WO2013067772A1 - 一种mtc设备与uicc绑定的方法、装置及系统 - Google Patents

一种mtc设备与uicc绑定的方法、装置及系统 Download PDF

Info

Publication number
WO2013067772A1
WO2013067772A1 PCT/CN2012/070402 CN2012070402W WO2013067772A1 WO 2013067772 A1 WO2013067772 A1 WO 2013067772A1 CN 2012070402 W CN2012070402 W CN 2012070402W WO 2013067772 A1 WO2013067772 A1 WO 2013067772A1
Authority
WO
WIPO (PCT)
Prior art keywords
uicc
mtc device
identity information
binding
binding relationship
Prior art date
Application number
PCT/CN2012/070402
Other languages
English (en)
French (fr)
Inventor
余万涛
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US14/347,999 priority Critical patent/US9158549B2/en
Priority to EP12847016.8A priority patent/EP2750424B1/en
Publication of WO2013067772A1 publication Critical patent/WO2013067772A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/4401—Bootstrapping
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules
    • H04W12/48—Security arrangements using identity modules using secure binding, e.g. securely binding identity modules to devices, services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Definitions

  • the present invention relates to a mobile communication system and a machine type communication (MTC) technology, and in particular to a method, device and system for binding an MTC device to a Universal Integrated Circuit Card (UICC).
  • MTC machine type communication
  • UICC Universal Integrated Circuit Card
  • MTC is an application wireless communication technology that realizes data communication and communication between machines and machines, machines and people.
  • MTC applications are widely used, such as intelligent measurement, remote monitoring, tracking, medical treatment, etc.
  • MTC's equipment for machine-to-machine communication namely MTC devices, has a large number of applications and a wide range of applications, which has great market prospects.
  • the main long-distance connection technologies in MTC include Global System for Mobile Communications (GSM)/General Packet Radio Service (GPRS)/Universal Mobile Telecommunications System (UMTS).
  • the short-distance connection technologies mainly include 802.11 b/g, Bluetooth, Zigbee, Radio Frequency Identification (RFID) and the like.
  • MTC integrates wireless communication and information technology, it can be used for two-way communication, such as collecting information, setting parameters and sending commands over long distances, thus enabling different application scenarios such as security monitoring, vending, and cargo tracking. Almost all the equipment involved in daily life has the potential to become a potential customer of MTC.
  • MTC provides a simple means of establishing real-time data between devices, between remote devices, or with individuals.
  • the MTC device communicates with the MTC server (MTC Server) through the 3GPP (3GPP, Third Generation Partnership Projects) network. Letter.
  • MTC server MTC Server
  • 3GPP Third Generation Partnership Project
  • a shared key can be established between the UICC and the terminal by using a Generic Bootstrapping Architecture (GBA) process, and a secure connection is established between the UICC and the terminal, and secure communication is performed between the UICC and the terminal.
  • GBA Generic Bootstrapping Architecture
  • a secure connection can be used to bind the terminal to the UICC.
  • GBA defines a common key agreement mechanism between the terminal and the server. As shown in Figure 1, a description of the reference point between GBA and its network element entities is described.
  • a user equipment (UE, User Equipment) is a general term for a terminal device (such as a mobile phone) and a (U) SIM card.
  • the terminal here may be a mobile terminal of a card (such as a mobile phone), or may be a fixed terminal of the card.
  • the BSF BitTorrent, Network Application Function
  • AKA Authentication and Key Agreement
  • the session key of the communication, the BSF can set the life cycle of the key according to the local policy
  • the Home Subscriber Server stores the authentication data of the (U) SIM card in the UE, such as the secret in the SIM card.
  • the BSF obtains information about the HSS storing the relevant user data (such as the name of the HSS) by querying the subscription location function (SLF, Subscriber Locator Function), in a single HSS environment, or when the BSF is configured to use the pre-designated HSS When you do not need SLF.
  • SLF Subscriber Locator Function
  • the 3GPP network supports the establishment of a secure connection between the UICC and the terminal in the shared key mode, and the binding between the UICC and the terminal is implemented through a secure connection.
  • the shared key method defined by 3GPP is mainly: establishing a shared key Ks_local between the UICC and the terminal by using GBA (U.S. GBA-U, GBA with UlCC-based enhancements), and then using the shared key Ks- Local establishes a secure connection between the UICC and the terminal.
  • GBA U.S. GBA-U, GBA with UlCC-based enhancements
  • the MTC device since the MTC device needs to communicate without human intervention, During use, the MTC device may be used by an illegal user. Therefore, it is also necessary to bind the UICC to the MTC device to avoid illegal use of the UICC and the MTC device.
  • the method of implementing UICC and terminal binding in 3GPP can also be used for binding between UICC and MTC devices in the MTC system.
  • the binding relationship between the UICC and the MTC device established by the GBA-U mode can only be valid during the lifetime of the shared key Ks_local. After the lifetime of the shared key Ks_local is over, the binding relationship between the UICC and the MTC device may be lost, so that the MTC device may be used by other illegal users, or the UICC is used for an illegal MTC device.
  • the main purpose of the present invention is to provide a method, device, and system for binding an MTC device to a UICC, and to solve the problem that the binding relationship is shared when the MTC system uses the GBA-U method to implement binding between the MTC device and the UICC.
  • the present invention provides a method for binding an MTC device to a UICC, and the method includes: in a process of establishing a shared key, the NAF acquires identity information of the MTC device and identity information of the UICC;
  • the NAF establishes a binding relationship between the MTC device and the UICC according to the identity information of the MTC device and the identity information of the UICC, and saves the binding relationship between the MTC device and the UICC.
  • the process of establishing the shared key is: a process of establishing a shared key by using a GBAC (GBA-U) method based on UICC enhancement.
  • GBAC GBAC-U
  • the NAF is based on the identity information of the MTC device, and the UICC.
  • the identity information, the binding relationship between the MTC device and the UICC is established, and the NAF queries the binding relationship of the MTC device according to the UICC identity information and the identity information of the MTC device.
  • the binding relationship of the UICC, the MTC device does not have a binding relationship with the UICC, and the MTC device does not have a binding relationship with other UICCs, and the UICC does not have a binding relationship with other MTC devices.
  • the identity information of the MTC device includes one or more of the following information: an identity of the MTC device, an International Mobile Equipment Identity (IMEI), an IMEISV, an application identity;
  • IMEI International Mobile Equipment Identity
  • IMEISV International Mobile Equipment Identity
  • application identity an application identity
  • the identity information of the UICC includes one or more of the following information: an integrated circuit card identifier (ICCID) of the UICC, an identity information of the USIM on the UICC, and an application identity of the UICC; the establishing the MTC device and the The binding relationship between the UICCs includes: establishing a correspondence between any one or more kinds of information in the MTC device identity information and any one or more pieces of information in the UICC identity information.
  • ICCID integrated circuit card identifier
  • the method further includes: the NAF updating the binding relationship table stored by the NAF according to the user requirement.
  • the present invention also provides a method for establishing a shared key between an MTC device and a UICC, the method comprising:
  • the NAF receives a service request that is sent by the MTC device, including the identity information of the MTC device, and the identity information of the UICC;
  • the NAF based on the identity information of the MTC device and the identity information of the UICC, query the binding relationship of the MTC device in the binding relationship table stored in the self, and the binding relationship of the UICC;
  • the NAF When a binding relationship exists between the MTC device and the UICC, the NAF generates a shared key for secure communication between the MTC device and the UICC, and determines a life week of the shared key. And returning the shared key and the lifetime of the shared key to the MTC device.
  • the present invention further provides an apparatus for implementing binding of an MTC device and a UICC, the device comprising: an acquiring unit, a binding unit, and a storage unit;
  • An obtaining unit configured to acquire identity information of the MTC device and identity information of the UICC during the establishment of the shared key
  • a binding unit configured to establish, according to the identity information of the MTC device acquired by the acquiring unit, and the identity information of the UICC, a binding relationship between the MTC device and the UICC, and save the binding to the storage unit Relational tables;
  • a storage unit configured to save the binding relationship table.
  • the acquiring unit is configured to acquire the identity information of the MTC device and the identity information of the UICC in the process of establishing the shared key by using the GBA-U manner.
  • the binding unit is configured to: query the MTC device in the binding relationship table saved by the storage unit according to the UICC identity information acquired by the acquiring unit and the identity information of the MTC device a binding relationship, and a binding relationship of the UICC, where the MTC device does not have a binding relationship with the UICC, and the MTC device does not have a binding relationship with other UICCs, and the UICC and other MTC devices When there is no binding relationship, a binding relationship between the MTC device and the UICC is established.
  • the identity information of the MTC device includes one or more of the following information: an identity of the MTC device, an International Mobile Equipment Identity (IMEI), an IMEISV, an application identity;
  • IMEI International Mobile Equipment Identity
  • IMEISV International Mobile Equipment Identity
  • application identity an application identity
  • the identity information of the UICC includes one or more of the following information: an integrated circuit card identifier (ICCID) of the UICC, an identity information of the USIM on the UICC, and an application identity of the UICC; the binding unit is also used to establish a correspondence between any one or more of the MTC device identity information and any one or more of the UICC identity information.
  • the present invention further provides a system for implementing binding of an MTC device to a UICC, the system comprising: an MTC device, a UICC, and a NAF, where the NAF includes an acquiring unit, a binding unit, and a storage unit;
  • An obtaining unit configured to acquire identity information of the MTC device and identity information of the UICC from the MTC device after acquiring the identity information of the UICC from the UICC in the process of establishing the shared key;
  • a binding unit configured to establish, according to the identity information of the MTC device acquired by the acquiring unit, and the identity information of the UICC, a binding relationship between the MTC device and the UICC, and save the binding to the storage unit Relational tables;
  • a storage unit configured to save the binding relationship table.
  • the identity information of the MTC device includes one or more of the following information: an identity of the MTC device, an International Mobile Equipment Identity (IMEI), an IMEISV, an application identity;
  • IMEI International Mobile Equipment Identity
  • IMEISV International Mobile Equipment Identity
  • application identity an application identity
  • the identity information of the UICC includes one or more of the following information: an integrated circuit card identifier (ICCID) of the UICC, an identity information of the USIM on the UICC, and an application identity of the UICC; the binding unit is further configured to: Establishing a correspondence between any one or more kinds of information in the MTC device identity information and any one or more pieces of information in the UICC identity information.
  • ICCID integrated circuit card identifier
  • the present invention further provides a system for implementing a shared key between an MTC device and a UICC, the system comprising: an MTC device, a UICC, and a NAF;
  • An MTC device configured to interact with the UICC, initiate establishment of a shared key, and obtain identity information of the UICC from the UICC;
  • the NAF is configured to receive, by the MTC device, a service request that includes the identity information of the MTC device and the identity information of the UICC, and query the self-storage based on the identity information of the MTC device and the identity information of the UICC.
  • Binding relationship of the MTC device in the binding relationship table, and a binding relationship of the UICC exists between the MTC device and the UICC When the relationship is bound, a shared key for secure communication between the MTC device and the UICC is generated, a life cycle of the shared key is obtained, and the shared key and the lifetime of the shared key are returned.
  • a shared key for secure communication between the MTC device and the UICC is generated, a life cycle of the shared key is obtained, and the shared key and the lifetime of the shared key are returned.
  • the NAF acquires the identity information of the MTC device and the identity information of the UICC in the process of establishing the shared key, and establishes a relationship between the MTC device and the UICC.
  • the binding relationship is saved and saved, and the binding between the UICC and the MTC device is implemented, and the UICC is restricted to be used by the specific MTC device, so that the binding relationship between the MTC device and the UICC is not shared by using the GBA-U method.
  • the key life cycle is limited, so that the use of the MTC device and the UICC can be ensured in real time.
  • Figure 1 is a schematic diagram showing the structure of the existing GBA
  • FIG. 2 is a flowchart of an implementation of a method for binding an MTC device to a UICC according to the present invention
  • FIG. 3 is a schematic structural diagram of a system for binding an MTC device to a UICC according to Embodiment 1 of the present invention
  • FIG. 4 is a schematic flowchart of a process of binding a MTC device to a UICC according to Embodiment 1 of the present invention
  • FIG. 5 is a schematic flowchart of establishing a shared key after an MTC device is bound to a UICC according to Embodiment 1 of the present invention.
  • the basic idea of the present invention is: in the process of establishing a shared key between the UICC and the MTC device, establishing a binding relationship between the UICC and the MTC device on the NAF and saving the binding relationship in the binding relationship table to implement binding of the UICC and the MTC device, Limit UICC for specific MTC devices.
  • the binding method of the MTC device and the UICC of the present invention may mainly include the following steps:
  • Step 101 In the process of establishing the shared key Ks_local, the NAF acquires the MTC device. Identity information, and identity information of the UICC;
  • the process of establishing the shared key Ks_local is specifically as follows: The process of establishing the shared key Ks_local by using the GBA-U method.
  • Step 102 The NAF establishes a binding relationship between the MTC device and the UICC according to the identity information of the MTC device and the identity information of the UICC, and saves the binding relationship between the MTC device and the UICC.
  • the shared key Ks_local establishment process is started; in the shared key Ks_local During the establishment process, the NAF obtains the identity information of the MTC device and the UICC identity information, and establishes a binding relationship between the MTC device and the UICC based on the identity information of the MTC device and the identity information of the UICC, and saves the binding relationship to the binding relationship table. .
  • the establishing a binding relationship between the MTC device and the UICC may be: establishing an association relationship between the MTC device identity information and the UICC identity information.
  • the identity information of the MTC device may include one or more of the following information: an identity of the MTC device (Terminal-ID), an international mobile device identity code (IMEI, International Mobile Equipment Identity), an IMEISV, an application identity ( Terminal — appli — ID ) and so on.
  • an identity of the MTC device (Terminal-ID)
  • IMEI international mobile device identity code
  • IMEISV International Mobile Equipment Identity
  • an application identity Terminal — appli — ID
  • the identity information of the UICC may include one or more of the following information: UICC's Integrated Circuit Card Identity (ICCID), USIM identity information on the UICC (eg, USIM's International Mobile Subscriber Identity (IMSI) International Mobile Subscriber Identification Number ) ), and UICC application identity (UICC appli lD ) and other information.
  • ICCID Integrated Circuit Card Identity
  • IMSI International Mobile Subscriber Identity
  • UICC application identity UICC application identity
  • the establishing the binding relationship between the MTC device and the UICC may include: establishing any one or more kinds of information in the MTC device identity information, and any one of the UICC identity information. Correspondence between one or more kinds of information.
  • the binding relationship between the UICC and the MTC device can also be updated according to the needs of the user. Specifically, the user logs in to the NAF through the MTC device, and sends an update request to the NAF. When the NAF determines that the update request is valid, the user updates the binding relationship table stored by itself according to the update request.
  • the user may send an update request to the NAF by logging in to the NAF, and when the NAF determines that the update request is valid, the user stores the update request according to the update request.
  • the update is made corresponding to the binding relationship table of the user.
  • the present invention further provides a method for establishing a shared key between an MTC device and a UICC.
  • the method is implemented in a GBA-U manner.
  • the method includes: the NAF receiving the MTC device sent includes the After the identity information of the MTC device and the service request of the identity information of the UICC, the binding relationship of the MTC device in the binding relationship table stored in the self-check and the binding relationship of the UICC are performed in the MTC device and the UICC.
  • the NAF receiving the MTC device sent includes the After the identity information of the MTC device and the service request of the identity information of the UICC, the binding relationship of the MTC device in the binding relationship table stored in the self-check and the binding relationship of the UICC are performed in the MTC device and the UICC.
  • a shared key is generated, a life cycle of the shared key is determined, and the shared key and a life cycle of the shared key are returned to the MTC device.
  • the NAF rejects the request of the MTC device.
  • the present invention further provides an apparatus for implementing binding of an MTC device and a UICC, the apparatus comprising: an acquiring unit, a binding unit, and a storage unit; wherein, the acquiring unit is configured to establish a shared key In the process, the identity information of the MTC device and the identity information of the UICC are obtained.
  • the binding unit is configured to establish the MTC device and the UICC according to the identity information of the MTC device acquired by the acquiring unit and the identity information of the UICC. a binding relationship between the binding relationship and the storage relationship unit; the storage unit is configured to save the binding relationship table.
  • the obtaining unit may be configured to obtain the identity information of the MTC device and the identity information of the UICC in the process of establishing the shared key by using the GBA-U manner.
  • the binding unit may be configured to: acquire a UICC identity letter according to the acquiring unit And the identity information of the MTC device, the binding relationship of the MTC device in the binding relationship table saved by the storage unit, and the binding relationship of the UICC, where the MTC device and the UICC are not When there is a binding relationship, and the MTC device does not have a binding relationship with other UICCs, and the UICC does not have a binding relationship with other MTC devices, the binding relationship between the MTC device and the UICC is established.
  • the binding unit is configured to establish a correspondence between any one or more kinds of information in the MTC device identity information and any one or more pieces of information in the UICC identity information.
  • the present invention also provides a system for implementing binding of an MTC device to a UICC, the system comprising: the foregoing MTC device, UICC, and NAF.
  • the present invention further provides a system for implementing a shared key between an MTC device and a UICC, where the system may include: an MTC device, a UICC, and an NAF; wherein the MTC device is configured to interact with the UICC to start Establishing a shared key, and obtaining identity information of the UICC from the UICC; the NAF is configured to receive, by the MTC device, a service request that includes the identity information of the MTC device and the identity information of the UICC, based on The identity information of the MTC device and the identity information of the UICC, the binding relationship of the MTC device in the binding relationship table stored by the user, and the binding relationship of the UICC; between the MTC device and the UICC When a binding relationship exists, a shared key for secure communication between the MTC device and the UICC is generated, a life cycle of the shared key is obtained, and the shared key and the life cycle of the shared key are generated. Returned to the MTC device.
  • the system may include: an MTC device, a UICC,
  • the system for implementing the binding of the MTC device and the UICC, and the system for implementing the shared key between the MTC device and the UICC may be the same system.
  • FIG. 3 is a structural diagram of a system for implementing binding of a UICC and an MTC device in this embodiment.
  • the system includes: an MTC device, a UICC, and a NAF, where the UICC is installed on the MTC device, and the NAF is responsible for the key establishment process between the UICC and the MTC device, and the binding relationship between the MTC and the UICC is stored in On the NAF.
  • the system may further include: a BSF, where the NAF and the BSF are used to implement a shared key establishment process between the UICC and the MTC device by using the GBA-U mode.
  • the BSF is used to pass the AKA protocol.
  • the MTC device is authenticated and can set the lifetime of the shared key according to local policies.
  • NAF is a key center used to establish a shared key between an MTC device and a UICC. It can be located in a mobile communication network or outside a mobile communication network.
  • the UICC is provided with a user identification module.
  • the user identity module may be a Subscriber Identity Module (SIM), a Universal Subscriber Identity Module (USIM), or an IP Multimedia Service Identity Module (ISIM).
  • SIM Subscriber Identity Module
  • USIM Universal Subscriber Identity Module
  • ISIM IP Multimedia Service Identity Module
  • the specific implementation process of binding the UICC and the MTC device, as shown in FIG. 4 may include the following steps:
  • Step 200 The MTC device checks whether it stores a valid shared key Ks_local for communicating with the UICC. If yes, proceed to step 201. If not, the GBA-U-based key establishment process needs to be started, and the steps are continued. 202;
  • Step 201 The MTC device sends a verification request of the shared key Ks_local to the UICC, and requests the UICC to check whether it also has a legal shared key Ks_local.
  • the UICC receives the verification request and checks whether it has a legal shared key. Ks_local, if not, proceed to step 202, and if yes, end the current process;
  • Step 202 The MTC device sends a request for starting the key establishment process to the UICC.
  • the request for starting the key establishment process may include identity information of the MTC device.
  • the identity information of the MTC device may include one or more of the following information: MTC The identity of the device, the IMEI or IMEISV of the MTC device, the application identity of the MTC device, and so on.
  • Step 203 The UICC receives the request for the startup key establishment process sent by the MTC device, starts the GBA-U process, generates the intermediate key Ks_int-NAF, and the boot session identifier used to identify the current GBA-U process (B -TID, Bootstrapping Transaction Identifier), obtain the NAF_ID of the NAF from the information stored by itself or from the BSF, and feed back the NAF_ID, the B-TID, and the identity information of the NAC to the MTC device;
  • B -TID Bootstrapping Transaction Identifier
  • Step 204 The MTC device sends a shared key generation instruction to the UICC, and the UICC receives the shared key generation instruction, generates a shared key Ks_local, and obtains information such as a life cycle of the shared key Ks_local;
  • Step 205 The MTC device establishes a secure connection with the NAF based on the NAF-ID of the UICC feedback.
  • Step 206 The MTC device sends a service request to the NAF through a secure connection established with the NAF, where the service request includes the B- TID and UICC identity information, and identity information of the MTC device;
  • Step 207 The NAF, according to the UICC identity information in the service request and the identity information of the MTC device, query the binding relationship of the MTC device and the binding relationship of the UICC, and the MTC device does not have a binding relationship with the UICC. If the MTC device does not have a binding relationship with other UICCs, and the UICC does not have a binding relationship with other MTC devices, proceed to step 208;
  • the NAF queries whether the binding relationship between the UICC identity information and the identity information of the MTC device exists in the binding relationship table stored in the NAF. If yes, the binding relationship exists between the MTC device and the UICC. If not, there is no binding relationship between the MTC device and the UICC.
  • Step 208 The NAF generates a shared key according to the B-TID in the service request information. Ks_local, and determining the lifecycle of the shared key Ks_local, sending the shared key Ks_local and its lifecycle to the MTC device, and the UICC identity information and the MTC device in the service request information.
  • the identity information is bound and stored in the binding relationship table of the storage, and the establishment of the shared key Ks_local and the binding between the MTC device and the UICC are implemented.
  • the binding relationship between the UICC and the MTC device may be one or more of the following:
  • the binding relationship between the UICC and the MTC device that is, the correspondence between the ICCID of the UICC and the Terminal-ID of the MTC device;
  • the binding relationship between the USIM and the MTC device on the UICC that is, the correspondence between the identity information of the USIM on the UICC (such as IMSI) and the identity information of the MTC device (such as IMEI or IMEISV);
  • the relationship between the application on the UICC and the application on the MTC device that is, the correspondence between the UICC appli lD of the UICC and the Terminal-appli-ID of the MTC device; or, the ICCID and UICC_appli-ID of the UICC, and the MTC
  • the specific implementation process of establishing the shared key Ks_local may include the following steps:
  • Steps 300-306 identical to steps 200-206;
  • Step 307 The NAF queries the binding relationship of the MTC device and the binding relationship of the UICC according to the UICC identity information in the service request information and the identity information of the MTC device, and the binding relationship between the MTC device and other UICCs is And / or UICC and other MTC devices exist If the binding relationship exists, and the MTC device does not have a binding relationship with the UICC, the NAF rejects the service request of the MTC, returns a message that the service request fails to the MTC device, and ends the current process; When the UICC has a binding relationship, proceed to step 308;
  • Step 308 The NAF generates a shared key Ks_local according to the B-TID in the service request information, and obtains a lifecycle of the shared key Ks_local, and sends the shared key Ks_local and its life cycle. To the MTC device, the establishment of the shared key Ks_local is implemented.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明公开了一种机器类通信（MTC）设备与通用集成电路卡（UICC）绑定的方法，所述方法包括：在共享密钥的建立过程中，应用服务器（NAF）获取MTC设备的身份信息、以及UICC的身份信息（101）；NAF根据所述MTC设备的身份信息、以及UICC的身份信息，建立所述MTC设备与所述UICC之间的绑定关系，并保存到自身存储的绑定关系表中（102）。本发明还公开了用于MTC设备与UICC绑定的装置及系统，以及一种MTC设备与UICC之间建立共享密钥的方法和系统，使得采用增强的通用引导构架（GBA-U）方法实现MTC设备与UICC之间的绑定时绑定关系不会受到共享密钥生命周期的限制，从而能够实时确保MTC设备与UICC的使用安全。

Description

一种 MTC设备与 UICC绑定的方法、 装置及系统 技术领域
本发明涉及移动通信系统和机器类通信 （ MTC , Machine Type Communication )技术 , 特别地 , 涉及一种 MTC设备与通用集成电路卡 ( UICC, Universal Integrated Circuit Card )绑定的方法、 装置及系统。 背景技术
MTC是实现机器与机器、 机器与人之间的数据通信和交流的应用无线 通信技术， MTC应用范围非常广泛， 例如智能测量、 远程监控、 跟踪、 医 疗等。 与传统的人与人之间的通信相比， MTC中用于机器到机器通信的设 备， 即 MTC设备（MTC Device )数量巨大， 应用领域广泛， 具有巨大的 市场前景。
MTC中主要的远距离连接技术包括全球移动通信系统（GSM, Global System for Mobile communications )/通用分组无线服务技术（ GPRS, General Packet Radio Service) /通用移动通信系统 （UMTS , Universal Mobile Telecommunications System ) , 近距离连接技术主要有 802.11 b/g、 蓝牙、 紫 蜂（Zigbee )、 射频识别 （RFID, Radio Frequency Identification )等。 由于 MTC整合了无线通信和信息技术， 可用于双向通信， 如远距离收集信息、 设置参数和发送指令， 因此可实现不同的应用方案， 如安全监测、 自动售 货、 货物跟踪等。 几乎所有日常生活中涉及到的设备都有可能成为 MTC的 潜在服务对象。 MTC提供了设备实时数据在系统之间、 远程设备之间、 或 与个人之间建立无线连接的简单手段。
现有的 MTC系统中， MTC设备通过第三代合作伙伴计划（ 3GPP, Third Generation Partnership Projects ) 网络与 MTC服务器（ MTC Server )进行通 信。
在 3GPP 系统中， UICC 与终端之间可以使用通用引导架构 （GBA, Generic Bootstrapping Architecture )过程建立共享密钥， 用于 UICC与终端 之间建立安全连接， 并进行安全通信， UICC与终端之间的安全连接可以用 于对终端和 UICC进行绑定。 GBA定义了一种在终端和服务器之间通用的 密钥协商机制。如图 1所示，描述了 GBA及其各网元实体间的参考点描述。 其中， 用户设备（UE, User Equipment )是终端设备（如手机）和 (U)SIM 卡的总称， 这里的终端可以是插卡的移动终端（如手机等）， 也可以是插卡 的固定终端（如机顶盒等）；应用服务器（ NAF , Network Application Function ) 用于实现应用的业务逻辑功能，在完成对 UE的认证后为 UE提供业务服务； ？ I导月良务功能 ( BSF , Bootstrapping Server Function )是 GBA的核心网元， BSF 和 UE 通过认证与密钥协商协议 （AKA, Authentication and Key Agreement )实现认证，并且协商出随后用于 UE和 NAF间通信的会话密钥， BSF能够根据本地策略设定密钥的生命周期； 归属用户服务器（HSS, Home Subscriber Server )存储了 UE 中 (U) SIM卡的鉴权数据， 如 SIM卡中的密 钥 Ki等； BSF通过查询签约位置功能（ SLF, Subscriber Locator Function ) 获得存储相关用户数据的 HSS的相关信息 （如 HSS的名称）， 在单一 HSS 环境中、 或者当 BSF配置成使用预先指定的 HSS时， 不需要 SLF。
目前 3GPP网络支持在共享密钥方式下，建立 UICC与终端之间安全连 接， 通过安全连接实现对 UICC与终端之间的绑定。 3GPP定义的共享密钥 方式主要是：通过基于 UICC增强的 GBA ( GBA-U, GBA with UlCC-based enhancements )方式建立 UICC与终端之间的共享密钥 Ks— local, 再使用共 享密钥 Ks— local建立 UICC与终端之间的安全连接。如此建立的 UICC与终 端之间的绑定只能在共享密钥 Ks— local的生命周期内有效。
在 MTC系统中， 由于 MTC设备需要在无人干预的情况下进行通信， 在使用过程中， MTC设备可能被非法用户使用， 因此， 也需要将 UICC与 MTC设备绑定， 以避免 UICC和 MTC设备被非法使用。 在 3GPP中实现 UICC与终端绑定的方法也可以用于 MTC系统中 UICC与 MTC设备之间的 绑定。但在 MTC系统中，以 GBA-U方式建立的 UICC与 MTC设备之间的 绑定关系只能在共享密钥 Ks— local的生命周期内有效。在共享密钥 Ks— local 的生命周期结束后， UICC与 MTC设备之间的绑定关系会失去作用， 使得 MTC设备有可能被其他非法用户使用， 或者 UICC被用于非法的 MTC设 备。
因此，对于 3GPP网络和 MTC系统来说，在使用 GBA-U方法实现 MTC 设备与 UICC 之间的绑定时， 如何避免建立的绑定关系不受共享密钥 Ks— local生命周期的限制是需要解决的问题。 发明内容
有鉴于此， 本发明的主要目的在于提供一种 MTC设备与 UICC绑定的 方法、装置及系统，解决 MTC系统采用 GBA-U方法实现 MTC设备与 UICC 之间的绑定时绑定关系受共享密钥 Ks— local生命周期限制的问题。
为达到上述目的， 本发明的技术方案是这样实现的：
本发明提供了一种 MTC设备与 UICC绑定的方法， 所述方法包括： 在共享密钥的建立过程中， NAF获取 MTC设备的身份信息、以及 UICC 的身份信息；
NAF根据所述 MTC设备的身份信息、 以及 UICC的身份信息， 建立所 述 MTC设备与所述 UICC之间的绑定关系， 并保存到自身存储的绑定关系 表中。
在上述方案中， 所述共享密钥的建立过程为： 采用基于 UICC增强的 GBA ( GBA-U )方式建立共享密钥的过程。
在上述方案中， 所述 NAF根据所述 MTC设备的身份信息、 以及 UICC 的身份信息， 建立所述 MTC设备与所述 UICC之间的绑定关系， 包括： 所述 NAF根据所述 UICC身份信息和所述 MTC设备的身份信息， 查 询所述 MTC设备的绑定关系、 以及所述 UICC的绑定关系， 在所述 MTC 设备与所述 UICC不存在绑定关系， 且 MTC设备与其他 UICC不存在绑定 关系、 同时所述 UICC与其他 MTC设备也不存在绑定关系时， 建立所述
MTC设备与所述 UICC之间的绑定关系。
在上述方案中，所述 MTC设备的身份信息包括以下信息中的一种或多 种： MTC设备的身份标识、 国际移动设备身份码（IMEI )、 IMEISV, 应用 身份标识；
所述 UICC的身份信息包括以下信息中的一种或多种： UICC的集成电 路卡识别码（ ICCID )、 UICC上 USIM的身份信息和 UICC的应用身份标识； 所述建立所述 MTC设备与所述 UICC之间的绑定关系， 包括： 建立所 述 MTC设备身份信息中的任意一种或多种信息、 与所述 UICC身份信息中 的任意一种或多种信息之间的对应关系。
在上述方案中， 所述方法还包括： 所述 NAF根据用户需求对自身存储 的绑定关系表进行更新。
本发明还提供了一种 MTC设备与 UICC之间建立共享密钥的方法， 所 述方法包括：
NAF接收 MTC设备所发送包含有所述 MTC设备的身份信息、 以及 UICC的身份信息的服务请求；
NAF基于所述 MTC设备的身份信息、 以及 UICC的身份信息， 查询自 身存储的绑定关系表中所述 MTC设备的绑定关系、 以及所述 UICC的绑定 关系；
在所述 MTC设备与 UICC之间存在绑定关系时， NAF生成用于所述 MTC设备与 UICC之间安全通信的共享密钥， 确定所述共享密钥的生命周 期， 并将所述共享密钥以及所述共享密钥的生命周期返回给所述 MTC设 备。
本发明还提供了一种用于实现 MTC设备与 UICC绑定的装置， 所述装 置包括： 获取单元、 绑定单元和存储单元； 其中，
获取单元，用于在共享密钥的建立过程中，获取 MTC设备的身份信息、 以及 UICC的身份信息；
绑定单元， 用于根据所述获取单元所获取 MTC设备的身份信息、 以及 UICC的身份信息， 建立所述 MTC设备与所述 UICC之间的绑定关系， 并 保存到存储单元中的绑定关系表；
存储单元， 用于保存所述绑定关系表。
在上述方案中， 所述获取单元， 用于在采用 GBA-U方式建立共享密钥 的过程中， 获取 MTC设备的身份信息、 以及 UICC的身份信息。
在上述方案中， 所述绑定单元， 用于： 根据所述获取单元所获取 UICC 身份信息和所述 MTC设备的身份信息，查询所述存储单元保存的绑定关系 表中所述 MTC设备的绑定关系、 以及所述 UICC的绑定关系，在所述 MTC 设备与所述 UICC不存在绑定关系， 且所述 MTC设备与其他 UICC不存在 绑定关系、 同时所述 UICC与其他 MTC设备也不存在绑定关系时， 建立所 述 MTC设备与所述 UICC之间的绑定关系。
在上述方案中，所述 MTC设备的身份信息包括以下信息中的一种或多 种： MTC设备的身份标识、 国际移动设备身份码（IMEI )、 IMEISV, 应用 身份标识；
所述 UICC的身份信息包括以下信息中的一种或多种： UICC的集成电 路卡识别码（ ICCID )、 UICC上 USIM的身份信息和 UICC的应用身份标识； 所述绑定单元还用于建立所述 MTC设备身份信息中的任意一种或多 种信息、 与所述 UICC身份信息中的任意一种或多种信息之间的对应关系。 本发明还提供了一种用于实现 MTC设备与 UICC绑定的系统， 所述系 统包括： MTC设备、 UICC和 NAF, NAF包括获取单元、 绑定单元和存储 单元； 其中，
获取单元，用于在共享密钥的建立过程中，所述 MTC设备从所述 UICC 获取 UICC的身份信息后，从所述 MTC设备中获取 MTC设备的身份信息、 以及 UICC的身份信息；
绑定单元， 用于根据所述获取单元所获取 MTC设备的身份信息、 以及 UICC的身份信息， 建立所述 MTC设备与所述 UICC之间的绑定关系， 并 保存到存储单元中的绑定关系表；
存储单元， 用于保存所述绑定关系表。
在上述方案中，所述 MTC设备的身份信息包括以下信息中的一种或多 种： MTC设备的身份标识、 国际移动设备身份码（IMEI )、 IMEISV, 应用 身份标识；
所述 UICC的身份信息包括以下信息中的一种或多种： UICC的集成电 路卡识别码（ ICCID )、 UICC上 USIM的身份信息和 UICC的应用身份标识； 所述绑定单元还用于：建立所述 MTC设备身份信息中的任意一种或多 种信息、 与所述 UICC身份信息中的任意一种或多种信息之间的对应关系。
本发明还提供了一种用于实现 MTC设备与 UICC建立共享密钥的系 统， 所述系统包括： MTC设备、 UICC和 NAF; 其中，
MTC设备， 用于与所述 UICC交互， 启动共享密钥的建立， 并从所述 UICC中获取 UICC的身份信息；
NAF, 用于接收到所述 MTC设备所发送包含有所述 MTC设备的身份 信息、以及 UICC的身份信息的服务请求，基于所述 MTC设备的身份信息、 以及 UICC的身份信息， 查询自身存储的绑定关系表中所述 MTC设备的绑 定关系、 以及所述 UICC的绑定关系； 在所述 MTC设备与 UICC之间存在 绑定关系时， 生成用于所述 MTC设备与 UICC之间安全通信的共享密钥， 得到所述共享密钥的生命周期， 并将所述共享密钥以及所述共享密钥的生 命周期返回给所述 MTC设备。
本发明提供的 MTC设备与 UICC绑定方法、装置及系统， NAF在共享 密钥的建立过程中获取 MTC设备的身份信息、 以及 UICC的身份信息， 建 立所述 MTC设备与所述 UICC之间的绑定关系并保存，实现 UICC与 MTC 设备之间的绑定， 限制 UICC用于特定的 MTC设备， 使得采用 GBA-U方 法实现 MTC设备与 UICC之间的绑定时绑定关系不会受到共享密钥生命周 期的限制， 从而能够实时确保 MTC设备与 UICC的使用安全。 附图说明
图 1为现有 GBA的组成结构示意图；
图 2为本发明 MTC设备与 UICC绑定方法的实现流程图；
图 3为本发明实施例一中用于 MTC设备与 UICC绑定的系统的组成结 构示意图；
图 4为本发明实施例一中 MTC设备与 UICC绑定过程的流程示意图； 图 5为本发明实施例一中 MTC设备与 UICC绑定后建立共享密钥的流 程示意图。 具体实施方式
本发明的基本思想是： UICC与 MTC设备建立共享密钥的过程中， 在 NAF上建立 UICC与 MTC设备的绑定关系并保存到绑定关系表中， 实现 UICC与 MTC设备的绑定， 以限制 UICC用于特定的 MTC设备。
本发明 MTC设备与 UICC绑定方法， 如图 2所示， 主要可以包括如下 步驟：
步驟 101 : 在共享密钥 Ks— local的建立过程中， NAF获取 MTC设备的 身份信息、 以及 UICC的身份信息；
这里， 共享密钥 Ks— local的建立过程具体为： 采用 GBA-U方式建立共 享密钥 Ks— local的过程。
步驟 102: NAF根据所述 MTC设备的身份信息、 以及 UICC的身份信 息， 建立所述 MTC设备与所述 UICC之间的绑定关系， 并保存到自身存储 的绑定关系表中。
实际应用中， 当 MTC设备与 UICC之间需要进行安全通信时， MTC 设备与 UICC之间不存在共享密钥 Ks— local,则启动共享密钥 Ks— local建立 过程； 在共享密钥 Ks— local的建立过程中， NAF获取 MTC设备的身份信 息、 以及 UICC身份信息， 并基于 MTC设备的身份信息与 UICC的身份信 息， 建立 MTC设备与 UICC的绑定关系并保存到所述绑定关系表中。
其中， 所述建立所述 MTC设备与所述 UICC之间的绑定关系， 具体可 以是：建立所述 MTC设备身份信息与所述 UICC身份信息之间的关联关系。
这里， MTC设备的身份信息可以包括以下信息中的一种或多种： MTC 设备的身份标识（Terminal— ID )、 国际移动设备身份码（ IMEI, International Mobile Equipment Identity ), IMEISV、 应用身份标识（ Terminal— appli— ID ) 等。
UICC的身份信息可以包括以下信息中的一种或多种： UICC的集成电 路卡识别码（ ICCID, Integrate Circuit Card Identity ), UICC上 USIM的身 份信息 （如 USIM 的国际移动用户识别码 （IMSI , International Mobile Subscriber Identification Number ) )、 和 UICC 的应用 身份标识 ( UICC appli lD )等信息。
这里， 所述建立所述 MTC设备与所述 UICC之间的绑定关系， 可以包 括： 建立所述 MTC设备身份信息中的任意一种或多种信息、 与所述 UICC 身份信息中的任意一种或多种信息之间的对应关系。 实际应用中， UICC与 MTC设备的绑定关系还可以根据用户的需求进 行更新。 具体地， 用户通过 MTC设备登录到所述 NAF上， 向所述 NAF发 送更新请求， NAF判断所述更新请求有效时， 按照所述更新请求对自身存 储的绑定关系表进行更新。 例如， 当用户原有的 MTC设备损坏或不在属于 该用户时， 用户可以通过登录所述 NAF, 向所述 NAF发送更新请求， NAF 判断所述更新请求有效时， 按照所述更新请求对自身存储的对应于该用户 的绑定关系表进行更新。
相应的， 本发明还提供了一种 MTC设备与 UICC之间建立共享密钥的 方法， 该方法通过 GBA-U方式实现， 具体地， 该方法包括： NAF接收到 MTC设备所发送包含有所述 MTC设备的身份信息、 以及 UICC的身份信 息的服务请求后， 查询自身存储的绑定关系表中所述 MTC设备的绑定关 系、 以及所述 UICC的绑定关系， 在所述 MTC设备与 UICC之间存在绑定 关系时， 生成共享密钥， 确定所述共享密钥的生命周期， 并将所述共享密 钥以及所述共享密钥的生命周期返回给所述 MTC设备。
这里， 如果 MTC设备与其他 UICC有绑定关系， 和 /或 UICC与其他 MTC设备存在绑定关系， 则 NAF拒绝 MTC设备的请求。
相应的，本发明还提供了一种用于实现 MTC设备与 UICC绑定的装置， 所述装置包括： 获取单元、 绑定单元和存储单元； 其中， 获取单元， 用于 在共享密钥的建立过程中， 获取 MTC设备的身份信息、 以及 UICC的身份 信息； 绑定单元， 用于根据所述获取单元所获取 MTC设备的身份信息、 以 及 UICC的身份信息， 建立所述 MTC设备与所述 UICC之间的绑定关系， 并保存到存储单元中的绑定关系表； 存储单元， 用于保存所述绑定关系表。
这里，所述获取单元可以用于在采用 GBA-U方式建立共享密钥的过程 中， 获取 MTC设备的身份信息、 以及 UICC的身份信息。
这里，所述绑定单元可以用于：根据所述获取单元所获取 UICC身份信 息和所述 MTC设备的身份信息，查询所述存储单元保存的绑定关系表中所 述 MTC设备的绑定关系、 以及所述 UICC的绑定关系， 在所述 MTC设备 与所述 UICC不存在绑定关系，且 MTC设备与其他 UICC不存在绑定关系、 同时所述 UICC与其他 MTC设备也不存在绑定关系时， 建立所述 MTC设 备与所述 UICC之间的绑定关系。具体地，所述绑定单元用于建立所述 MTC 设备身份信息中的任意一种或多种信息、与所述 UICC身份信息中的任意一 种或多种信息之间的对应关系。
本发明还提供了一种用于实现 MTC设备与 UICC绑定的系统， 所述系 统包括： 上述的 MTC设备、 UICC和 NAF。
此外， 本发明还提供了一种用于实现 MTC设备与 UICC建立共享密钥 的系统， 所述系统可以包括： MTC设备、 UICC和 NAF; 其中， MTC设备， 用于与所述 UICC交互，启动共享密钥的建立，并从所述 UICC中获取 UICC 的身份信息； NAF, 用于接收到所述 MTC设备所发送包含有所述 MTC设 备的身份信息、 以及 UICC的身份信息的服务请求， 基于所述 MTC设备的 身份信息、以及 UICC的身份信息，查询自身存储的绑定关系表中所述 MTC 设备的绑定关系、 以及所述 UICC的绑定关系； 在所述 MTC设备与 UICC 之间存在绑定关系时， 生成用于所述 MTC设备与 UICC之间安全通信的共 享密钥， 得到所述共享密钥的生命周期， 并将所述共享密钥以及所述共享 密钥的生命周期返回给所述 MTC设备。
实际应用中， 所述用于实现 MTC设备与 UICC绑定的系统、 以及用于 实现 MTC设备与 UICC建立共享密钥的系统可以是同一个系统。
实施例一
本实施例中， 以 3GPP网络为例说明 UICC与 MTC设备绑定的具体实 现过程。
图 3是本实施例中用于实现 UICC与 MTC设备绑定的系统的组成结构 示意图， 其中， 所述系统包括： MTC设备、 UICC和 NAF, 其中， UICC 安装在 MTC设备上， NAF负责 UICC与 MTC设备之间的密钥建立过程， MTC与 UICC之间的绑定关系存储在 NAF上。
实际应用中， 所述系统还可以包括： BSF , 所述 NAF与 BSF共同用于 采用 GBA-U方式实现 UICC与 MTC设备之间的共享密钥建立过程， 具体 地， BSF用于通过 AKA协议对 MTC设备进行认证， 并能够根据本地策略 设定共享密钥的生命周期。 NAF是用于建立 MTC设备与 UICC之间共享密 钥的密钥中心， 它可以位于移动通信网络中， 也可以位于移动通信网络之 外。
其中， UICC上设置有用户身份识别模块。 这里， 用户身份识别模块可 以是用户标识模块（ SIM, Subscriber Identity Module )、 通用用户标识模块 ( USIM, Universal Subscriber Identity Module )或 IP多媒体业务标识模块 ( ISIM, IP Multi Media Service Identity Module )。
本实施例中， UICC与 MTC设备绑定的具体实现流程， 如图 4所示， 可以包括如下步驟：
步驟 200: MTC设备检查自身是否存储有用于与 UICC进行通信的合 法共享密钥 Ks— local, 如果是， 则继续步驟 201 , 如果不是， 则需要启动基 于 GBA-U的密钥建立过程， 继续步驟 202;
步驟 201 : MTC设备向 UICC发送共享密钥 Ks— local的检验请求， 请 求 UICC检验其是否也有合法的共享密钥 Ks— local, UICC接收到所述检验 请求， 检验自身是否有合法的共享密钥 Ks— local, 如果不是， 则继续步驟 202, 如果是， 则结束当前流程；
步驟 202: MTC设备向 UICC发送用于启动密钥建立过程的请求。 这里，所述用于启动密钥建立过程的请求中可以包括 MTC设备的身份 信息。 其中， MTC设备的身份信息可以包括如下信息的一种或多种： MTC 设备的身份标识、 MTC设备的 IMEI或 IMEISV、 MTC设备的应用身份标 识等。
步驟 203: UICC接收所述 MTC设备所发送启动密钥建立过程的请求， 启动 GBA-U过程， 生成中间密钥 Ks— int— NAF、 以及用于标识当前 GBA-U 过程的引导会话标识 ( B-TID, Bootstrapping Transaction Identifier ), 从自身 存储的信息中或从 BSF 上获取 NAF 的 NAF— ID, 并向 MTC设备反馈 NAF— ID、 B-TID以及自身的身份信息；
步驟 204: MTC设备向 UICC发送共享密钥生成指令， UICC接收所述 共享密钥生成指令，生成共享密钥 Ks— local,并得到共享密钥 Ks— local的生 命周期等信息；
这里， 由 BSF设定共享密钥 Ks— local的生命周期后返回给 UICC。 步驟 205: MTC设备基于 UICC反馈的 NAF— ID与 NAF建立安全连接； 步驟 206: MTC设备通过与 NAF之间建立的安全连接， 向 NAF发送 服务请求， 所述服务请求中包含 UICC反馈的 B-TID和 UICC身份信息、 以及所述 MTC设备的身份信息；
步驟 207: NAF根据所述服务请求中的 UICC身份信息和所述 MTC设 备的身份信息， 查询 MTC设备的绑定关系、 以及 UICC 的绑定关系， 在 MTC设备与所述 UICC不存在绑定关系，且 MTC设备与其他 UICC不存在 绑定关系、 同时所述 UICC与其他 MTC设备也不存在绑定关系时， 继续步 驟 208;
具体地， NAF在自身存储的绑定关系表中查询是否存在 UICC身份信 息和所述 MTC设备的身份信息之间的绑定关系， 如果是， 则所述 MTC设 备与 UICC之间存在绑定关系， 如果不是， 则所述 MTC设备与 UICC之间 不存在绑定关系。
步驟 208: NAF 根据所述服务请求信息中的 B-TID, 生成共享密钥 Ks— local, 并确定共享密钥 Ks— local的生命周期， 将所述共享密钥 Ks— local 及其生命周期发送给 MTC设备， 并将所述服务请求信息中 UICC身份信息 和所述 MTC设备的身份信息绑定后存储到自身存储的绑定关系表中， 实现 共享密钥 Ks— local的建立、 以及所述 MTC设备与 UICC之间的绑定。
其中， UICC与 MTC设备之间的绑定关系具体可以是以下的一种或多 种：
第一： UICC与 MTC设备之间的绑定关系： 即 UICC的 ICCID与 MTC 设备的 Terminal— ID之间的对应关系；
第二： UICC上 USIM与 MTC设备的绑定关系： 即 UICC上 USIM的 身份信息（如 IMSI )与 MTC设备的身份信息（如 IMEI或 IMEISV ) 的对 应关系；
第三： UICC 上应用与 MTC 设备上应用的关联关系： 即 UICC 的 UICC appli lD与 MTC设备的 Terminal— appli— ID之间的对应关系； 或者， UICC 的 ICCID 及 UICC— appli— ID、 与 MTC 设备的 Terminal— ID 及 Terminal— appli— ID之间的对应关系； 或者， UICC上 USIM的 IMSI及 UICC 的 UICC— appli— ID、 与 MTC设备的身份信息（ IMEI或 IMEISV )及 MTC 设备的 Terminal— appli— ID之间的对应关系。
实际应用中，在 MTC设备与 UICC之间建立绑定关系后， UICC与 MTC 设备之间的共享密钥 Ks— local失效， 需要进行安全通信时， 则需要重新建 立新的共享密钥 Ks— local, 此时， 建立共享密钥 Ks— local的具体实现流程， 如图 5所示， 可以包括如下步驟：
步驟 300-306: 与步驟 200-206完全相同；
步驟 307: NAF根据所述服务请求信息中的 UICC身份信息和所述 MTC 设备的身份信息， 查询 MTC设备的绑定关系、 以及 UICC的绑定关系， 在 MTC设备与其他 UICC存在绑定关系、 和 /或 UICC与其他 MTC设备存在 绑定关系， 且 MTC设备与所述 UICC不存在绑定关系时， 则 NAF拒绝所 述 MTC的服务请求， 返回服务请求失败的消息给所述 MTC设备， 结束当 前流程； 在所述 MTC设备与所述 UICC存在绑定关系时， 继续步驟 308;
步驟 308: NAF 根据所述服务请求信息中的 B-TID, 生成共享密钥 Ks— local, 并得到共享密钥 Ks— local的生命周期， 将所述共享密钥 Ks— local 及其生命周期发送给 MTC设备， 实现共享密钥 Ks— local的建立。
以上所述， 仅为本发明的较佳实施例而已， 并非用于限定本发明的保 护范围。

Claims

权利要求书
1、 一种机器类通信 MTC设备与通用集成电路卡 UICC绑定的方法， 其特征在于， 所述方法包括：
在共享密钥的建立过程中， 应用服务器 NAF获取 MTC设备的身份信 息、 以及 UICC的身份信息；
NAF根据所述 MTC设备的身份信息、 以及 UICC的身份信息， 建立所 述 MTC设备与所述 UICC之间的绑定关系， 并保存到自身存储的绑定关系 表中。
2、 根据权利要求 1所述 MTC设备与 UICC绑定的方法， 其特征在于， 所述共享密钥的建立过程为：采用基于 UICC增强的 GBA GBA-U方式 建立共享密钥的过程。
3、 根据权利要求 1所述 MTC设备与 UICC绑定的方法， 其特征在于， 所述 NAF根据所述 MTC设备的身份信息、 以及 UICC的身份信息， 建立 所述 MTC设备与所述 UICC之间的绑定关系， 包括：
所述 NAF根据所述 UICC身份信息和所述 MTC设备的身份信息， 查 询所述 MTC设备的绑定关系、 以及所述 UICC的绑定关系， 在所述 MTC 设备与所述 UICC不存在绑定关系， 且 MTC设备与其他 UICC不存在绑定 关系、 同时所述 UICC与其他 MTC设备也不存在绑定关系时， 建立所述 MTC设备与所述 UICC之间的绑定关系。
4、 根据权利要求 1或 3所述 MTC设备与 UICC绑定的方法， 其特征 在于，
所述 MTC设备的身份信息包括以下信息中的一种或多种： MTC设备 的身份标识、 国际移动设备身份码 IMEI、 IMEISV, 应用身份标识；
所述 UICC的身份信息包括以下信息中的一种或多种： UICC的集成电 路卡识别码 ICCID、 UICC上 USIM的身份信息和 UICC的应用身份标识； 所述建立所述 MTC设备与所述 UICC之间的绑定关系， 包括： 建立所 述 MTC设备身份信息中的任意一种或多种信息、 与所述 UICC身份信息中 的任意一种或多种信息之间的对应关系。
5、 根据权利要求 1至 3任一项所述 MTC设备与 UICC绑定的方法， 其特征在于， 所述方法还包括： 所述 NAF根据用户需求对自身存储的绑定 关系表进行更新。
6、 一种 MTC设备与 UICC之间建立共享密钥的方法， 其特征在于， 所述方法包括：
NAF接收 MTC设备所发送包含有所述 MTC设备的身份信息、 以及 UICC的身份信息的服务请求；
NAF基于所述 MTC设备的身份信息、 以及 UICC的身份信息， 查询自 身存储的绑定关系表中所述 MTC设备的绑定关系、 以及所述 UICC的绑定 关系；
在所述 MTC设备与 UICC之间存在绑定关系时， NAF生成用于所述 MTC设备与 UICC之间安全通信的共享密钥， 确定所述共享密钥的生命周 期， 并将所述共享密钥以及所述共享密钥的生命周期返回给所述 MTC设 备。
7、 一种用于实现 MTC设备与 UICC绑定的装置， 其特征在于， 所述 装置包括： 获取单元、 绑定单元和存储单元； 其中，
获取单元，用于在共享密钥的建立过程中，获取 MTC设备的身份信息、 以及 UICC的身份信息；
绑定单元， 用于根据所述获取单元所获取 MTC设备的身份信息、 以及 UICC的身份信息， 建立所述 MTC设备与所述 UICC之间的绑定关系， 并 保存到存储单元中的绑定关系表；
存储单元， 用于保存所述绑定关系表。
8、 根据权利要求 Ί所述用于实现 MTC设备与 UICC绑定的装置， 其 特征在于，所述获取单元，用于在采用 GBA-U方式建立共享密钥的过程中， 获取 MTC设备的身份信息、 以及 UICC的身份信息。
9、 根据权利要求 7所述用于实现 MTC设备与 UICC绑定的装置， 其 特征在于， 所述绑定单元， 用于： 根据所述获取单元所获取 UICC身份信息 和所述 MTC设备的身份信息，查询所述存储单元保存的绑定关系表中所述 MTC设备的绑定关系、 以及所述 UICC的绑定关系， 在所述 MTC设备与 所述 UICC不存在绑定关系， 且所述 MTC设备与其他 UICC不存在绑定关 系、同时所述 UICC与其他 MTC设备也不存在绑定关系时，建立所述 MTC 设备与所述 UICC之间的绑定关系。
10、 根据权利要求 7所述实现 MTC设备与 UICC绑定的装置， 其特征 在于，
所述 MTC设备的身份信息包括以下信息中的一种或多种： MTC设备 的身份标识、 国际移动设备身份码 IMEI、 IMEISV, 应用身份标识；
所述 UICC的身份信息包括以下信息中的一种或多种： UICC的集成电 路卡识别码 ICCID、 UICC上 USIM的身份信息和 UICC的应用身份标识； 所述绑定单元还用于建立所述 MTC设备身份信息中的任意一种或多 种信息、 与所述 UICC身份信息中的任意一种或多种信息之间的对应关系。
11、 一种用于实现 MTC设备与 UICC绑定的系统， 其特征在于， 所述 系统包括： MTC设备、 UICC和 NAF, NAF包括获取单元、 绑定单元和存 储单元； 其中，
获取单元，用于在共享密钥的建立过程中，所述 MTC设备从所述 UICC 获取 UICC的身份信息后，从所述 MTC设备中获取 MTC设备的身份信息、 以及 UICC的身份信息；
绑定单元， 用于根据所述获取单元所获取 MTC设备的身份信息、 以及 UICC的身份信息， 建立所述 MTC设备与所述 UICC之间的绑定关系， 并 保存到存储单元中的绑定关系表；
存储单元， 用于保存所述绑定关系表。
12、 根据权利要求 11所述实现 MTC设备与 UICC绑定的系统， 其特 征在于，
所述 MTC设备的身份信息包括以下信息中的一种或多种： MTC设备 的身份标识、 国际移动设备身份码 IMEI、 IMEISV, 应用身份标识；
所述 UICC的身份信息包括以下信息中的一种或多种： UICC的集成电 路卡识别码 ICCID、 UICC上 USIM的身份信息和 UICC的应用身份标识； 所述绑定单元还用于建立所述 MTC设备身份信息中的任意一种或多 种信息、 与所述 UICC身份信息中的任意一种或多种信息之间的对应关系。
13、 一种用于实现 MTC设备与 UICC建立共享密钥的系统， 其特征在 于， 所述系统包括： MTC设备、 UICC和 NAF; 其中，
MTC设备， 用于与所述 UICC交互， 启动共享密钥的建立， 并从所述 UICC中获取 UICC的身份信息；
NAF, 用于接收到所述 MTC设备所发送包含有所述 MTC设备的身份 信息、以及 UICC的身份信息的服务请求，基于所述 MTC设备的身份信息、 以及 UICC的身份信息， 查询自身存储的绑定关系表中所述 MTC设备的绑 定关系、 以及所述 UICC的绑定关系； 在所述 MTC设备与 UICC之间存在 绑定关系时， 生成用于所述 MTC设备与 UICC之间安全通信的共享密钥， 得到所述共享密钥的生命周期， 并将所述共享密钥以及所述共享密钥的生 命周期返回给所述 MTC设备。
PCT/CN2012/070402 2011-11-11 2012-01-16 一种mtc设备与uicc绑定的方法、装置及系统 WO2013067772A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US14/347,999 US9158549B2 (en) 2011-11-11 2012-01-16 Method, apparatus and system for binding MTC device and UICC
EP12847016.8A EP2750424B1 (en) 2011-11-11 2012-01-16 Method, device and system for binding mtc device and uicc

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201110356685.XA CN103108311B (zh) 2011-11-11 2011-11-11 一种mtc设备与uicc绑定的方法、装置及系统
CN201110356685.X 2011-11-11

Publications (1)

Publication Number Publication Date
WO2013067772A1 true WO2013067772A1 (zh) 2013-05-16

Family

ID=48288488

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/070402 WO2013067772A1 (zh) 2011-11-11 2012-01-16 一种mtc设备与uicc绑定的方法、装置及系统

Country Status (4)

Country Link
US (1) US9158549B2 (zh)
EP (1) EP2750424B1 (zh)
CN (1) CN103108311B (zh)
WO (1) WO2013067772A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111049672A (zh) * 2019-11-18 2020-04-21 蔚复来(浙江)科技股份有限公司 一种物联网设备id智能分配方法

Families Citing this family (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB201122206D0 (en) 2011-12-22 2012-02-01 Vodafone Ip Licensing Ltd Sampling and identifying user contact
US9781085B2 (en) * 2012-02-14 2017-10-03 Nokia Technologies Oy Device to device security using NAF key
US9100175B2 (en) 2013-11-19 2015-08-04 M2M And Iot Technologies, Llc Embedded universal integrated circuit card supporting two-factor authentication
US9350550B2 (en) * 2013-09-10 2016-05-24 M2M And Iot Technologies, Llc Power management and security for wireless modules in “machine-to-machine” communications
GB2518255A (en) 2013-09-13 2015-03-18 Vodafone Ip Licensing Ltd Communicating with a machine to machine device
US10498530B2 (en) 2013-09-27 2019-12-03 Network-1 Technologies, Inc. Secure PKI communications for “machine-to-machine” modules, including key derivation by modules and authenticating public keys
US10700856B2 (en) 2013-11-19 2020-06-30 Network-1 Technologies, Inc. Key derivation for a module using an embedded universal integrated circuit card
CN105792095A (zh) * 2014-12-23 2016-07-20 中兴通讯股份有限公司 用于mtc分组通信的密钥协商方法、系统及网络实体
US9853977B1 (en) 2015-01-26 2017-12-26 Winklevoss Ip, Llc System, method, and program product for processing secure transactions within a cloud computing system
US10834136B2 (en) 2017-06-15 2020-11-10 Palo Alto Networks, Inc. Access point name and application identity based security enforcement in service provider networks
US10721272B2 (en) * 2017-06-15 2020-07-21 Palo Alto Networks, Inc. Mobile equipment identity and/or IOT equipment identity and application identity based security enforcement in service provider networks
US11050789B2 (en) 2017-06-15 2021-06-29 Palo Alto Networks, Inc. Location based security in service provider networks
US10693918B2 (en) 2017-06-15 2020-06-23 Palo Alto Networks, Inc. Radio access technology based security in service provider networks
US10708306B2 (en) 2017-06-15 2020-07-07 Palo Alto Networks, Inc. Mobile user identity and/or SIM-based IoT identity and application identity based security enforcement in service provider networks
US10812532B2 (en) 2017-06-15 2020-10-20 Palo Alto Networks, Inc. Security for cellular internet of things in mobile networks
KR102462366B1 (ko) 2018-04-06 2022-11-04 삼성전자주식회사 eUICC 버전을 협상하는 방법 및 장치
CN110446200A (zh) * 2018-05-03 2019-11-12 北京握奇智能科技有限公司 一种物联网业务机卡绑定的方法和系统
CN110958598B (zh) * 2018-09-26 2022-05-06 中国移动通信有限公司研究院 一种移动终端和sim卡的绑定认证方法和装置
CN112449341B (zh) * 2019-08-29 2022-08-09 华为云计算技术有限公司 IoT设备数据管理方法、装置和系统
CN110995745B (zh) * 2019-12-17 2021-09-21 武汉绿色网络信息服务有限责任公司 一种物联网非法机卡分离识别的方法及装置
CN111901792B (zh) * 2020-09-08 2023-04-07 中国联合网络通信集团有限公司 一种uicc应用设置信息管理方法、系统及终端

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102026241A (zh) * 2009-09-10 2011-04-20 华为技术有限公司 业务检测方法及核心网设备、检测设备
CN102137397A (zh) * 2011-03-10 2011-07-27 西安电子科技大学 机器类型通信中基于共享群密钥的认证方法
CN102238534A (zh) * 2011-07-15 2011-11-09 电信科学技术研究院 终端标识通知及维护方法和设备

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2210436A1 (en) 2007-10-05 2010-07-28 InterDigital Technology Corporation Techniques for secure channelization between uicc and a terminal
CN102075909B (zh) 2009-11-23 2014-01-01 中兴通讯股份有限公司 一种imsi与imei绑定关系的校验方法和装置
CN102196438A (zh) * 2010-03-16 2011-09-21 高通股份有限公司 通信终端标识号管理的方法和装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102026241A (zh) * 2009-09-10 2011-04-20 华为技术有限公司 业务检测方法及核心网设备、检测设备
CN102137397A (zh) * 2011-03-10 2011-07-27 西安电子科技大学 机器类型通信中基于共享群密钥的认证方法
CN102238534A (zh) * 2011-07-15 2011-11-09 电信科学技术研究院 终端标识通知及维护方法和设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2750424A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111049672A (zh) * 2019-11-18 2020-04-21 蔚复来(浙江)科技股份有限公司 一种物联网设备id智能分配方法
CN111049672B (zh) * 2019-11-18 2022-09-02 蔚复来(浙江)科技股份有限公司 一种物联网设备id智能分配方法

Also Published As

Publication number Publication date
EP2750424A4 (en) 2015-03-04
CN103108311A (zh) 2013-05-15
EP2750424A1 (en) 2014-07-02
CN103108311B (zh) 2017-11-28
EP2750424B1 (en) 2018-01-03
US20140244994A1 (en) 2014-08-28
US9158549B2 (en) 2015-10-13

Similar Documents

Publication Publication Date Title
WO2013067772A1 (zh) 一种mtc设备与uicc绑定的方法、装置及系统
US9467432B2 (en) Method and device for generating local interface key
EP2744250B1 (en) Method and apparatus for binding universal integrated circuit card and machine type communication device
US20090217038A1 (en) Methods and Apparatus for Locating a Device Registration Server in a Wireless Network
US9992673B2 (en) Device authentication by tagging
CN102595389B (zh) 一种mtc服务器共享密钥的方法及系统
WO2011035572A1 (zh) 一种m2m设备归属网络运营商变更的方法和系统
CN102469455B (zh) 基于通用引导架构的机器类通信设备分组管理方法及系统
US20120178418A1 (en) Method and System for Changing a Selected Home Operator of a Machine to Machine Equipment
WO2016179966A1 (zh) 一种实现网络接入的方法、终端及计算机存储介质
WO2012151941A1 (zh) 终端组的移动性管理实体选择方法及系统
WO2011029296A1 (zh) 向机器到机器设备提供机器通信身份模块的系统及方法
US20160316311A1 (en) Method and apparatus for provisioning an operational subscription
WO2012151819A1 (zh) 一种mtc设备触发的方法和系统
WO2012151846A1 (zh) 一种触发特定位置终端的方法、系统和终端
WO2011029308A1 (zh) 一种m2m设备归属网络运营商变更的方法和系统
WO2012151928A1 (zh) 一种触发终端组的方法及系统
WO2011029297A1 (zh) 向机器到机器设备提供机器通信身份模块的系统及方法
EP4203392B1 (en) Authentication support for an electronic device to connect to a telecommunications network
WO2012062115A1 (zh) 一种机器类通信接入控制的方法、系统及装置
WO2023126296A1 (en) Authentication support for an electronic device to connect to a telecommunications network
WO2013113185A1 (zh) 业务签约信息处理方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12847016

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 14347999

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2012847016

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE