WO2014205846A1

WO2014205846A1 - Data transmission method, machine type communication terminal and addressing server

Info

Publication number: WO2014205846A1
Application number: PCT/CN2013/078509
Authority: WO
Inventors: 陈璟; 段为明; 房明
Original assignee: 华为技术有限公司
Priority date: 2013-06-29
Filing date: 2013-06-29
Publication date: 2014-12-31
Also published as: CN104521255A; CN104521255B

Abstract

The embodiment of the present invention provides a data transmission method, machine type communication (MTC) terminal and addressing server, the method comprising: for a target application server, the machine type communication (MTC) terminal generating data carrying the identity information of the MTC terminal, the data at least comprising application data and addressing information; and the MTC terminal sending the data to the addressing server via an access network so that the addressing server sends the data to the target application server according to the addressing information; thus, the purpose that the data sent by the MTC terminal is directly transmitted to the corresponding application server via the wireless access network is realized.

Description

Data transmission method, machine type communication terminal and addressing server

The present invention relates to communication technologies, and in particular, to a data transmission method, a machine type communication terminal, and an address server. Background technique

The characteristics of Small Data Transmission apply to Machine Type Communication (MTC) terminals that send or receive small amounts of data. In order to improve the lifetime of the MTC terminal, the MTC terminal is required to be a very low-power MTC terminal in the process of small data transmission, and the radio access network (RAN) side detects and controls the behavior of the MTC terminal, for example, in canceling the service. The MTC terminal is closed.

In the prior art, in order to meet the requirements of small data transmission characteristics, the MTC terminal periodically wakes up and sends small data to the radio access network through little message interaction. After the small data is sent, the MTC terminal re-enters the sleep state. . In this way, the power consumption of the MTC terminal can be minimized, thereby making the MTC terminal have an extremely long life cycle.

However, the data sent by the MTC terminal eventually needs to be transmitted to the corresponding application server. In the above method for transmitting small data, only the air interface transmission between the MTC terminal and the access network is considered, and the scheme of transmitting small data from the access network to the application server is not considered. Summary of the invention

The embodiment of the invention provides a data transmission method, a machine type communication terminal and an address server, which directly transmit data transmitted by the MTC terminal to the corresponding application server via the wireless access network.

In a first aspect, an embodiment of the present invention provides a data transmission method, including:

The machine type communication MTC terminal generates data for carrying the identity information of the MTC terminal for the target application server, where the data includes at least application data and addressing information;

The MTC terminal transmits the data to an addressing server via an access network to cause the addressing server to transmit the data to the target application server based on the addressing information.

In a first possible implementation manner of the first aspect, the machine type communication MTC terminal is The target application server generates data carrying identity information, including:

The machine type communication MTC terminal generates data for carrying the permanent identity information of the MTC terminal for the target application server.

In a second possible implementation manner of the first aspect, the MTC terminal generates, by the target application server, data that carries the identity information of the MTC terminal, including:

Determining, by the MTC terminal, whether the first temporary identity information of the MTC terminal exists locally; if yes, generating, by the target application server, data carrying the first temporary identity information; otherwise, if not, The target application server generates data carrying permanent identity information.

In conjunction with the first aspect or the second possible implementation of the first aspect, in a third possible implementation of the first aspect, the MTC terminal sends the data to an addressing server via an access network After that, including:

Receiving, by the MTC terminal, the encrypted second temporary identity information sent by the addressing server via the access network, where the second temporary identity information is that the addressing server is the MTC according to a preset policy. Generated by the terminal;

The MTC terminal decrypts the second temporary identity information and saves the second temporary identity information.

With the third possible implementation of the first aspect, in a fourth possible implementation manner of the first aspect, if the MTC terminal determines that the first temporary identity information of the MTC terminal exists locally, After the MTC terminal sends the data to the address server via the access network, before the MTC terminal receives the encrypted second temporary identity information sent by the addressing server via the access network, the method includes:

Receiving, by the MTC terminal, a failure indication sent by the addressing server via the access network, where the failure indication is that the addressing server cannot identify the MTC terminal according to the first temporary identity information, Generated by the MTC terminal;

The MTC terminal deletes the first temporary identity information, and generates data carrying the permanent identity information for the target application server;

The MTC terminal transmits data carrying the permanent identity information to the addressing server via the access network.

Combining the second, third or fourth possible implementation of the first aspect, in the first In a fifth possible implementation manner, the MTC terminal generates, by the target application server, data that carries the first temporary identity information, including:

The MTC terminal protects data carrying the first temporary identity information and generates protected data for the target application server.

With reference to the fifth possible implementation manner of the first aspect, in a sixth possible implementation manner of the first aspect, the MTC terminal saves a key corresponding to the permanent identity information, where the MTC terminal Protecting data carrying the first temporary identity information, and generating protected data for the target application server, including:

The MTC terminal protects the application data and the addressing information by using the key. With reference to any one of the first to fourth possible implementations of the first aspect, in a seventh possible implementation of the first aspect, the MTC terminal is configured to carry the data of the permanent identity information Protection is performed to generate protected data for the target application server.

With reference to the seventh possible implementation of the first aspect, in an eighth possible implementation manner of the first aspect, the MTC terminal saves a public key and a key corresponding to the permanent identity information, where The MTC terminal protects the data carrying the permanent identity information, and generates protected data for the target application server, including:

The MTC terminal encrypts the permanent identity information by using the public key, and protects the application data and the addressing information by using the key; or

The MTC terminal encrypts the permanent identity information and the addressing information by using the public key, and protects the application data by using the key; or

The MTC terminal protects the application data and the addressing information by using the dense molybdenum. With reference to the seventh possible implementation of the first aspect, in a ninth possible implementation manner of the first aspect, the MTC terminal saves a public key and a key corresponding to the permanent identity information, The MTC terminal encrypts the data carrying the permanent identity information, and before generating the protected data for the target application server, the method includes:

The MTC terminal calculates an integrity protection key according to the key;

The MTC terminal calculates a message check code MAC according to the integrity protection key;

The MTC terminal protects the data carrying the permanent identity information, and generates protected data for the target application server, including:

The MTC terminal uses the public key pair to identify the identity information, the addressing information, and the application Data and the MAC encryption.

In conjunction with the eighth possible implementation of the first aspect, in a tenth possible implementation manner of the first aspect, the MTC terminal uses the key to protect the application data and the addressing information , including:

The MTC terminal calculates the encryption key and the integrity key by using the key;

And the MTC terminal encrypts the application data and the addressing information by using the encryption key, and uses the integrity key to perform integrity protection on the application data and the addressing information.

With reference to the possible implementation of any one of the fifth to the tenth aspects of the first aspect, in an eleventh possible implementation manner of the first aspect, the method further includes:

The MTC terminal adds anti-replay information to the protected data, and the anti-replay information includes: one of current time information, bidirectional current value information, serial number information, or a combination thereof.

In a second aspect, an embodiment of the present invention provides a data transmission method, including:

Addressing server receiver class communication data transmitted by the MTC terminal via the access network and carrying the identity information of the MTC terminal, the data including at least application data and addressing information;

The addressing server transmits the data to the target application server based on the addressing information. In a first possible implementation manner of the second aspect, the addressing server receiver class communication data sent by the MTC terminal via the access network and carrying the identity information of the MTC terminal includes:

The addressing server receives the MTC terminal to generate data for the target application server to carry the first temporary identity information.

In a second possible implementation of the second aspect, the addressing server receiver class communication data sent by the MTC terminal via the access network and carrying the identity information of the MTC terminal includes:

The addressing server receives the MTC terminal to generate data carrying the permanent identity information for the target application server.

In conjunction with the first possible implementation of the second aspect, in a third possible implementation manner of the second aspect, the addressing server receives the MTC terminal and generates the carrying After the data of a temporary identity information, including:

Determining, by the addressing server, whether the MTC terminal can be identified according to the first temporary identity information; If the addressing server cannot identify the MTC terminal according to the first temporary identity information, send a failure indication to the MTC terminal via the access network;

The addressing server receives data carrying the persistent identity information sent by the MTC terminal via the access network.

With reference to the second aspect, the first, the second, or the third possible implementation of the second aspect, in a fourth possible implementation of the second aspect, Addressing information, before sending the data to the target application server, includes:

The addressing server generates and encrypts the second temporary identity information for the MTC terminal according to a preset policy.

The addressing server transmits the second temporary identity information to the MTC terminal via the access network.

In conjunction with the second or third possible implementation of the second aspect, in a fifth possible implementation of the second aspect, the addressing server receives the MTC terminal and generates the target application server The data carrying the permanent identity information includes:

The addressing server receives the protected data sent by the MTC terminal, and the protected data is generated by the MTC terminal protecting the data carrying the permanent identity information.

With the fifth possible implementation of the second aspect, in a sixth possible implementation manner of the second aspect, after the receiving, by the addressing server, the protected data sent by the MTC terminal, the method includes:

The addressing server determines a key corresponding to the permanent identity information;

The addressing server decrypts and performs integrity verification on the application data according to the key. With reference to the sixth possible implementation of the second aspect, in a seventh possible implementation of the second aspect, after the addressing server determines the key corresponding to the permanent identity information, the method includes:

The addressing server decrypts and completes the addressing information according to the key. With reference to the fifth, sixth or seventh possible implementation of the second aspect, in an eighth possible implementation manner of the second aspect, the addressing server, according to the addressing information, The data is sent to the target application server, including:

The addressing server transmits the protected data carrying the security protection information to the target application server according to the addressing information. With the fifth possible implementation of the second aspect, in a ninth possible implementation manner of the second aspect, after the receiving, by the addressing server, the protected data sent by the MTC terminal, the method includes:

Determining, by the addressing server, a home addressing server according to the permanent identity information or the first temporary identity information, where the home addressing server is an address that holds a private key corresponding to a public key of the MTC terminal server.

With reference to any one of the fifth to the ninth possible implementation manners of the second aspect, in the tenth possible implementation manner of the second aspect, the addressing server receives the received by the MTC terminal Protected data, including:

The addressing server receives protected data that adds anti-replay information, and the anti-replay information includes: one of current time information, bidirectional current value information, serial number information, or a combination thereof.

The addressing server performs an anti-replay check on the protected data based on the anti-replay information.

In a third aspect, an embodiment of the present invention provides a data transmission method, including:

The access network receives the addressing data of the addressing server receiving device type communication and the MTC terminal carrying the identity information of the MTC terminal, where the data includes at least application data and addressing information;

The access network transmits the data to an addressing server to cause the addressing server to transmit the data to a target application server based on the addressing information.

In a first possible implementation manner of the third aspect, the access network receives, by the addressing server, the receiver-type communication MTC terminal, the data that carries the identity information of the MTC terminal, and includes:

The access network receives data that is sent by the MTC terminal and carries the first temporary identity information. In a second possible implementation manner of the third aspect, the access network receives data that is sent by the addressing server, the receiver type communication MTC terminal, and carries the identity information of the MTC terminal, and includes:

The access network receives data that carries the permanent identity information sent by the MTC terminal.

In a fourth aspect, an embodiment of the present invention provides a machine type communication MTC terminal, including: a processing module, configured to generate, by using a target application server, data that carries identity information of the MTC terminal, where the data includes at least application data, Address information; And a sending module, configured to send the data to the addressing server via the access network, so that the addressing server sends the data to the target application server according to the addressing information.

In a first possible implementation manner of the fourth aspect, the processing module is configured to: generate data for carrying the permanent identity information of the MTC terminal for the target application server. In a second possible implementation manner of the fourth aspect, the MTC terminal further includes: a determining module, configured to determine whether the first temporary identity information of the MTC terminal exists locally; and the processing module is configured to: The determining module determines that the first temporary identity information exists locally, and generates data that carries the first temporary identity information for the target application server; if the determining module determines that the local does not exist, The first temporary identity information is used to generate data carrying permanent identity information for the target application server.

With reference to the fourth aspect, or the second possible implementation manner of the fourth aspect, in a third possible implementation manner of the fourth aspect, the MTC terminal further includes:

a receiving module, configured to receive the encrypted second temporary identity information sent by the addressing server via the access network, where the second temporary identity information is the addressing server according to a preset policy, Generated by the MTC terminal;

The processing module is configured to decrypt the second temporary identity information, and save the second temporary identity information.

With reference to the third possible implementation manner of the fourth aspect, in a fourth possible implementation manner of the fourth aspect, if the determining module determines that the first temporary identity information of the MTC terminal exists locally, The receiving module is configured to:

Receiving a failure indication sent by the addressing server via the access network, where the failure indication is generated by the addressing server for the MTC terminal when the MTC terminal cannot be identified according to the first temporary identity information. ;

The processing module is configured to delete the first temporary identity information, and generate data that carries the permanent identity information for the target application server;

The sending module is configured to send data carrying the persistent identity information to the addressing server via the access network.

With reference to the second, third, or fourth possible implementation of the fourth aspect, in a fifth possible implementation manner of the fourth aspect, the processing module is configured to carry the first The data of the temporary identity information is protected, and the protected data is generated for the target application server. With reference to the fifth possible implementation manner of the fourth aspect, in a sixth possible implementation manner of the fourth aspect, the processing module is configured to use the key to pair the application data with the Address information protection.

With reference to the possible implementation of any one of the first to fourth aspects of the fourth aspect, in a seventh possible implementation of the fourth aspect, the processing module is configured to carry the permanent identity The data of the information is protected to generate protected data for the target application server.

With reference to the seventh possible implementation of the fourth aspect, in an eighth possible implementation manner of the fourth aspect, the MTC terminal further includes:

a storage module, configured to store a public key and a key corresponding to the permanent identity information, where the processing module is configured to encrypt the permanent identity information by using the public key, and use the key to the application Data and the addressing information are protected; or

The processing module is configured to encrypt the permanent identity information and the addressing information by using the public key, and protect the application data by using the key; or

The processing module is configured to protect the application data and the addressing information by using the dense molybdenum.

With reference to the seventh possible implementation of the fourth aspect, in a ninth possible implementation manner of the fourth aspect, the MTC terminal further includes:

a storage module, configured to store a public key and a key corresponding to the permanent identity information; the processing module, configured to calculate an integrity protection key according to the key; according to the integrity protection key, Calculating a message check code MAC; encrypting the identity information, the addressing information, the application data, and the MAC by using the public key.

In conjunction with the eighth possible implementation of the fourth aspect, in a tenth possible implementation manner of the fourth aspect, the processing module is configured to calculate an encryption key and integrity using the key And encrypting the application data and the addressing information by using the encryption key, and using the integrity key to perform integrity protection on the application data and the addressing information.

With reference to the fifth to tenth possible implementation manners of the fourth aspect, in an eleventh possible implementation manner of the fourth aspect, the processing module is configured to The data adds anti-replay information, and the anti-replay information includes: one of current time information, bidirectional current value information, serial number information, or a combination thereof.

In a fifth aspect, an embodiment of the present invention provides an addressing server, including: a receiving module, configured to receive data of the identity information of the MTC terminal sent by the MTC terminal via the access network, where the data includes at least application data and addressing information;

And a sending module, configured to send the data to the target application server according to the addressing information. In a first possible implementation manner of the fifth aspect, the receiving module is configured to receive, by the MTC terminal, data that is used by the target application server to carry the first temporary identity information.

In a second possible implementation manner of the fifth aspect, the receiving module is configured to receive, by the MTC terminal, data that is used by the target application server to carry the permanent identity information.

In conjunction with the first possible implementation of the fifth aspect, in a third possible implementation of the fifth aspect, the addressing server further includes:

a determining module, configured to determine, according to the first temporary identity information, whether the MTC terminal is identifiable;

The sending module is configured to: when the determining module is unable to identify the MTC terminal according to the first temporary identity information, send a failure indication to the MTC terminal by using the access network; And configured to receive data that is sent by the MTC terminal and sent by the access network to carry the permanent identity information.

With reference to the fifth aspect, the first, the second or the third possible implementation manner of the fifth aspect, in a fourth possible implementation manner of the fifth aspect, the addressing server further includes: a processing module, configured to generate and encrypt second temporary identity information for the MTC terminal according to a preset policy;

The sending module is configured to send the second temporary identity information to the MTC terminal via the access network.

With reference to the second or third possible implementation of the fifth aspect, in a fifth possible implementation manner of the fifth aspect, the receiving module is configured to receive the protected sent by the MTC terminal Data, the protected data is generated by the MTC terminal protecting the data carrying the permanent identity information.

With reference to the fifth possible implementation manner of the fifth aspect, in a sixth possible implementation manner of the fifth aspect, the processing module is configured to determine a key corresponding to the permanent identity information, Declaring the key, decrypting and verifying the application data.

With reference to the sixth possible implementation manner of the fifth aspect, in a seventh possible implementation manner of the fifth aspect, the processing module is configured to solve the addressing information according to the key Secret and integrity verification.

With reference to the fifth, sixth, or seventh possible implementation manner of the fifth aspect, in an eighth possible implementation manner of the fifth aspect, the sending module is configured to use, according to the addressing information , Send protected data carrying security information to the target application server.

With reference to the fifth possible implementation manner of the fifth aspect, in a ninth possible implementation manner of the fifth aspect, the processing module is configured to use the permanent identity information or the first temporary identity information Determining a home addressing server, which is an addressing server that holds a private key corresponding to the public key of the MTC terminal.

With reference to any one of the fifth to the ninth possible implementation manners of the fifth aspect, in a tenth possible implementation manner of the fifth aspect, the receiving module is further configured to receive an anti-replay The protected data of the information, the anti-replay information includes: one of current time information, two-way current value information, serial number information, or a combination thereof;

The processing module is configured to perform anti-replay checking on the protected data according to the anti-replay information.

In a sixth aspect, an embodiment of the present invention provides an access network, including:

a receiving module, configured to receive data that is sent by the MTC terminal that is addressed by the server, and that carries the identity information of the MTC terminal, where the data includes at least application data and addressing information, and a sending module, where the data is sent to Addressing the server to cause the addressing server to transmit the data to the target application server based on the addressing information.

In a first possible implementation manner of the sixth aspect, the receiving module is configured to receive data that is sent by the MTC terminal and that carries the first temporary identity information.

In a second possible implementation manner of the sixth aspect, the receiving module is configured to receive data that is sent by the MTC terminal and that carries permanent identity information.

According to a seventh aspect, an embodiment of the present invention provides a machine type communication MTC terminal, including: a processor and a memory, where the memory stores an execution instruction, when the MTC terminal is running, between the processor and the memory In communication, the processor executing the execution instruction causes the MTC terminal to perform any of the first to eleventh possible implementations of the first aspect, the first aspect.

According to an eighth aspect, an embodiment of the present invention provides an addressing server, including: a processor and a memory, where the memory stores an execution instruction, when the addressing server is running, the processor and the Communicating between the memories, the processor executing the execution instructions to cause the addressing server to perform any of the first to tenth possible implementations of the second aspect, the second aspect.

According to a ninth aspect, an embodiment of the present invention provides an access network, including: a processor and a memory, where the memory stores an execution instruction, and when the access network is running, the processor and the memory communicate And executing, by the processor, the execution instruction, so that the access network performs the first or second possible implementation manner of the third aspect, the second aspect, or the second aspect.

The data transmission method, the machine type communication terminal, and the address server provided by the embodiment of the present invention, the MTC terminal sends the data that is generated by the target application server and carries the identity information of the MTC terminal to the access network, and the access network receives the received data. The data is forwarded directly to the addressing server without any processing, thereby realizing the purpose of directly transmitting the data sent by the MTC terminal to the corresponding application server via the wireless access network. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor. 1 is a flowchart of Embodiment 1 of a data transmission method according to the present invention;

2 is a flowchart of Embodiment 2 of a data transmission method according to the present invention;

3 is a flowchart of Embodiment 3 of a data transmission method according to the present invention;

4 is a signaling diagram of Embodiment 4 of a data transmission method according to the present invention;

FIG. 5 is a signaling diagram of Embodiment 5 of a data transmission method according to the present invention;

6 is a first schematic structural diagram of protected data of the present invention;

7 is a signaling diagram of Embodiment 6 of a data transmission method according to the present invention;

Figure 8 is a second schematic structural view of protected data of the present invention;

9 is a signaling diagram of Embodiment 7 of a data transmission method according to the present invention;

10 is a schematic structural diagram of Embodiment 1 of an MTC terminal according to the present invention;

11 is a schematic structural diagram of Embodiment 2 of an MTC terminal according to the present invention;

12 is a schematic structural diagram of Embodiment 1 of an addressing server according to the present invention;

13 is a schematic structural diagram of Embodiment 2 of an addressing server according to the present invention; FIG. 14 is a first embodiment of an access network according to the present invention;

Figure 15

Figure 16

17 is a specific embodiment of the access network embodiment of the present invention. The purpose, technical solutions, and advantages of the embodiments of the present invention will be more apparent. The following is a description of the embodiments of the present invention. The present invention is clearly and completely described, and it is obvious that the described embodiments are a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

FIG. 1 is a flowchart of Embodiment 1 of a data transmission method according to the present invention. The execution subject of this embodiment is a machine type communication MTC terminal, which is suitable for a scenario in which data is directly transmitted to a target application server via an access network. Specifically, this embodiment includes the following steps:

101. Machine type communication The MTC terminal generates data for carrying the identity information of the MTC terminal for the target application server, and the data includes at least application data and addressing information.

The MTC terminal device generates data for carrying the MTC terminal identity information for the target application server, for example, data carrying the permanent identity (PID) information of the MTC terminal or the Temporary Identity (TID) information carrying the MTC terminal. The data. The data also includes application data (data), addressing information (Addressing Info), and the like. The addressing information may be independent information, such as a Fully Qualified Domain Name (FQDN), an Internet Protocol (IP) address, etc. of the target application server carried in the application data; or, there may be no independent The addressing information includes the corresponding addressing information in the identity information of the MTC terminal, that is, part of the identity information can be used for addressing. For example, each MTC terminal has a fixed target application server, and the identity information corresponding to the target application server is included in the identity information of the MTC terminal.

Optionally, if only the permanent identity information is saved on the MTC terminal, or if the permanent identity information is saved on the MTC terminal, and the first temporary identity information is saved, if the preset MTC terminal device can only use the permanent identity information, Then, the MTC terminal generates data for carrying the permanent identity information of the MTC terminal for the target application server. Wherein, the first temporary identity information is before the data is sent, Save local temporary identity information.

Optionally, if the MTC terminal does not preset the usage manner of the identity information, the MTC terminal needs to determine whether the first temporary identity information of the MTC terminal exists locally; if yes, generate, by the target application server, the first temporary identity information. Data; otherwise, if not present, generate data carrying permanent identity information for the target application server.

102. The MTC terminal sends data to the addressing server via the access network, so that the addressing server sends the data to the target application server according to the addressing information.

The MTC terminal sends the generated data to the access network, such as a radio network controller (RNC), a base station controller (BSC), etc., and the access network does not perform any processing on the received data. Directly forwarded to the addressing server. After receiving the data, the addressing server sends the data to the target application server based on the addressing information.

It should be noted that, in the foregoing process, if the permanent identity information is stored on the MTC terminal, the MTC terminal further stores a public key Kpub and a key K corresponding to the permanent identity information, and correspondingly, corresponding to the public key. The private key Kpri is stored on the addressing server, and the mapping server also stores the permanent identity information of the MTC terminal and the corresponding relationship of the corresponding key K.

In addition, it should be noted that since the public key Kpub, the private key Kpri, and the key K are set for security protection, the addressing server is only responsible for finding the target application server based on the addressing information and verifying the data. Etc., generally does not have a decryption operation. Therefore, the key server can be set, the above-mentioned private key Kpri can be set on the key server, the identity information is decrypted by the key server, etc.; or, the above-mentioned private key Kpri is still set on the addressing server. , decryption of identity information by the addressing server, and the like. For the sake of clarity, if the following is not emphasized, the correspondence between the above permanent identity information and the corresponding key K is essentially stored on the key server.

Specifically, a plurality of address servers may share a key server, for example, integrating a key server at an address server, or separately setting a key server for the plurality of address servers. At this time, the key server stores the correspondence between the permanent identity information of all MTC terminals within the range governed by the addressing servers and the corresponding key K. For example, to set up a key server for the addressing servers in Beijing and Shanghai, the key server stores the identity information and key correspondence of all MTC terminals in Shanghai and Beijing.

Alternatively, you can set up a separate key server for each addressing server, for example, A key server is integrated on each addressing server, or the key server can be set independently with its corresponding addressing server. At this time, only the permanent identity information of a part of the MTC terminal and the corresponding relationship of the corresponding key K are saved on each key server. For example, the key server set up for the addressing server in Beijing only stores the identity information of the MTC terminal in Beijing and the correspondence between the keys. The key server set for the addressing server in Shanghai only stores the identity information of the MTC terminal in Shanghai. The correspondence of the keys.

In the data transmission method provided by the embodiment of the present invention, the MTC terminal sends the data that carries the identity information of the MTC terminal generated by the target application server to the access network, and the access network does not perform any processing on the received data, and directly forwards the data to the access network. The server is addressed to achieve the purpose of directly transmitting data sent by the MTC terminal to the corresponding application server via the wireless access network.

Further, in the first embodiment, after the MTC terminal sends data to the addressing server via the access network, the MTC terminal receives the encrypted second temporary identity information sent by the addressing server via the access network, and the second temporary identity information is The addressing server generates the MTC terminal according to the preset policy; the MTC terminal decrypts the second temporary identity information, and saves the second temporary identity information.

Specifically, after the MTC terminal sends the data to the addressing server via the access network, the addressing server verifies whether the data is correct, and generates new temporary identity information, that is, the second temporary identity information, for the MTC terminal according to the preset policy, and Encrypting the second temporary identity information, such as encrypting the second temporary identity information by using a shared key between the addressing server and the MTC terminal, and transmitting the encrypted second temporary identity information to the MTC via the access network. terminal. The shared key is obtained, for example, by processing the key K corresponding to the permanent identity information according to a preset policy.

After receiving the encrypted second temporary identity information, the MTC terminal decrypts the second temporary identity information and saves the same, and deletes the first temporary identity information, so that the second temporary identity information is sent during the subsequent resending of the data. It can be used as the first temporary identity information stored locally by the MTC terminal.

In addition, the addressing server also needs to save the correspondence between the second temporary identity information and the permanent identity information, that is, the addressing server stores the correspondence between the first temporary identity information and the permanent identity information, and the second temporary identity information of the MTC terminal. Correspondence with permanent identity information. In this way, when the MTC terminal does not receive the second temporary identity information, the first temporary identity information may continue to be carried in the data and sent to the addressing server via the access network, so that the addressing server can identify by using the first temporary identity information. MTC terminal.

Further, if the MTC terminal determines that the first temporary identity letter of the MTC terminal exists locally After the MTC terminal sends the data to the addressing server via the access network, the MTC terminal receives the encrypted second temporary identity information sent by the addressing server via the access network, and the MTC terminal receives the addressing server and sends the information through the access network. The failure indication is that the failure indication is generated by the MTC terminal when the addressing server cannot identify the MTC terminal according to the first temporary identity information, and the MTC terminal deletes the first temporary identity information, and generates data carrying the permanent identity information for the target application server, MTC. The terminal transmits data carrying permanent identity information to the addressing server via the access network.

Specifically, if the MTC terminal determines that the first temporary identity information of the MTC terminal exists locally, after the MTC terminal sends the data to the addressing server via the access network, the addressing server determines, according to the first temporary identity information, whether the MTC can be identified. If the terminal is identifiable, verify that the data is correct, and generate a second temporary identity information for the MTC terminal according to the preset policy; otherwise, if the addressing server cannot identify the MTC terminal according to the first temporary identity information, Then, a failure indication is sent to the MTC terminal via the access network, and the reason for the failure of the MTC terminal is notified.

After receiving the failure indication, the MTC terminal finds that the failure reason is that the addressing server cannot identify the first temporary identity information, and then deletes the first temporary identity information, and generates data carrying permanent identity information for the target application server, and re-accesses the access network. Send to the addressing server.

Further, in the first embodiment, the MTC terminal generates data carrying the first temporary identity information for the target application server, including: the MTC terminal protects data carrying the first temporary identity information, and generates protected data for the target application server. .

Specifically, the MTC terminal stores a key corresponding to the permanent identity information, and uses the key to protect the data and the addressing information. For example, based on the key, the integrity protection key and the encryption key are calculated, the application data and the addressing information are encrypted by the encryption key, and the integrity key is used to protect the integrity of the data and the addressing information.

Further, in the first embodiment, the MTC terminal generates data carrying the permanent identity information for the target application server, including: the MTC terminal protects the data carrying the permanent identity information, and generates the protected data for the target application server. Specifically, the MTC terminal can protect data carrying permanent identity information by:

Method 1: The MTC terminal encrypts the permanent identity information by using the public key, and protects the application data and the addressing information by using the key.

Manner 2: The MTC terminal encrypts the permanent identity information and the addressing information by using the public key, and protects the application data by using the key. Manner 3: The MTC terminal calculates an integrity protection key according to the key, and calculates a message authentication code (MAC) according to the integrity protection key. The MTC terminal then encrypts the identity information, addressing information, application data, and MAC using the public key.

In the fourth method, the MTC terminal stores a key corresponding to the permanent identity information, and uses the key to protect the data and the addressing information. For example, based on the key, the integrity protection key and the encryption key are calculated, the application data and the addressing information are encrypted by the encryption key, and the integrity key is used to protect the integrity of the data and the addressing information. In this way, there is no need to encrypt the permanent identity. Since in most cases the MTC terminal will send a temporary identity and the probability of sending a permanent identity is low, the security risk is acceptable in some scenarios.

It can be known from the foregoing manners 1 and 2: The addressing information can be encrypted by using the public key together with the permanent identity information; or the addressing information can be protected by the key together with the application data. According to the foregoing method 3, the addressing information, the application data, and the permanent identity information may also be encrypted together by using a public key. In addition, as described in the foregoing manner 4, the identity information may not be encrypted, but only the addressing information and the application data. Protect.

In the first method, the MTC terminal calculates the encryption key and the integrity key by using the key. then,

The MTC terminal encrypts the application data and the addressing information by using the encryption key, and uses the integrity key to integrity protect the application data and the addressing information.

Further, in the process of generating the protected data for the target application server, the MTC terminal may further add anti-replay information to the protected data, and the anti-replay information includes: current time information, bidirectional current value information, and serial number information. One of the information or a combination thereof.

FIG. 2 is a flowchart of Embodiment 2 of a data transmission method according to the present invention. The execution body of this embodiment is an addressing server, which is suitable for a scenario in which data is directly transmitted to a target application server via an access network. Specifically, this embodiment includes the following steps:

201. Addressing Server Receiver Class Communication The data of the MTC terminal carrying the identity information of the MTC terminal sent by the MTC terminal, and the data includes at least application data and addressing information.

In this step, the addressing information may be independent information, or the corresponding addressing information may be included in the identity information of the MTC terminal, that is, part of the identity information can be used for addressing.

Optionally, the addressing server receives the MTC terminal to generate data for carrying the first temporary identity information for the target application server.

Optionally, the addressing server receives the MTC terminal and generates a permanent identity for the target application server. Informational data.

202. The addressing server sends the data to the target application server according to the addressing information.

For the description of the identity information, the addressing information, and the like in this embodiment, refer to the embodiment shown in FIG. 1 , and details are not described herein again.

The data transmission method provided by the embodiment of the present invention, the addressing server implements according to the addressing information

The data sent by the MTC terminal is directly transmitted to the corresponding application server via the wireless access network.

Further, in the foregoing Embodiment 2, if the data received by the addressing server is the data carrying the first temporary identity information, after receiving the data carrying the first temporary identity information, the addressing server is configured according to the first temporary identity. Information, to determine whether the MTC terminal can be identified.

If the addressing server is unable to identify the MTC terminal according to the first temporary identity information, sending a failure indication to the MTC terminal via the access network, and informing the MTC terminal of the reason for the failure, so that the MTC terminal deletes the first temporary identity information according to the failure indication. The data carrying the permanent identity information is re-generated for the target application server, sent to the addressing server via the access network, and the addressing server receives the regenerated data.

If the addressing server can identify the MTC terminal based on the first temporary identity information, then verify that the data is correct and sent to the target application server.

Further, in the foregoing Embodiment 2, after receiving the data sent by the MTC, for example, the data carrying the first temporary identity information, the data carrying the permanent identity information, or the retransmitted data carrying the permanent identity information, Before the data is sent to the target application server, the addressing server generates a second temporary identity information for the MTC terminal according to the preset policy, and encrypts, and saves the correspondence between the second temporary identity information and the permanent identity information, and the second temporary The identity information is sent to the MTC terminal via the access network.

For details, refer to the foregoing Embodiment 1, and details are not described herein again.

Further, in the foregoing embodiment, the addressing server receives the data that the MTC terminal generates for the target application server to carry the first temporary identity information, and the method includes: the addressing server receives the protected data sent by the MTC terminal, and the protected data is the MTC. The terminal generates the data that protects the data carrying the first temporary identity information.

Further, in the foregoing Embodiment 2, the addressing server receives the data that the MTC terminal generates the permanent identity information for the target application server, and the method includes: the addressing server receives the protected data sent by the MTC terminal, and the protected data is the MTC terminal pair. Protect data with permanent identity information After the build.

Further, after the addressing server receives the protected data sent by the MTC terminal, the key corresponding to the permanent identity information is determined, and the application data is decrypted and integrity verified according to the key.

Further, after the addressing server receives the protected data sent by the MTC terminal, the addressing server determines a key corresponding to the permanent identity information, and decrypts and integrity verifies the addressing information according to the key.

Further, in the foregoing Embodiment 2, after the protected data is decrypted and the integrity verification is performed, in order to prevent the attacker from transmitting the unprotected data to the target application server, the addressing server is protected according to the addressing information. The security protection information is added to the data, and the security protection information indicates whether the identity information in the data is protected, whether the application data is protected, and whether the addressing information is protected, so that the application server can determine the received data according to a preset policy. Whether proper protection is carried out and whether it is safety data.

Further, in the foregoing embodiment 2, after receiving the protected data sent by the MTC terminal, the addressing server determines the home addressing server according to the permanent identity information, and the home addressing server is configured to store the key K with the MTC terminal. Address server.

Specifically, if each of the addressing servers has a separate key server, the address server corresponding to the permanent identity information of the MTC terminal may not be saved on the addressing server currently visited by the MTC terminal, that is, the currently visited homing The address server is not the home server of the MTC terminal. At this point, the addressing server needs to determine the home server of the MTC terminal.

Specifically, the home server of the MTC terminal may be determined according to the first temporary identity or permanent identity reported by the MTC terminal. When the permanent identity information is protected by public key cryptography, the content of the permanent identity information used to address the home server portion should be sent to the visited addressing server in clear text.

Further, in the foregoing Embodiment 2, the protected server that receives the protected data sent by the MTC terminal may be protected data that adds anti-replay information, and the anti-replay information includes: current time information, bidirectional current value information, One of the serial number information or a combination thereof. At this time, the address server can also perform anti-replay check on the protected data based on the anti-replay information.

FIG. 3 is a flowchart of Embodiment 3 of a data transmission method according to the present invention. The execution entity of this embodiment is an access network, and is applicable to a scenario in which data is directly transmitted to a target application server via an access network. Specifically, the embodiment includes the following steps:

301. The access network receives the addressing server and receives the MTC from the MTC terminal. The data of the identity information of the terminal, and the data includes at least application data and addressing information.

Specifically, the access network will receive all data sent by the MTC terminal, and perform no processing on the received data, and directly forward to the addressing server.

Optionally, the access network receives the data that is sent by the MTC terminal and carries the first temporary identity information. Optionally, the access network receives data that is sent by the MTC terminal and carries permanent identity information.

302. The access network sends the data to the addressing server, so that the addressing server sends the data to the target application server according to the addressing information.

According to the data transmission method provided by the embodiment of the present invention, the access network receives all data sent by the MTC terminal, performs no processing on the received data, and directly forwards to the addressing server, so that the addressing server implements the MTC according to the addressing information. The data sent by the terminal is directly transmitted to the corresponding application server via the wireless access network.

Next, the data method provided by the present invention will be described in detail based on the interaction process between the MTC terminal and the access network and the addressing server.

FIG. 4 is a signaling diagram of Embodiment 4 of a data transmission method according to the present invention. In this embodiment, the data is not securely protected, that is, the identity information, the application data, the addressing information, and the like in the data are not encrypted. Specifically, the embodiment includes the following steps:

401. The MTC terminal sends data carrying the addressing information to the access network.

402. The access network sends data carrying the addressing information to the addressing server.

The access network side device, such as RNC, BSC, etc., does not process any data sent by the received MTC terminal and sends it to the fixed addressing server. The fixed addressing server is, for example, an addressing server having a separate key server; or it may be an addressing server that shares a key server with other addressing servers.

403. The addressing server determines the target application server according to the addressing information.

404. The addressing server sends data carrying the addressing information to the target application server.

FIG. 5 is a signaling diagram of Embodiment 5 of a data transmission method according to the present invention. In this embodiment, the MTC terminal generates data for carrying the permanent identity information of the MTC terminal for the target application server, and uses the current time information as anti-replay information. In addition, in this embodiment, multiple addressing servers share a key server, and the MTC terminal stores a public key Kpub and corresponding to the permanent identity information PID. The key K, such as Time, Kpub{PID, K}, has a Time stored on the addressing server, and the key server stores the permanent identity information of all MTC terminals within the scope of the address server and the corresponding secret. The correspondence of the key K, the clock Time, and the private key Kpri corresponding to the public key, such as {PID1, Kl}, {PID2, K2}, {PID3, Κ3}. Specifically, the embodiment includes the following steps:

501. The MTC terminal generates protected data for the target application server.

A clock is set on the MTC terminal, which can accurately record the current time information, and the clock is synchronized with each clock set on the addressing server and the key server. Among them, keeping the synchronization means that the current time information of each clock does not need to be particularly precise, and there may be an allowable error, for example, there is a minute level error. Specifically, this step includes the following substeps:

5011. Encrypt the PID by using the public key Kpub.

To ensure that each encryption result is different, the current time information Time is also used as an encryption input parameter.

5012. Secure the application data by using a key.

The MTC terminal uses the key to secure the application data, including encryption protection and integrity protection. To prevent replay, the current time information can also be used as a security input parameter.

5013. Secure the addressing information.

The addressing information can be encrypted with the public key Kpub, or with the application data, using the key K. Therefore, step 5013 can be performed simultaneously with 5011. At this time, the protected data can be represented as Kpub{PIDII[Addressing Info], Time}; or, step 5013 can be performed simultaneously with 5012, at this time, the protected data is K{ [Address Info] II data, Time}.

Hereinafter, the present invention will be described in detail by taking the addressing information together with the application data and using the key K for security protection as an example.

Figure 6 is a first schematic diagram of the protected data of the present invention. In this embodiment, the cryptographic algorithm for the PID adopts RSA, and the security protection for the addressing information and the application data includes encryption protection and integrity protection, wherein the encryption protection algorithm is AES-CTR (128 bits), and the integrity protection is adopted. HMAC-SHA256, the cryptographic algorithm for key K is AES-CTR (128 bits).

Referring to FIG. 6, in this embodiment, the encryption protection for the PID is specifically: The 1-bit identification bit 1 indicates whether the security information for the PID is encrypted, for example, the identifier bit 1 is 0, indicating that the PID is not Encryption is performed, and the flag bit 1 is 1, indicating that the PID is encrypted. The public key Kpub=(n, e) is stored on the MTC terminal, where n is 2048 bits in length and e is usually 65537. The MTC terminal obtains the encrypted plaintext P based on the current time information and the PID. The current time information is the time recorded by the clock of the MTC terminal, which is accurate to the second, and is represented by 14 numbers of 10 (year, month, day, minute, and second, 4+2+2+2+2+2). The PID is in the International Mobile Subscriber Identity (IMSI) format and is represented by 15 decimal digits. Thus, the plaintext P is the current time information of the PIDII, that is, 29 decimal numbers, and each decimal number is recorded by 4 bits, a total of 116 bits, and the 116 bits are the plaintext P to be encrypted.

The MTC terminal performs a cipher operation on the encrypted plaintext P, that is, the ciphertext C = P ^e mod(n) is calculated, and the length of the ciphertext C is 2048 bits.

Referring to FIG. 6, in this embodiment, the security protection for the application data and the addressing information is specifically: The identifier bit 2 indicates whether the application data and the addressing information are ciphered for security protection information, and the identifier bit 3 indicates Whether the security information of the integrity protection of the application data and the addressing information is 2, 3 is 1, indicating that the application data and the addressing information are encrypted and integrity protected, and the identifier bits 2 and 3 are 0. Indicates that application data and addressing information are not encrypted and integrity protected. The MTC terminal calculates the encryption key Kc and the integrity protection key Ki based on the key K (128 bits) and the current time. Kc=HMAC-SHA256(K, "OxOOIIT"), Ki= HMAC-SHA256CK, "ΟχΟΙΙΙΤ") , T is the current time information of the clock of the MTC terminal, accurate to the second, expressed by 14 10 numbers (year, month and day) Time and minute, 4+2+2+2+2+2). Each decimal number is represented by 4 bits, a total of 56 bits, and the 56 bits are D.

The MTC terminal uses Kc to encrypt the addressing information and application data. The encryption algorithm is AES-CTR algorithm, and the key is the first 128 bits of Kc. The first 64 bits of the 128-bit counter (COUNT) required by the AES-CTR algorithm are the first 64 bits of HMAC-SHA256 (K, "0x02" IIP), the last 64 bits are incremented from 0, and the encrypted ciphertext length and addressing are obtained. The information II application data has the same length, and the encryption is used to ensure that the addressing information and the application data are not eavesdropped by an attacker.

The MTC terminal utilizes Ki to perform integrity protection operations on the addressing information and the application data. The MTC terminal calculates the message check code MAC=HMAC-SHA256 (Ki, "addressing information and ciphertext of application data"). The output length of the HMAC-SHA256 algorithm is 256 bits, and the first X bits of 256 bits can be used as the MAC as needed, for example, the first 32 bits are selected as the MAC. As shown in Figure 6, if integrity protection is not performed, the MAC is 0; otherwise, if integrity protection is performed, the MAC is 1. The length of the MAC is 32 bits, and the ciphertext of the addressing information and the application data is not falsified by the MAC.

502. The MTC terminal sends the protected data to the access network.

503. The access network sends the protected data to the addressing server.

In steps 502 and 503, the access network does not perform any processing on the received data and directly sends the data to the addressing server.

504. The addressing server sends the encrypted PID to the key server.

The addressing server sends the encrypted PID in the received protected data to the Key Server.

505. The Key Server decrypts the encrypted PID by using the private key kpri.

The Key Server decrypts the PID of the MTC terminal and the time information during encryption by using the private key kpri, and obtains the corresponding key K according to the PID search.

506. The Key Server sends the PID and the Κ to the addressing server.

The Key Server sends the decrypted PID, time information, etc. to the addressing server. In addition, the Key Server may not send the key K to the addressing server, but deduct the same key used for decryption or verification as the MTC terminal, and send the derived key to the addressing server.

It should be noted that if the addressing information is also encrypted by the public key Kpub, the Key Server also needs to send the decrypted addressing information to the addressing server.

507. The addressing server uses K to decrypt and verify the application data.

If the addressing information is also protected by the key K, the addressing server also decrypts and verifies the addressing information. The addressing server compares the time information when encrypting and the time information of the addressing server to determine whether the data is playback data.

508. The addressing server sends data to the application server.

The addressing server constructs the decrypted protected data and transmits the decrypted data to the target application server based on the addressing information (the target application server is not shown). In order to prevent an attacker from sending unprotected data to the application server, the addressing server can also send the security protection information of the data to the target application server, as shown in Figure 6, the identification bit 1, the identification bit 2 or the identification bit. The information of 3 causes the target application server to determine whether the received data is properly protected according to the preset policy and the security protection information.

It should be noted that, in this embodiment, the MTC terminal, the addressing server, and the key service are used. The clock is set on the device, and the time information is used for anti-replay check. However, the present invention is not limited thereto. In other possible implementation manners, anti-replay can also be implemented by using a bidirectional nonce. The length of the Nonce is 32 to 128 bits, which can be used in the MTC terminal and the addressing server. The transmission is performed by signaling. In addition, it is also possible to use the serial number instead of the time information for anti-replay checking, and the serial number is maintained and kept synchronized between the MTC terminal, the addressing server, and the key server.

FIG. 7 is a signaling diagram of Embodiment 6 of a data transmission method according to the present invention. In this embodiment, the addressing server stores the private key kpri, the decryption of the PID by the addressing server, and the like. Specifically, the embodiment includes the following steps:

601. The MTC terminal generates protected data for the target application server.

Specifically, the MTC terminal calculates the integrity protection key Ki. For example, the Ki is calculated by using the key K or Ki is derived based on the current time information, and the message check code MAC is calculated by using Ki. Then, the public key Kpub is used to encrypt "PIDII Addressing Information II Application Data II Current Time Information IIMAC" to obtain protected data.

Figure 8 is a schematic diagram showing the second structure of the protected data of the present invention. For descriptions of the identifiers, the time information, and the MAC, refer to Figure 6 above, and details are not described herein.

602. The MTC terminal sends the protected data to the access network.

603. The access network sends the protected data to the addressing server.

604. The addressing server decrypts the protected data by using a private key kpri.

The addressing server uses kpri to decrypt the received protected disappearance, and obtains the plain text "PIDII Addressing Information II Application Data II Current Time Information IIMAC"

605. The addressing server sends the PID and the current time information to the Key Server.

606. The Key Server performs an anti-replay check and recalculates Ki.

607. The Key Server sends the new Ki to the addressing server.

608. The addressing server uses Ki to perform an anti-replay check.

The addressing server uses the new ki received to perform current time and MAC verification.

609. The addressing server sends data to the application server.

In the foregoing Embodiment 5 and Embodiment 6, the MTC terminal can only use the permanent identity information, and in order to protect the data, the current time information and the like are introduced, so that the length of the data is increased. However, the present invention is not limited thereto. In other possible implementation manners, the MTC terminal may also use temporary identity information, and only the message check code MAC is added to the data security protection. Specifically, see Figure 9 Example VII.

FIG. 9 is a signaling diagram of Embodiment 7 of a data transmission method according to the present invention. In this embodiment, the MTC terminal uses a temporary identity mechanism. Specifically, the embodiment includes the following steps:

Channel assignment.

7011. The MTC terminal sends a channel request information (Channel Request) to the access network.

7012. The MTC terminal receives an immediate assignment information sent by the access network.

702. The MTC terminal determines whether the first temporary identity information exists locally.

If the first temporary identity information exists locally, generate data carrying the first temporary identity information for the target application server, and perform step 703; otherwise, if the first temporary identity information does not exist locally, generate the permanent identity for the target application server. For the data of the information, refer to the embodiment shown in Figure 5 or Figure 7, and no further details are provided here.

703. The MTC terminal sends data that carries the first temporary identity information to the access network.

Optionally, in this step, the MTC terminal can protect the application data and the addressing information by using a key corresponding to the permanent identity information. Specifically, the MTC terminal calculates the integrity protection key and the encryption key according to the key, encrypts the application data and the addressing information by using the encryption key, and performs integrity protection on the application data and the addressing information by using the integrity key. .

704. The access network sends data that carries the first temporary identity information to the addressing server.

705. The addressing server determines whether the MTC terminal is identifiable.

The addressing server searches for the permanent identity information corresponding to the first temporary identity information according to the first temporary identity information. If the identifier is not found, the addressing server cannot identify the MTC terminal, and step 706 is performed; otherwise, if , the address server can identify the MTC terminal, and step 709 is performed.

706. The addressing server sends a failure indication to the MTC terminal via the access network.

Specifically, this step includes the following sub-steps:

7061. The addressing server sends a failure indication to the access network.

7062. The access network sends a failure indication to the MTC terminal.

707. The MTC terminal deletes the first temporary identity information, and generates data that carries the permanent identity information for the target application server. 708. The MTC terminal sends data carrying permanent identity information to the addressing server via the access network. Specifically, this step includes the following sub-steps:

7081: The MTC terminal sends data carrying permanent identity information to the access network;

7082. The access network sends data carrying permanent identity information to the addressing server.

Optionally, in the above 7081 and 7082, the MTC terminal may use any one of the methods 1 to 4 to protect the data carrying the permanent identity information by using the MTC terminal.

709. The addressing server verifies that the data is correct, generates and sends a second temporary identity information to the target application server.

In this step, after verifying the data, if it is correct, it is sent to the target application server (the target application server is not shown in the figure); otherwise, if it is not correct, the data is discarded. In addition, the addressing server further generates new temporary identity information, ie, second temporary identity information, for the MTC terminal according to a preset policy, and encrypts the second temporary identity information, for example, a key derived according to the key K. The second temporary identity information is encrypted.

710. The addressing server sends the decrypted second temporary identity information to the MTC terminal via the access network.

Specifically, the step includes the following sub-steps;

7101. The addressing server sends the encrypted second temporary identity information to the access network.

7102. The access network sends the encrypted second temporary identity information to the MTC terminal.

711. The MTC terminal decrypts and saves the second temporary identity information.

FIG. 10 is a schematic structural diagram of Embodiment 1 of an MTC terminal according to the present invention. The MTC terminal provided in this embodiment is an apparatus embodiment corresponding to the embodiment of FIG. 1 of the present invention, and the specific implementation process is not described herein. Specifically, the MTC terminal 100 provided in this embodiment specifically includes:

The processing module 11 is configured to generate data for carrying the identity information of the MTC terminal for the target application server, where the data includes at least application data and addressing information;

The sending module 12 is configured to send data to the addressing server via the access network, so that the addressing server sends the data to the target application server according to the addressing information.

The MTC terminal provided by the embodiment of the present invention sends data for carrying the identity information of the MTC terminal generated by the target application server to the access network, and the access network does not perform any processing on the received data, and directly forwards the data to the address server. Thereby, the purpose of transmitting the data sent by the MTC terminal directly to the corresponding application server via the wireless access network is achieved. Further, the processing module 11 is configured to generate data for carrying the permanent identity information of the MTC terminal for the target application server.

FIG. 11 is a schematic structural diagram of Embodiment 2 of an MTC terminal according to the present invention. As shown in FIG. 11, the MTC terminal 200 of this embodiment is based on the device structure of FIG. 10, and further includes:

The determining module 13 is configured to determine whether the first temporary identity information of the MTC terminal exists locally. The processing module 11 is configured to: if the determining module 13 determines that the first temporary identity information exists locally, generate the first temporary identity for the target application server. The data of the information; otherwise, if the judging module 13 judges that the first temporary identity information does not exist locally, the data that carries the permanent identity information is generated for the target application server.

Referring to FIG. 11, further, the MTC terminal 100 further includes:

The receiving module 14 is configured to receive the encrypted second temporary identity information sent by the addressing server via the access network, where the second temporary identity information is generated by the addressing server according to a preset policy, for the MTC terminal;

The processing module 11 is configured to decrypt the second temporary identity information, and save the second temporary identity information. Further, if the determining module 13 determines that the first temporary identity information of the MTC terminal exists locally, the receiving module 14 is configured to receive a failure indication sent by the addressing server via the access network, where the failure indication is that the addressing server is according to the first temporary When the identity information cannot identify the MTC terminal, it is generated for the MTC terminal;

The processing module 11 is configured to delete the first temporary identity information, and generate data that carries the permanent identity information for the target application server;

The sending module 12 is configured to send data carrying permanent identity information to the addressing server via the access network.

Further, the processing module 11 is configured to protect data carrying the first temporary identity information and generate protected data for the target application server.

Further, the processing module 11 is configured to protect application data and addressing information by using a key pair. Further, the processing module 11 is configured to protect data carrying permanent identity information and generate protected data for the target application server.

Referring to FIG. 11, further, the MTC terminal 200 further includes:

The storage module 15 is configured to save a public key and a key corresponding to the permanent identity information. The processing module 11 is configured to encrypt the permanent identity information by using the public key, and use the key pair application data. With addressing information protection; or,

The processing module 11 is configured to encrypt the permanent identity information and the addressing information by using the public key, and protect the application data by using the key; or

The processing module 11 is configured to protect application data and addressing information by using dense molybdenum.

Further, the storage module 15 is configured to save a public key and a key corresponding to the permanent identity information;

The processing module 11 is configured to calculate an integrity protection key according to the key, calculate a message check code MAC according to the integrity protection key, and encrypt the identity information, the addressing information, the application data, and the MAC by using the public key.

Further, the processing module 11 is configured to calculate an encryption key and an integrity key by using a key, encrypt application data and addressing information by using an encryption key, and apply application data and addressing information by using an integrity key. Integrity protection.

Further, the processing module is configured to add anti-replay information to the protected data, and the anti-replay information includes: one of current time information, bidirectional current value information, serial number information, or a combination thereof.

FIG. 12 is a schematic structural diagram of Embodiment 1 of the addressing server of the present invention. The addressing server provided in this embodiment is an apparatus embodiment corresponding to the embodiment of FIG. 2 of the present invention, and the specific implementation process is not described herein. Specifically, the addressing server 300 provided in this embodiment specifically includes:

The receiving module 21 is configured to receive data of the identity information of the MTC terminal sent by the MTC terminal via the access network, where the data includes at least application data and addressing information;

The sending module 22 is configured to send data to the target application server according to the addressing information. The addressing server provided by the embodiment of the present invention achieves the purpose of directly transmitting data sent by the MTC terminal to the corresponding application server via the wireless access network according to the addressing information.

Further, the receiving module 21 is configured to receive, by the MTC terminal, data for carrying the first temporary identity information for the target application server.

Further, the receiving module 21 is configured to receive, by the MTC terminal, data for carrying the permanent identity information for the target application server.

FIG. 13 is a schematic structural diagram of Embodiment 2 of an addressing server according to the present invention. As shown in FIG. 13, the addressing server 400 of the present embodiment is based on the device structure of FIG. 12. Further, the addressing server 400 further includes: The determining module 23 is configured to determine, according to the first temporary identity information, whether the MTC terminal is identifiable, and the sending module 22, configured to: when the determining module cannot identify the MTC terminal according to the first temporary identity information, to the MTC terminal via the access network Send failure indication;

The receiving module 21 is configured to receive data that carries the permanent identity information sent by the MTC terminal via the access network.

Referring to FIG. 13, further, the addressing server 400 further includes:

The processing module 24 is configured to generate and encrypt the second temporary identity information for the MTC terminal according to the preset policy.

The sending module 22 is configured to send the second temporary identity information to the MTC terminal via the access network. Further, the receiving module 21 is configured to receive the protected data sent by the MTC terminal, and the protected data is generated by the MTC terminal protecting the data carrying the permanent identity information.

Further, the processing module 24 is configured to determine a key corresponding to the permanent identity information, and perform decryption and integrity verification on the application data according to the key.

Further, the processing module 24 is configured to perform decryption and integrity verification on the addressing information according to the key.

Further, the sending module 22 is configured to send the protected data carrying the security protection information to the target application server according to the addressing information.

Further, the processing module 24 is configured to determine, according to the permanent identity information or the first temporary identity information, the home addressing server, where the home addressing server is an address server that stores a private key corresponding to the public key of the MTC terminal.

Further, the receiving module 21 is further configured to receive protected data that adds anti-replay information, where the anti-replay information includes: one of current time information, bidirectional current value information, serial number information, or a combination thereof;

The processing module 24 is configured to perform anti-replay checking on the protected data according to the anti-replay information. FIG. 14 is a schematic structural diagram of Embodiment 1 of an access network according to the present invention. The access network provided in this embodiment is an apparatus embodiment corresponding to the embodiment of FIG. 3 of the present invention, and the specific implementation process is not described herein again. Specifically, the access network 500 provided in this embodiment specifically includes:

The receiving module 31 is configured to receive, by the addressing server, the receiver type communication, the data of the identity information carried by the MTC terminal and the MTC terminal, where the data includes at least application data and addressing information;

a sending module 32, configured to send data to the addressing server, so that the addressing server is based on the addressing letter Information, send data to the target application server.

In the access network provided by the embodiment of the present invention, the access network receives all the data sent by the MTC terminal, performs no processing on the received data, and directly forwards the data to the addressing server, so that the addressing server implements the MTC according to the addressing information. The data sent by the terminal is directly transmitted to the corresponding application server via the wireless access network.

Further, the receiving module 31 is configured to receive data that is sent by the MTC terminal and that carries the first temporary identity information.

Further, the receiving module 31 is configured to receive data that carries the permanent identity information sent by the MTC terminal.

FIG. 15 is a schematic structural diagram of Embodiment 3 of an MTC terminal according to the present invention. As shown in FIG. 15, the MTC terminal 600 provided in this embodiment includes a processor 61 and a memory 62. The MTC terminal 600 can also include a transmitter 63 and a receiver 64. Transmitter 63 and receiver 64 can be coupled to processor 61. The memory 62 stores execution instructions. When the MTC terminal 600 is running, the processor 61 communicates with the memory 62. The processor 61 calls the execution instructions in the memory 62 for executing the method embodiment shown in FIG. Similar to the technical effect, it will not be described here.

16 is a schematic structural diagram of Embodiment 3 of an addressing server according to the present invention. As shown in FIG. 16, the addressing server 700 provided in this embodiment includes a processor 71 and a memory 72. The addressing server 700 can also include a transmitter 73, a receiver 74. Transmitter 73 and receiver 74 can be coupled to processor 71. The memory 72 stores execution instructions. When the addressing server 700 is running, the processor 71 communicates with the memory 72. The processor 71 calls the execution instructions in the memory 72 for executing the method embodiment shown in FIG. 2, which is implemented. The principle and technical effects are similar and will not be described here.

FIG. 17 is a schematic structural diagram of Embodiment 2 of an access network according to the present invention. As shown in FIG. 17, the access network 800 provided in this embodiment includes a processor 81 and a memory 82. The access network 800 can also include a transmitter 83, a receiver 84. Transmitter 83 and receiver 84 can be coupled to processor 81. The memory 82 stores execution instructions. When the access network 800 is running, the processor 81 communicates with the memory 82, and the processor 81 calls the execution instructions in the memory 82 for executing the method embodiment shown in FIG. The principle and technical effects are similar and will not be described here.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. Including the steps of the above method embodiments; The storage medium includes: a ROM, a RAM, a magnetic disk, or an optical disk, and the like, which can store program codes.

Finally, it should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting thereof; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the foregoing embodiments may be modified, or some or all of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the technical solutions of the embodiments of the present invention. range.

Claims

claims

1. A data transmission method, characterized by including:

The machine type communication MTC terminal generates data carrying the identity information of the MTC terminal for the target application server. The data at least includes application data and addressing information;

The MTC terminal sends the data to the addressing server via the access network, so that the addressing server sends the data to the target application server according to the addressing information.

2. The method according to claim 1, characterized in that the machine type communication MTC terminal generates data carrying identity information for the target application server, including:

The machine type communication MTC terminal generates data carrying the permanent identity information of the MTC terminal for the target application server.

3. The method according to claim 1, characterized in that the MTC terminal generates data carrying the identity information of the MTC terminal for the target application server, including:

The MTC terminal determines whether the first temporary identity information of the MTC terminal exists locally; if it exists, generate data carrying the first temporary identity information for the target application server; otherwise, if it does not exist, then generate the data for the target application server; The target application server generates data carrying permanent identity information.

4. The method according to claim 1 or 3, characterized in that, after the MTC terminal sends the data to the addressing server via the access network, it includes:

The MTC terminal receives the encrypted second temporary identity information sent by the addressing server via the access network, and the second temporary identity information is the MTC for the addressing server according to a preset policy. generated by the terminal;

5. The method according to claim 4, wherein if the MTC terminal determines that the first temporary identity information of the MTC terminal exists locally, the MTC terminal sends the information to the addressing server via the access network. After the above data, before the MTC terminal receives the encrypted second temporary identity information sent by the addressing server via the access network, it includes:

The MTC terminal receives a failure indication sent by the addressing server via the access network, and the failure indication is when the addressing server cannot identify the MTC terminal based on the first temporary identity information. Generated by MTC terminal; The MTC terminal deletes the first temporary identity information and generates data carrying the permanent identity information for the target application server;

The MTC terminal sends data carrying the permanent identity information to the addressing server via the access network.

6. The method according to any one of claims 3 to 5, characterized in that the MTC terminal generates data carrying the first temporary identity information for the target application server, including:

The MTC terminal protects the data carrying the first temporary identity information and generates protected data for the target application server.

7. The method according to claim 6, wherein the MTC terminal stores a key corresponding to the permanent identity information, and the MTC terminal protects the data carrying the first temporary identity information, Generate protected data for the target application server, including:

The MTC terminal uses the key to protect the application data and the addressing information.

8. The method according to any one of claims 2 to 5, characterized in that the MTC terminal generates data carrying the permanent identity information for the target application server, including:

The MTC terminal protects the data carrying the permanent identity information and generates protected data for the target application server.

9. The method according to claim 8, characterized in that the MTC terminal stores a public key and a key corresponding to the permanent identity information, and the MTC terminal protects the data carrying the permanent identity information. , generating protected data for the target application server, including: the MTC terminal using the public key to encrypt the permanent identity information, and using the key to protect the application data and the addressing information; or,

The MTC terminal uses the public key to encrypt the permanent identity information and the addressing information, and uses the key to protect the application data; or,

The MTC terminal uses the encryption to protect the application data and the addressing information.

10. The method according to claim 8, characterized in that, the MTC terminal stores a public key and a key corresponding to the permanent identity information, and the MTC terminal encrypts the data carrying the permanent identity information. , before generating protected data for the target application server, including: the MTC terminal calculates the integrity protection key based on the key;

The MTC terminal calculates the message check code MAC based on the integrity protection key;

The MTC terminal protects the data carrying permanent identity information and responds to the target Use the server to generate protected data, including:

The MTC terminal uses the public key to encrypt the identity information, the addressing information, the application data and the MAC.

11. The method according to claim 9, characterized in that the MTC terminal uses the key to protect the application data and the addressing information, including:

The MTC terminal uses the key to calculate the encryption key and the integrity key;

The MTC terminal uses the encryption key to encrypt the application data and the addressing information, and uses the integrity key to perform integrity protection on the application data and the addressing information.

12. The method according to any one of claims 6 to 11, further comprising: the MTC terminal adding anti-replay information to the protected data, the anti-replay information including: current One or a combination of time information, bidirectional current value information, sequence number information.

13. A data transmission method, characterized by including:

The addressing server receives data carrying the identity information of the MTC terminal sent by the machine type communication MTC terminal via the access network, where the data at least includes application data and addressing information;

The addressing server sends the data to the target application server according to the addressing information.

14. The method according to claim 13, wherein the addressing server receives data carrying the identity information of the MTC terminal sent by the machine type communication MTC terminal via the access network, including:

The addressing server receives the MTC terminal and generates data carrying the first temporary identity information for the target application server.

15. The method according to claim 13, characterized in that the addressing server receives data carrying the identity information of the MTC terminal sent by the machine type communication MTC terminal via the access network, including:

The addressing server receives the MTC terminal and generates data carrying the permanent identity information for the target application server.

16. The method according to claim 14, characterized in that, after the addressing server receives the data carrying the first temporary identity information generated by the MTC terminal for the target application server, it includes:

The addressing server determines whether the MTC terminal can be identified based on the first temporary identity information; If the addressing server cannot identify the MTC terminal based on the first temporary identity information, then sends a failure indication to the MTC terminal via the access network;

The addressing server receives the data carrying the permanent identity information sent by the MTC terminal via the access network.

17. The method according to any one of claims 13 to 16, characterized in that, before the addressing server sends the data to the target application server according to the addressing information, it includes: the addressing server Generate and encrypt second temporary identity information for the MTC terminal according to the preset policy;

The addressing server sends the second temporary identity information to the MTC terminal via the access network.

18. The method according to claim 15 or 16, characterized in that the addressing server receives the data generated by the MTC terminal carrying the permanent identity information for the target application server, including:

The addressing server receives the protected data sent by the MTC terminal, and the protected data is generated by the MTC terminal after protecting the data carrying the permanent identity information.

19. The method according to claim 18, characterized in that, after the addressing server receives the protected data sent by the MTC terminal, it includes:

The addressing server decrypts and verifies the integrity of the application data based on the key.

20. The method according to claim 19, characterized in that, after the addressing server determines the key corresponding to the permanent identity information, it includes:

The addressing server decrypts and verifies the integrity of the addressing information based on the key.

21. The method according to any one of claims 18 to 20, characterized in that the addressing server sends the data to the target application server according to the addressing information, including:

The addressing server sends protected data carrying security protection information to the target application server according to the addressing information.

22. The method according to claim 18, characterized in that, after the addressing server receives the protected data sent by the MTC terminal, it includes:

The addressing server determines a home addressing server based on the permanent identity information or the first temporary identity information. The home addressing server stores a public key corresponding to the MTC terminal. The private key of the addressing server.

23. The method according to any one of claims 18 to 22, characterized in that the addressing server receives the protected data sent by the MTC terminal, including:

The addressing server receives protected data with added anti-replay information. The anti-replay information includes: one of current time information, bidirectional current value information, serial number information, or a combination thereof.

24. A data transmission method, characterized by including:

The access network receiving addressing server receives data sent by the machine type communication MTC terminal carrying the identity information of the MTC terminal, where the data at least includes application data and addressing information;

The access network sends the data to the addressing server, so that the addressing server sends the data to the target application server according to the addressing information.

25. The method according to claim 24, characterized in that the access network receiving addressing server receives the data carrying the identity information of the MTC terminal sent by the machine type communication MTC terminal, including:

The access network receives the data carrying the first temporary identity information sent by the MTC terminal.

26. The method according to claim 24, characterized in that the access network receiving addressing server receives the data carrying the identity information of the MTC terminal sent by the machine type communication MTC terminal, including:

The access network receives data carrying permanent identity information sent by the MTC terminal.

27. A machine type communication MTC terminal, characterized by including:

A processing module configured to generate data carrying the identity information of the MTC terminal for the target application server, where the data at least includes application data and addressing information;

A sending module, configured to send the data to the addressing server via the access network, so that the addressing server sends the data to the target application server according to the addressing information.

28. The MTC terminal according to claim 27, characterized in that the processing module is used for:

Generate data carrying permanent identity information of the MTC terminal for the target application server.

29. The MTC terminal according to claim 27, characterized in that, the MTC terminal Also includes:

The judgment module is used to judge whether the first temporary identity information of the MTC terminal exists locally; the processing module is used to determine whether the first temporary identity information exists locally. If the judgment module judges that the first temporary identity information exists locally, it is the target application. The server generates data carrying the first temporary identity information; otherwise, if the determination module determines that the first temporary identity information does not exist locally, generate data carrying permanent identity information for the target application server.

30. The MTC terminal according to claim 27 or 29, characterized in that the MTC terminal further includes:

A receiving module configured to receive the encrypted second temporary identity information sent by the addressing server via the access network, where the second temporary identity information is the addressing server according to a preset policy. Generated by MTC terminal;

The processing module is used to decrypt the second temporary identity information and save the second temporary identity information.

31. The MTC terminal according to claim 30, wherein if the determination module determines that the first temporary identity information of the MTC terminal exists locally, the receiving module is configured to: receive from the addressing server A failure indication sent via the access network, the failure indication being generated for the MTC terminal when the addressing server cannot identify the MTC terminal based on the first temporary identity information;

The processing module is used to delete the first temporary identity information and generate data carrying the permanent identity information for the target application server;

The sending module is configured to send data carrying the permanent identity information to the addressing server via the access network.

32. The MTC terminal according to any one of claims 29 to 31, characterized in that, the processing module is used to protect the data carrying the first temporary identity information, and generate a protected message for the target application server. Protected data.

33. The MTC terminal according to claim 32, wherein the processing module is configured to use the key to protect the application data and the addressing information.

34. The MTC terminal according to any one of claims 28 to 31, characterized in that the processing module is used to protect the data carrying the permanent identity information and generate a protected data for the target application server. data.

35. The MTC terminal according to claim 34, characterized in that, the MTC terminal further includes:

The storage module is used to store a public key and the key corresponding to the permanent identity information; the processing module is used to use the public key to encrypt the permanent identity information, and use the key to encrypt the application Protection of data and said addressing information; or,

The processing module is configured to use the public key to encrypt the permanent identity information and the addressing information, and use the key to protect the application data; or,

The processing module is configured to use the dense molybdenum to protect the application data and the addressing information.

36. The MTC terminal according to claim 34, characterized in that, the MTC terminal further includes:

The storage module is used to store a public key and the key corresponding to the permanent identity information; the processing module is used to calculate the integrity protection key based on the key; based on the integrity protection key, Calculate the message check code MAC; use the public key to encrypt the identity information, the addressing information, the application data and the MAC.

37. The MTC terminal according to claim 35, characterized in that: the processing module is configured to use the key to calculate an encryption key and an integrity key; use the encryption key to encode the application data The application data and the addressing information are encrypted, and the integrity key is used to protect the integrity of the application data and the addressing information.

38. The MTC terminal according to any one of claims 32 to 37, characterized in that: the processing module is used to add anti-replay information to the protected data, and the anti-replay information includes: currently time information, bidirectional current value information, sequence number information, or a combination thereof.

39. An addressing server, characterized by including:

A receiving module configured to receive data carrying the identity information of the MTC terminal sent by the machine type communication MTC terminal via the access network, where the data at least includes application data and addressing information;

A sending module, configured to send the data to the target application server according to the addressing information.

40. The addressing server according to claim 39, characterized in that the receiving module is configured to receive the data carrying the first temporary identity information generated by the MTC terminal for the target application server.

41. The addressing server according to claim 39, characterized in that: the receiving module, Used to receive the MTC terminal and generate data carrying the permanent identity information for the target application server.

42. The addressing server according to claim 40, characterized in that, the addressing server further includes:

A judgment module, configured to judge whether the MTC terminal can be identified based on the first temporary identity information;

The sending module is configured to send a failure indication to the MTC terminal via the access network if the judging module cannot identify the MTC terminal based on the first temporary identity information; the receiving module, Used to receive data carrying the permanent identity information sent by the MTC terminal via the access network.

43. The addressing server according to any one of claims 39 to 42, characterized in that the addressing server further includes:

A processing module configured to generate and encrypt second temporary identity information for the MTC terminal according to a preset policy;

44. The addressing server according to claim 41 or 42, characterized in that: the receiving module is configured to receive protected data sent by the MTC terminal, and the protected data is the pair of data sent by the MTC terminal. The data carrying the permanent identity information is generated after being protected.

45. The addressing server according to claim 44, characterized in that the processing module is used to determine a key corresponding to the permanent identity information, and decrypt and decrypt the application data according to the key. Integrity verification.

46. The addressing server according to claim 45, characterized in that the processing module is used to decrypt and verify the integrity of the addressing information according to the key.

47. The addressing server according to any one of claims 44 to 46, characterized in that the sending module is configured to send protected data carrying security protection information to the target application according to the addressing information. server.

48. The addressing server according to claim 44, characterized in that, the processing module is configured to determine a home addressing server based on the permanent identity information or the first temporary identity information, the home addressing server The server is an addressing service that stores a private key corresponding to the public key of the MTC terminal. server.

49. The addressing server according to any one of claims 44 to 48, characterized in that the receiving module is also used to receive protected data with anti-replay information added, and the anti-replay information includes: One of current time information, bidirectional current value information, serial number information, or a combination thereof; the processing module is configured to perform an anti-replay check on the protected data based on the anti-replay information.

50. An access network, characterized by: including:

The receiving module is used to receive the data carrying the identity information of the MTC terminal sent by the machine type communication MTC terminal received by the addressing server. The data at least includes application data and addressing information; the sending module is used to send the data to Addressing the server, so that the addressing server sends the data to the target application server according to the addressing information.

51. The access network according to claim 50, wherein the receiving module is configured to receive data carrying the first temporary identity information sent by the MTC terminal.

52. The method according to claim 50, characterized in that the receiving module is configured to receive data carrying permanent identity information sent by the MTC terminal.

53. A machine type communication MTC terminal, characterized in that it includes: a processor and a memory. The memory stores execution instructions. When the MTC terminal is running, the processor communicates with the memory. The processor executes the execution instruction to cause the MTC terminal to execute the method described in any one of claims 1 to 12.

54. An addressing server, characterized in that it includes: a processor and a memory, the memory stores execution instructions, and when the addressing server is running, there is communication between the processor and the memory, and the processing The processor executes the execution instructions to cause the addressing server to execute the method according to any one of claims 13-23.

55. An access network, characterized in that it includes: a processor and a memory, the memory stores execution instructions, and when the access network is running, the processor communicates with the memory, and the processing The processor executes the execution instruction to cause the access network to execute the method according to any one of claims 24 to 26.