WO2013181847A1 - 一种无线局域网接入鉴权方法、设备及系统 - Google Patents

一种无线局域网接入鉴权方法、设备及系统 Download PDF

Info

Publication number
WO2013181847A1
WO2013181847A1 PCT/CN2012/076662 CN2012076662W WO2013181847A1 WO 2013181847 A1 WO2013181847 A1 WO 2013181847A1 CN 2012076662 W CN2012076662 W CN 2012076662W WO 2013181847 A1 WO2013181847 A1 WO 2013181847A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
user equipment
access point
wlan
point device
Prior art date
Application number
PCT/CN2012/076662
Other languages
English (en)
French (fr)
Inventor
李欢
蔡慧
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201280000791.7A priority Critical patent/CN103609154B/zh
Priority to PCT/CN2012/076662 priority patent/WO2013181847A1/zh
Publication of WO2013181847A1 publication Critical patent/WO2013181847A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • Wireless local area network access authentication method device and system
  • the present invention relates to the field of communications, and in particular, to a wireless local area network access authentication method, device, and system.
  • the access network is functionally independent, but in the case of being physically integrated, the authentication process of the existing user equipment (User Equipment, UE for short) from the 3GPP network and the WLAN network is as shown in Figure 1, and generally includes :
  • the UE accesses the 3GPP network, and sends an Attach Request access request to a Mobility Management Entity (MME).
  • MME Mobility Management Entity
  • NAS Network Access Server, network access server
  • the UE and the MME derive the master key K ASME NAS key K for encryption NASint, K NASenc, and means between the UE and eNodeB (evolved Node B, a base station) air interface encryption key K eN . deB .
  • the UE completes the PDN (Packet Data Network) connection establishment process on the 3GPP side.
  • K eN . deB is passed to the eNodeB, and the key required for air interface encryption is derived from this
  • the UE accesses from the WLAN network, and the layer 2 connection establishment is completed.
  • the WLAN network sends an Extensible Authentication Protocol (MME) request message to the UE, and triggers the UE to initiate authentication authentication.
  • MME Extensible Authentication Protocol
  • the UE sends an extended authentication protocol response message EAP-RSP, including its own identifier.
  • the WLAN network sends an EAP response message sent by the UE to the AAA. (Authentication Authorization Accounting, Authentication, Authorization, and Billing).
  • the AAA server retrieves an authentication vector from a Home Subscriber Server (HSS).
  • HSS Home Subscriber Server
  • the AAA server retrieves the subscription data from the HS S (Home Subscriber Server).
  • the AAA server sends the EAP-REQ to the WLAN access network, where the authentication parameters RAND and AUTN are carried.
  • the WLAN access network forwards the EAP-REQ message to the UE.
  • the UE checks the parameters in the EAP-REQ message and verifies the network. And send an EAP-RSP message to the WLAN access network.
  • the WLAN access network sends this EAP-RSP message to the AAA server.
  • the AAA server sends an authentication response message EAP Success to the WLAN access network, where the key MSK (Master Session Key) is carried.
  • MSK Master Session Key
  • the WLAN access network stores the key MSK, and notifies the UE that the authentication is successful. So far, the UE shares the key generated in this authentication process with the WLAN access network.
  • the authentication authentication mode used by the UE when accessing the 3GPP core network from the 3GPP is different from the authentication authentication mode used by the UE when accessing the GPP from the WLAN to the 3GPP core network.
  • the UE accesses the 3GPP core network from 3GPP and WLAN in succession even if the 3GPP access network and the WLAN access network are the same carrier and share the same subscription data, the authentication authentication process needs to go through two Set, this will bring a long delay to the connection establishment.
  • An embodiment of the present invention provides a WLAN access authentication method, device, and system.
  • the UE can implement the UE from 3 Fast authentication for GPP and WLAN access to the 3GPP core network.
  • a wireless local area network access authentication method including: an access point device acquiring a user identifier of a user equipment by using a wireless local area network (WLAN); and the access point device searching for the user according to the user identifier.
  • WLAN wireless local area network
  • the access point device sends, by using the WLAN, an authentication success message carrying the key or the derived key of the key to the user equipment, to indicate that the user equipment is allowed to use the key or the The derived key is accessed to the WLAN.
  • a base station and an access point device convergence entity including: a first receiving unit, configured to receive, by using a third generation partnership plan 3GPP network, a first message that is sent by a user equipment and includes a user identifier of the user equipment, Extracting and saving the user identifier;
  • a key obtaining unit configured to obtain a key for air interface encryption performed by the user equipment with the 3GPP network, and save the key and a correspondence between the key and the user identifier;
  • a second receiving unit configured to acquire the user identifier of the user equipment by using a wireless local area network (WLAN);
  • WLAN wireless local area network
  • a searching unit configured to find the key according to the user identifier and the correspondence relationship
  • a sending unit configured to send, by using the WLAN, an authentication success message carrying the key or a derived key of the key to the user equipment, to indicate that the user equipment is allowed to use the key or the A derived key accesses the WLAN.
  • a base station including:
  • a first receiving unit configured to receive, by using a third generation partnership plan 3GPP network, a first message that is sent by the user equipment and that includes the user identifier of the user equipment, and extracts and saves the user identifier;
  • a key obtaining unit configured to obtain a key for air interface encryption performed by the user equipment with the 3GPP network, and save the key and a correspondence between the key and the user identifier;
  • a second receiving unit configured to receive an access point device of the wireless local area network WLAN a key query message containing the user identification
  • a first sending unit configured to send a key response message including the key to the access point device, so that the access point device extracts the key from the key response message and allows the The user equipment accesses the WLAN using the key.
  • an access point device including:
  • a first receiving unit configured to acquire a user identifier of the user equipment by using a wireless local area network (WLAN);
  • WLAN wireless local area network
  • a first sending unit configured to send a key query message including the user identifier to a base station of a pre-configured third generation partner plan 3GPP network;
  • a second receiving unit configured to receive a key response message including the key from the base station, and extract the key from the key response message
  • a second sending unit configured to send, by using the WLAN, an authentication success message carrying the key or a derived key of the key to the user equipment, to indicate that the user equipment is allowed to use the key or The derived key accesses the WLAN.
  • a communication system comprising: a user equipment and the base station and access point device fusion entity described above.
  • a communication system comprising: a user equipment, the base station described above, and the access point device described above.
  • the WLAN access authentication method, device, and system provided by the embodiment of the present invention re-use the key of the user equipment and the 3GPP network for air interface encryption in the process of the user equipment accessing the 3GPP core network from the access point device of the WLAN . Therefore, in the scenario where the 3GPP access network and the WLAN access network are the same carrier and share the same subscription data, the user equipment does not need to access the 3GPP core network from the 3GPP and the WLAN. Two sets of authentication and authentication processes are performed, but a set of keys is shared, that is, only one authentication authentication is needed, which greatly improves the authentication of user equipments when accessing 3GPP and WLANs to the 3GPP core network. Speed, which reduces the connection setup delay.
  • FIG. 1 is a schematic diagram of an authentication process in which a UE accesses a 3GPP network and a WLAN network in succession in the prior art;
  • FIG. 2 is a block diagram of a method for accessing an access authentication method of a radio access network according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of a method for accessing an access method of a radio access network according to an embodiment of the present invention
  • FIG. 4 is a schematic flowchart of a method for access authentication of a radio access network according to another embodiment of the present invention.
  • FIG. 5 is a schematic flowchart of a method for access authentication of a radio access network according to another embodiment of the present invention.
  • FIG. 6 is a schematic flowchart of a method for access authentication of a radio access network according to still another embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a base station and an access point device fusion entity according to an embodiment of the present disclosure
  • FIG. 8 is a schematic structural diagram of a base station and an access point device fusion entity according to another embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a base station according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of a base station according to another embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of an access point device according to an embodiment of the present invention
  • FIG. 12 is a schematic structural diagram of an access point device according to another embodiment of the present invention
  • FIG. 13 is a schematic structural diagram of a communication system according to an embodiment of the present invention.
  • FIG. 14 is a schematic structural diagram of a communication system according to another embodiment of the present invention. detailed description
  • the WLAN access authentication method provided by the embodiment of the present invention, as shown in FIG. 2, the method steps include:
  • the access point device acquires a user identifier of the user equipment by using a wireless local area network (WLAN).
  • WLAN wireless local area network
  • the access point device finds, according to the user identifier, a key used for air interface encryption by the user equipment and the 3GPP network.
  • the method may further include: receiving, by the base station of the 3GPP network, the first message that is sent by the user equipment and including the user identifier, and extracting and saving the user identifier.
  • the base station obtains the key, and stores the key and a correspondence between the key and the user identification.
  • the base station obtains the key may include:
  • the base station receives an initial context setup request message sent by the user equipment that includes the key, and extracts the key.
  • the base station receives an initial context setup request message that is sent by the user equipment and includes the first key, extracts the first key, and derives the key according to the first key.
  • the access point device obtains the user identifier of the user equipment by using the WLAN, and the access point device searches for the key used for the air interface encryption of the user equipment and the 3GPP network according to the user identifier, and may have the following four types. Specific implementation.
  • the base station and the access point device are the same entity.
  • the user identifier may be a Media Access Control (MAC) address of the user equipment, and the first message may be a Radio Resource Control (RRC) message.
  • the obtaining, by the access point device, the user identifier of the user equipment by using the WLAN may include: the access point device receiving the second message including the MAC address sent by the user equipment in the process of establishing the layer 2 connection with the user equipment in the WLAN, and The MAC address is extracted from the second message.
  • MAC Media Access Control
  • RRC Radio Resource Control
  • the base station and the access point device are the same entity.
  • the user identifier may be an International Mobile Subscriber Identification Number (IMSI) or NAI of the user equipment, and the first message in step S202 may be an attach request message.
  • IMSI International Mobile Subscriber Identification Number
  • NAI NAI of the user equipment
  • the obtaining, by the access point device, the user identifier of the user equipment by using the WLAN may include: after the access point device establishes a layer 2 connection with the user equipment in the WLAN, receiving an authentication authentication request that is sent by the user equipment and includes the IMSI or the NAI of the user equipment. The message extracts the IMSI or the NAI from the authentication request message.
  • the base station and the access point device are different entities that are interoperable.
  • the user identifier may be a MAC address of the user equipment, and the first message may be an RRC message.
  • the obtaining, by the access point device, the user identifier of the user equipment by using the WLAN may include: the access point device receiving the second message including the MAC address sent by the user equipment in the process of establishing the layer 2 connection with the user equipment in the WLAN, and The MAC address is extracted from the second message.
  • the access point device may: according to the user identifier and the foregoing correspondence, the access key device: the access point device sends a key query message including the user identifier to the base station; and the access point device receives the key response including the key from the base station. a message, and extracting the key from the key reply message.
  • the base station and the access point device are different entities that are interoperable.
  • the user identifier may be an IMSI or an NAI of the user equipment, and the first message may be an attach request message.
  • the obtaining, by the access point device, the user identifier by using the WLAN may include: after the access point device establishes a layer 2 connection with the user equipment in the WLAN, receiving an authentication authentication request message that is sent by the user equipment and includes the IMSI or the NAI of the user equipment, The IMSI or the NAI is extracted in the authentication authentication request message.
  • the access point device may: according to the user identifier and the foregoing correspondence, the access point device: the access point device sends a key query message including the user identifier to the base station; and the access point device receives the key including the key from the base station. Answering the message and extracting the key from the key reply message.
  • the access point device sends, by using the WLAN, an authentication success message carrying the key or the derived key of the key to the user equipment, to indicate that the user equipment is allowed to use the key or the derived key. Access to the WLAN.
  • the WLAN access authentication method provided by the embodiment of the present invention re-uses the key of the user equipment and the 3GPP network for air interface encryption in the process of the user equipment accessing the 3GPP core network from the WLAN access point device. Therefore, in the scenario where the 3GPP access network and the WLAN access network are the same carrier and share the same subscription data, the user equipment does not access from the 3GPP and the WLAN to the 3GPP core network. Two sets of authentication and authentication processes are required, but a set of keys is shared, that is, only one authentication authentication is required, which greatly improves the user equipment's access from 3GPP and WLAN to the 3GPP core network. The speed of authentication is reduced, and the connection establishment delay is reduced.
  • the WLAN access authentication method provided by the embodiment of the present invention takes the 3GPP access network and the WLAN access network convergence scenario as an example, and the user identifier of the UE is described by taking the MAC address as an example. Furthermore, in the present embodiment, the 3GPP base station (eNodeB) and the WLAN access point device (Wifi) are physically interoperable to the same entity, but are relatively independent in function.
  • eNodeB 3GPP base station
  • Wii WLAN access point device
  • this embodiment is described by taking the steps of the UE accessing the 3GPP core network from 3GPP and successfully authenticating the authentication, and then accessing the 3GPP core network from the WLAN as an example.
  • the UE accesses the 3GPP network, and sends an attach request message to the MME. 5302. The UE completes authentication and encryption with the 3GPP through the MME.
  • the UE and the MME derive a key K NAS LNT , K NA S enC for NAS encryption and a UE and the base station from the master key (first key) K AS ME Air interface encrypted key K EN . deB , and by K EN . deB derived export copper encryption required for copper encryption KuPenc ' KRRCint ' KRRC enc °
  • the base station obtains a key for performing air interface encryption with the UE, and the key may be one or several of KAS ME, ENODEB , K UPENC , K RRC int or K RRCENC .
  • the specific obtaining process may include: receiving, by the base station, an initial context setup request message that is sent by the UE and including the key, and extracting the key.
  • the base station receives an initial context setup request message that is sent by the UE and includes a master key (first key) K AS ME , extracts K AS ME , and derives the key according to the K AS ME .
  • the UE may carry its own MAC address (user identifier) in, for example, an RRC message to the base station.
  • the base station extracts and saves the user identity from the message.
  • the base station saves the correspondence between the key and the key and the UE user identifier.
  • the UE completes the PDN connection establishment process on the 3GPP side.
  • the base station may also connect the Service Set Identifier (S SID) of the fused WLAN access network with the PDN to establish a response message, and send the message to the UE through the 3GPP network.
  • S SID Service Set Identifier
  • the access point device of the WLAN (which may be Wifi in this embodiment) broadcasts, to the UE, information about the (ie, fused) 3GPP cell corresponding to the access point device, so that the UE in the 3GPP cell selects the connection.
  • the ingress device accesses the WLAN.
  • the UE receives the broadcast of the access point device of the WLAN, and selects a WLAN access network that includes the 3GPP cell in which the UE is located.
  • the access point device of the WLAN establishes a layer 2 connection with the UE.
  • the access point device can receive the UE. Sending a second message containing the MAC address of the UE, and extracting the MAC address from the second message.
  • the access point device queries the base station for a key corresponding to the MAC address of the UE.
  • the base station and the access point device are the same physical entity, and therefore, the query operation of the access point device may be performed inside the entity. If the UE has successfully authenticated the authentication on the 3GPP side of the entity, both the UE and the WLAN access network can use the key stored on the base station or directly derive the new key using the key.
  • the access point device sends an authentication success message to the UE, where the key to be used in the WLAN access network is used to indicate that the UE is allowed to use the key or the new secret derived by the key to access the WLAN.
  • the WLAN access authentication method provided by the embodiment of the present invention saves an air interface encryption key when the user equipment accesses the 3GPP core network from the base station of the 3GPP, and reuses the access device to access the 3GPP from the WLAN access point device of the user equipment.
  • the WLAN at this time is the WLAN of the 3GPP cell where the user equipment is currently located. Therefore, in the scenario where the 3GPP access network and the WLAN access network are the same carrier and share the same subscription data, the user equipment accesses the 3GPP core network from the 3GPP and the WLAN.
  • a set of keys is shared, that is, only one authentication authentication is required, which greatly improves the user equipment's access to the 3GPP core network from 3GPP and WLAN.
  • the speed of authentication is reduced, and the connection establishment delay is reduced.
  • the description is performed by the UE performing the 3GPP attaching and then the WLAN access, and the actual process is not limited thereto, and may be, when the UE accesses from the WLAN. Attach 3GPP.
  • the UE must first complete the authentication and authentication process with the 3GPP base station, and then access the WLAN access point.
  • the UE selects the access performed by the WLAN access network included in the cell in which the UE is currently located, but if the UE selects the WLAN access network that is not included in the cell in which the current cell is located, the UE accesses the WLAN access network.
  • the subsequent process is consistent with the description of the existing protocol, and requires a complete EAP authentication and authentication process, which is the same as the prior art and will not be described again.
  • the wireless local area network access authentication method provided by the embodiment of the present invention is basically similar to the second embodiment except that the base station (eNodeB) of the 3GPP and the access point device (WLAN) of the WLAN are in different physical entities that can communicate with each other.
  • the base station (eNodeB) of the 3GPP and the access point device (WLAN) of the WLAN are in different physical entities that can communicate with each other.
  • the first part is the same as steps S301 to S305 of the above embodiment, and details are not described herein again.
  • the access point device sends a key query message including a MAC address to the base station.
  • the base station sends a key response message including the MAC address corresponding key to the access point device, and the access point device extracts the key from the key response message.
  • step of extracting the key shown by the access point device is also the same as step S307 of the foregoing embodiment, and details are not described herein again.
  • the WLAN access authentication method provided by the embodiment of the present invention saves an air interface encryption key when the user equipment accesses the 3GPP core network from the base station of the 3GPP, and reuses the access device to access the 3GPP from the WLAN access point device of the user equipment.
  • the WLAN at this time is the WLAN of the 3GPP cell where the user equipment is currently located. Therefore, in the scenario where the 3GPP access network and the WLAN access network are the same carrier and share the same subscription data, the user equipment accesses the 3GPP core network from the 3GPP and the WLAN.
  • a set of keys is shared, that is, only one authentication authentication is required, which greatly improves the user equipment's access to the 3GPP core network from 3GPP and WLAN.
  • the speed of authentication is reduced, and the connection establishment delay is reduced.
  • the WLAN access authentication method provided by the embodiment of the present invention takes the 3GPP access network and the WLAN access network convergence scenario as an example, and the user identifier of the UE is described by taking IMSI as an example. Furthermore, in the present embodiment, the 3GPP base station (eNodeB) and the WLAN access point device (Wifi) are physically interoperable to the same entity, but are relatively independent in function.
  • eNodeB 3GPP base station
  • Wii WLAN access point device
  • the UE first accesses the 3GPP core network from 3GPP. After the authentication of the authentication right, the steps of accessing the 3GPP core network from the WLAN are taken as an example for description.
  • the UE accesses the 3GPP network, and sends an attach request message to the MME.
  • the UE completes authentication and encryption with the 3GPP through the MME.
  • the UE and the MME derive a key K NASLNT for NAS encryption, K NAS enC and an air interface encryption between the UE and the base station by the master key (first key) K ASME .
  • Key K EN . deB and by K EN . deB derived export copper encryption required for copper encryption KuPenc ' KRRCint ' KRRC enc °
  • the base station obtains a key for performing air interface encryption with the UE, and the key may be one or several of KASME, ENODEB , K UPENC , K RRC int or K RRCENC .
  • the specific obtaining process may include: receiving, by the base station, an initial context setup request message that is sent by the UE and including the key, and extracting the key.
  • the base station receives an initial context setup request message that is sent by the UE and includes a master key (first key) K ASME , extracts K ASME , and derives the key according to the K ASME .
  • the UE may carry its own IMSI in, for example, an attach request message or the like, and send it to the base station.
  • the base station extracts and saves the user identity from the message.
  • the UE After the authentication is successful, the UE completes the PDN connection establishment process on the 3GPP side.
  • the base station may also send a service set identifier (Service Set Identifier, SSID) of the fused WLAN access network to the PDN to establish a response message, and send the message to the UE through the 3GPP network.
  • SSID Service Set Identifier
  • the access point device of the WLAN (which may be Wifi in this embodiment) broadcasts, to the UE, information about the (ie, fused) 3GPP cell corresponding to the access point device, so that the UE in the 3GPP cell selects the access.
  • the point device accesses the WLAN.
  • the UE receives the broadcast of the access point device of the WLAN, and selects a WLAN access network that includes the 3GPP cell in which the UE is located.
  • the access point device of the WLAN establishes a layer 2 connection with the UE.
  • the access point device sends an EAP request to the UE. 5507.
  • the UE sends an authentication authentication request message EAP-RSP to the access point device, and carries the user identifier, IMSI, in the authentication authentication request message.
  • the access point device queries the base station for a key corresponding to the MAC address of the UE.
  • the base station and the access point device are the same physical entity, and therefore, the query operation of the access point device may be performed inside the entity. If the UE has successfully authenticated the authentication on the 3GPP side of the entity, both the UE and the WLAN access network can use the key stored on the base station or directly derive the new key using the key.
  • the access point device sends an authentication success message to the UE, where the key to be used in the WLAN access network is used to indicate that the UE is allowed to use the key or the new secret derived by the key to access the WLAN.
  • the WLAN access authentication method provided by the embodiment of the present invention saves an air interface encryption key when the user equipment accesses the 3GPP core network from the base station of the 3GPP, and reuses the access device to access the 3GPP from the WLAN access point device of the user equipment.
  • the WLAN at this time is the WLAN of the 3GPP cell where the user equipment is currently located. Therefore, in the scenario where the 3GPP access network and the WLAN access network are the same carrier and share the same subscription data, the user equipment accesses the 3GPP core network from the 3GPP and the WLAN.
  • a set of keys is shared, that is, only one authentication authentication is required, which greatly improves the user equipment's access to the 3GPP core network from 3GPP and WLAN.
  • the speed of authentication is reduced, and the connection establishment delay is reduced.
  • the description is performed by the UE performing the 3GPP attaching and then the WLAN access, and the actual process is not limited thereto, and may be, when the UE accesses from the WLAN. Attach 3GPP.
  • the UE must first complete the authentication and authentication process with the 3GPP base station, and then access the WLAN access point.
  • the UE selects the access performed by the WLAN access network included in the cell in which the UE is currently located, but if the UE selects the WLAN access network that is not included in the cell in which the current cell is located, the UE accesses the WLAN access network.
  • the subsequent process is consistent with the description of the existing protocol, and requires a complete EAP authentication and authentication process, which is the same as the prior art and will not be described again.
  • the WLAN access authentication method provided by the embodiment of the present invention is basically similar to the fifth embodiment except that the base station (eNodeB) of the 3GPP and the access point device (Wifi) of the WLAN are in different physical entities that can communicate with each other.
  • the base station (eNodeB) of the 3GPP and the access point device (Wifi) of the WLAN are in different physical entities that can communicate with each other.
  • the first part is the same as the steps S501 to S507 of the above embodiment, and will not be described again.
  • the access point device sends a key query message including the IMSI to the base station.
  • the base station sends a key response message including the IMSI corresponding key to the access point device, and the access point device extracts the key from the key response message.
  • the step of the access point device extracting the key shown is the same as the step S509 of the foregoing embodiment, and details are not described herein again.
  • the WLAN access authentication method provided by the embodiment of the present invention saves an air interface encryption key when the user equipment accesses the 3GPP core network from the base station of the 3GPP, and reuses the access device to access the 3GPP from the WLAN access point device of the user equipment.
  • the WLAN at this time is the WLAN of the 3GPP cell where the user equipment is currently located. Therefore, in the scenario where the 3GPP access network and the WLAN access network are the same carrier and share the same subscription data, the user equipment accesses the 3GPP core network from the 3GPP and the WLAN.
  • a set of keys is shared, that is, only one authentication authentication is required, which greatly improves the user equipment's access to the 3GPP core network from 3GPP and WLAN.
  • the speed of authentication is reduced, and the connection establishment delay is reduced.
  • the embodiment of the present invention provides a base station and an access point device fusion entity 70, which can be applied to the methods provided in the foregoing Embodiment 1, the second embodiment, and the fourth embodiment, and the related steps in the method are performed.
  • the base station and access point device fusion entity 70 includes:
  • the first receiving unit 701 is configured to receive, by using the third generation partnership plan 3GPP network, a first message that is sent by the user equipment and includes a user identifier of the user equipment, and extract and save the first message.
  • User ID is configured to be used to extract, by using the third generation partnership plan 3GPP network.
  • the key obtaining unit 702 is configured to obtain a key for the user equipment to perform air interface encryption with the 3GPP network, and save the key and a correspondence between the key and the user identifier.
  • the second receiving unit 703 is configured to obtain a user identifier of the user equipment by using a wireless local area network (WLAN).
  • WLAN wireless local area network
  • the searching unit 704 is configured to find the key according to the user identifier and the foregoing correspondence.
  • the sending unit 705 is configured to send, by using the WLAN, an authentication success message carrying the key or the derived key of the key to the user equipment, to indicate that the user equipment is allowed to access the WLAN by using the key or the derived key.
  • the key obtaining unit 702 includes:
  • the first message receiving and extracting module 7021 is configured to receive an initial context establishment request message that is sent by the user equipment and includes the key, and extract the key.
  • the second message receiving and extracting module 7022 is configured to receive an initial context setup request message that is sent by the user equipment and includes the first key, and extract the first key.
  • the key derivation module 7023 is configured to use the first key. Derived the key.
  • the base station and the access point device convergence entity provided by the embodiment of the present invention can save the air interface encryption key of the user equipment when the user equipment accesses the 3GPP core network from the 3GPP base station, and reuse the access device device of the user equipment from the WLAN.
  • the 3GPP core network Into the process of the 3GPP core network. Therefore, in the scenario where the 3GPP access network and the WLAN access network are the same carrier and share the same subscription data, the user equipment does not need to access the 3GPP core network from the 3GPP and the WLAN.
  • Two sets of authentication and authentication processes are performed, but a set of keys is shared, that is, only one authentication authentication is needed, which greatly improves the user equipment's access from 3GPP and WLAN to the 3GPP core network. The speed of authentication is reduced, and the connection establishment delay is reduced.
  • An embodiment of the present invention provides a base station 90, which can be applied to the foregoing embodiment.
  • the third embodiment is the method provided in the fifth embodiment, and the relevant steps in the method are performed.
  • the base station 90 includes:
  • the first receiving unit 901 is configured to receive, by using the third generation partnership plan 3GPP network, a first message that is sent by the user equipment and that includes the user identifier of the user equipment, and extract and save the user identifier.
  • the key obtaining unit 902 is configured to obtain a key for the user equipment to perform air interface encryption with the 3GPP network, and save the key and the corresponding relationship between the key and the user identifier.
  • the second receiving unit 903 is configured to receive a key query message that is sent by the access point device of the wireless local area network WLAN and includes the user identifier.
  • the first sending unit 904 is configured to send a key response message including the key to the access point device, so that the access point device extracts the key from the key response message, and allows the user equipment to use the The key is connected to the WLAN.
  • the base station provided by the embodiment of the present invention can save the air interface encryption key when the user equipment accesses the 3GPP core network from the 3GPP base station, and sends the air interface encryption key to the access point device of the WLAN, so as to reuse the access of the user equipment from the WLAN.
  • the point device accesses the 3GPP core network. Therefore, in the scenario where the 3GPP and the WLAN access network are the same carrier and share the same subscription data, the user equipment does not access from the 3GPP and the WLAN to the 3GPP core network in the scenario of the prior art.
  • Two sets of authentication and authentication processes are required, but a set of keys is shared, that is, only one authentication authentication is required, which greatly improves the authentication of user equipments when accessing 3GPP and WLANs to the 3GPP core network.
  • the authentication speed reduces the connection establishment delay.
  • the base station 90 further includes:
  • a second sending unit 905 configured to send, by using the 3GPP network, a packet data network connection setup response message that includes a service set identifier S SID of the access point device, so that the user equipment selects the access point device to access the WLAN.
  • the embodiment of the present invention provides an access point device 1 10, which can be applied to the methods provided in the foregoing Embodiment 1, the third embodiment, and the fifth embodiment, and performs related operations in the method. Steps.
  • the access point device 1 10 includes:
  • the first receiving unit 1101 is configured to acquire a user identifier of the user equipment by using a wireless local area network (WLAN).
  • WLAN wireless local area network
  • the first sending unit 1102 is configured to send a key query message including the user identifier to a base station of a pre-configured third generation partnership plan 3GPP network.
  • the second receiving unit 1103 is configured to receive a key response message including the key from the base station, and extract the key from the key response message.
  • a second sending unit 1104 configured to send, by using the WLAN, an authentication success message carrying the key or a derived key of the key to the user equipment, to indicate that the user equipment is allowed to use the key or the The derived key is accessed to the WLAN.
  • the access point device provided by the embodiment of the present invention can obtain an air interface encryption key when the user equipment accesses the 3GPP core network from the base station of the 3GPP, and reuses the access point device of the user equipment from the WLAN. Access to the 3GPP core network. Therefore, in the scenario where the 3GPP access network and the WLAN access network are the same carrier and share the same subscription data, the user equipment does not need to access the 3GPP core network from the 3GPP and the WLAN. Perform two sets of authentication and authentication processes, but share a set of keys, that is, only one authentication and authentication is required, which greatly improves the authentication of user equipment when accessing 3GPP and WLAN to 3GPP core network. Speed, which reduces the connection setup delay.
  • the access point device 1 10 further includes: a broadcasting unit 1105, configured to broadcast, to the user equipment, information about a 3GPP cell corresponding to the access point device 110, so as to be in the The user equipment of the 3GPP cell selects the access point device 1 10 to access the WLAN.
  • a broadcasting unit 1105 configured to broadcast, to the user equipment, information about a 3GPP cell corresponding to the access point device 110, so as to be in the The user equipment of the 3GPP cell selects the access point device 1 10 to access the WLAN.
  • the embodiment of the present invention provides a communication system, as shown in FIG. 13, including: a user equipment 1301, and a base station and access point device fusion entity 1302 according to the second embodiment, the fourth embodiment, and the sixth embodiment.
  • the communication system includes:
  • Embodiment 3 User equipment 1401, and as described in Embodiment 3, Embodiment 5, and Embodiment 7
  • the base station 1402 and the access point device 1403 as described in the third embodiment, the fifth embodiment, and the eighth embodiment.
  • the base station saves the air interface encryption key when the user equipment accesses the 3GPP core network from the base station of the 3GPP, and reuses the access device to access the 3GPP core network from the access point device of the WLAN.
  • the WLAN at this time is the WLAN of the 3GPP cell where the user equipment is currently located. Therefore, in the scenario where the 3GPP and the WLAN access network are the same carrier and share the same subscription data, the user equipment accesses the 3GPP core network from the 3GPP and the WLAN.
  • a set of keys is shared, that is, only one authentication authentication is required, which greatly improves the user equipment's access to the 3GPP core network from 3GPP and WLAN.
  • the speed of authentication is reduced, and the connection establishment delay is reduced.

Abstract

本发明实施例提供了一种无线局域网接入鉴权方法、设备及系统，涉及通信领域，在3GPP接入网和WLAN接入网为同一个运营商，共享同一份签约数据的场景下，能够实现UE从3GPP和WLAN先后接入到3GPP核心网时的快速鉴权认证。该无线局域网接入鉴权方法，包括：接入点设备通过无线局域网WLAN获取用户设备的用户标识；所述接入点设备根据所述用户标识，查找到用于所述用户设备与3GPP网络进行空口加密的密钥；所述接入点设备通过所述WLAN向所述用户设备发送携带所述密钥或所述密钥的派生密钥的鉴权成功消息，以指示允许所述用户设备使用所述密钥或所述派生密钥接入所述WLAN。发明实施例用于无线局域网接入。

Description

一种无线局域网接入鉴权方法、 设备及系统 技术领域
本发明涉及通信领域，尤其涉及一种无线局域网接入鉴权方法、 设备及系统。
背景技术
第三代伙伴计戈 'J ( The 3rd Generation Partnership Proj ect , 简称 3GPP )接入网和无线局 i或网（ Wireless Wireless Local Area Network , 简称 WLAN ) 接入网融合 即 3GPP接入网与 WLAN接入网在功 能上是独立的， 但物理上是一体的情况下， 现有用户设备 （ User Equipment , 简称 UE ) 从 3GPP 网络和 WLAN 网络先后接入的鉴权 过程如图 1所示， 一般包括：
5101、 UE接入 3GPP 网络， 发送 Attach Request接入请求到移 动性管理网元 ( Mobility Management Entity , 简称 MME )。
5102、 3GPP 网络鉴权与建立 NAS ( Network Access Server , 网 络接入服务器 ) 安全过程——即激活完整性保护和 NAS加密。 在此 过程中， UE 与 MME 由主密钥 KASME派生出用于 NAS 加密的密钥 KNASint , KNASenc , 以及用于 UE与 eNodeB ( evolved Node B , 基站） 之间空口加密的密钥 KeN。deB。 鉴权成功之后， UE 完成 3GPP 侧的 PDN ( Packet Data Network , 分组数据网 ） 连接建立过程。 在此过程 中， KeN。deB被传送给 eNodeB , 并由此派生出空口加密所需的密钥
KuPenc ' KRRCint , KRRC enc °
5103、 随后， UE从 WLAN网络接入， 完成层二连接建立。
5104、 WLAN网络发送扩展认证协议（ Extensible Authentication Protocol , 简称 ΕΑΡ ) 请求消息给 UE , 触发 UE发起鉴权认证。
5105、 UE 发送扩展认证协议响应消息 EAP-RSP , 其中包括自 己的标识。
5106、 WLAN 网络将 UE 发送的 EAP 响应消息发送到 AAA ( Authentication Authorization Accounting , 鉴权, 授权和计费 ) 月良 务器。
5107、 AAA服务器从归属网络服务器（ Home Subscriber Server, 简称 HSS ) 取回鉴权向量。
5108、 AAA月良务器从 HS S ( Home Subscriber Server , 归属网络 服务器） 取回签约数据。
5109、 AAA服务器发送 EAP-REQ到 WLAN接入网络， 其中携 带鉴权参数 RAND , AUTN。
S 1 10、 WLAN接入网络将 EAP-REQ消息转发给 UE。
51 1 1、 UE 检查 EAP-REQ 消息中的参数， 验证网络。 并发送 EAP-RSP消息给 WLAN接入网络。
51 12、 WLAN接入网络将此 EAP-RSP消息发送到 AAA服务器。
51 13、 AAA 服务器发送鉴权认证响应消息 EAP Success 到 WLAN接入网络， 其中携带密钥 MSK ( Master Session Key , 主会话 密钥 ）。
51 14、 WLAN接入网络存储密钥 MSK, 并通知 UE鉴权认证成 功。至此 UE与 WLAN接入网络共享此鉴权认证过程中产生的密钥。
由上述过程可以看出， UE从 3GPP接入到 3GPP核心网时所使 用的鉴权认证方式 , 与 UE从 WLAN接入到 3 GPP核心网时所使用 的鉴权认证方式不同。 换句话说， UE从 3GPP和 WLAN先后接入到 3GPP核心网时，即使 3GPP接入网与 WLAN接入网为同一个运营商 , 且共享同一份签约数据， 该鉴权认证过程也需要经过两套， 这将给 连接建立带来较长的时延。
发明内容
本发明的实施例提供一种无线局域网接入鉴权方法、 设备及系 统， 在 3GPP接入网和 WLAN接入网为同一个运营商， 共享同一份 签约数据的场景下，能够实现 UE从 3 GPP和 WLAN先后接入到 3GPP 核心网时的快速鉴权认证。
为达到上述目 的， 本发明的实施例采用如下技术方案： 一方面， 提供一种无线局域网接入鉴权方法， 包括： 接入点设备通过无线局域网 WLAN获取用户设备的用户标识； 所述接入点设备根据所述用户标识， 查找到用于所述用户设备 与 3 GPP 网络进行空口加密的密钥；
所述接入点设备通过所述 WLAN 向所述用户设备发送携带所 述密钥或所述密钥的派生密钥的鉴权成功消息， 以指示允许所述用 户设备使用所述密钥或所述派生密钥接入所述 WLAN。
一方面， 提供一种基站和接入点设备融合实体， 包括： 第一接收单元， 用于通过第三代伙伴计划 3GPP 网络接收用户 设备发送的包含所述用户设备的用户标识的第一消息， 提取并保存 所述用户标识；
密钥获得单元， 用于获得用于所述用户设备与所述 3GPP 网络 进行空口加密的密钥， 保存所述密钥以及所述密钥和所述用户标识 的对应关系；
第二接收单元， 用于通过无线局域网 WLAN获取所述用户设备 的所述用户标识；
查找单元， 用于根据所述用户标识和所述对应关系， 查找到所 述密钥；
发送单元， 用于通过所述 WLAN向所述用户设备发送携带所述 密钥或所述密钥的派生密钥的鉴权成功消息， 以指示允许所述用户 设备使用所述密钥或所述派生密钥接入所述 WLAN。
一方面， 提供一种基站， 包括：
第一接收单元， 用于通过第三代伙伴计划 3GPP 网络接收用户 设备发送的包含所述用户设备的用户标识的第一消息， 提取并保存 所述用户标识；
密钥获得单元， 用于获得用于所述用户设备与所述 3GPP 网络 进行空口加密的密钥， 保存所述密钥以及所述密钥和所述用户标识 的对应关系；
第二接收单元， 用于接收无线局域网 WLAN的接入点设备发送 的包含所述用户标识的密钥查询消息；
第一发送单元， 用于向所述接入点设备发送包含所述密钥的密 钥应答消息， 以便所述接入点设备从所述密钥应答消息中提取所述 密钥并允许所述用户设备使用所述密钥接入所述 WLAN。
一方面， 提供一种接入点设备， 包括：
第一接收单元， 用于通过无线局域网 WLAN获取用户设备的用 户标识；
第一发送单元， 用于向预先配置的第三代伙伴计划 3GPP 网络 的基站发送包含所述用户标识的密钥查询消息；
第二接收单元， 用于从所述基站接收包含所述密钥的密钥应答 消息， 并从所述密钥应答消息中提取所述密钥；
第二发送单元， 用于通过所述 WLAN向所述用户设备发送携带 所述密钥或所述密钥的派生密钥的鉴权成功消息， 以指示允许所述 用户设备使用所述密钥或所述派生密钥接入所述 WLAN。
一方面， 提供一种通信系统， 包括： 用户设备和上述的基站和 接入点设备融合实体。
一方面， 提供一种通信系统， 包括： 用户设备、 上述的基站、 和上述的接入点设备。
本发明实施例提供的无线局域网接入鉴权方法、 设备及系统， 在用户设备从 WLAN的接入点设备接入 3GPP核心网的过程中重用 了该用户设备与 3GPP 网络进行空口加密的密钥。 因此， 相对现有 技术而言， 在 3GPP接入网和 WLAN接入网为同一个运营商， 共享 同一份签约数据的场景下， 用户设备从 3GPP和 WLAN先后接入到 3GPP核心网时不在需要进行两套鉴权认证过程， 而是共用了一组密 钥， 也即只需进行一次鉴权认证即可， 大大提高了用户设备从 3GPP 和 WLAN先后接入到 3GPP核心网时的鉴权认证速度， 降低了连接 建立时延。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案， 下 面将对实施例或现有技术描述中所需要使用的附图作简单地介绍， 显而易见地， 下面描述中的附图仅仅是本发明的一些实施例， 对于 本领域普通技术人员来讲， 在不付出创造性劳动的前提下， 还可以 根据这些附图获得其他的附图。
图 1 为现有技术中 UE从 3 GPP 网络和 WLAN网络先后接入的 鉴权过程示意图；
图 2为本发明实施例提供的无线接入网接入鉴权方法流程框图 图；
图 3 为本发明实施例提供的无线接入网接入鉴权方法的流程示 意图；
图 4为本发明另一实施例提供的无线接入网接入鉴权方法的流 程示意图；
图 5 为本发明又一实施例提供的无线接入网接入鉴权方法的流 程示意图；
图 6为本发明再一实施例提供的无线接入网接入鉴权方法的流 程示意图；
图 7为本发明实施例提供的基站、 接入点设备融合实体的结构 示意图；
图 8为本发明另一实施例提供的基站和接入点设备融合实体的 结构示意图；
图 9为本发明实施例提供的基站的结构示意图；
图 10为本发明另一实施例提供的基站的结构示意图；
图 1 1 为本发明实施例提供的接入点设备的结构示意图； 图 12为本发明另一实施例提供的接入点设备的结构示意图； 图 13为本发明实施例提供的通信系统的结构示意图；
图 14为本发明另一实施例提供的通信系统的结构示意图。 具体实施方式
下面将结合本发明实施例中的附图， 对本发明实施例中的技术 方案进行清楚、 完整地描述， 显然， 所描述的实施例仅仅是本发明 一部分实施例， 而不是全部的实施例。 基于本发明中的实施例， 本 领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他 实施例， 都属于本发明保护的范围。
实施例一
本发明实施例提供的无线局域网接入鉴权方法， 如图 2所示， 该方法步骤包括：
5201、接入点设备通过无线局域网 WLAN获取用户设备的用户 标识。
5202、 接入点设备根据所述用户标识， 查找到用于所述用户设 备与 3GPP网络进行空口加密的密钥。
在本步骤之前，可以进一步包括： 3GPP 网络的基站通过该 3GPP 网络接收所述用户设备发送的包含用户标识的第一消息， 提取并保 存该用户标识。
基站获得所述密钥， 保存所述密钥以及所述密钥和所述用户标 识的对应关系。
进一步地， "基站获得所述密钥" 可以包括：
基站接收用户设备发送的包含该密钥的初始上下文建立请求消 息， 提取该密钥。
或者， 可以包括：
基站接收用户设备发送的包含第一密钥的初始上下文建立请求 消息， 提取该第一密钥， 根据该第一密钥， 派生所述密钥。
在本实施例中， 接入点设备通过 WLAN获取用户设备的用户标 识， 接入点设备根据该用户标识， 查找到用于用户设备与 3 GPP 网 络进行空口加密的密钥， 可以有以下四种具体实现方式。
方式一：
所述基站和所述接入点设备为同一实体。
用户标识可以为所述用户设备的介质访问控制 （ Media Access Control , 简称为 MAC ) 地址， 上述第一消息可以为无线资源控制 协议 ( Radio Resource Control , 简称为 RRC ) 消息。 接入点设备通过 WLAN获取用户设备的用户标识可以包括： 接 入点设备在建立与用户设备在 WLAN中的层二连接过程中， 接收用 户设备发送的包含 MAC地址的第二消息，并从第二消息中提取所述 MAC地址。
方式二：
基站和接入点设备为同一实体。
用户标识可以为用户设备的国际移动用户识别码（ International Mobile Subscriber Identification Number , 简称为 IMSI ) 或 NAI , 步 骤 S202 中第一消息可以为附着请求消息。
接入点设备通过 WLAN获取用户设备的用户标识可以包括： 在 接入点设备建立与用户设备在 WLAN中的层二连接之后， 接收用户 设备发送的包含用户设备的 IMSI 或 NAI 的鉴权认证请求消息， 从 鉴权认证请求消息中提取 IMSI或所述 NAI。
方式三：
基站和接入点设备为可互通的不同实体。
用户标识可以为用户设备的 MAC 地址， 步骤上述第一消息可 以为 RRC消息。
接入点设备通过 WLAN获取用户设备的用户标识可以包括： 接 入点设备在建立与用户设备在 WLAN中的层二连接过程中， 接收用 户设备发送的包含 MAC地址的第二消息，并从第二消息中提取 MAC 地址。
接入点设备根据用户标识和上述对应关系， 查找到密钥可以包 括： 接入点设备向基站发送包含用户标识的密钥查询消息； 接入点 设备从基站接收包含该密钥的密钥应答消息， 并从该密钥应答消息 中提取所述密钥。
方式四：
基站和接入点设备为可互通的不同实体。
用户标识可以为用户设备的 IMSI或 NAI ,上述第一消息可以为 附着请求消息。 接入点设备通过 WLAN获取用户标识可以包括： 在接入点设备 建立与用户设备在 WLAN中的层二连接之后， 接收用户设备发送的 包含用户设备的 IMSI或 NAI 的鉴权认证请求消息， 从该鉴权认证 请求消息中提取所述 IMSI或所述 NAI。
接入点设备根据用户标识和上述对应关系， 查找到密钥可以包 括： 接入点设备向基站发送包含用户标识的密钥查询消息； 接入点 设备从基站接收包含所述密钥的密钥应答消息， 并从所述密钥应答 消息中提取所述密钥。
S203、接入点设备通过 WLAN向所述用户设备发送携带所述密 钥或所述密钥的派生密钥的鉴权成功消息， 以指示允许用户设备使 用所述密钥或所述派生密钥接入 WLAN。
本发明实施例提供的无线局域网接入鉴权方法， 在用户设备从 WLAN 的接入点设备接入 3 GPP核心网的过程中重用了该用户设备 与 3GPP 网络进行空口加密的密钥。 因此， 相对现有技术而言， 在 3GPP接入网和 WLAN接入网为同一个运营商， 共享同一份签约数 据的场景下， 用户设备从 3 GPP和 WLAN先后接入到 3GPP核心网 时不在需要进行两套鉴权认证过程， 而是共用了一组密钥， 也即只 需进行一次鉴权认证即可， 大大提高了用户设备从 3GPP 和 WLAN 先后接入到 3 GPP核心网时的鉴权认证速度， 降低了连接建立时延。
实施例二
本发明实施例提供的无线局域网接入鉴权方法， 以 3GPP 接入 网和 WLAN接入网融合场景为例， UE的用户标识以 MAC地址为例 进行说明。 此外， 在本实施例中， 3GPP的基站 （ eNodeB ) 和 WLAN 的接入点设备 ( Wifi ) 在物理上是可互通的同一实体， 但在功能上 是相对独立的。
如图 3所示， 本实施例以 UE先从 3GPP接入 3GPP核心网并成 功鉴权认证之后， 再从 WLAN接入 3GPP核心网的步骤为例进行说 明。
S301、 UE接入 3GPP网络， 向 MME发送附着请求消息。 5302、 UE通过 MME完成与 3 GPP的鉴权与加密。
示例性的，在此过程中， UE与 MME由主密钥（第一密钥）KAS ME 派生出用于 NAS加密的密钥 KNAS LNT , KNA S enC 以及用于 UE与基站 之间空口加密的密钥 KEN。deB , 并由 KEN。deB派生出口空加密所需的密 铜 KuPenc ' KRRCint ' KRRC enc °
此外， 在本步骤中， 基站获得用于与 UE进行空口加密的密钥， 该密钥可以是 KAS ME, ENODEB , KUPENC, KRRCint或 KRRCENC中的一个或几 个。 其具体获得过程可以包括： 基站接收 UE 发送的包含密钥的初 始上下文建立请求消息， 提取所述密钥。 或者， 基站接收 UE 发送 的包含主密钥 （第一密钥） KAS ME的初始上下文建立请求消息， 提取 KAS ME , 根据所述 KA S ME , 派生所述密钥。
需要说明的是， 在上述步骤 S301 的附着请求或者步骤 S302的 鉴权认证过程中， UE可以将自 己的 MAC地址 （用户标识） 携带在 例如 RRC消息等中发送给基站。 基站从该消息中提取并保存该用户 标识。
进一步地， 基站在得到用于与该 UE 进行空口加密的密钥后， 保存所述密钥和所述密钥与 UE用户标识的对应关系。
5303、 鉴权认证成功后， UE完成 3GPP侧的 PDN连接建立过 程。
可选的， 基站还可以将融合的 WLAN 接入网的服务集标识 ( Service Set Identifier , 简称为 S SID ) 与 PDN连接建立响应消息， 通过 3GPP网络向 UE发送。
S304、 WLAN 的接入点设备 （在本实施例中可以是 Wifi ) 向 UE广播发送该接入点设备对应的 （ 即融合的 ) 3GPP 小区的信息， 以便处于该 3 GPP小区的 UE选择该接入点设备接入所述 WLAN。
S305、 UE接收到 WLAN的接入点设备的广播， 选择包含自 己 所在 3GPP 小区的 WLAN接入网接入， WLAN 的接入点设备与 UE 建立层二连接。
在本步骤建立层二连接的过程中， 接入点设备可以接收该 UE 发送的包含 UE的 MAC地址的第二消息， 并从该第二消息中提取出 所述 MAC地址。
5306、接入点设备向基站查询该 UE的此 MAC地址所对应的密 钥。 由于在本实施例中， 基站和接入点设备为同一物理实体， 因此， 接入点设备的查询操作在实体内部进行即可。 若 UE 已在该实体的 3GPP侧成功鉴权认证，则 UE和 WLAN接入网均可使用基站上存储 的密钥或者直接以此密钥派生出新密钥使用。
5307、 接入点设备向 UE发送鉴权成功消息， 其中包括将要在 WLAN接入网中使用的密钥， 以指示允许 UE使用该密钥或该密钥 派生出的新密要接入所述 WLAN。
本发明实施例提供的无线局域网接入鉴权方法， 保存了用户设 备从 3GPP的基站接入 3GPP核心网时的空口加密密钥，并重用在该 用户设备从 WLAN的接入点设备接入 3GPP核心网的过程中， 当然， 此时的 WLAN为该用户设备当前所在 3GPP小区的 WLAN。 因此 , 相对现有技术而言 , 在 3GPP接入网和 WLAN接入网为同一个运营 商， 共享同一份签约数据的场景下， 用户设备从 3 GPP和 WLAN先 后接入到 3 GPP 核心网时不在需要进行两套鉴权认证过程， 而是共 用了一组密钥， 也即只需进行一次鉴权认证即可， 大大提高了用户 设备从 3GPP和 WLAN先后接入到 3GPP核心网时的鉴权认证速度， 降低了连接建立时延。
需要说明的是， 在上述实施例中， 是以 UE先进行 3GPP附着， 然后再从 WLAN接入为例进行的说明， 实际过程并不限于此， 也可 以是在 UE从 WLAN接入的同时， 进行 3GPP的附着。 但一定是 UE 首先完成与 3 GPP基站的鉴权、 认证过程， 再接入 WLAN接入点。
再有， 上述过程中是以 UE 选择了包含在自身当前所在小区内 的 WLAN接入网进行的接入， 但如果 UE选择了不包含在自 己当前 所在小区的 WLAN接入网进行接入， 则之后的过程与现有协议描述 的一致， 需要完整的 EAP鉴权认证过程， 因与现有技术相同， 不再 贅述。 实施例三
本发明实施例提供的无线局域网接入鉴权方法， 基本与实施例 二类似，只是 3 GPP的基站（ eNodeB )和 WLAN的接入点设备（ Wifi ) 在可互通的不同物理实体。
如图 4所示， 在本实施例的各个步骤中， 开始部分与上述实施 例的步骤 S301〜步骤 S305相同， 不再贅述。
之后的， 包括：
S306'、接入点设备向基站发送包含 MAC地址的密钥查询消息。
S306 " 基站向接入点设备发送包含该 MAC 地址对应密钥的密 钥应答消息， 接入点设备从所述密钥应答消息中提取所述密钥。
接入点设备提取出所示密钥后的步骤也与上述实施例的步骤 S307相同， 不再贅述。
本发明实施例提供的无线局域网接入鉴权方法， 保存了用户设 备从 3GPP的基站接入 3GPP核心网时的空口加密密钥，并重用在该 用户设备从 WLAN的接入点设备接入 3GPP核心网的过程中， 当然， 此时的 WLAN为该用户设备当前所在 3GPP 小区的 WLAN。 因此 , 相对现有技术而言 , 在 3GPP接入网和 WLAN接入网为同一个运营 商， 共享同一份签约数据的场景下， 用户设备从 3 GPP和 WLAN先 后接入到 3 GPP 核心网时不在需要进行两套鉴权认证过程， 而是共 用了一组密钥， 也即只需进行一次鉴权认证即可， 大大提高了用户 设备从 3GPP和 WLAN先后接入到 3GPP核心网时的鉴权认证速度， 降低了连接建立时延。
实施例四
本发明实施例提供的无线局域网接入鉴权方法， 以 3GPP 接入 网和 WLAN接入网融合场景为例 , UE的用户标识以 IMSI为例进行 说明。 此外， 在本实施例中， 3GPP的基站 （ eNodeB ) 和 WLAN的 接入点设备 （ Wifi ) 在物理上是可互通的同一实体， 但在功能上是 相对独立的。
如图 5所示， 本实施例以 UE先从 3GPP接入 3GPP核心网并成 功鉴权认证之后， 再从 WLAN接入 3GPP核心网的步骤为例进行说 明。
S501、 UE接入 3GPP网络， 向 MME发送附着请求消息。
5502, UE通过 MME完成与 3GPP的鉴权与加密。
示例性的，在此过程中， UE与 MME由主密钥（第一密钥）KASME 派生出用于 NAS加密的密钥 KNASLNT, KNASenC 以及用于 UE与基站 之间空口加密的密钥 KEN。deB, 并由 KEN。deB派生出口空加密所需的密 铜 KuPenc ' KRRCint ' KRRC enc °
此外， 在本步骤中， 基站获得用于与 UE进行空口加密的密钥， 该密钥可以是 KASME, ENODEB, KUPENC, KRRCint或 KRRCENC中的一个或几 个。 其具体获得过程可以包括： 基站接收 UE 发送的包含密钥的初 始上下文建立请求消息， 提取所述密钥。 或者， 基站接收 UE 发送 的包含主密钥 （第一密钥） KASME的初始上下文建立请求消息， 提取 KASME, 根据所述 KASME, 派生所述密钥。
需要说明的是， 在上述步骤 S501 的附着请求或者步骤 S502的 鉴权认证过程中， UE可以将自 己的 IMSI携带在例如附着请求消息 等中发送给基站。 基站从该消息中提取并保存该用户标识。
5503、 鉴权认证成功后， UE完成 3GPP侧的 PDN连接建立过 程。
可选的， 基站还可以将融合的 WLAN 接入网的服务集标识 ( Service Set Identifier, 简称为 SSID ) 与 PDN连接建立响应消息， 通过 3GPP网络向 UE发送。
S504、 WLAN 的接入点设备 （在本实施例中可以是 Wifi ) 向 UE广播发送该接入点设备对应的 （ 即融合的 ) 3GPP 小区的信息， 以便处于该 3GPP小区的 UE选择该接入点设备接入所述 WLAN。
5505、 UE接收到 WLAN的接入点设备的广播， 选择包含自 己 所在 3GPP 小区的 WLAN接入网接入， WLAN 的接入点设备与 UE 建立层二连接。
5506、 接入点设备向 UE发送 EAP请求。 5507、 UE 向接入点设备发送鉴权认证请求消息 EAP-RSP , 并 在该鉴权认证请求消息中携带自 己的用户标识—— IMSI。
5508、接入点设备向基站查询该 UE的此 MAC地址所对应的密 钥。 由于在本实施例中， 基站和接入点设备为同一物理实体， 因此， 接入点设备的查询操作在实体内部进行即可。 若 UE 已在该实体的 3GPP侧成功鉴权认证，则 UE和 WLAN接入网均可使用基站上存储 的密钥或者直接以此密钥派生出新密钥使用。
5509、 接入点设备向 UE发送鉴权成功消息， 其中包括将要在 WLAN接入网中使用的密钥， 以指示允许 UE使用该密钥或该密钥 派生出的新密要接入所述 WLAN。
本发明实施例提供的无线局域网接入鉴权方法， 保存了用户设 备从 3GPP的基站接入 3GPP核心网时的空口加密密钥，并重用在该 用户设备从 WLAN的接入点设备接入 3GPP核心网的过程中， 当然， 此时的 WLAN为该用户设备当前所在 3GPP小区的 WLAN。 因此 , 相对现有技术而言 , 在 3GPP接入网和 WLAN接入网为同一个运营 商， 共享同一份签约数据的场景下， 用户设备从 3 GPP和 WLAN先 后接入到 3 GPP 核心网时不在需要进行两套鉴权认证过程， 而是共 用了一组密钥， 也即只需进行一次鉴权认证即可， 大大提高了用户 设备从 3GPP和 WLAN先后接入到 3GPP核心网时的鉴权认证速度， 降低了连接建立时延。
需要说明的是， 在上述实施例中， 是以 UE先进行 3GPP附着， 然后再从 WLAN接入为例进行的说明， 实际过程并不限于此， 也可 以是在 UE从 WLAN接入的同时， 进行 3GPP的附着。 但一定是 UE 首先完成与 3 GPP基站的鉴权、 认证过程， 再接入 WLAN接入点。
再有， 上述过程中是以 UE 选择了包含在自身当前所在小区内 的 WLAN接入网进行的接入， 但如果 UE选择了不包含在自 己当前 所在小区的 WLAN接入网进行接入， 则之后的过程与现有协议描述 的一致， 需要完整的 EAP鉴权认证过程， 因与现有技术相同， 不再 贅述。 实施例五
本发明实施例提供的无线局域网接入鉴权方法， 基本与实施例 五类似，只是 3 GPP的基站（ eNodeB )和 WLAN的接入点设备（ Wifi ) 在可互通的不同物理实体。
如图 6所示， 在本实施例的各个步骤中， 开始部分与上述实施 例的步骤 S501〜步骤 S507相同， 不再贅述。
之后的， 包括：
S508'、 接入点设备向基站发送包含 IMSI的密钥查询消息。
S508 " 基站向接入点设备发送包含该 IMSI 对应密钥的密钥应 答消息， 接入点设备从所述密钥应答消息中提取所述密钥。
接入点设备提取出所示密钥后的步骤也与上述实施例的步骤 S509相同， 不再贅述。
本发明实施例提供的无线局域网接入鉴权方法， 保存了用户设 备从 3GPP的基站接入 3GPP核心网时的空口加密密钥，并重用在该 用户设备从 WLAN的接入点设备接入 3GPP核心网的过程中， 当然， 此时的 WLAN为该用户设备当前所在 3GPP小区的 WLAN。 因此 , 相对现有技术而言 , 在 3GPP接入网和 WLAN接入网为同一个运营 商， 共享同一份签约数据的场景下， 用户设备从 3 GPP和 WLAN先 后接入到 3 GPP 核心网时不在需要进行两套鉴权认证过程， 而是共 用了一组密钥， 也即只需进行一次鉴权认证即可， 大大提高了用户 设备从 3GPP和 WLAN先后接入到 3GPP核心网时的鉴权认证速度， 降低了连接建立时延。
实施例六
本发明实施例提供一种基站和接入点设备融合实体 70 , 可以应 用在上述实施例一、 实施例二、 实施例四提供的方法中， 并执行该 方法中的相关步骤。 如图 7所示， 基站和接入点设备融合实体 70包 括：
第一接收单元 701 ,用于通过第三代伙伴计划 3GPP 网络接收用 户设备发送的包含用户设备的用户标识的第一消息， 提取并保存该 用户标识。
密钥获得单元 702 ,用于获得用于所述用户设备与 3GPP 网络进 行空口加密的密钥， 保存所述密钥以及所述密钥和所述用户标识的 对应关系。
第二接收单元 703 , 用于通过无线局域网 WLAN获取该用户设 备的用户标识。
查找单元 704 , 用于根据用户标识和上述对应关系， 查找到该 密钥。
发送单元 705 , 用于通过 WLAN向用户设备发送携带该密钥或 该密钥的派生密钥的鉴权成功消息， 以指示允许用户设备使用该密 钥或派生密钥接入所述 WLAN。
进一步地， 如图 8所示， 密钥获得单元 702包括：
第一消息接收提取模块 7021 , 用于接收用户设备发送的包含所 述密钥的初始上下文建立请求消息， 提取所述密钥。
或者包括：
第二消息接收提取模块 7022 , 用于接收用户设备发送的包含第 一密钥的初始上下文建立请求消息， 提取所述第一密钥； 密钥派生 模块 7023 , 用于所述第一密钥， 派生所述密钥。
本发明实施例提供的基站和接入点设备融合实体， 能够保存用 户设备从 3GPP的基站接入 3 GPP核心网时的空口加密密钥， 并重用 在该用户设备从 WLAN的接入点设备接入 3GPP核心网的过程中。 因此， 相对现有技术而言， 在 3GPP接入网和 WLAN接入网为同一 个运营商， 共享同一份签约数据的场景下， 用户设备从 3GPP 和 WLAN先后接入到 3GPP核心网时不在需要进行两套鉴权认证过程， 而是共用了一组密钥， 也即只需进行一次鉴权认证即可， 大大提高 了用户设备从 3 GPP和 WLAN先后接入到 3 GPP核心网时的鉴权认 证速度， 降低了连接建立时延。
实施例七
本发明实施例提供一种基站 90 , 可以应用在上述实施例一、 实 施例三、 实施例五提供的方法中， 并执行该方法中的相关步骤。 如 图 9所示， 基站 90包括：
第一接收单元 901 ,用于通过第三代伙伴计划 3GPP 网络接收用 户设备发送的包含用户设备的用户标识的第一消息， 提取并保存该 用户标识。
密钥获得单元 902 ,用于获得用于用户设备与该 3GPP网络进行 空口加密的密钥， 保存所述密钥以及所述密钥和用户标识的对应关 系。
第二接收单元 903 , 用于接收无线局域网 WLAN的接入点设备 发送的包含该用户标识的密钥查询消息。
第一发送单元 904 , 用于向接入点设备发送包含所述密钥的密 钥应答消息， 以便接入点设备从密钥应答消息中提取所述密钥， 并 允许该用户设备使用所述密钥接入该 WLAN。
本发明实施例提供的基站， 能够保存用户设备从 3GPP 的基站 接入 3 GPP核心网时的空口加密密钥， 并发送给 WLAN的接入点设 备， 以便重用在该用户设备从 WLAN的接入点设备接入 3 GPP核心 网的过程中。 因此， 相对现有技术而言， 在 3 GPP接入网和 WLAN 接入网为同一个运营商， 共享同一份签约数据的场景下， 用户设备 从 3GPP和 WLAN先后接入到 3GPP核心网时不在需要进行两套鉴 权认证过程， 而是共用了一组密钥， 也即只需进行一次鉴权认证即 可， 大大提高了用户设备从 3GPP和 WLAN先后接入到 3GPP核心 网时的鉴权认证速度， 降低了连接建立时延。
进一步地， 如图 10所示， 该基站 90还包括：
第二发送单元 905 ,用于通过所述 3GPP 网络向用户设备发送包 含接入点设备的服务集标识 S SID的分组数据网连接建立响应消息， 以便用户设备选择所述接入点设备接入 WLAN。
实施例八
本发明实施例提供一种接入点设备 1 10 , 可以应用在上述实施 例一、 实施例三、 实施例五提供的方法中， 并执行该方法中的相关 步骤。 如图 1 1 所示， 接入点设备 1 10 包括：， 包括：
第一接收单元 1 101 ,用于通过无线局域网 WLAN获取用户设备 的用户标识。
第一发送单元 1 102 , 用于向预先配置的第三代伙伴计划 3GPP 网络的基站发送包含所述用户标识的密钥查询消息。
第二接收单元 1 103 , 用于从基站接收包含该密钥的密钥应答消 息， 并从该密钥应答消息中提取所述密钥。
第二发送单元 1 104 ,用于通过该 WLAN向该用户设备发送携带 所述密钥或所述密钥的派生密钥的鉴权成功消息， 以指示允许该用 户设备使用所述密钥或所述派生密钥接入所述 WLAN。
本发明实施例提供的接入点设备， 能够从 3GPP 的基站中或得 到用户设备从 3GPP的基站接入 3GPP核心网时的空口加密密钥， 并 重用在该用户设备从 WLAN的接入点设备接入 3GPP核心网的过程 中。 因此， 相对现有技术而言， 在 3GPP接入网和 WLAN接入网为 同一个运营商， 共享同一份签约数据的场景下， 用户设备从 3GPP 和 WLAN先后接入到 3GPP核心网时不在需要进行两套鉴权认证过 程， 而是共用了一组密钥， 也即只需进行一次鉴权认证即可， 大大 提高了用户设备从 3GPP和 WLAN先后接入到 3GPP核心网时的鉴 权认证速度， 降低了连接建立时延。
进一步地， 如图 12所示， 所述接入点设备 1 10还包括： 广播单元 1 105 , 用于向用户设备广播发送该接入点设备 1 10对 应的 3GPP小区的信息， 以便处于所述 3GPP小区的用户设备选择所 述接入点设备 1 10接入所述 WLAN。
实施例九
本发明实施例提供一种通信系统， 如图 13所示， 包括： 用户设备 1301 , 以及如实施例二、 实施例四、 实施例六所述的 基站和接入点设备融合实体 1302。
或者， 该通信系统， 如图 14所示， 包括：
用户设备 1401 , 以及如实施例三、 实施例五、 实施例七所述的 基站 1402 和如实施例三、 实施例五、 实施例八所述的接入点设备 1403。
本发明实施例提供的通信系统， 基站保存了用户设备从 3 GPP 的基站接入 3GPP 核心网时的空口加密密钥， 并重用在该用户设备 从 WLAN的接入点设备接入 3 GPP核心网的过程中， 当然， 此时的 WLAN为该用户设备当前所在 3 GPP 小区的 WLAN。 因此， 相对现 有技术而言， 在 3 GPP接入网和 WLAN接入网为同一个运营商， 共 享同一份签约数据的场景下， 用户设备从 3GPP和 WLAN先后接入 到 3 GPP 核心网时不在需要进行两套鉴权认证过程， 而是共用了一 组密钥， 也即只需进行一次鉴权认证即可， 大大提高了用户设备从 3GPP和 WLAN先后接入到 3GPP核心网时的鉴权认证速度，降低了 连接建立时延。
以上所述， 仅为本发明的具体实施方式， 但本发明的保护范围 并不局限于此， 任何熟悉本技术领域的技术人员在本发明揭露的技 术范围内， 可轻易想到变化或替换， 都应涵盖在本发明的保护范围 之内。 因此， 本发明的保护范围应以所述权利要求的保护范围为准。

Claims

权 利 要 求 书
1、 一种无线局域网接入鉴权方法， 其特征在于， 包括： 接入点设备通过无线局域网 WLAN获取用户设备的用户标识； 所述接入点设备根据所述用户标识，查找到用于所述用户设备与
3GPP网络进行空口加密的密钥；
所述接入点设备通过所述 WLAN 向所述用户设备发送携带所述 密钥或所述密钥的派生密钥的鉴权成功消息， 以指示允许所述用户设 备使用所述密钥或所述派生密钥接入所述 WLAN。
2、 根据权利要求 1 所述的方法， 其特征在于， 在所述接入点设 备根据所述用户标识， 查找到用于所述用户设备与 3GPP网络进行空 口加密的密钥之前， 所述方法进一步包括：
所述 3GPP网络的基站通过所述 3GPP 网络接收所述用户设备发 送的包含所述用户标识的第一消息， 提取并保存所述用户标识；
所述基站获得所述密钥，保存所述密钥以及所述密钥和所述用户 标识的对应关系。
3、 根据权利要求 2所述的方法， 其特征在于， 所述基站和所述 接入点设备为同一实体；
所述接入点设备根据所述用户标识，查找到用于所述用户设备与 3GPP网络进行空口加密的密钥， 包括：
所述接入点设备根据所述用户标识和所述对应关系，查找到所述 密钥。
4、 根据权利要求 2所述的方法， 其特征在于， 所述基站和所述 接入点设备为可互通的不同实体；
所述接入点设备根据所述用户标识，查找到用于所述用户设备与 3GPP网络进行空口加密的密钥， 包括：
根据预先配置的所述接入点设备和所述基站的对应关系，所述接 入点设备向所述基站发送包含所述用户标识的密钥查询消息；
所述接入点设备从所述基站接收包含所述密钥的密钥应答消息， 并从所述密钥应答消息中提取所述密钥。
5、 根据权利要求 2 - 4任一所述的方法， 其特征在于， 所述基站 获得所述密钥包括： 所述基站接收所述用户设备发送的包含所述密钥 的初始上下文建立请求消息， 提取所述密钥；
或者，
所述基站接收所述用户设备发送的包含第一密钥的初始上下文 建立请求消息， 提取所述第一密钥， 根据所述第一密钥， 派生所述密 钥。
6、 根据权利要求 3所述的方法， 其特征在于，
所述用户标识为所述用户设备的介质访问控制 MAC地址， 所述 第一消息为无线资源控制协议 RRC消息；
所述接入点设备通过无线局域网 WLAN 获取所述用户标识包 括： 所述接入点设备在建立与所述用户设备在所述 WLAN 中的层二 连接过程中， 接收所述用户设备发送的包含所述 MAC地址的第二消 息， 并从所述第二消息中提取所述 MAC地址。
7、 根据权利要求 3所述的方法， 其特征在于，
所述用户标识为所述用户设备的国际移动用户识别码 IMSI或网 络接入识别符 NAI , 所述第一消息为附着请求消息；
所述接入点设备通过无线局域网 WLAN 获取所述用户标识包 括： 在所述接入点设备建立与所述用户设备在所述 WLAN 中的层二 连接之后，接收所述用户设备发送的包含所述用户设备的 IMSI或 NAI 的鉴权认证请求消息， 从所述鉴权认证请求消息中提取所述 IMSI或 所述 NAI。
8、 根据权利要求 4所述的方法， 其特征在于，
所述用户标识为所述用户设备的 MAC 地址， 所述第一消息为 RRC消息；
所述接入点设备通过无线局域网 WLAN 获取所述用户标识包 括： 所述接入点设备在建立与所述用户设备在所述 WLAN 中的层二 连接过程中， 接收所述用户设备发送的包含所述 MAC地址的第二消 息， 并从所述第二消息中提取所述 MAC地址。
9、 根据权利要求 4所述的方法， 其特征在于，
所述用户标识为所述用户设备的 IMSI或 NAI , 所述第一消息为 附着请求消息；
所述接入点设备通过无线局域网 WLAN 获取所述用户标识包 括： 在所述接入点设备建立与所述用户设备在所述 WLAN 中的层二 连接之后，接收所述用户设备发送的包含所述用户设备的 IMSI或 NAI 的鉴权认证请求消息， 从所述鉴权认证请求消息中提取所述 IMSI或 所述 NAI。
10、 根据权利要求 1 - 9任一所述方法， 其特征在于， 还包括： 所述接入点设备向所述用户设备广播发送所述接入点设备对应 的 3GPP小区的信息， 以便处于所述 3GPP小区的所述用户设备选择 所述接入点设备接入所述 WLAN。
11、 根据权利要求 1 - 9任一所述方法， 其特征在于， 还包括： 所述基站通过所述 3GPP网络向所述用户设备发送包含所述接入 点设备的服务集标识 SSID的分组数据网连接建立响应消息， 以便所 述用户设备选择所述接入点设备接入所述 WLAN。
12、 一种基站和接入点设备融合实体， 其特征在于， 包括： 第一接收单元， 用于通过第三代伙伴计划 3GPP网络接收用户设 备发送的包含所述用户设备的用户标识的第一消息， 提取并保存所述 用户标识；
密钥获得单元， 用于获得用于所述用户设备与所述 3GPP网络进 行空口加密的密钥， 保存所述密钥以及所述密钥和所述用户标识的对 应关系；
第二接收单元， 用于通过无线局域网 WLAN 获取所述用户设备 的所述用户标识；
查找单元， 用于根据所述用户标识和所述对应关系， 查找到所述 密钥；
发送单元， 用于通过所述 WLAN 向所述用户设备发送携带所述 密钥或所述密钥的派生密钥的鉴权成功消息， 以指示允许所述用户设 备使用所述密钥或所述派生密钥接入所述 WLAN。
13、 根据权利要求 12所述的基站和接入点设备融合实体， 其特 征在于， 所述密钥获得单元包括：
第一消息接收提取模块，用于接收所述用户设备发送的包含所述 密钥的初始上下文建立请求消息， 提取所述密钥；
或者包括：
第二消息接收提取模块，用于接收所述用户设备发送的包含第一 密钥的初始上下文建立请求消息，提取所述第一密钥； 密钥派生模块， 用于所述第一密钥， 派生所述密钥。
14、 一种基站， 其特征在于， 包括：
第一接收单元， 用于通过第三代伙伴计划 3GPP网络接收用户设 备发送的包含所述用户设备的用户标识的第一消息， 提取并保存所述 用户标识；
密钥获得单元， 用于获得用于所述用户设备与所述 3GPP网络进 行空口加密的密钥， 保存所述密钥以及所述密钥和所述用户标识的对 应关系；
第二接收单元， 用于接收无线局域网 WLAN 的接入点设备发送 的包含所述用户标识的密钥查询消息；
第一发送单元，用于向所述接入点设备发送包含所述密钥的密钥 应答消息， 以便所述接入点设备从所述密钥应答消息中提取所述密 钥， 并允许所述用户设备使用所述密钥接入所述 WLAN。
15、 根据权利要求 14所述的基站， 其特征在于， 所述基站还包 括：
第二发送单元， 用于通过所述 3GPP网络向所述用户设备发送包 含接入点设备的服务集标识 SSID的分组数据网连接建立响应消息， 以便所述用户设备选择所述接入点设备接入 WLAN。
16、 一种接入点设备， 其特征在于， 包括：
第一接收单元， 用于通过无线局域网 WLAN 获取用户设备的用 户标识； 第一发送单元， 用于向预先配置的第三代伙伴计划 3GPP网络的 基站发送包含所述用户标识的密钥查询消息；
第二接收单元，用于从所述基站接收包含所述密钥的密钥应答消 息， 并从所述密钥应答消息中提取所述密钥；
第二发送单元， 用于通过所述 WLAN 向所述用户设备发送携带 所述密钥或所述密钥的派生密钥的鉴权成功消息， 以指示允许所述用 户设备使用所述密钥或所述派生密钥接入所述 WLAN。
17、 根据权利要求 16所述的接入点设备， 其特征在于， 所述接 入点设备还包括：
广播单元，用于向所述用户设备广播发送所述接入点设备对应的 3GPP 小区的信息， 以便处于所述 3GPP 小区的所述用户设备选择所 述接入点设备接入所述 WLAN。
18、 一种通信系统， 其特征在于， 包括：
用户设备，以及如权利要求 12或 13所述的基站和接入点设备融 合实体。
19、 一种通信系统， 其特征在于， 包括：
用户设备， 以及如权利要求 14或 15所述的基站， 和如权利要求 16、 17所述的接入点设备。
PCT/CN2012/076662 2012-06-08 2012-06-08 一种无线局域网接入鉴权方法、设备及系统 WO2013181847A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201280000791.7A CN103609154B (zh) 2012-06-08 2012-06-08 一种无线局域网接入鉴权方法、设备及系统
PCT/CN2012/076662 WO2013181847A1 (zh) 2012-06-08 2012-06-08 一种无线局域网接入鉴权方法、设备及系统

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2012/076662 WO2013181847A1 (zh) 2012-06-08 2012-06-08 一种无线局域网接入鉴权方法、设备及系统

Publications (1)

Publication Number Publication Date
WO2013181847A1 true WO2013181847A1 (zh) 2013-12-12

Family

ID=49711311

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/076662 WO2013181847A1 (zh) 2012-06-08 2012-06-08 一种无线局域网接入鉴权方法、设备及系统

Country Status (2)

Country Link
CN (1) CN103609154B (zh)
WO (1) WO2013181847A1 (zh)

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105451284A (zh) * 2014-07-10 2016-03-30 华为技术有限公司 用于网络切换的方法及装置
WO2016180145A1 (zh) * 2015-09-10 2016-11-17 中兴通讯股份有限公司 一种无线网络鉴权方法及核心网网元、接入网网元、终端
WO2017024662A1 (zh) * 2015-08-11 2017-02-16 华为技术有限公司 一种接入认证方法及装置
CN107295512A (zh) * 2016-03-31 2017-10-24 展讯通信（上海）有限公司 通信设备及从lte向wlan切换过程中鉴权的方法
KR20180057665A (ko) * 2015-09-22 2018-05-30 후아웨이 테크놀러지 컴퍼니 리미티드 사용자 장비(ue)를 위한 액세스 방법, 디바이스 및 시스템
CN108513295A (zh) * 2018-04-12 2018-09-07 北京佰才邦技术有限公司 快速认证方法、服务器和用户设备
US10849191B2 (en) 2016-07-13 2020-11-24 Huawei International PTE., Ltd. Unified authentication for heterogeneous networks
US10939294B2 (en) 2015-08-12 2021-03-02 Blackberry Limited Network access identifier including an identifier for a cellular access network node

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019140633A1 (zh) 2018-01-19 2019-07-25 Oppo广东移动通信有限公司 指示用户设备获取密钥的方法、用户设备及网络设备
CN110475250A (zh) * 2019-08-28 2019-11-19 上海连尚网络科技有限公司 无线网络连接方法、装置、电子设备及介质
CN110493782A (zh) * 2019-08-28 2019-11-22 上海连尚网络科技有限公司 无线网络连接方法、装置、电子设备及介质
CN111405557B (zh) * 2020-03-19 2022-03-15 中国电子科技集团公司第三十研究所 一种使5g网络灵活支撑多种主认证鉴权算法的方法及系统
CN115065970A (zh) * 2022-06-23 2022-09-16 中国联合网络通信集团有限公司 鉴权方法、可信无线局域网交互功能设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20040049189A (ko) * 2002-12-05 2004-06-11 엘지전자 주식회사 무선랜과 범용 이동통신 시스템망간의 아이피 할당 방법
CN1719799A (zh) * 2005-07-15 2006-01-11 北京北方烽火科技有限公司 无线局域网与3gpp网的融合方法
CN101562814A (zh) * 2009-05-15 2009-10-21 中兴通讯股份有限公司 一种第三代网络的接入方法及系统
CN101835155A (zh) * 2010-03-31 2010-09-15 中兴通讯股份有限公司 一种终端接入融合网络的方法及系统

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100762644B1 (ko) * 2004-12-14 2007-10-01 삼성전자주식회사 Ｗｌａｎ-ｕｍｔｓ 연동망 시스템과 이를 위한 인증 방법
EP1890455A1 (en) * 2006-08-18 2008-02-20 Nokia Siemens Networks Gmbh & Co. Kg Method and apparatus for handover to a WLAN connection involving a trigger for mobility at Packet Data Gateway (PDG)
CN101610507A (zh) * 2009-06-16 2009-12-23 天津工业大学 一种接入3g-wlan互联网络的方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20040049189A (ko) * 2002-12-05 2004-06-11 엘지전자 주식회사 무선랜과 범용 이동통신 시스템망간의 아이피 할당 방법
CN1719799A (zh) * 2005-07-15 2006-01-11 北京北方烽火科技有限公司 无线局域网与3gpp网的融合方法
CN101562814A (zh) * 2009-05-15 2009-10-21 中兴通讯股份有限公司 一种第三代网络的接入方法及系统
CN101835155A (zh) * 2010-03-31 2010-09-15 中兴通讯股份有限公司 一种终端接入融合网络的方法及系统

Cited By (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105451284A (zh) * 2014-07-10 2016-03-30 华为技术有限公司 用于网络切换的方法及装置
EP3328106A4 (en) * 2015-08-11 2018-08-29 Huawei Technologies Co., Ltd. Access verification method and apparatus
WO2017024662A1 (zh) * 2015-08-11 2017-02-16 华为技术有限公司 一种接入认证方法及装置
CN106797559A (zh) * 2015-08-11 2017-05-31 华为技术有限公司 一种接入认证方法及装置
KR20180038493A (ko) * 2015-08-11 2018-04-16 후아웨이 테크놀러지 컴퍼니 리미티드 액세스 인증 방법 및 장치
KR102022813B1 (ko) * 2015-08-11 2019-09-18 후아웨이 테크놀러지 컴퍼니 리미티드 액세스 인증 방법 및 장치
US10939294B2 (en) 2015-08-12 2021-03-02 Blackberry Limited Network access identifier including an identifier for a cellular access network node
WO2016180145A1 (zh) * 2015-09-10 2016-11-17 中兴通讯股份有限公司 一种无线网络鉴权方法及核心网网元、接入网网元、终端
KR102024653B1 (ko) * 2015-09-22 2019-09-24 후아웨이 테크놀러지 컴퍼니 리미티드 사용자 장비(ue)를 위한 액세스 방법, 디바이스 및 시스템
JP2018532325A (ja) * 2015-09-22 2018-11-01 華為技術有限公司Ｈｕａｗｅｉ Ｔｅｃｈｎｏｌｏｇｉｅｓ Ｃｏ．，Ｌｔｄ． ユーザ機器ｕｅのアクセス方法、アクセスデバイス、およびアクセスシステム
EP3340690A4 (en) * 2015-09-22 2018-07-18 Huawei Technologies Co., Ltd. Access method, device and system for user equipment (ue)
KR20180057665A (ko) * 2015-09-22 2018-05-30 후아웨이 테크놀러지 컴퍼니 리미티드 사용자 장비(ue)를 위한 액세스 방법, 디바이스 및 시스템
EP3657835A1 (en) * 2015-09-22 2020-05-27 Huawei Technologies Co., Ltd. Access method of user equipment and user equipment
US11178584B2 (en) 2015-09-22 2021-11-16 Huawei Technologies Co., Ltd. Access method, device and system for user equipment (UE)
CN107295512A (zh) * 2016-03-31 2017-10-24 展讯通信（上海）有限公司 通信设备及从lte向wlan切换过程中鉴权的方法
US10849191B2 (en) 2016-07-13 2020-11-24 Huawei International PTE., Ltd. Unified authentication for heterogeneous networks
CN108513295A (zh) * 2018-04-12 2018-09-07 北京佰才邦技术有限公司 快速认证方法、服务器和用户设备

Also Published As

Publication number Publication date
CN103609154B (zh) 2017-08-04
CN103609154A (zh) 2014-02-26

Similar Documents

Publication Publication Date Title
WO2013181847A1 (zh) 一种无线局域网接入鉴权方法、设备及系统
CN109511113B (zh) 安全实现方法、相关装置以及系统
CN107852407B (zh) 用于集成小型小区和Wi-Fi网络的统一认证
CA2995311C (en) Network access identifier including an identifier for a cellular access network node
JP6632713B2 (ja) 直接通信キーの確立のための方法および装置
JP6022596B2 (ja) 融合ワイヤレスネットワークにおいての認証の方法およびデバイス
US11109206B2 (en) Security method and system for supporting discovery and communication between proximity based service terminals in mobile communication system environment
US10687213B2 (en) Secure establishment method, system and device of wireless local area network
US10798082B2 (en) Network authentication triggering method and related device
CN110495198B (zh) 网络认证方法、网络设备、终端设备及存储介质
WO2018170617A1 (zh) 一种基于非3gpp网络的入网认证方法、相关设备及系统
WO2011098048A1 (zh) 无线节点入网方法、系统及中继节点
WO2013107423A1 (zh) 一种网络接入的认证方法、系统和设备
WO2016015748A1 (en) Authentication in a radio access network
EP3158785A1 (en) Methods and arrangements for identification of user equipments for authentication purposes
EP3213545B1 (en) Identification of a wireless device in a wireless communication environment
US20230275883A1 (en) Parameter exchange during emergency access using extensible authentication protocol messaging
WO2013152740A1 (zh) 用户设备的认证方法、装置及系统
KR101434750B1 (ko) 이동통신망에서 지리 정보를 이용한 무선랜 선인증 방법 및 장치
CN115412909A (zh) 一种通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12878236

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 12878236

Country of ref document: EP

Kind code of ref document: A1