WO2012062115A1

WO2012062115A1 - Method, system and apparatus for access control of machine type communication

Info

Publication number: WO2012062115A1
Application number: PCT/CN2011/076104
Authority: WO
Inventors: 余万涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-11-08
Filing date: 2011-06-22
Publication date: 2012-05-18
Also published as: CN102469448B; CN102469448A

Abstract

The present invention discloses a method, system and apparatus for access control of Machine Type Communication (MTC). In the solutions of the present invention, a mobile communication network, after receiving an access request sent by an MTC device, determines whether the MTC device is associated with an identification module of an MTC user; if yes, the mobile communication network accepts the access of the MTC device, or otherwise, rejects the access of the MTC device. According to the solutions provided by the present invention, it enables the mobile communication network to accept the access only of associated MTC users and MTC devices and to reject the access of MTC users and MTC devices that are not associated, realizing the control and management of access of MTC users and MTC devices and effectively preventing MTC users from abusing MTC devices.

Description

Method, system and device for machine type communication access control

The invention relates to a machine type communication (MTC) technology, in particular to a method, system and device for machine type communication access control. Background technique

MTC refers to a series of technologies and combinations of technologies that use wireless communication technology to realize data communication and communication between machines and machines, machines and people. MTC has two meanings: The first meaning is the machine itself, called the smart device in the embedded field; the second meaning is the connection between the machine and the machine, connecting the machines together through the network. MTC is used in a wide range of applications, such as smart measurement, remote monitoring, tracking, medical, etc., to make human life more intelligent. Compared with traditional human-to-human communication, MTC devices have a large number of applications and a wide range of applications, which has great market prospects.

In MTC, the main long-distance connection technologies include Global System for Mobile communications (GSM)/General Packet Radio Service (GPRS)/Universal Mobile Telecommunications System (Universal Mobile Telecommunications System). UMTS), etc., the short-distance connection technology mainly includes 802.11b/g, Bluetooth, Zigbee, Radio Frequency Identification (RFID) and the like. Because MTC integrates wireless communication and information technology, it can be used for two-way communication, such as collecting information over long distances, setting parameters and sending commands, thus enabling different applications such as security monitoring, vending, and goods tracking. Almost all the equipment involved in everyday life is likely to become a potential customer. MTC provides a simple means of real-time data transfer between devices or between remote devices, or to establish a wireless connection with an individual.

The architecture of the MTC system is shown in Figure 1. The MTC device passes the 3GPP network and MTC. The server (MTC Server) communicates, and the MTC server provides Machine to Machine (M2M) services for MTC users.

For MTC systems, due to the diversity and complexity of MTC applications, MTC applications have a common feature. Due to the wide variety of MTC applications, each MTC application has different equipment requirements for MTC devices, so different MTC devices may have different device functions and device capabilities in an MTC system.

For the MTC server, the information to be received not only needs to be from a legitimate MTC user, but also needs to be from a legitimate MTC device. Therefore, the 3GPP network is required to control the access of the MTC user and the MTC device.

At present, the access control modes supported by the 3GPP network include: access control for the access of the MTC user through the security authentication mode; and access control for the MTC device by establishing a black and white list. This type of access control, although it is convenient for MTC users to access different 3GPP networks using different MTC devices, can only perform separate access control for MTC users or MTC devices, and cannot effectively prevent MTC users from abusing MTC. device. Summary of the invention

In view of this, the main object of the present invention is to provide a method, system and device for machine type communication access control, which effectively prevents MTC users from abusing MTC equipment.

In order to solve the above technical problem, the technical solution of the present invention is implemented as follows:

A method for machine type communication MTC access control, the MTC device includes an identity recognition module of an MTC user, and the mobile communication network supports association between the MTC device and the MTC user identity module, and the method includes: the mobile communication network receives the MTC device to send After the access request, it is determined whether the MTC device is associated with the identity recognition module, and if so, accepts access by the MTC device; otherwise, the access of the MTC device is denied.

Before determining whether the MTC device is associated with the identity recognition module, the method further includes: performing access authentication on the MTC user, or performing access authentication on the MTC user and on the MTC device After authentication is performed, after the authentication is passed, it is determined whether the MTC device is associated with the identity recognition module. Determining whether the MTC device is associated with the identity recognition module, specifically: determining whether the MTC user identity information and the MTC device identity information carried in the access request meet the association relationship between the established MTC device and the MTC user identity module, If it is met, it accepts the access of the MTC device, otherwise it rejects the access of the MTC device.

Determining whether the MTC user identity information and the MTC device identity information carried in the access request meet the association relationship between the established MTC device and the MTC user identity module, specifically: determining whether the MTC device identity information is based on the stored association relationship list It has been associated with the corresponding MTC user identity information. If there is an association between the MTC device identity information and the corresponding MTC user identity information in the association list, the access of the MTC device is accepted, otherwise, the access of the MTC device is denied.

Before determining whether the MTC device is associated with the identity recognition module, the method further includes: the MTC device sending an association request to the mobile communication network, and after receiving the association request sent by the MTC device, the mobile communication network determines whether the associated MTC device has been associated with The identity recognition module of the other MTC user is associated, and if so, the association request is rejected, otherwise, the association relationship between the associated MTC device and the identity recognition module is established.

The association request includes the MTC device identity information and the MTC user identity information, and the determining whether the associated MTC device is associated with the identity identification module of the other MTC user, specifically: determining the MTC device identity information based on the stored association relationship list If the relationship between the MTC device identity information and the MTC user identity information exists in the association relationship list, the association request is rejected, if the MTC device identity information and the MTC user do not exist in the association relationship list. The association relationship between the identity information establishes an association relationship between the MTC device that needs to be associated with the identity recognition module, and updates the association relationship list.

The method further includes: receiving, by the mobile communication network, a logout association request sent by the MTC device After that, it is determined whether the associated MTC device needs to be logged out to be associated with the identity recognition module, and if so, the association relationship between the MTC device and the identity recognition module is cancelled, otherwise, the logout association request is rejected.

The de-registration association request includes the MTC user identity information and the MTC device identity information, and the determining whether the associated MTC device needs to be associated with the identity recognition module is specifically: determining, according to the stored association relationship list, whether the MTC device identity information has been Associated with the MTC user identity information, if the association relationship between the MTC device identity information and the MTC user identity information exists in the association relationship list, the association relationship between the MTC device and the identity recognition module is cancelled, and the association relationship list is updated, if the association relationship If there is no association between the MTC device identity information and the MTC user identity information in the list, the logout association request is rejected.

A system for machine type communication access control, comprising:

An MTC device including an MTC user identity module, configured to send an access request to a mobile communication network; the MTC user identity module is located on a universal integrated circuit card UICC; a functional entity for MTC access control, located in the mobile And a communication network, configured to determine whether the MTC device is associated with the identity recognition module, and if yes, access the MTC device; otherwise, reject the access of the MTC device.

The MTC device is further configured to: send an association request to the mobile communication network; the function entity for the MTC access control is further configured to: receive an association request sent by the MTC device, determine whether the associated MTC device needs to be Already associated with the identity module of the other MTC user, if yes, the association request is rejected, and if not, the association relationship between the MTC device and the identity module is established.

The MTC device is further configured to: send a logout association request to the mobile communication network; the function entity for the MTC access control is further configured to: receive a logout association request sent by the MTC device, and determine that the associated MTC device needs to be logged out Whether it has been associated with the identity module, and if so, the relationship between the MTC device and the identity module is logged out, and if not, the note is rejected Pin association request.

The function entity for the MTC access control is further configured to: perform access authentication on the MTC user, or perform access authentication on the MTC user and perform authentication on the MTC device. After the authentication is passed, determine whether the MTC device is Has been associated with the identity module.

A device for communication access control of a machine type, comprising:

a receiving unit, configured to receive an access request sent by the MTC device, and send the access request to the access determining unit, where the access request carries the MTC user identity information and the MTC device identity information;

The access judging unit is configured to determine whether the MTC device is associated with the identity module of the MTC user, and if yes, accept the access of the MTC device; otherwise, the access of the MTC device is rejected.

The device further includes: an association establishing unit,

The receiving unit is further configured to: receive an association request sent by the MTC device, and send the association request to the associated establishing unit;

The association establishing unit is configured to determine whether an MTC device that needs to be associated is associated with an identity recognition module of another MTC user, and if yes, reject the association request, and if not, establish an association relationship between the MTC device and the identity recognition module. .

The device further includes: an associated logout unit,

The receiving unit is further configured to: receive a logout association request sent by the MTC device, and send the request to the associated logout unit;

The associated deregistration unit is configured to determine whether the MTC device that needs to be logged off is associated with the identity recognition module of the MTC user, and if yes, revoke the association relationship between the MTC device and the identity recognition module, and if not, reject the association Log out of the association request.

The access judging unit is further configured to: perform an access authentication on the MTC user, or perform an access authentication on the MTC user and perform an authentication on the MTC device, and after the authentication is passed, determine whether the MTC device has been associated with the MTC user. The identity module is associated. According to the solution provided by the present invention, after receiving the access request sent by the MTC device, the mobile communication network determines whether the MTC device is associated with the identity recognition module of the MTC user, and if yes, accepts the access of the MTC device, otherwise, rejects The access of the MTC device enables the mobile communication network to accept only the access of the associated MTC user and the MTC device, and the unassociated MTC user and the MTC device will be denied access, thereby realizing the control of accessing the MTC user and the MTC device. Management, effectively preventing the abuse of MTC devices by MTC users.

In addition, the mobile communication network can also maintain the association relationship between the MTC device and the legal MTC user, and facilitate the control and management of the MTC user and the MTC device access by the mobile communication network. DRAWINGS

Figure 1 is a schematic diagram of the architecture of the MTC system;

2 is a schematic diagram of an MTC access control process in the present invention;

3 is a schematic structural diagram of an MTC access control system according to the present invention;

4 is a schematic flowchart of establishing an association relationship between an MTC device and an identity module of an MTC user when the MTC device is initially accessed according to the present invention;

FIG. 5 is a schematic flowchart of the relationship between the MTC device and the identity recognition module of the MTC user in the present invention;

6 is a schematic diagram of a process of associating an MTC device with an identity module of an MTC user in the present invention;

7 is a schematic diagram showing the process of association between an MTC device and an identity recognition module of an MTC user in the present invention;

FIG. 8 is a schematic structural diagram of an MTC access control apparatus according to the present invention. detailed description

In practical applications, for the MTC server, the information to be received not only needs to be from a legitimate MTC user, but also needs to be a legitimate MTC device from a legitimate MTC user. Cause Therefore, in the MTC system, in consideration of the legitimacy of the MTC device and the MTC user, the relationship between the legal MTC device and the legal MTC user needs to be further considered to effectively prevent the MTC user from abusing the MTC device.

2 is a schematic diagram of an access control process in an MTC according to the present invention. As shown in FIG. 2, the specific processing includes:

Step 201: The mobile communication network receives an access request sent by the MTC device, where the MTC device includes an identity recognition module of the MTC user.

When the MTC device needs to access the mobile communication network, it sends an access request to the mobile communication network, where the access request carries the MTC user identity information and the MTC device identity information; the mobile communication network receives the access request, and the mobile communication network supports The association of the MTC device with the MTC user identity module.

The MTC device is a device used by the MTC user for machine type communication, and the identity module of the MTC user is installed in the MTC device. The mobile communication network may specifically be a 3GPP network or a 3GPP2 network. The identity module of the MTC user may specifically be a user identity module.

(Subscriber Identity Module, SIM), Universal Subscriber Identity Module (USIM), IP Multimedia Service Identity Module (IPI), which can be located on a smart card, such as a universal integrated circuit card. (Universal Integrated Circuit Card, UICC). The MTC user identity information may be an International Mobile Subscriber Identification Number (IMSI) of the identity module or MTC identity information for the MTC user identity. The MTC device identity information can be the device's international mobile device identifier.

(International Mobile Equipment Identity number, IMEI) or MTC identity information for MTC device identity.

After receiving the access request sent by the MTC device, the mobile communication network performs access authentication on the MTC user, or performs access authentication on the MTC user and authenticates the MTC device, and the authentication is passed. After that, it indicates that the MTC user, or the MTC user and the MTC device are legal, and then proceeds to step 202.

Step 202: The mobile communication network determines whether the MTC device is associated with the MTC user, that is, whether the MTC device is associated with the identity recognition module of the MTC user. If yes, the mobile communication network accepts the access of the MTC device, and the MTC device accesses. The mobile communication network; otherwise, the mobile communication network rejects the access of the MTC device and may further return a denial of access message to the MTC device.

The mobile communication network determines whether the MTC user identity information and the MTC device identity information carried in the access request meet the association relationship between the established MTC device and the MTC user identity module, that is, whether the MTC device identity information has been determined based on the stored association relationship list. Associated with the corresponding MTC user identity information, if yes, that is, the association relationship between the MTC device identity information and the corresponding MTC user identity information exists in the association relationship list, indicating that the MTC device is a legal MTC device of the legal MTC user, and the mobile communication network accepts the MTC The access of the device, the MTC device accesses the mobile communication network; if not, the association relationship between the MTC device identity information and the corresponding MTC user identity information does not exist in the association list, indicating that the MTC device is not a legal MTC device of the legal MTC user, The mobile communication network rejects the access of the MTC device. The access of the MTC device to the mobile communication network means: After the MTC device is authenticated by the mobile communication network, it is allowed to access the mobile communication network to use the related communication service.

According to the description of the above process, the mobile communication network only accepts the access of the associated MTC user and the MTC device, and the access is denied for the unassociated MTC user and the MTC device.

After receiving the association request from the MTC device, the mobile communication network determines whether the associated MTC device has been associated with the identity recognition module of other MTC users according to the MTC user identity information and the MTC device identity information that are required to be associated in the association request. Linking, that is, determining whether the MTC device identity information is associated with other MTC user identity information based on the stored association list, and if so, the MTC device identity information and the MTC user are present in the association relationship list. The association relationship of the identity information is rejected, and if not, the association relationship between the MTC device identity information and the MTC user identity information does not exist in the association relationship list, and the association request is accepted, and the MTC device and the MTC user to be associated are established. The association of the identity module updates the stored association list. The MTC device may be an MTC device that needs to be associated, that is, the MTC user sends an association request through the MTC device that needs to be associated; or may be an MTC device that has been associated with the MTC user identified by the MTC user identity information, that is, the MTC user passes The associated MTC device issues an association request to associate with other MTC devices. Thus, in the present invention, one MTC device can only be associated with an identity module of one MTC user; an identity module of an MTC user can associate multiple MTC devices.

In addition, the mobile communication network can also establish an association relationship between the MTC device to be associated with the MTC user identity module through the network management system, obtain a list of association relationships, and store the association relationship.

According to the above description, the mobile communication network that provides the communication service between the MTC device and the MTC server needs to include the functional functions for the MTC access control in addition to the existing network functions, including: MTC user authentication function. , or the MTC user authentication function and the MTC device authentication function, and the MTC user and the MTC device association management function, as shown in FIG. In the MTC access control system shown in FIG. 3, an MTC device including an MTC user identity module and a functional entity for MTC access control in a mobile communication network, where the MTC device is configured to send an access to the mobile communication network The function entity for the MTC access control is used to determine whether the MTC device is associated with the identity module of the MTC user, and if so, access the MTC device; otherwise, the access of the MTC device is denied. The identity module of the MTC user can be USIM, ISIM, etc., usually located on the UICC. The specific structure of the functional entity for MTC access control in the mobile communication network will be described in further detail later in FIG.

The function entity for the MTC access control is also used for performing access authentication on the MTC user, or performing access authentication on the MTC user and authenticating the MTC device. After the authentication is passed, determining whether the MTC device has been associated with The MTC user's identity module is associated. The MTC device is further configured to send an association request or a logout association request to the mobile communication network; the function entity for the MTC access control is further configured to establish or cancel an association relationship between the MTC device and the MTC user identity module, and the stored association relationship list Manage and maintain. Specifically, the function entity for the MTC access control is configured to receive an association request sent by the MTC device, determine whether the associated MTC device has been associated with an identity module of another MTC user, and if yes, reject the association request, If not, the association relationship between the MTC device and the MTC user identity module is established, and is further used to update the stored association relationship list. The function entity for the MTC access control is configured to receive the logout association request sent by the MTC device, determine whether the associated MTC device needs to be associated with the MTC user identity module, and if so, log off the MTC device and the MTC user identity. The association relationship of the identification module is further used to update the stored association relationship list, and if not, the logout association request is rejected.

The MTC device may establish an association relationship with the MTC user identity module through the association establishment process in the initial access process, and may include the MTC device authentication or the MTC device authentication in the association establishment process, which is implemented by the system. To decide. 4 is a schematic flowchart (including MTC device authentication) for establishing an association relationship between an MTC device and an MTC user identity identification module during initial access of the MTC device according to the present invention. As shown in FIG. 4, the specific processing includes: Step 400: Include an MTC user When the MTC device of the identity module first accesses the mobile communication network, the MTC user access authentication supported by the mobile communication network is first performed between the mobile communication network and the MTC device. The MTC user access authentication is the same as the mobile user authentication process of the existing mobile communication network. For example, the MTC device sends the MTC user identity information to the mobile communication network, and the mobile communication network is in a database such as a Home Subscriber Server (HSS). The relevant information is searched for, and a set of authentication vectors is generated and sent to the mobility management entity (MME). The MME selects one of the authentication vectors to perform bidirectional authentication on the MTC user. After the authentication is passed, the MTC user is considered to be legal.

Step 401: After the MTC user passes the access authentication, the mobile communication network performs the MTC device. Authentication. MTC device authentication can use various existing device authentication methods, such as using digital certificate authentication methods.

Step 402: After the MTC device is authenticated, the MTC device sends an association request of the MTC device and the MTC user to the mobile communication network, where the association request carries the MTC device identity information and the MTC user identity information that need to be associated. The MTC user identity information may be IMSI or MTC identity information for the MTC user identity. The MTC device identity information may be IMEI or MTC identity information for the MTC device identity.

Step 403: After receiving the association request sent by the MTC device, the mobile communication network checks the stored association relationship list according to the MTC device identity information and the MTC user identity information, and determines whether the MTC device identity information is associated with other MTC user identity information, if Yes, that is, the association relationship between the MTC device identity information and the MTC user identity information exists in the association relationship list, indicating that the MTC device is associated with the identity recognition module of another MTC user, rejecting the association request, if not, that is, in the association relationship list If there is no association between the MTC device identity information and the MTC user identity information, it indicates that the MTC device is not associated with the identity module of the other MTC user, and the association is accepted regardless of whether the MTC user identity module has been associated with another MTC device. The request establishes an association relationship between the MTC device and the MTC user identity module, and updates the stored association relationship list, that is, adds the association relationship to the association relationship list.

Step 404: The mobile communication network feeds back an acknowledgement message to the MTC device, and notifies the MTC device of the association result.

In addition, except that the MTC device shown in FIG. 4 is initially accessed by the mobile communication network to associate it with the identification module of the MTC user; or the MTC user may send the MTC device to the mobile communication network through the MTC device already associated with it. Correlation request, requesting the mobile communication network to associate another MTC device with the MTC user, that is, after the MTC device accesses the mobile communication network, the MTC user sends an association request through the MTC device, where the association request carries the need to be associated MTC device identity information and MTC user identity information; mobile communication network needs to determine Whether the associated MTC device has been associated with the identity module of the other MTC user to determine whether to establish an association relationship between the MTC device and the MTC user identity module. The specific processing procedure of the MTC device accessing the mobile communication network is as shown in FIG. 2 .

In the above-described process in which the MTC device is associated with the identity module of the MTC user, the unassociated MTC device can be associated with the identity module of any MTC user.

The mobile communication network can also cancel the association relationship between the MTC device and the MTC user identity module. As shown in FIG. 5, the specific processing of the relationship between the MTC device and the MTC user identity module is as follows:

Step 500: The MTC device accesses the mobile communication network, and the specific processing process is as shown in FIG. 2 . Step 501: The MTC user sends a logout association request to the mobile communication network by using the MTC device, where the logout association request carries the MTC device identity information and the MTC user identity information that need to be logged off. The MTC user identity information may be IMSI or MTC identity information for the MTC user identity. The MTC device identity information may be IMEI or MTC identity information for the MTC device identity. The MTC device that sends the logout association request may be an MTC device that needs to be logged out associated with the MTC user's identity module, or may be another MTC device through which the MTC user logs out of its associated MTC device.

Step 502: After receiving the logout association request sent by the MTC device, the mobile communication network checks the association list of the stored MTC device and the MTC user identity module according to the MTC device identity information and the MTC user identity information, and determines whether the MTC exists in the association list. The association between the device identity information and the corresponding MTC user identity information, if yes, the relationship between the MTC device and the MTC user identity module is deleted, and the stored association relationship list is updated, that is, the association relationship is deleted from the association relationship list; If it exists, it will not be processed.

Step 503: The mobile communication network feeds back an acknowledgement message to the MTC device, and notifies the MTC device to cancel the association result.

The mobile communication network can also deregister the association between the MTC device and the MTC user identity module. Relationship, after the association relationship between the MTC device and an MTC user identity module is cancelled, the MTC device can establish an association relationship with the new MTC user identity module through the association establishment process. In the process of establishing an association relationship, the MTC device may be authenticated, or the MTC device may not be authenticated, which is determined by the specific implementation of the system.

The association establishment process including the authentication of the MTC device is as shown in FIG. 6. The specific process includes: Step 600: Perform MTC user access authentication supported by the mobile communication network between the mobile communication network and the MTC device. The MTC user access authentication is the same as the mobile user authentication process of the existing mobile communication network. For example, the MTC device sends the MTC user identity information to the mobile communication network, and the mobile communication network searches for related information in a database such as the HSS to generate a group. The authentication vector is sent to the MME, and the MME selects one of the authentication vectors to perform bidirectional authentication on the MTC user. After the authentication is passed, the MTC user is considered to be legal.

Step 601: After the MTC user accesses the authentication, the mobile communication network authenticates the MTC device. MTC device authentication can use various existing device authentication methods, such as using digital certificate authentication methods.

Step 602: After the MTC device is authenticated, the MTC device sends an association request of the MTC device and the MTC user to the mobile communication network, where the association request carries the MTC device identity information and the MTC user identity information that need to be associated. The MTC user identity information may be IMSI or MTC identity information for the MTC user identity. The MTC device identity information may be IMEI or MTC identity information for the MTC device identity.

Step 603: After receiving the association request sent by the MTC device, the mobile communication network checks the stored association relationship list according to the MTC device identity information and the MTC user identity information, and determines whether the MTC device identity information is associated with other MTC user identity information, if Yes, that is, the association relationship between the MTC device identity information and the MTC user identity information exists in the association relationship list, indicating that the MTC device is associated with the identity recognition module of another MTC user, rejecting the association request, if not, that is, in the association relationship list There is no MTC device identity information and MTC user identity The association relationship of the information indicates that the MTC device is not associated with the identity module of the other MTC user, and the association request is accepted regardless of whether the MTC device has been associated with another MTC device, and the MTC device and the MTC user identity are established. The association relationship of the module, and updating the stored association list, that is, adding the association to the association list.

Step 604: The mobile communication network feeds back an acknowledgement message to the MTC device, and notifies the MTC device of the association result.

The association establishment process that does not include the authentication of the MTC device is as shown in FIG. 7. The specific process includes: Step 700: Perform MTC user access authentication supported by the mobile communication network between the mobile communication network and the MTC device. The MTC user access authentication is the same as the mobile user authentication process of the existing mobile communication network. For example, the MTC device sends the MTC user identity information to the mobile communication network, and the mobile communication network searches for related information in a database such as the HSS to generate a group. The authentication vector is sent to the MME, and the MME selects one of the authentication vectors to perform bidirectional authentication on the MTC user. After the authentication is passed, the MTC user is considered to be legal.

Step 701: After the MTC user access authentication is passed, the MTC device sends an association request of the MTC device and the MTC user to the mobile communication network, where the association request carries the MTC device identity information and the MTC user identity information that need to be associated. The MTC user identity information may be IMSI or MTC identity information for the MTC user identity. The MTC device identity information may be IMEI or MTC identity information for the MTC device identity.

Step 702: After receiving the association request sent by the MTC device, the mobile communication network checks the stored association relationship list according to the MTC device identity information and the MTC user identity information, and determines whether the MTC device identity information is associated with other MTC user identity information, if Yes, that is, the association relationship between the MTC device identity information and the MTC user identity information exists in the association relationship list, indicating that the MTC device is associated with the identity recognition module of another MTC user, rejecting the association request, if not, that is, in the association relationship list If there is no association between the MTC device identity information and the MTC user identity information, it indicates that the MTC device is not associated with the identity module of other MTC users. Association, whether the MTC device's identity module is associated with another MTC device, accepts the association request, establishes an association relationship between the MTC device and the MTC user identity module, and updates the stored association relationship list, that is, adds the association relationship to In the list of associations.

Step 703: The mobile communication network feeds back an acknowledgement message to the MTC device, and notifies the MTC device of the association result.

FIG. 8 is a schematic structural diagram of an MTC access control apparatus according to the present invention. As shown in FIG. 8, the apparatus includes: a receiving unit and an access determining unit, where the receiving unit is configured to receive an access request sent by the MTC device and send the request An access judging unit, where the access request carries the MTC user identity information and the MTC device identity information; the access judging unit is configured to determine whether the MTC device is associated with the MTC user identity recognition module, and if yes, accept the MTC device Access, otherwise, denying access to the MTC device.

The access judging unit is further configured to: perform access authentication on the MTC user, or perform access authentication on the MTC user and perform authentication on the MTC device, and after the authentication is passed, determine whether the MTC device has been identified with the MTC user. The module is associated. The access judging unit implements the MTC user authentication function, or the MTC user authentication function and the MTC device authentication function shown in FIG.

The MTC access control device further includes: an association establishing unit, the receiving unit is further configured to receive an association request sent by the MTC device and send the association request to the association establishing unit; the association establishing unit is configured to determine whether the MTC device that needs to be associated has the identity with another MTC user The identification module is associated with, if yes, the association request is rejected, and if not, the association relationship between the MTC device and the MTC user identity module is established, and is further used to update the stored association relationship list.

The MTC access control device further includes: an association cancellation unit, the receiving unit is further configured to receive the cancellation association request sent by the MTC device and send the cancellation association request to the associated cancellation unit; and the associated cancellation unit is configured to determine whether the associated MTC device needs to be logged out and the MTC user The identity recognition module is associated with, if yes, the association relationship between the MTC device and the MTC user identity module is cancelled, and is further used to update the stored association relationship list, and if not, the logout association request is rejected. The association establishing unit and the associated deregistration unit implement the MTC user and MTC device association management functions shown in FIG.

The above description is only for the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included. Within the scope of protection of the present invention.

Claims

Claim

A machine type communication MTC access control method, the MTC device includes an MTC user identity recognition module, wherein the mobile communication network supports association between the MTC device and the MTC user identity module, and the method includes:

After receiving the access request sent by the MTC device, the mobile communication network determines whether the MTC device is associated with the identity recognition module, and if so, accepts the access of the MTC device; otherwise, the access of the MTC device is rejected.

The method according to claim 1, wherein before the determining whether the MTC device has been associated with the identity recognition module, the method further includes:

The MTC user is authenticated, or the MTC user is authenticated and the MTC device is authenticated. After the authentication is passed, it is determined whether the MTC device is associated with the identity module.

The method according to claim 1, wherein the determining whether the MTC device is associated with the identity recognition module is specifically:

Determining whether the MTC user identity information and the MTC device identity information carried in the access request meet the association relationship between the established MTC device and the MTC user identity module, and if yes, accept the access of the MTC device; otherwise, reject the MTC device. Access.

The method according to claim 3, wherein the determining whether the MTC user identity information and the MTC device identity information carried in the access request meet the association relationship between the established MTC device and the MTC user identity module, Specifically:

Determining, according to the stored association list, whether the MTC device identity information is associated with the corresponding MTC user identity information, and if the relationship between the MTC device identity information and the corresponding MTC user identity information exists in the association relationship list, accepting the access of the MTC device, Otherwise, access to the MTC device is denied.

5. The method according to claim 1, wherein the determining the MTC device is Before being associated with the identity module, it also includes:

The MTC device sends an association request to the mobile communication network, and after receiving the association request sent by the MTC device, the mobile communication network determines whether the associated MTC device has been associated with the identity recognition module of the other MTC user, and if yes, rejects the association request. Otherwise, the association relationship between the MTC device that needs to be associated and the identity module is established.

The method according to claim 5, wherein the association request includes MTC device identity information and MTC user identity information, and the determining whether the associated MTC device has been associated with an identity module of another MTC user , Specifically:

Determining whether the MTC device identity information is associated with other MTC user identity information based on the stored association list, and if the association relationship between the MTC device identity information and the MTC user identity information exists in the association relationship list, rejecting the association request, if the association relationship The association between the MTC device identity information and the MTC user identity information does not exist in the list, and the association relationship between the MTC device that needs to be associated and the identity recognition module is established, and the association relationship list is updated.

The method according to any one of claims 1 to 6, further comprising: after receiving the logout association request sent by the MTC device, the mobile communication network determines whether the associated MTC device needs to be logged off The identity module is associated, and if so, the association relationship between the MTC device and the identity module is logged off, otherwise, the logout association request is rejected.

The method according to claim 7, wherein the de-registration association request includes MTC user identity information and MTC device identity information, and the determining whether the associated MTC device needs to be logged off is associated with the identity recognition module, specifically For:

Determining whether the MTC device identity information is associated with the MTC user identity information based on the stored association list, and if the association relationship between the MTC device identity information and the MTC user identity information exists in the association relationship list, the MTC device and the identity recognition module are logged off. The association relationship is updated, and the association relationship list is updated. If the association relationship between the MTC device identity information and the MTC user identity information does not exist in the association relationship list, the logout association request is rejected.

A machine type communication access control system, comprising: an MTC device including an MTC user identity module, configured to send an access request to a mobile communication network; the MTC user identity recognition module is located on the UICC ;

a functional entity for MTC access control, located in the mobile communication network, configured to determine whether the MTC device is associated with the identity recognition module, and if yes, accessing the MTC device; otherwise, rejecting the MTC device Access.

10. The system of claim 9 wherein:

The MTC device is further configured to: send an association request to the mobile communication network;

The function entity for the MTC access control is further configured to: receive an association request sent by the MTC device, determine whether an associated MTC device is associated with an identity recognition module of another MTC user, and if yes, reject the The association request, if not, establishes an association relationship between the MTC device and the identity recognition module.

11. The system of claim 9 wherein:

The MTC device is further configured to: send a logout association request to the mobile communication network; the function entity for the MTC access control is further configured to: receive a logout association request sent by the MTC device, and determine that the associated MTC device needs to be logged out Whether the association module has been associated with the identity module, and if so, the association relationship of the MTC device with the identity module is logged out, and if not, the logout association request is rejected.

12. A system according to any one of claims 9 to 11 wherein:

13. A device for communication access control of a machine type, comprising:

a receiving unit, configured to receive an access request sent by the MTC device, and send the access request to the access determining unit, where the access request carries the MTC user identity information and the MTC device identity information; The access judging unit is configured to determine whether the MTC device is associated with the identity module of the MTC user, and if yes, accept the access of the MTC device, otherwise, reject the access of the MTC device.

The device according to claim 13, wherein the device further comprises: an association establishing unit,

The device according to claim 13, wherein the device further comprises: an associated logout unit,

The device according to any one of claims 13 to 15, wherein the access judging unit is further configured to:

The MTC user is authenticated by access, or the MTC user is authenticated and the MTC device is authenticated. After the authentication is passed, it is determined whether the MTC device is associated with the MTC user identity recognition module.