WO2014026540A1

WO2014026540A1 - Method and device for access control

Info

Publication number: WO2014026540A1
Application number: PCT/CN2013/080382
Authority: WO
Inventors: 全海洋; 张惠英; 张英; 刘建华
Original assignee: 电信科学技术研究院
Priority date: 2012-08-15
Filing date: 2013-07-30
Publication date: 2014-02-20
Also published as: CN103596242B; CN103596242A

Abstract

The embodiments of the present invention relate to the technical field of wireless communications, and in particular, to a method and device for access control, which are used to solve the problem existing in the prior art that when an MTC application server needs to prohibit the communications between user equipments in some groups and networks, an excessive signalling load and a waste of resources will be caused. The method for access control provided in the embodiments of the present invention includes: an MTC application server sending to a core network control node a group identifier of a group which needs to be prohibited and location information about the location where each user equipment in the group is located, which is used to inform the core network control node of informing the user equipments in the group corresponding to the group identifier that the access is prohibited. Since the embodiments of the present invention enable a user equipment not to perform access control by informing the user equipment of a group identifier of a group which needs to be prohibited, when an MTC application server needs to prohibit communications between user equipments in some groups and networks, the excessive signalling load is reduced and resources are saved.

Description

Method and apparatus for performing access control The present application claims to be filed on August 15, 2012 by the Chinese Patent Office, Application No. 201210291395.6, entitled "A Method and Apparatus for Access Control" Priority is hereby incorporated by reference in its entirety.

Technical field

The present invention relates to the field of wireless communication technologies, and in particular, to a method and device for performing access control. Background technique

Machine-type communication (MTC) is a new communication concept. Its purpose is to combine many different types of communication technologies, such as: machine-to-machine communication, machine control communication, human-computer interaction communication, mobile Connected communications to promote social production and lifestyle development. It is expected that the human-to-human communication business may only account for 1/3 of the entire user equipment market, and a larger number of communications is the MTC communication service. Sometimes, MTC communication is also known as Machine-to-machine (M2M) communication or the Internet of Things.

Current mobile communication networks are designed for communication between people, such as: determination of network capacity. If it is desired to utilize the mobile communication network to support MTC communication, it is necessary to optimize the mechanism of the mobile communication system according to the characteristics of the MTC communication, so that it can be better in the case where the traditional human-to-human communication is not affected or less affected. Implement MTC communication.

The MTC application server can store information about the MTC device and the interaction of the application layer data. When the MTC application server performs maintenance, upgrade, or prohibits certain group user devices from communicating with the network according to a certain policy, after the user equipment managed by the MTC application server accesses, the connection is released because the server refuses. Thus, in the case where a large number of MTC devices exist and communicate with the network, the signaling load is too high and resources are wasted.

In summary, when the MTC application server performs maintenance, upgrade, or prohibits certain group user devices from communicating with the network according to certain policies, the signaling load is too high and resources are wasted. Summary of the invention

A method and a device for performing access control according to an embodiment of the present invention are provided to solve the problem that when the MTC application server existing in the prior art needs to prohibit certain group user equipments from communicating with the network, the signaling load is too high. The problem of wasting resources.

A method for performing access control according to an embodiment of the present invention includes:

The MTC application server determines that the user equipment in the group needs to be disabled;

The MTC application server sends the group identifier of the group that needs to be forbidden and the location information of the location where each user equipment is located in the group to the core network control node, and is used to instruct the core network control node to notify the group corresponding to the group identifier. Group User equipment in the middle is forbidden to access.

Another method for performing access control according to an embodiment of the present invention includes:

The core network control node determines, according to the received location information from the MTC application server, an access network node corresponding to the geographic location of each location information;

The core network control node sends the received group identifier corresponding to the group that is forbidden to access from the MTC application server to the access network node, and is used to instruct the access network node to notify the group identifier User equipment in the corresponding group is prohibited from accessing.

Another method for performing access control provided by the embodiment of the present invention includes:

The access network node receives the group identity of the group that is prohibited from accessing the control node of the core network;

And the access network node sends the group identifier of the group that is forbidden to be sent to the user equipment that is located in the group corresponding to the group identifier, and is used to notify the user equipment to prohibit access.

When the user equipment needs to perform access control, it is determined whether the group identifier of the group to which the access group is prohibited has the group identifier of the group to which the group belongs. From the network side to determine;

The user equipment cancels the access control after determining the group identifier of the group that needs to perform access control in the group identifier of the group that is prohibited from accessing; in determining the group identifier of the group that is prohibited from accessing After there is no group identification of the group that needs to perform access control, access control is performed.

An MTC application server for performing access control according to an embodiment of the present invention includes:

a first determining module, configured to determine that the user equipment in the group needs to be prohibited from accessing;

a first processing module, configured to send the group identifier of the group that needs to be forbidden and the location information of the location where each user equipment is located in the group to the core network control node, to indicate that the core network control node notifies the group identifier User equipment in the group is forbidden to access.

A core network control node for performing access control according to an embodiment of the present invention includes:

a second determining module, configured to determine, according to the received location information from the MTC application server, an access network node corresponding to a geographic location of each location information;

a second processing module, configured to send, to the access network node, a group identifier corresponding to the group that is forbidden to access from the MTC application server, to notify the access network node to notify the group The user equipment in the corresponding group is prohibited from accessing.

An access network node for performing access control according to an embodiment of the present invention includes:

a first receiving module, configured to receive a group identifier of a group that is forbidden to access from a core network control node, and a third processing module, configured to send, to the The user equipment in the group corresponding to the group identifier is used to notify the user equipment to prohibit access. A user equipment for performing access control according to an embodiment of the present invention includes:

a judging module, configured to determine, in the group ID of the group that is prohibited from accessing, a group identifier of the group to which the group is prohibited, wherein the group identifier of the group to which the access is prohibited is a user The device is determined according to the received notification from the network side;

a control module, configured to: after determining a group identity of a group that needs to perform access control in a group identity of a group that is prohibited from accessing, canceling access control; determining a group identity of a group that is prohibited from accessing After there is no group identification of the group that needs to perform access control, access control is performed.

The embodiment of the present invention notifies the user equipment of the group identity of the group that needs to be forbidden to prevent the user equipment from performing access control, thereby reducing signaling when the MTC application server needs to prohibit certain group user equipment from communicating with the network. The load is too high, saving resources. DRAWINGS

1 is a schematic flow chart of a method for performing access control by an auxiliary user equipment on an MTC application server side according to an embodiment of the present invention;

2 is a schematic flow chart of a method for controlling access control of a user equipment on a control node of a core network according to an embodiment of the present invention;

3 is a schematic flowchart of a method for performing access control on a user equipment of an access network node according to an embodiment of the present invention; FIG. 4 is a schematic flowchart of a method for performing access control on a user equipment according to an embodiment of the present invention;

FIG. 5 is a schematic flowchart of a method for performing access control according to an embodiment of the present invention;

6 is a schematic structural diagram of an MTC application server according to an embodiment of the present invention;

7 is a schematic structural diagram of a control node of a core network according to an embodiment of the present invention;

8 is a schematic structural diagram of an access network node according to an embodiment of the present invention;

FIG. 9 is a schematic structural diagram of a user equipment according to an embodiment of the present invention. detailed description

In the embodiment of the present invention, the group identifier of the group to be forbidden is notified to the user equipment, so that the user equipment does not perform access control, so that the signaling load is reduced when the MTC application server needs to prohibit certain group user equipments from communicating with the network. Too high, saving resources.

The embodiments of the present invention are applicable to a Long Term Evolution (LTE) system and a Universal Mobile Telecommunications System (UMTS), and other systems having an MTC application server and requiring access control.

The embodiments of the present invention are further described in detail below with reference to the accompanying drawings.

As shown in FIG. 1 , a method package for assisting user equipment to perform access control on an MTC application server side according to an embodiment of the present invention is provided. The following steps are included:

Step 101: The MTC application server determines that the user equipment in the group needs to be disabled.

Step 102: The MTC application server sends the group identifier of the group that needs to be forbidden and the location information of the location where each user equipment is located in the group to the core network control node, to notify the core network control node to notify the corresponding group identifier. User equipment in the group is forbidden to access.

The MTC application server determines that the user equipment in the group needs to be disabled. For example, the MTC application server performs maintenance, the MTC application server performs the upgrade, and the MTC application server prohibits the user equipment in the group according to a certain policy. Into.

Preferably, after step 102, the method further includes:

After determining that the user equipment in the group is to be unblocked, the MTC application server sends the group identifier of the group that needs to be forbidden and the location information of the location where each user equipment in the group is located to the core network control node. And the user equipment in the group corresponding to the group identifier is notified to notify the core network control node to cancel the access prohibition.

The group identifier may be a complete group of Group ID of each group, or may be a partial bit of the Group ID. If it is a partial bit of the Group ID, it can be used when all groups with the same bit are disabled. For example, the Group ID is 000112. If all the groups in which the first three digits of the Group ID are 0 are forbidden, the 000 can be used as the group identifier.

If the number of prohibited groups is relatively large, the signaling load carried in the system information will increase, in order to reduce the signaling load. Optimized allocation methods can be considered when assigning group IDs. For example, the N bits in front of the identity of the group managed by an MTC server must be the same, and N is the number less than the length of the Group ID. For example, the Group ID is 16 bits. Then it can be assumed that the upper 8 bits of the group managed by an MTC server are the same. Abcdefgh _{0 is} assumed to broadcast abcdefgh 8 digits or broadcast abcdefgh00000000 16 digits in the system information, indicating that all high 8 is Groups of abcdefgh are forbidden to access. The abcdefgh used by different MTC servers is different. In order to deploy the package, abcdefgh can also be the identification number of the MTC server.

Considering the scenario of sharing a PLMN, the access control information may carry group control information of multiple PLMNs. The geographic location information may be a cell in which the group exists, a tracking area (TA), and a location area.

(Location Area, LA), Registered Area (RA), etc. can represent the geographic location of the user equipment in the group.

As shown in FIG. 2, the method for controlling the access control of the user equipment on the node side of the core network in the embodiment of the present invention includes the following steps:

Step 201: The core network control node determines, according to the received location information from the MTC application server, an access network node corresponding to the geographic location of each location information.

Step 202: The core network control node sends the received group identifier corresponding to the group that is forbidden to access from the MTC application server to the access network node, and is used to notify the access network node to notify the group corresponding to the group identifier. User equipment Access is forbidden.

Preferably, after step 202, the method further includes:

The core network control node sends the received group identifier corresponding to the group that cancels the access from the MTC application server to the access network node, and is used to notify the access network node to notify the user in the group corresponding to the group identifier. The device is forbidden to access.

As shown in FIG. 3, the method for performing access control on an access user node of an access network node in the embodiment of the present invention includes the following steps:

Step 301: The access network node receives the group identifier of the group that is forbidden to access from the control node of the core network. Step 302: The access network node sends the group identifier of the group that is prohibited from accessing to the group identifier. The user equipment in the group is used to notify the user equipment that access is prohibited.

There are many ways for the access network node to send the group identity of the group that is forbidden to the user equipment in the group corresponding to the group identity.

Manner 1: The access network node directly sends the group identity of the group that is forbidden to the user equipment.

In an implementation, the access network node may send the group identity of the group that is forbidden to the user equipment by broadcast or multicast.

If the group identity of the group that is forbidden to be accessed is sent to the user equipment by using the multicast mode, the access network node may send the group identity of the group that is forbidden to the user equipment by using the group scheduling mode.

Specifically, the access network node may use the group wireless network temporary identifier (Group) before sending the group scheduling.

The radio network Temporary Identity (G-RNTI) performs scheduling, so that the user equipment in the group obtains the group identity of the group that is prohibited from accessing the scheduled resources by monitoring the G-RNTI.

In an implementation, the access network node may place the group identity of the group that is prohibited from accessing into a System Information Block (SIB). The SIB can be sent through the existing SIB (see the 25.331 or 36.331 protocol, the same below) or via the new SIB. If it is a new SIB, a preferred method is that the scheduling period of the SIB is the same as the scheduling period of the SIB where the existing access control is located.

For the first mode, the core network control node receives the group device of the group that cancels the access from the core network control node, and is used to notify the user equipment to cancel the access prohibition.

In an implementation, the access network node may send the group identity of the group that is forbidden to be accessed to the user equipment by means of broadcast or multicast.

If the group identity of the group that is forbidden to be accessed is sent to the user equipment by using the multicast mode, the access network node may send the group identity of the group that is forbidden to the user equipment by using the group scheduling mode. Specifically, before the group identifier is sent, the access network node may perform scheduling by using the G-RNTI, so that the user equipment in the group obtains the group that cancels the access prohibition on the scheduled resource by monitoring the G-RNTI. Group ID.

In an implementation, the access network node may place the group identity of the group that is forbidden from accessing in the SIB. The SIB can be sent via the original SIB or via the new SIB. If it is a new SIB, a preferred method is that the scheduling period of the SIB is the same as the scheduling period of the SIB where the existing access control is located.

Manner 2: The access network node sends the group identity of the group that is prohibited from accessing to the user equipment in the group access control information.

In an implementation, the access network node may send the group access control information including the group identifier to the user equipment in a broadcast or multicast manner.

If the group access control information is sent to the user equipment in the multicast mode, the access network node may send the group access control information to the user equipment in a group scheduling manner.

Specifically, before the group identifier is sent, the access network node may perform scheduling by using the G-RNTI, so that the user equipment in the group obtains the group access control information on the scheduled resource by monitoring the G-RNTI.

In an implementation, the access network node may place the group access control information in the SIB. The SIB can be sent via the original SIB or via the new SIB. If it is a new SIB, a preferred method is that the scheduling period of the SIB is the same as the scheduling period of the SIB where the existing access control is located.

For the second mode, after receiving the group identity of the group that is forbidden to access from the core network control node, the core network control node sends the group identity of the group identity of the group that does not include the forbidden access to the user equipment. The control information is used to notify the user equipment to cancel the access prohibition.

In an implementation, the access network node may send the group access control information of the group identifier of the group that does not include the forbidden access to the user equipment in a broadcast or multicast manner.

If the group access control information of the group identifier of the group that does not include the forbidden access is sent to the user equipment by using the multicast mode, the access network node may use the group scheduling mode to include the group that does not include the forbidden access. The group access control information of the group identifier of the group is sent to the user equipment.

Specifically, before the group scheduling is sent, the access network node may use the G-RNTI to perform scheduling, so that the user equipment in the group obtains the group access control information on the scheduled resources by monitoring the G-RNTI, and Whether the corresponding group is prohibited from accessing according to whether the group access control information includes the group identifier.

In an implementation, the access network node may place group access control information that does not include the group identity of the group that is forbidden to access from being placed in the SIB. The SIB can be sent via the original SIB or via the new SIB. If it is a new SIB, a preferred method is that the scheduling period of the SIB is the same as the scheduling period of the SIB where the existing access control is located.

Among them, in the first mode and the second mode, the public land mobile network (PLMN) can be shared. For example, a broadcast or multicast PLMN can be broadcast and groups under it are forbidden to access. Case.

In the above process, if it is necessary to cancel the access control of the partial group and increase the access control of the partial group. This process is similar to the cancellation process. After you cancel the partial group ID, you can add a new group ID for access control. For example: The group that is forbidden to access is group 1, group 2, group 3, then the group identifier of group 1, 2, 3 is given in broadcast or group scheduling. Then, if the user of group 1 is to be allowed to access, and the user of group 4 is prohibited from accessing, the group identification of groups 2, 3, and 4 is given in the broadcast or group scheduling.

As shown in FIG. 4, the method for performing access control by a user equipment according to an embodiment of the present invention includes the following steps:

Step 401: When the user equipment needs to perform access control, determine whether the group identifier of the group to which the access group is prohibited has the group identifier of the group to which the group belongs, and the group identifier of the group that is prohibited from accessing is the user. The device is determined according to the received notification from the network side;

Step 402: After determining, by the user equipment, the group identifier of the group that needs to perform access control in the group identifier of the group that is prohibited from accessing, cancel the access control; and determine the group identifier of the group that is prohibited from accessing. After there is no group identification of the group that needs to perform access control, access control is performed.

There are many ways for the user equipment to receive notifications from the network side. Here are a few:

Manner 1: The user equipment directly receives the group identity of the group that is forbidden to access or cancels the group identity of the group that is forbidden to access.

Specifically, after receiving the group identity of the group that is forbidden to access from the control node of the core network or receiving the group identity of the group that cancels the access from the core network control node, the user equipment updates the forbidden access. The group ID of the group.

Then, when the user equipment needs to perform access control, it is determined whether the group identifier of the group to which the access is prohibited has the group identifier of the group to which the group belongs.

In an implementation, the user equipment may receive the group identity from the core network control node by broadcast or multicast. If the group identity is received in the multicast mode, the user equipment can receive the group identity by using the group scheduling mode. Specifically, the user equipment searches for the G-RNTI, and if it is determined on the control channel that the G-RNTI used for the group scheduling is searched, the group identifier that is prohibited from being accessed is received on the resource scheduled by the control channel.

In an implementation, the user equipment can receive the group identity through the SIB. The SIB can be sent via the original SIB or via the new SIB. If it is a new SIB, a preferred method is that the scheduling period of the SIB is the same as the scheduling period of the SIB where the existing access control is located.

For the first method, an implementation manner is as follows: The access layer of the user equipment receives the group identifier, and when the access control needs to be performed, it is determined whether the group identifier of the group that is prohibited from accessing has a group of the group to which the group belongs. The group identifier, after determining the group identifier of the group that needs to perform access control in the group identifier of the group that is prohibited from accessing, notifying the non-access stratum that the group is prohibited from being accessed by the network;

Another implementation manner is: a group of the group that the access layer of the user equipment receives from the network side that is forbidden to access The group identifier is notified to the non-access stratum, and when the non-access stratum needs to perform access control, it is determined whether the group identifier of the group to which the access group is prohibited has the group identifier of the group to which the group belongs.

Manner 2: The user equipment directly receives the group identity of the group that is forbidden to access or cancels the group identity of the group that is prohibited from accessing.

Manner 2: The user equipment receives group access control information including a group identifier of a group that is prohibited from accessing.

Specifically, after receiving, by the user equipment, the group access control information of the group identifier of the group that prohibits access from the core network control node, the user equipment receives the group access control information from the core network control node. The group identity is the group identity of the group that is prohibited from accessing.

In an implementation, the user equipment may receive group access control information from the core network control node by means of broadcast or multicast.

If the group access control information is received through the multicast mode, the user equipment may receive the group access control information by using the group scheduling mode.

Specifically, the user equipment searches for the G-RNTI, if it is determined that the searched G-RNTI is the corresponding group of the group.

The G-RNTI receives the group access control information through the group.

Specifically, the user equipment searches for the G-RNTI, and if it is determined on the control channel that the G-RNTI used for the group scheduling is searched, the group access control information is received on the resource scheduled by the control channel.

In an implementation, the user equipment may receive group access control information through the SIB. The SIB can be sent via the original SIB or via the new SIB. In the case of a new SIB, a preferred method is that the scheduling period of the SIB is the same as the scheduling period of the SIB in which the existing access control is located.

For the second method, an implementation manner is as follows: The access layer of the user equipment receives the group access control information, and when the access control needs to be performed, it is determined whether the group identifier of the group that is prohibited from accessing belongs to the group to which the group belongs. The group identifier of the group, after determining the group identifier of the group that needs to perform access control in the group identifier of the group that is prohibited from accessing, notifying the non-access stratum that the group is prohibited from being accessed by the network;

In another implementation manner, the access layer of the user equipment receives the group access control information, and notifies the non-access stratum of the group access control information of the group that is prohibited from accessing the network side. When the access layer needs to perform access control, it determines whether the group identifier of the group to which the access group is prohibited has the group identifier of the group to which the group belongs.

Wherein, if the PLMN is shared, the user equipment performs an access decision according to the information that the group under the home PLMN (Home PLMN, HPLMN) prohibits access. In the case of roaming scenarios, the decision to group access is also based on the HPLMN.

As shown in FIG. 5, the method for notifying a user equipment to prohibit or cancel a forbidden group includes the following steps: Step 501: The MTC application server determines that the user equipment in the group needs to be prohibited from being accessed. The group identifier and the location information of the location where each user equipment is located in the group are sent to the core network control node; Step 502: The core network control node determines each location information according to the received location information from the MTC application server. The access network node corresponding to the geographical location;

Step 503: The core network control node sends the received group identifier corresponding to the group that is forbidden to access from the MTC application server to the access network node.

Step 504: The access network node sets the group identity of the group that is forbidden to access to the group access control information, and sends the group identity information to the user equipment that is located in the group corresponding to the group identity.

Step 505: The user equipment determines, according to the received group access control information, a group that needs to be disabled. Step 506: The MTC application server determines that the user equipment in the group that needs to be forbidden is accessed, and the group that needs to be forbidden is to be cancelled. The group identifier of the group and the location information of the location where each user equipment is located in the group are sent to the core network control node;

Step 507: The core network control node determines, according to the received location information from the MTC application server, an access network node corresponding to the geographic location of each location information.

Step 508: The core network control node sends the received group identifier corresponding to the group that is forbidden to access from the MTC application server to the access network node.

Step 509: The access network node sends, to the user equipment, group access control information that does not include a group identifier of the group that cancels the prohibition of access;

Step 510: The user equipment determines, according to the received group access control information, a group that needs to be disabled. If the user equipment needs to perform access control, determine whether there is a group identifier of the group that is prohibited from accessing. The group ID of the group to which the group belongs, if yes, the access control is cancelled; otherwise, the access control is performed, for example, according to the access class barring mechanism (ACB, also called access control mechanism), enhancement The access prevention mechanism (Enhanced Access Barring, EAB, also known as enhanced access control mechanism) and/or roaming access control information is used for access.

The user equipment determines whether there is a necessary connection between the group identifier of the group to which the group is prohibited from being associated with the group identifier of the group to which the group belongs to, and the user equipment needs to perform access control. The judgment may be made according to the group identifier of the group that is prohibited from accessing after the latest update.

The solution of the present invention will be described in detail below by enumerating an application scenario.

Taking 7J Watch Company as an example, IWC wants to upgrade the server that manages the water meter in Chaoyang District (that is, the third-party MTC application server) between 12 midnight and 6 am the next day. The MTC server sends the identification information of the group it manages and the geographical location information (for example, the TA list (list) covering the Chaoyang District) to the control node of the core network at around midnight. The core network node determines which base stations need to be sent according to the TA list, and then sends the group identity information to the corresponding RAN control node under these TAs (eB) or Radio Network Controller (RNC). ). Radio Access Network (RAN) The control node delivers the group ID of the group to be forbidden through a new system information block, or to an existing SIB, such as SIB2 (LTE) or SIB3 (UMTS). Assume that there are two groups that are forbidden to access, and their group IDs are Group Id 1 and Group Id 2, then both group IDs are broadcasted in the system information. After that, the user equipment belonging to the two groups of Group id 1 and Group Id 2 receives the broadcast information and saves the related information. When the user equipment needs to communicate with the network, check the content of the system information, and confirm that the group to which it belongs belongs to the group that is prohibited from accessing, notify the NAS that the access fails, and indicate that the network denial group user equipment access.

Wait until the next morning at 6 am, the MTC server ends the upgrade, and sends the information to cancel the access control to the core network control node. The core network finds the RAN control node corresponding to its corresponding TA according to the Group id to be canceled, and sends the canceled information to the corresponding RAN control node. The RAN control node updates the system information based on the information.

The user equipment updates the system information and saves the system information. When the user equipment needs to access the network, it is determined whether the group to which it belongs can be accessed. If it is determined that the user equipment of the group is allowed to access, the behavior in the regular access process such as ACB check is performed.

For the above scenario, the user equipment may also inform the non-access stratum related information when the received system information includes the group identifier to which the system information belongs, and indicate that the group to which the group belongs is prohibited from accessing. After the system information is updated, the group identifier that is prohibited by the user equipment before being judged is not in the broadcast information, the non-access stratum is notified, and the related group access prohibition command is cancelled. When the user equipment wants to access, its non-access stratum determines whether to initiate an access request message to the access layer according to whether the group is prohibited from accessing. If it is forbidden, it will not be sent. Otherwise, the command of the access request can be sent to the access layer.

For the above scenario, the RAN control node may use the G-RNTI to schedule all group user equipments to notify the current control information for prohibiting access. The G-RNTI is reserved in advance, that is, an identifier that is known in advance by the network side and the user equipment, and is similar to a paging RNTI (Paging RNTI, P-RNTI, also referred to as a paging radio network temporary identifier). The public access control information on the shared channel is received by listening to the G-RNTI on the shared control channel. This information content is similar to the information in the system information in Embodiment 1 and Embodiment 3. It can carry group information, or part of the group identification. Considering the scenario of sharing a PLMN, it is also possible to carry group control information of a plurality of PLMNs that are prohibited from accessing. This information is transmitted periodically by G-RNTI group scheduling. In the event of a change in information, it must be sent in a timely manner.

Based on the same inventive concept, an embodiment of the present invention further provides an MTC application server. The method for solving the problem is similar to the method for accessing the user equipment on the MTC application server side of the embodiment of the present invention. For the implementation of the device, refer to the implementation of the method, and the repeated description will not be repeated.

As shown in FIG. 6, the MTC application server of the embodiment of the present invention includes: a first determining module 600 and a first processing module 610.

The first determining module 600 is configured to determine that the user equipment in the group needs to be prohibited from accessing;

The first processing module 610 is configured to send the group identifier of the group that needs to be forbidden and the location information of the location where each user equipment in the group is located to the core network control node, to notify the core network control node to notify the group identifier Corresponding group User equipment in the group is forbidden to access.

The first determining module 600 and the first processing module 610 may be devices such as a processor.

Preferably, the first determining module 600 determines that the user equipment access in the forbidden group needs to be cancelled;

Correspondingly, the first processing module 610 sends the group identifier of the group that needs to be forbidden and the location information of the location where each user equipment in the group is located to the core network control node, to notify the core network control node to notify the group. The user equipment in the corresponding group is identified to cancel the access.

Based on the same inventive concept, the core network control node is also provided in the embodiment of the present invention. The principle of the device solving the problem is similar to the method for the access control of the user equipment on the control node side of the core network in the embodiment of the present invention. Therefore, the implementation of the device can be referred to the implementation of the method, and the repeated description will not be repeated.

As shown in FIG. 7, the core network control node of the embodiment of the present invention includes: a second determining module 700 and a second processing module 710.

a second determining module 700, configured to determine, according to the received location information from the MTC application server, an access network node corresponding to a geographic location of each location information;

The second processing module 710 is configured to send, to the access network node, the group identifier corresponding to the group that is forbidden to access from the MTC application server, to notify the access network node to notify the group corresponding to the group identifier User equipment in the middle is forbidden to access.

The second determining module 700 and the second processing module 710 may be devices such as a processor.

Preferably, the second determining module 700 determines, according to the received location information from the MTC application server, an access network node corresponding to the geographic location of each location information;

Correspondingly, the second processing module 710 sends the received group identifier corresponding to the group that cancels the access from the MTC application server to the access network node, and is used to notify the access network node to notify the group corresponding to the group identifier. User equipment in the group is forbidden to access.

Based on the same inventive concept, an access network node is also provided in the embodiment of the present invention. The method for solving the problem is similar to the method for accessing the user equipment on the access network node side of the embodiment of the present invention. Therefore, the implementation of the device can be referred to the implementation of the method, and the repeated description will not be repeated.

As shown in FIG. 8, the access network node in the embodiment of the present invention includes: a first receiving module 800 and a third processing module 810. The first receiving module 800 is configured to receive a group identifier of a group that is prohibited from accessing the core network control node, and the third processing module 810 is configured to send the group identifier of the group that is prohibited from accessing to the group group. The user equipment in the corresponding group is used to notify the user equipment that access is prohibited.

The first receiving module 800 may be a transmission device having a transceiving function; the third processing module

The 810 can be a device such as a processor.

Preferably, the first receiving module 800 receives the group identifier of the group from the core network control node that cancels the access prohibition; Correspondingly, the third processing module 810 sends the group identifier of the group that is forbidden to be accessed to the user equipment that is located in the group corresponding to the group identifier, and is used to notify the user equipment to cancel the access prohibition.

Preferably, the third processing module 810 sends the group identifier to the user equipment by means of broadcast or group scheduling. Preferably, the third processing module 810 sends the group identifier to the user equipment in the group access control information. Preferably, the first receiving module 800 receives the group identity of the group from the core network control node that cancels the access prohibition;

Correspondingly, the third processing module 810 sends the group access control information that does not include the group identifier of the group for which the access is prohibited to be sent to the user equipment located in the group corresponding to the group identifier.

Preferably, the third processing module 810 sends the group access control information to the user equipment by means of broadcast or group scheduling.

Preferably, when the third processing module 810 sends the packet in the group scheduling manner, the user equipment is scheduled by using the G-RNTI.

The user equipment is provided in the embodiment of the present invention. The method for solving the problem is similar to the method for the user equipment to perform access control according to the embodiment of the present invention. Therefore, the implementation of the device can refer to the method. The implementation, the repetition will not be repeated.

As shown in FIG. 9, the user equipment in the embodiment of the present invention includes: a determining module 900 and a control module 910.

The determining module 900 is configured to determine, when the access control needs to be performed, whether the group identifier of the group to which the access is prohibited has a group identifier of the group to which the group belongs, wherein the group identifier of the group that is prohibited from accessing is The user equipment is determined according to the received notification from the network side;

The control module 910 is configured to cancel the access control after determining the group identity of the group that needs to perform access control in the group identity of the group that is prohibited from accessing; After the group ID of the group that does not need access control is identified in the identifier, access control is performed.

The determining module 900 and the control module 910 may be devices such as a processor.

Preferably, the user equipment of the embodiment of the present invention may further include:

The second receiving module 920 is configured to: after receiving the group identifier of the group that is prohibited from accessing the core network control node or receiving the group identifier of the group that is forbidden to access from the core network control node, the update is prohibited. The group ID of the group that is accessed.

The second receiving module 920 can be a transmission device with a transceiving function.

Preferably, the judging module 900 receives the group identifier included in the group access control information from the core network control node as the group identifier of the group that is prohibited from accessing.

Preferably, the determining module 900 receives the notification from the core network control node by means of broadcast or group scheduling. Preferably, the judging module 900 and the second receiving module 920 are at the access layer, the control module 910 is at the non-access stratum, or the second receiving module 920 is at the access layer, and the judging module 900 and the control module 910 are at the non-access stratum. . Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the present invention is in the form of a computer program product embodied on one or more computer-usable storage interfaces (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each process and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Although the preferred embodiment of the invention has been described, it will be apparent to those of ordinary skill in the art that <RTIgt; Therefore, the appended claims are intended to be construed as including the preferred embodiments and the modifications

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the invention

Claims

Rights request

A method for performing access control, characterized in that the method comprises:

Machine type communication The MTC application server determines that user equipment access in the group needs to be prohibited;

The MTC application server sends the group identifier of the group that needs to be forbidden and the location information of the location where each user equipment is located in the group to the core network control node, and is used to instruct the core network control node to notify the group corresponding to the group identifier. User equipment in the group is forbidden to access.

2. The method according to claim 1, wherein the MTC application server sends the group identifier of the group that needs to be forbidden and the location information of the location where each user equipment in the group is located to the core network control node. After that, it also includes:

After determining that the user equipment in the group is required to be unblocked, the MTC application server sends the group identifier of the group that needs to be forbidden and the location information of the location where each user equipment in the group is located to the core network control. And a node, configured to instruct the core network control node to notify the user equipment in the group corresponding to the group identifier to cancel the access prohibition.

3. A method for performing access control, characterized in that the method comprises:

The method according to claim 3, wherein the core network control node sends the received group identifier corresponding to the group that is forbidden to access from the MTC application server to the access network node. And the method further includes: determining, by the core network control node, the access network node corresponding to the geographic location of each location information according to the received location information from the MTC application server;

Sending, by the core network control node, the group identifier corresponding to the group that cancels the access prevention from the MTC application server to the access network node, and instructing the access network node to notify the group The user equipment in the corresponding group is identified to cancel the access.

5. A method for performing access control, characterized in that the method comprises:

The method of claim 5, wherein the access network node sends the group identifier to the user equipment in the group corresponding to the group identifier, and further includes:

Receiving, by the core network control node, a group identifier of a group from the core network control node that cancels the forbidden access; The core network control node sends the group identifier of the group that is forbidden to access to the user equipment that is located in the group corresponding to the group identifier, and is used to notify the user equipment to cancel the prohibition of access.

The method of claim 5, wherein the core network control node sends the group identifier to the user equipment, including:

The core network control node sends the group identifier to the user equipment by means of broadcast or group scheduling.

The method according to claim 5, wherein the access network node sends the group identity to the group access control information by sending the group identity to the access network node Give the user device.

The method of claim 8, wherein the access network node sends the group identifier to the user equipment in the group corresponding to the group identifier, and further includes:

The core network control node receives a group identity of a group from the core network control node that cancels the forbidden access; the core network control node does not include the group of the group identity of the group that cancels the forbidden access group The access control information is sent to the user equipment located in the group corresponding to the group identifier.

The method of claim 8, wherein the core network control node sends the group access control information to the user equipment, including:

The core network control node sends the group access control information to the user equipment in a broadcast or group scheduling manner.

The method according to claim 7 or 10, wherein, when the core network control node sends in a group scheduling manner, the user equipment is scheduled by using a G-RNTI.

12. A method for performing access control, characterized in that the method comprises:

When the user equipment needs to perform access control, it is determined whether the group identifier of the group to which the access group is prohibited has the group identifier of the group to which the group belongs. The notification from the network side is determined;

The method of claim 12, wherein the user equipment determines the group identity of the group that is forbidden to access, including:

After the user equipment receives the group identity of the group that is forbidden to access from the core network control node or receives the group identity of the group that cancels the access restriction from the core network control node, the group that is forbidden to access is updated. The group ID of the group.

The method of claim 12, wherein the receiving, by the user equipment, the notification from the core network control node comprises:

The user equipment will receive the group identifier included in the group access control information from the core network control node. The group ID of the group that is prohibited from access.

The method according to claim 13 or 14, wherein the user equipment receives the notification from the core network control node, including:

The user equipment receives the notification from the core network control node by means of broadcast or group scheduling.

The method according to any one of claims 12 to 14, wherein the access layer of the user equipment determines whether the group identifier of the group to which the access group is prohibited has the group identifier of the group to which the group belongs. After determining the group identifier of the group that needs to perform access control in the group identifier of the group that is prohibited from accessing, notify the non-access stratum that the group is prohibited from being accessed by the network; or

The access layer of the user equipment notifies the non-access stratum of the received group identity of the group that is forbidden to access from the network side, and the non-access stratum determines whether the group identity of the group that is prohibited from accessing is The group ID of the group to which you belong.

17. A machine type communication MTC application server for performing access control, wherein the MTC application server comprises:

The MTC application server according to claim 17, wherein the first determining module is further configured to: determine that the user equipment access in the group is required to be canceled;

The first processing module is further configured to: send the group identifier of the group that needs to be forbidden and the location information of the location where each user equipment in the group is located to the core network control node, where used to indicate the notification of the core network control node The user equipment in the group corresponding to the group identifier cancels the access prohibition.

A core network control node for performing access control, wherein the core network control node includes: a second determining module, configured to determine each location information according to the received location information from the MTC application server. The access network node corresponding to the geographical location;

The core network control node according to claim 19, wherein the second determining module is further configured to: determine, according to the received location information from the MTC application server, a geographical location of each location information Access network node;

The second processing module is further configured to: send the received group identifier corresponding to the group that cancels the access from the MTC application server to the access network node, and is used to notify the access network node to notify Corresponding to the group identifier User equipment in the group is forbidden from accessing.

An access network node that performs access control, where the access network node includes:

a first receiving module, configured to receive a group identifier of a group that is forbidden to access from a core network control node, and a third processing module, configured to send, to the The user equipment in the group corresponding to the group identifier is used to notify the user equipment to prohibit access.

The access network node according to claim 21, wherein the first receiving module is further configured to: receive a group identifier of a group that is forbidden to be accessed from a control node of the core network;

The third processing module is further configured to: send the group identifier of the group that is forbidden to access to the user equipment that is located in the group corresponding to the group identifier, to notify the user equipment to cancel the prohibition Access.

The access network node according to claim 21, wherein the third processing module is specifically configured to: send the group identifier to the user equipment by using a broadcast or a group scheduling manner.

The access network node according to claim 21, wherein the third processing module is specifically configured to: send the group identifier to the user equipment by placing the group identifier in the group access control information.

The access network node according to claim 24, wherein the first receiving module is further configured to: receive a group identifier of a group that is forbidden to access from a control node of the core network;

The third processing module is further configured to: send group access control information that does not include the group identifier of the group that cancels the access prohibition to the user equipment that is located in the group corresponding to the group identifier.

The access network node according to claim 24, wherein the third processing module is specifically configured to: send the group access control information to the user equipment by using a broadcast or a group scheduling manner.

The access network node according to claim 23 or 26, wherein the third processing module is further configured to: when the group scheduling mode is sent, scheduling the user equipment by using a G-RNTI.

A user equipment for performing access control, where the user equipment includes:

The user equipment of claim 28, wherein the user equipment further comprises:

a second receiving module, configured to receive a group identity of a group that is forbidden to access from a core network control node or to receive a group identity of a group that is forbidden to access from a core network control node, The group ID of the entered group.

The user equipment according to claim 28, wherein the determining module is specifically configured to: The group identifier included in the group access control information received from the core network control node is used as the group identifier of the group that is prohibited from accessing.

The user equipment according to claim 29 or 30, wherein the determining module is specifically configured to: receive a notification from a core network control node by using a broadcast or a group scheduling manner.

The user equipment according to claim 29, wherein the determining module and the second receiving module are in an access layer, and the control module is in a non-access stratum; or

The second receiving module is at an access layer, and the determining module and the control module are at a non-access stratum.