the negotiation request message carries a request for creating an MTC device group;

The M2M-SC sends a boot initialization message to the second MTC device.

A device group management system based on GBA, characterized in that: the system comprises: a first MTC device, a BSF and an M2M-SC; wherein

The first MTC device is configured to negotiate with the M2M-SC to determine that the group identifier is to be added to the G-ID. When the MTC device is grouped, a first session key is established between the first MTC device and the M2M-SC through the first GBA process with the BSF and the M2M-SC;

The M2M-SC, the group identifier G-ID and the group key Kg used to group the MTC device are encrypted by the first session key and then sent to the first MTC device.

Further, the system further includes: a second MTC device that creates the MTC device group;

a second MTC device, configured to determine, by the M2M-SC, that when the MTC device group is to be created, a second GBA process is performed with the BSF and the M2M-SC, and a second is established between the second MTC device and the M2M-SC. Session key

The M2M-SC is further configured to create a group identifier G-ID and a group key Kg of the MTC device group, and encrypt the created G-ID and Kg by using the second session key, and then send the same to the second MTC device. .

Further, the M2M-SC is further configured to: after creating the G-ID and the Kg, create a correspondence list of user identity and device identity of the G-ID and the MTC device, where the correspondence relationship list includes Corresponding relationship between the G-ID and the user identity and the device identity of the second MTC device; and is further configured to update the correspondence relationship list after acquiring the first session key.

It can be seen from the above technical solution that the present invention proposes a feasible MTC device grouping method, and since the group members in the M2M-SC and the MTC device group each have a G-ID and a Kg uniquely corresponding to the MTC device group, Therefore, it is possible to securely manage group members in the MTC device group; even if an attacker masquerades as a group member, since it cannot obtain Kg, the group information cannot be obtained. DRAWINGS

1 is a schematic diagram of a GBA model in the prior art;

2 is a schematic diagram of a GBA-based MTC device group management system according to the present invention; 3 is a schematic flowchart of creating a grouping of an MTC device according to the present invention;

4 is a schematic flow chart of the MTC device joining the MTC device group according to the present invention. detailed description

The technical solution of the present invention will be described in detail below with reference to the accompanying drawings.

The MTC device group management method based on the GBA is applied to the system shown in FIG. 2, and the system includes an MTC device, a BSF, and an M2M-SC (Machine Machine Service Center). In the present invention, the MTC device refers to a device for machine-to-machine communication in a mobile communication network, and the MTC device is installed with a UICC (Universal Integrated Circuit Card); the M2M-SC has a network application function (NAF), Group member management functions, etc.

The GBA-based MTC device group management method includes two aspects: creating an MTC device grouping and an MTC device joining an MTC device grouping.

As shown in FIG. 3, the process of creating an MTC device grouping according to the present invention includes:

Step 301: The MTC device sends a negotiation request message to the M2M-SC, where the negotiation request message carries a request for creating an MTC device group.

Step 302: The M2M-SC sends a boot initialization message to the MTC device.

Steps 301-302 mainly involve the MTC device negotiating with the M2M-SC to determine that the MTC device group is to be created;

Step 303: Perform a boot authentication process between the MTC device and the BSF, by which the MTC device and the BSF determine a session key (such as Ks-NAF) for subsequent communication between the MTC device and the M2M-SC. ;

Step 304: A boot security association process is performed between the MTC device and the M2M-SC. In the boot security association process, the M2M-SC obtains a session key that is communicated with the MTC device from the BSF, that is, the session key determined in step 303.

Steps 303-304 mainly involve the passage between the MTC device and the BSF and the M2M-SC. The GBA process, establishing a session key between the MTC device and the M2M-SC;

Step 305: After the M2M-SC obtains the session key, the M2M-SC creates a G-ID (Group Identifier) and a group key Kg according to the request information for creating the MTC device group, and creates a G-ID and A mapping list of user identities (such as IMSI, International Mobile Subscriber Identity) and device identities (such as IMEI, International Mobile Equipment Identity) of the MTC device. The correspondence list initially includes only the G-ID and the MTC device that created the packet. Correspondence between user identity and device identity, and the correspondence list is managed and maintained by the M2M-SC;

The G-ID is used to bind the user identity and device identity of the MTC device, and the group key Kg is used for security management of the MTC device group; the G-ID is unique and can be used as an agreement between the MTC device and the M2M-SC. Group key identity (ie G-ID and Kg - corresponding);

Step 306: The M2M-SC encrypts the created session key obtained by the G-ID and the Kg obtained in step 304 and sends the session key to the MTC device.

The MTC device decrypts the G-ID and Kg with the session key determined in step 303 and stores it. If the above boot process (steps 301-304) uses GBA-ME, ie the boot process is performed on the mobile device (ME), the G-ID and Kg may be stored in the MTC device; if the above boot process is used The GBA-U, that is, the boot process is performed on the UICC, can store the G-ID and Kg in the UICC of the MTC device. The specific details of the boot process can be referred to the existing related protocols and will not be described in detail here.

It can be seen from the above process that when the G-ID of an MTC device group is created, a grouping of MTC devices based on the G-ID is determined.

As shown in FIG. 4, the process for the MTC device to join the MTC device group includes: Step 401: The MTC device sends a negotiation request message to the M2M-SC, where the negotiation request message carries the MTC device group with the group ID being the G-ID. Request

Here, how the MTC device acquires the G-ID of the MTC device group is not the weight of the present invention. Point, do not describe here;

Step 402: The M2M-SC sends a boot initialization message to the MTC device.

Steps 401-402 are mainly related to the MTC device negotiating with the M2M-SC to determine the group to join the MTC device;

Step 403: Perform a boot authentication process between the MTC device and the BSF, by which the MTC device and the BSF determine a session key (such as Ks-NAF) for subsequent communication between the MTC device and the M2M-SC. ;

Step 404: A boot security association process is performed between the MTC device and the M2M-SC. In the boot security association process, the M2M-SC obtains a session key that is communicated with the MTC device from the BSF, that is, the session key determined in step 403.

Steps 403-404 mainly involve establishing a session key between the MTC device and the M2M-SC through the GBA process between the MTC device and the BSF and the M2M-SC;

Step 405: After obtaining the session key by the M2M-SC, the M2M-SC updates the correspondence list between the user identity and the device identity of the G-ID and the MTC device according to the request information of the MTC device group, that is, the existing correspondence relationship. The correspondence between the G-ID and the user identity (such as IMSI) and device identity (such as IMEI) of the newly joined MTC device is added to the list;

Step 406: The M2M-SC encrypts the G-ID and the Kg of the MTC device group by using the session key obtained in step 404, and sends the session key to the MTC device.

The MTC device decrypts the G-ID and Kg with the session key determined in step 403 and stores it. If the above boot process (steps 401-404) uses GBA-ME, the G-ID and Kg may be stored in the MTC device; if the above boot process uses GBA-U, the G-ID may be used. And Kg are stored in the UICC of the MTC device. The specific details of the boot process can be referred to the existing related protocols and will not be described in detail here.

Before step 405, the process for the MTC device to join the MTC device grouping further includes:

The M2M-SC sends the MTC device to be added to the MTC device that creates the MTC device packet. A join request, the join request carries information (such as an identity) of the MTC device to be joined;

The MTC device that creates the MTC device group determines whether to allow it to join according to the information of the MTC device to be added in the join request, and returns the decision result to the M2M-SC. The M2M-SC 4 starts or terminates the joining process according to the decision result.

In the present invention, one MTC device can create multiple MTC device packets, or only one MTC device packet can be created. An MTC device can join multiple MTC device groups, or only one MTC device group can be added. After joining an MTC device group, an MTC device can also create a new MTC device group. After an MTC device creates an MTC device group, it can also join other MTC device groups.

In addition, if group management of the MTC device is not required, the MTC device completes the authentication between the MTC device and the M2M-SC according to the normal GBA process.

In order to implement the above method, the present invention further provides a GBA-based MTC device group management system, the system comprising: a first MTC device, a BSF, and an M2M-SC; wherein, the first MTC device is configured to negotiate with the M2M-SC When determining that the MTC device group to be added to the group ID is a G-ID, the first session key is established between the first MTC device and the M2M-SC through the first GBA process with the BSF and the M2M-SC;

The system further includes: a second MTC device that creates the MTC device group; wherein, the second MTC device is configured to negotiate with the M2M-SC to determine that the MTC device group is to be created, and between the BSF and the M2M-SC Establishing a second session key between the second MTC device and the M2M-SC by using the second GBA process;

The M2M-SC is further configured to create the G-ID and the Kg, and the created G-ID and Kg are encrypted by the second session key and sent to the second MTC device. The M2M-SC is further configured to: after creating the G-ID and the Kg, create a correspondence list of the user identity and the device identity of the G-ID and the MTC device, where the correspondence relationship includes the G- Corresponding relationship between the ID and the user identity and the device identity of the second MTC device; and is further configured to update the correspondence relationship list after acquiring the first session key.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

Claim

A method for group management of a machine type communication device based on a universal booting architecture, wherein the method is applied to a system including a machine type communication MTC device, a boot server function BSF, and a machine to machine service center M2M-SC, Methods include:

When the first MTC device negotiates with the M2M-SC to determine the MTC device group to be added to the group identifier as the G-ID, the first MTC device and the BSF and the M2M-SC pass the first universal booting architecture GBA process, at the first MTC. Establishing a first session key between the device and the M2M-SC;

The M2M-SC encrypts the group identifier G-ID and the group key Kg of the MTC device group by the first session key and then sends the same to the first MTC device.

The packet management method of the machine type communication device based on the universal booting architecture according to claim 1, wherein the MTC device group is created by the second MTC device, and the creating process includes:

The method for group-based communication device group management based on the universal booting architecture according to claim 2, wherein after the creating the G-ID and the Kg, the method further comprises: creating the G by the M2M-SC - a correspondence between the ID and the user identity of the MTC device and the device identity, the correspondence list including the correspondence between the G-ID and the user identity and device identity of the second MTC device;

After the M2M-SC obtains the first session key, the method further includes: updating, by the M2M-SC, the correspondence list.

4. The general-purpose booting architecture-based machine type communication device grouping tube according to claim 3. The method further includes: before updating the correspondence list, the method further includes:

The method according to claim 1, wherein the method further comprises: the first MTC device passing the received G-ID and Kg through the The first session key is decrypted and stored in the first MTC device or in the universal integrated circuit card UICC of the first MTC device.

The method for managing a group-based communication device group based on a universal booting architecture according to claim 2, wherein the method further comprises: the second MTC device passing the received G-ID and Kg through the The second session key is decrypted and stored in the second MTC device or in the UICC of the second MTC device.

The method for managing a group-like communication device group based on a universal booting architecture according to claim 1, wherein the first MTC device negotiates with the M2M-SC to determine an MTC device group to be added to the group identifier as a G-ID. The process includes:

The first MTC device sends a negotiation request message to the M2M-SC, where the negotiation request message carries a request for grouping the MTC device with the group identifier G-ID;

The M2M-SC sends a boot initialization message to the first MTC device.

The method for managing a packet of a machine type communication device based on the universal booting architecture according to claim 1, wherein the process of determining, by the second MTC device, the M2M-SC to determine the group to be created by the M2M-SC includes:

The second MTC device sends a negotiation request message to the M2M-SC, where the negotiation request message carries a request for creating an MTC device group; The M2M-SC sends a bootstrap initialization message to the second MTC device.

9. A machine type communication device group management system based on a universal booting architecture, the system comprising: a first MTC device, a BSF, and an M2M-SC; wherein

The first MTC device is configured to negotiate with the M2M-SC to determine the MTC device group to be added to the group identifier as the G-ID, and pass the first GBA process with the BSF and the M2M-SC, and the first MTC device and the M2M-SC. Establishing a first session key between;

The M2M-SC is configured to encrypt the group identifier G-ID and the group key Kg of the MTC device group by using the first session key, and then send the packet to the first MTC device.

The device of the machine-type communication device group management system based on the universal booting architecture according to claim 9, wherein the system further comprises: a second MTC device that creates the MTC device group;

a second MTC device, configured to negotiate with the M2M-SC to determine that the MTC device group is to be created, and pass the second GBA process with the BSF and the M2M-SC, and establish a second between the second MTC device and the M2M-SC. Session key

The machine-based communication device group management system based on the universal booting architecture according to claim 10, wherein the M2M-SC is further configured to create the G after creating the G-ID and Kg. - a correspondence between the ID and the user identity of the MTC device and the device identity, the correspondence list including the correspondence between the G-ID and the user identity and device identity of the second MTC device; After the first session key is described, the correspondence list is updated.