WO2013000214A1

WO2013000214A1 - Access control method and system for mtc device

Info

Publication number: WO2013000214A1
Application number: PCT/CN2011/080994
Authority: WO
Inventors: 马景旺
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-06-27
Filing date: 2011-10-19
Publication date: 2013-01-03
Also published as: CN102857899B; CN102857899A

Abstract

Disclosed is an access control method for a machine type communication (MTC) device, comprising: after an MTC device connection control network element receives an access request from an MTC device, if it is judged that the MTC server requested by the MTC device to connect to is an MTC server that allows connection, then allow the MTC device to connect with the MTC server; and if it is judged that the MTC server requested by the MTC device to connect to is an MTC device that does not allow connection, then deny the access request from the MTC device. Also disclosed is an access control system for an MTC device. The MTC device of the present invention can only connect to the permitted MTC server, thereby preventing the MTC device from accessing an irrelevant MTC server, thus saving system resources and improving efficiency of the MTC server. In addition, in the present invention, the process of the MTC device accessing the MTC server is restricted, thereby reducing the risks of the MTC server being attacked, thus improving system security.

Description

Access control method and system for MTC device

The present invention relates to the field of Machine Type Communication (MTC), and in particular, to an access control method and system for an MTC device. Background technique

Cellular wireless communication system includes Global System of Mobile communication (GSM), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Time Division Synchronization Code Wireless communication systems such as Time Division-Synchronous Code Division Multiple Access (TD-SCDMA) and Long Term Evolution (LTE), which are mainly composed of Core Network (CN) and Access Network (Radio Access). Network, RAN) and terminal components, wherein the core network is responsible for non-access stratum transactions, such as terminal location update, and is an anchor point of the user plane; the access network includes a base station or a base station and a base station controller, and the access network is responsible for receiving Incoming layer transactions (such as management of radio resources); there may be physical or logical connections between base stations according to actual conditions, and each base station may be connected to one or more core network nodes. A terminal and user equipment (UE) are various devices that can communicate with a cellular wireless communication network, such as a mobile phone.

In addition to supporting communication between people, the existing cellular communication network can further support the MTC service in order to meet other requirements. In the MTC service, the communication between the MTC devices is independently performed by the MTC device, and no one needs to be required. Participation. An MTC device is generally composed of a sensing device module (such as a sensor), a communication module, and a power source. In the MTC service, the MTC device obtains data through its sensing device module, and then reports the data to the cellular communication network through the communication module, and accesses the public data network through the cellular communication network. MTC business can be applied to logistics In the areas of monitoring, security detection, telemedicine detection, remote meter reading, etc., the data reported by the MTC device can be managed by the cellular network operator or the MTC server of the MTC service operator, and the data is provided to the relevant MTC users. MTC service operators can provide services for an industry (such as power companies, etc.) and MTC service organizations that provide services for multiple MTC users.

Figure 1 is a schematic diagram of a network structure of a cellular communication network supporting MTC services. As shown in Figure 1, the MTC device connects to the MTC server through the cellular communication network, and reports the data to the MTC server. There may be multiple MTC servers in the network structure. The MTC server may be located in the core network or in the public data network. When the MTC server is located in the public data network, the MTC server is generally managed by the MTC service operator through the relevant communication protocol. Establish a connection with the relevant network element in the core network.

In a large number of MTC devices in a cellular communication system, the MTC devices are respectively applied to different MTC service applications, and the data needs to be reported to the corresponding MTC server. However, in the prior art, the MTC device is not connected to the MTC server. The MTC device is connected to the MTC server that is not related to it, which causes the load of the MTC server to increase, which wastes system resources and reduces the efficiency of the MTC server. Moreover, the process of accessing the MTC server to the MTC server is not performed. The restriction also poses a security threat. It is easy for an attacker to use an MTC device to attack an MTC server, resulting in the MTC server not working properly. Summary of the invention

In view of this, the main object of the present invention is to provide an access control method and system for an MTC device, which can save system resources, improve the efficiency of the MTC server, and improve system security.

To achieve the above objective, the technical solution of the embodiment of the present invention is implemented as follows:

An access control method for a machine type communication (MTC) device, including:

The MTC device connection control network element receives the access request of the MTC device, and the access request at least carries the MTC server information that the MTC device requests to connect; The MTC device connection control network element determines whether the MTC server that the MTC device requests to connect is an MTC server that is allowed to connect, and determines that the MTC server that the MTC device requests to connect is an MTC server that is allowed to connect, and allows the MTC device to connect to the MTC server. And determining that the MTC server requested by the MTC device is not an MTC server that is allowed to connect, and rejecting the access request of the MTC device.

The MTC device connection control network element determines whether the MTC server that the MTC device requests to connect to is an MTC server that is allowed to connect is specifically:

Sending an inquiry message to a Home Subscriber Server (HSS) or a Home Subscriber Location Register (HLR) in the core network, where the query message carries at least the MTC device information that initiates the access request; and receives the MTC device returned by the HSS or the HLR. The MTC subscription user information; sending an inquiry message to the HSS or the HLR, where the inquiry message carries at least the MTC subscription user information;

Receiving MTC server information associated with the MTC subscription user returned by the HSS or the HLR;

The MTC server is associated with the MTC subscription user, and then determines that the MTC server is an MTC server that the MTC device is allowed to connect to; the MTC server does not have an association relationship with the MTC subscription user, and the MTC server Not the MTC server that the MTC device is allowed to connect to.

Sending a query message to the HSS or the HLR, where the query message carries at least the MTC device information that initiates the access request;

Receiving MTC server information associated with the MTC subscription user to which the MTC device belongs, returned from the HSS or HLR;

Determining, by the MTC server, the MTC subscription user, determining the MTC service The MTC server is the MTC server that the MTC device is allowed to connect to; the MTC server is not associated with the MTC subscription user, and the MTC server is not the MTC server that the MTC device is allowed to connect to.

Sending a query message to the HSS or the HLR, where the query message carries at least the MTC device information that initiates the access request and the MTC server information that the MTC device requests to connect;

Receiving the query result returned from the HSS or the HLR, the query result indicating that the MTC server is an MTC server associated with the MTC subscription user to which the MTC device belongs, and determining that the MTC server is an MTC server allowed to be connected by the MTC device The query result indicates that the MTC server is not the MTC server associated with the MTC subscription user to which the MTC device belongs, and then determines that the MTC server is not the MTC server allowed to be connected by the MTC device.

The association setting information of the MTC subscription user and the MTC server is saved by the HSS or the HLR. After the MTC device connection control network element allows the MTC device to connect to the MTC server, the method further includes:

The MTC device connection control network element establishes a connection between the MTC device and the MTC server.

The MTC device connection control network element is a gateway located in a core network, and the MTC server is located in a core network or a public data network.

An access control system for an MTC device, including an MTC device connection control network element, an MTC device, and an MTC server;

The MTC device is connected to the control network element, and is configured to determine, after receiving the access request of the MTC device, whether the MTC server requested by the MTC device is an MTC server that is allowed to connect, and determine that the MTC server requests the MTC server to connect to Connected MTC server, And the MTC device is allowed to connect to the MTC server; if the MTC server that the MTC device requests to connect to is not the MTC server that is allowed to connect, the access request of the MTC device is rejected.

The system also includes HSS or HLR,

Sending a query message to the HSS or the HLR in the core network, where the query message carries at least the MTC device information that initiates the access request;

Receiving, by the HSS or the HLR, the MTC subscription user information to which the MTC device belongs; sending an inquiry message to the HSS or the HLR, where the query message carries at least the MTC subscription user information;

The system also includes HSS or HLR,

The HSS or the HLR saves the association setting information of the MTC subscription user and the MTC server, and the MTC device connection control network element is further configured to establish, after the MTC device is allowed to connect to the MTC server, between the MTC device and the MTC server. connection.

The access control method and system of the MTC device in the embodiment of the present invention, after the MTC device connection control network element receives the access request of the MTC device, the MTC device connection control network element determines whether the MTC server requested by the MTC device is the MTC that is allowed to connect. The server determines that the MTC server that the MTC device requests to connect is the MTC server that is allowed to connect, and allows the MTC device to connect to the MTC server; determining that the MTC server that the MTC device requests to connect is not allowed The connected MTC server rejects the access request of the MTC device. With the present invention, the MTC device can only be connected to the licensed MTC server, so that the MTC device can be prevented from accessing the unrelated MTC server, thereby saving system resources and improving the efficiency of the MTC server, and the present invention accesses the MTC device. The process of the MTC server is limited, which can reduce the risk of the MTC server being attacked and improve system security. DRAWINGS

FIG. 1 is a schematic diagram of a network structure of a cellular communication network supporting MTC services;

2 is a schematic flowchart of an access control method of an MTC device according to an embodiment of the present invention;

3 is a schematic flowchart of an MTC device connection control network element determining whether an MTC server requested by an MTC device is an MTC server that is allowed to connect according to an embodiment of the present invention;

4 is a schematic flowchart of another MTC device connection control network element determining whether an MTC server connected to an MTC device request is an MTC server that is allowed to connect according to an embodiment of the present invention;

FIG. 5 is a schematic flowchart of another MTC device connection control network element determining whether an MTC server connected to an MTC device request is an MTC server that is allowed to connect according to an embodiment of the present invention;

6 is a schematic structural diagram of an access control system of an MTC device according to the present invention;

FIG. 7 is a schematic structural diagram of an access control system of an MTC device according to an embodiment of the present invention; FIG. 8 is a schematic diagram of a connection between an MTC device and an MTC device access control network element according to an embodiment of the present invention;

Schematic diagram of the process of accessing the MTC device to the MTC server. detailed description

The basic idea of the present invention is: after receiving the access request of the MTC device, the MTC device connection control network element determines that the MTC server requested by the MTC device is an MTC server that is allowed to connect, and allows the MTC device to connect to the MTC server; If it is determined that the MTC server requested by the MTC device is not the MTC server that is allowed to connect, the access request of the MTC device is rejected. 1 is a schematic flowchart of an access control method of an MTC device according to an embodiment of the present invention. As shown in FIG. 2, the method includes:

Step 201: The MTC device connection control network element receives an access request of the MTC device, and the access request carries at least the MTC server information that the MTC device requests to connect.

Step 202: The MTC device connection control network element determines whether the MTC server requested by the MTC device is an MTC server that is allowed to connect, and if yes, go to step 203; otherwise, go to step 204.

Step 203: Allow the MTC device to connect to the MTC server.

Step 204: Reject the access request of the MTC device.

FIG. 3 is a schematic flowchart of an MTC device connection control network element determining whether an MTC server requested by an MTC device is an MTC server that is allowed to connect, as shown in FIG. 3, where the process includes:

Step 1: The MTC device connection control network element sends a query message to the Home Subscriber Server (HSS) or the Home Location Register (HLR) in the core network, and the query message carries at least the request for initiating the access request. MTC device information; Step 2: The MTC device connection control network element receives the MTC subscription user information of the MTC device returned by the HSS or the HLR;

Step 3: The MTC device connection control network element sends an inquiry message to the HSS or the HLR, where the inquiry message carries at least the MTC subscription user information;

Step 4: The MTC device connection control network element receives the MTC server information associated with the MTC subscription user returned by the HSS or the HLR.

Step 5: The MTC device connection control network element determines whether the MTC server requested by the MTC device is associated with the MTC subscription user, that is, whether the MTC server requested by the MTC device is included in the MTC server information returned by the HSS or the HLR, if The MTC server is associated with the MTC subscription user, and the MTC server is allowed for the MTC device. The connected MTC server; if the MTC server does not have an associated relationship with the MTC subscription user, the MTC server is not the MTC server to which the MTC device is allowed to connect.

4 is a schematic diagram of another MTC device connection control network element determining whether an MTC server connected to an MTC device request is an MTC server that is allowed to connect, as shown in FIG. 4, the process includes:

Step Γ: The MTC device connection control network element sends an inquiry message to the HSS or the HLR, where the inquiry message carries at least the MTC device information that initiates the access request;

Step 2: The MTC device connection control network element receives the MTC server information that is returned from the HSS or the HLR and is associated with the MTC subscription user to which the MTC device belongs.

Step 3: The MTC device connection control network element determines whether the MTC server requested by the MTC device is associated with the MTC subscription user. If the MTC server is associated with the MTC subscription user, the MTC server is allowed for the MTC device. The connected MTC server; if the MTC server does not have an associated relationship with the MTC subscription user, the MTC server is not the MTC server to which the MTC device is allowed to connect.

FIG. 5 is a schematic diagram of another embodiment of the MTC device connection control network element determining whether the MTC server connected to the MTC device is an MTC server that is allowed to connect. As shown in FIG. 5, the process includes:

Step 1": The MTC device connection control network element sends an inquiry message to the HSS or the HLR, where the inquiry message carries at least the MTC device information that initiates the access request and the MTC server information that the MTC device requests to connect;

Step 2: The MTC device connection control network element receives the query result returned from the HSS or the HLR. If the query result indicates that the MTC server is the MTC server associated with the MTC subscription user to which the MTC device belongs, it is determined that the MTC server is the MTC server. The MTC server that the device is allowed to connect to; if the query result indicates that the MTC server is not the MTC server associated with the MTC subscription user to which the MTC device belongs, it is determined that the MTC server is not the MTC server. The MTC server to which the device is allowed to connect.

In the embodiment of the present invention, the MTC subscription user is associated with the MTC server, and the MTC server can connect with the MTC device of the MTC subscription user and obtain the data reported by the MTC device of the MTC subscription user.

In the embodiment of the present invention, the association setting information of the MTC subscription user and the MTC server may be saved in the HSS or the HLR in the core network; the MTC device connects the associated MTC server of the MTC subscription user obtained by the control network element from the HLR or the HSS. The information can be the identity or address of the MTC server.

In the embodiment of the present invention, after the MTC device connection control network element allows the MTC device to connect to the MTC server, the connection between the MTC device and the MTC server can be further established.

In the embodiment of the present invention, the MTC device connection control network element may be a gateway located in the core network, and the gateway serves as an access point of the core network and the MTC server located in the public data network, and the MTC device connects to the MTC through the gateway. server.

An embodiment of the present invention further provides an access control system for an MTC device. FIG. 6 is a schematic structural diagram of an access control system of an MTC device according to the present invention. As shown in FIG. 6, the system includes: an MTC device connection control network element. , MTC device, MTC server; among them,

The MTC device is connected to the control network element, and is configured to determine, after receiving the access request of the MTC device, whether the MTC server that the MTC device requests to connect is an MTC server that is allowed to connect, and determine that the MTC server requests the connected MTC server to be allowed. The connected MTC server allows the MTC device to connect to the MTC server; and determines that the MTC server that the MTC device requests to connect to is not the MTC server that is allowed to connect, rejects the access request of the MTC device.

The system also includes HSS or HLR,

Sending a query message to the HSS or HLR in the core network, where the query message carries at least Accessing the requested MTC device information;

Receiving, by the HSS or the HLR, the MTC subscription user information that is sent by the MTC device; sending an inquiry message to the HSS or the HLR, where the query message carries at least the MTC subscription user information;

The system also includes HSS or HLR,

Sending a query message to the HSS or the HLR, where the query message carries at least the request to initiate the access request MTC device information and MTC server information requested by the MTC device;

The MTC device is connected to the control network element, and is further configured to establish a connection between the MTC device and the MTC server after allowing the MTC device to connect to the MTC server.

As shown in FIG. 7, the MTC server may be located in the core network or in the public data network. The MTC device establishes a connection with the MTC server through the MTC device access control network element in the core network, where the MTC device can pass through the core network. The network element is connected to the MTC access control network element. For example, the MTC device establishes a connection with the MTC access control network element through the GGSN/P-GW.

In the present invention, the MTC device access control network element functions as a gateway when the MTC device accesses the MTC server. The MTC device access control network element and the MTC server located in the core network can communicate using the GPRS Tunneling Protocol (GTP) in the core network, and the MTC device access control network element and the MTC server located in the public data network. Communication can be performed using Network Domain Security/Internet Protocol (NDS/IP) or other communication protocols.

The present invention will be further described in detail below with reference to the accompanying drawings.

Example

In this embodiment, the MTC subscription user is generally an industry organization or a merchant, etc., which can There are multiple MTC devices; the MTC subscription user needs to determine its own associated MTC server, and the MTC device of the subscription user is reported to the MTC server associated with the MTC subscription user; the MTC server can be managed by the MTC subscription user, and the MTC server is generally The MTC server of the MTC subscription user may also be an MTC server located in the core network. In this case, the MTC server is generally managed by the cellular communication network operator and provides services to the MTC subscription user.

When the MTC device is used, the MTC subscription user and the cellular communication network operator sign a service agreement, and the HSS/HLR of the home network of the MTC device registers the subscription information of the MTC device, and the subscription information may include the identifier of the MTC device (for example, the international mobile subscriber identity code) , referred to as IMSI), the information of the supported service capabilities, and the MTC subscribers to which it belongs; the HSS/HLR also stores the information of the MTC subscribers, including the information of the MTC server associated with the MTC subscribers.

When the MTC device reports data, it needs to establish a connection between the radio access network and the MTC device access control network element in the core network, and then establish a connection between the MTC device access control network element and the MTC server, and further send the reported data to the relevant data. MTC server. In this embodiment, the MTC device can establish a connection with the MTC device access control network element through the packet service data service contact GGSN/P-GW in the core network.

The following describes the process of connecting the MTC device to the MTC server after the MTC device establishes a connection with the MTC device access control network element:

Step 801: The MTC device sends, to the MTC device access control network element, request information for accessing the MTC server.

The request information includes the address or identifier of the MTC server that is requested to access.

Step 802: The MTC device access control network element obtains information about the MTC subscription user to which the MTC device belongs from the HLR/HSS.

The MTC device access control network element can be obtained from the HSS/HLR according to the identifier of the MTC device. The information about the signing user of the MTC device, the information of the signing user may include the identifier of the signing user. Step 803: The MTC device access control network element obtains information about the associated MTC server of the signing user from the HSS/HLR according to the identifier of the signing user. ;

The information of the associated MTC server may include the identifier and the address of the associated MTC server, etc. Step 804: The MTC device access control network element determines whether the MTC server that the MTC device requests to access is an MTC server that is allowed to access; The MTC server performs the operation of step 805. If it is not the MTC server that is allowed to access, the operation of step 806 is performed.

The MTC device access control network element can determine whether the MTC server that the MTC device requests to access is the associated MTC server of the MTC subscription user to which the MTC device belongs; if the MTC server that the MTC device requests to access is the MTC subscription user to which the MTC device belongs The associated MTC server is the MTC server that is allowed to access, and vice versa, the MTC server is not allowed to access.

Step 805: The MTC device access control unit establishes a connection between the MTC device and the MTC server that is requested to access.

After the MTC device establishes a connection with the MTC server that is requested to access, the MTC device sends the reported data to the MTC server.

Step 806: The MTC device access control unit rejects the request of the MTC device to access the MTC server.

Through the method of the present invention, the MTC device connection control network element can control the connection between the MTC device and the MTC server, so that the MTC device can establish a connection with the correct MTC server, and avoid the connection between the MTC device and the unrelated MTC server. It can avoid the load increase of the MTC server and the security threat of attacks from the MTC device.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

Claim

1. An access control method for a machine type communication (MTC) device, wherein the method comprises:

The MTC device connection control network element receives an access request of the MTC device, and the access request carries at least the MTC server information that the MTC device requests to connect;

The MTC device connection control network element determines whether the MTC server that the MTC device requests to connect is an MTC server that is allowed to connect, and determines that the MTC server that the MTC device requests to connect is an MTC server that is allowed to connect, and allows the MTC device to connect to the MTC server. And determining that the MTC server requested by the MTC device is not an MTC server that is allowed to connect, and rejecting the access request of the MTC device.

2. The method according to claim 1, wherein the MTC device connection control network element determines whether the MTC server requested to be connected by the MTC device is an MTC server that is allowed to connect, specifically:

3. The method according to claim 1, wherein the MTC device is connected to a control network element Determining whether the MTC server requested by the MTC device to connect is an MTC server that is allowed to connect is specifically:

The method according to claim 1, wherein the MTC device connection control network element determines whether the MTC server requested to be connected by the MTC device is an MTC server that allows connection:

The method according to any one of claims 1 to 4, wherein the association setting information of the MTC subscription user and the MTC server is saved by the HSS or the HLR.

The method according to any one of claims 1 to 4, wherein, after the MTC device connection control network element allows the MTC device to connect to the MTC server, the method further includes: The MTC device connection control network element establishes a connection between the MTC device and the MTC server.

The method according to claim 6, wherein the MTC device connection control network element is a gateway located in a core network, and the MTC server is located in a core network or a public data network.

8. An access control system for an MTC device, wherein the system includes an MTC device connection control network element, an MTC device, and an MTC server; wherein

The MTC device is connected to the control network element, and is configured to determine, after receiving the access request of the MTC device, whether the MTC server requested by the MTC device is an MTC server that is allowed to connect, and determine that the MTC server requests the MTC server to connect to The connected MTC server allows the MTC device to connect to the MTC server; and determines that the MTC server that the MTC device requests to connect to is not the MTC server that is allowed to connect, rejects the access request of the MTC device.

The system according to claim 8, wherein the system further comprises an HSS or an HLR, and the MTC device connection control network element determines whether the MTC server requested to be connected by the MTC device is an MTC server that is allowed to connect, specifically:

The MTC server is associated with the MTC subscription user, and then determines that the MTC server is an MTC server that the MTC device is allowed to connect to; the MTC server does not have an association relationship with the MTC subscription user, and the MTC server Not the MTC device Allow connection to the MTC server.

The system according to any one of claims 9 to 11, wherein the HSS or the HLR saves association setting information of the MTC subscription user and the MTC server.

13. The system according to any one of claims 8 to 11, wherein

The system according to claim 13, wherein the MTC device connection control network element is a gateway located in a core network, and the MTC server is located in a core network or a public data network.