WO2015165250A1 - 一种终端接入通信网络的方法、装置及通信系统 - Google Patents

一种终端接入通信网络的方法、装置及通信系统 Download PDF

Info

Publication number
WO2015165250A1
WO2015165250A1 PCT/CN2014/091004 CN2014091004W WO2015165250A1 WO 2015165250 A1 WO2015165250 A1 WO 2015165250A1 CN 2014091004 W CN2014091004 W CN 2014091004W WO 2015165250 A1 WO2015165250 A1 WO 2015165250A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
terminal
authentication
packet data
data network
Prior art date
Application number
PCT/CN2014/091004
Other languages
English (en)
French (fr)
Inventor
吴义壮
许怡娴
李欢
于游洋
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201480078488.8A priority Critical patent/CN106465117B/zh
Priority to EP14890620.9A priority patent/EP3131325A4/en
Publication of WO2015165250A1 publication Critical patent/WO2015165250A1/zh
Priority to US15/337,830 priority patent/US20170078288A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/081—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • the present invention relates to the field of communications, and in particular, to a method, an apparatus, and a communication system for a terminal to access a communication network.
  • EPC Evolved Packet Core
  • LTE Long Term Evolution
  • PGW Packet Data Network Gateway
  • AAA Authentication Authorization Accounting server
  • HSS Home Subscriber Server
  • the PGW is used to allocate an IP address to the user equipment during the establishment of the bearer access communication network, and serves as an anchor point for the user plane to move.
  • AAA is used to manage terminals accessing the LTE network, providing authentication and authorization and account services.
  • the HSS is a user database for storing user-related information, which may be related information such as user authentication and authorization and providing a user location IP address.
  • the 3GPP (3rd Generation Partnership Project) operator allows the user equipment (User Equipment) to pass the TWAN (Trusted WLAN Access Network).
  • the WLAN access network uses the S2a interface to access the EPC network, and the WLAN is a WLAN (Wireless Local Area Networks), and the TWAN includes a TWAG (Trusted WLAN access gateway).
  • TWAG Trusted WLAN access gateway
  • Access gateway a new control plane protocol WLCP (WLAN Control Protocol) is defined between the UE and the TWAG to provide control plane management functions.
  • WLCP can have two transmission modes, UDP (User Datagram). Protocol, User Datagram Protocol)/IP (Internet Protocol) transmission, or Ethernet frame transmission. At present, UDP/IP is selected as the transmission method of WLCP.
  • the terminal may pre-install a WLCP APP (WLAN Control Protocol application), and when the terminal accesses the EPC through the TWAN, the WLCP APP is called to invoke UDP ( The User Datagram Protocol (User Datagram Protocol) port initiates the process of establishing or releasing a PDN connection to the TWAG.
  • the WLCP APP may be pre-installed on the terminal by the operator, and the WLCP APP is authorized by the operator, and the WLCP APP needs to have a private API (Application Programming Interface) with an OS (Operating System). ), or the terminal customizes the private API to achieve the parameter information of the WLCP APP that other APPs cannot obtain.
  • the case where the OS is compromised and the private API is invoked is outside the scope of the present invention.
  • the malicious application may continuously call the UDP port used by the WLCP to initiate a PDN connection request message to the TWAG to trigger the WLCP. This may cause waste of resources on the network side, and the TWAG cannot process the legal WLCP APP.
  • the initiated request; or the malicious application continuously initiates the connection release request message, and maliciously disconnects the PDN connection of the terminal.
  • the embodiments of the present invention provide a method, a device, and a communication system for a terminal to access a communication network, which can effectively reduce the waste of resources on the network side caused by the malicious application of the terminal triggering WLCP.
  • the first aspect provides a method for a terminal to access a communication network, where the first device is a trusted wireless local area network access gateway TWAG, or the first device includes a TWAG and a trusted wireless local area network.
  • the authentication and authorization charging service agent TWAP the method includes:
  • the first message includes a second message and an authentication parameter
  • the authentication parameter is a token or a User Datagram Protocol UDP port number
  • the second message includes the encrypted authentication parameter
  • the second device Or receiving a first message sent by the second device, where the first message includes the second message, the second message includes the encrypted authentication parameter, and the authentication parameter is a token or a user datagram protocol UDP The port number;
  • the method further includes:
  • the packet data network connection request message includes the authentication parameter
  • the packet data network connection request message is a packet data network connection establishment request message
  • the packet data network connection is disconnected.
  • the method further includes:
  • the packet data network connection The message should be a packet data network connection setup response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the method further includes:
  • the authentication parameter is included in the packet data network connection request message, whether the authentication parameter corresponding to the identifier of the terminal in the packet data network connection request message is compared with the locally stored identifier corresponding to the terminal.
  • the packet data network connection response message is a packet data network connection setup response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the method further includes: after the receiving the first information sent by the second device, the method further includes:
  • the method further includes:
  • the authentication parameter is used to verify or identify a valid WLAN control protocol application.
  • the second message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA '-Notification, Extended Authentication Protocol - Authentication and Key Agreement' - Identity message EAP-AKA'-Identity, Extended Authentication Protocol - Request message EAP-REQ.
  • the first message is a message carried by the DIAMETER protocol.
  • the third message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA '-Notification, Extended Authentication Protocol - Authentication and Key Agreement' - Identity message EAP-AKA'-Identity, Extended Authentication Protocol - Response message EAP-RSP.
  • a second aspect provides a method for a terminal to access a communication network, which is applied to a terminal, The method includes:
  • an authentication parameter corresponding to the identifier of the terminal is generated.
  • the method further includes:
  • the method further includes:
  • the packet data network connection request message includes the authentication parameter
  • the packet data network connection request message is a packet data network connection establishment request message, and the packet data network connection is broken.
  • the open request message or the packet data network connection release request message is not limited to the packet data network connection.
  • the method further includes:
  • the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the authentication parameter is used to verify or identify a valid wireless local area network control protocol application.
  • the second message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA'-Notification, Extended Authentication Protocol - Any one of authentication and key agreement '-identity message EAP-AKA'-Identity, extended authentication protocol-request message EAP-REQ.
  • the third message is an extended authentication protocol-authentication and key agreement.
  • EAP-AKA'-Identity Extended Authentication Protocol - Response message
  • EAP-RSP Extended Authentication Protocol
  • a third aspect provides a method for a terminal to access a communication network, where the second device is an authentication authorization charging server AAA or a home user server HSS, and the method includes:
  • the authentication parameter is a token or a user datagram protocol UDP port number
  • the integrity protection first message the first message includes a second message and the authentication parameter
  • the second message includes the encrypted authentication parameter
  • the first message includes the second message, and the second message includes the encrypted authentication parameter;
  • the integrity protection second message and generating a first message
  • the first message includes the second message and the authentication parameter
  • the second message includes the encrypted authentication parameter
  • the integrity protection second message and generating a first message
  • the first message includes the second message
  • the second message includes the encrypted authentication parameter
  • the integrity protection second message and generating a first message, where the first message includes the second message and an authentication parameter;
  • the obtaining the authentication parameter includes:
  • the obtaining the authentication parameter includes:
  • the authentication parameter is used to verify or identify a valid wireless local area network control protocol application.
  • the second message is an extended authentication protocol-authentication and key negotiation'-notification message EAP-AKA '-Notification, Extended Authentication Protocol - Authentication and Key Agreement' - Identity message EAP-AKA'-Identity, Extended Authentication Protocol - Request message EAP-REQ.
  • the first message is a message carried by the DIAMETER protocol.
  • the third message is an extended authentication protocol-authentication and key agreement--notification message EAP-AKA '-Notification, Extended Authentication Protocol - Authentication and Key Agreement' - Identity message EAP-AKA'-Identity, Extended Authentication Protocol - Response message EAP-RSP.
  • a first device is provided, where the first device is a trusted wireless local area network access gateway TWAG, or the first device includes a TWAG and a trusted wireless local area network authentication and authorization charging service agent TWAP,
  • the first device includes:
  • a first receiving unit configured to receive a first message sent by the second device, where the first The message includes a second message and an authentication parameter, the authentication parameter is a token or a User Datagram Protocol UDP port number, and the second message includes the encrypted authentication parameter;
  • the first receiving unit is further configured to: or receive the first message sent by the second device, where the first message includes the second message, the second message includes the encrypted authentication parameter, and the authentication parameter For the token or user datagram protocol UDP port number;
  • the first receiving unit is further configured to receive a first message sent by the second device, where the first message includes a second message and an authentication parameter;
  • the first sending unit is configured to send the second message to the terminal.
  • the first device further includes:
  • a second receiving unit configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the authentication parameter, and the packet data network connection request message is a packet data network connection establishment request message , a packet data network connection disconnection request message or a packet data network connection release request message.
  • the first device further includes:
  • a first verification unit configured to verify whether the authentication parameter corresponding to the identifier of the terminal in the packet data network connection request message is the same as the authentication parameter corresponding to the identifier of the terminal stored locally;
  • the packet data network connection response message is a packet data network connection setup response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the first device further includes:
  • An checking unit configured to check whether the packet data network connection request message is included The authentication parameter
  • a second verification unit configured to: if the authentication parameter is included in the packet data network connection request message, verifying whether the authentication parameter corresponding to the identifier of the terminal in the packet data network connection request message is locally stored The authentication parameter corresponding to the identifier of the terminal is the same;
  • a third sending unit configured to send, to the terminal, the authentication parameter corresponding to the identifier of the terminal in the packet data network connection request message, and the locally configured authentication parameter corresponding to the identifier of the terminal
  • the packet data network connection response message is a packet data network connection setup response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • a reading unit configured to read, from the first message, the authentication parameter corresponding to the identifier of the terminal and the identifier of the terminal;
  • the first storage unit is configured to store the authentication parameter corresponding to the identifier of the terminal and the identifier of the terminal.
  • the first achievable manner to the third achievable manner in a fifth implementation manner, when the first message includes the second message, the second message includes When the authentication parameter is encrypted, the first device further includes:
  • a generating unit configured to generate the authentication parameter corresponding to the identifier of the terminal
  • a second storage unit configured to store the authentication parameter corresponding to the identifier of the terminal and an identifier of the terminal
  • a fourth sending unit configured to send the authentication parameter to the second device.
  • a third receiving unit configured to receive a third message sent by the terminal, where the third message includes the encrypted authentication parameter
  • a fifth sending unit configured to send the first message to the second device, where the first message includes the third message.
  • the authentication parameter is used to verify or identify a valid WLAN control protocol application.
  • the second message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA '-Notification, Extended Authentication Protocol - Authentication and Key Agreement' - Identity message EAP-AKA'-Identity, Extended Authentication Protocol - Request message EAP-REQ.
  • the first message is a message carried by the DIAMETER protocol.
  • the third message is an extended authentication protocol-authentication and key agreement'-notification message EAP - AKA '-Notification, Extended Authentication Protocol - Authentication and Key Agreement' - Identity message EAP-AKA'-Identity, Extended Authentication Protocol - Response message EAP-RSP.
  • a fifth aspect provides a terminal, where the terminal includes:
  • a first receiving unit configured to receive a second message sent by the first device, where the second message includes the encrypted authentication parameter, where the authentication parameter is a token or a User Datagram Protocol UDP port number;
  • a generating unit configured to generate an authentication parameter corresponding to the identifier of the terminal.
  • the terminal further includes:
  • An encryption unit configured to encrypt the authentication parameter
  • a sending unit configured to send a third message to the first device, where the third message includes the encrypted authentication parameter.
  • the terminal further includes:
  • the sending unit is further configured to send a packet data network connection request message to the first device, where the packet data network connection request message includes the authentication parameter, and the packet data network connection request message is a packet data network connection establishment request.
  • the terminal further includes:
  • a second receiving unit configured to receive a packet data network connection response message sent by the first device, where the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data The network connection releases the response message.
  • the authentication parameter is used to verify or identify a valid wireless local area network control protocol application.
  • the second message is an extended authentication protocol-authentication and key negotiation'-notification message EAP-AKA '-Notification, Extended Authentication Protocol - Authentication and Key Agreement' - Identity message EAP-AKA'-Identity, Extended Authentication Protocol - Request message EAP-REQ.
  • the third message is an extended authentication protocol-authentication and key negotiation'-notification message EAP-AKA'-Notification, Extended Authentication Protocol - Any one of authentication and key agreement '-identity message EAP-AKA'-Identity, extended authentication protocol-response message EAP-RSP.
  • a second device is provided, where the second device is an authentication and authorization charging server AAA or a home user server (HSS), and the second device includes:
  • An obtaining unit configured to obtain an authentication parameter, where the authentication parameter is a token or a user datagram protocol UDP port number;
  • An encryption unit configured to encrypt the authentication parameter
  • An integrity protection unit configured to integrity protect the first message, the first message includes a second message and the authentication parameter, and the second message includes the encrypted authentication parameter
  • the integrity protection unit is further configured to: or, the integrity protection first message, the first message includes the second message, and the second message includes the encrypted authentication parameter;
  • the integrity protection unit is further configured to: integrity protect the second message, and generate a first message, where the first message includes the second message and the authentication parameter, and the second message includes an encrypted Said authentication parameters;
  • the integrity protection unit is further configured to: integrity protect the second message, and generate a first message, where the first message includes the second message, and the second message includes the encrypted authentication parameter;
  • the integrity protection unit is further configured to: integrity protect the second message, and generate a first message, where the first message includes the second message and an authentication parameter;
  • a sending unit configured to send the first message to the first device, so that the first device acquires the second message or the authentication parameter from the first message.
  • the acquiring unit is specifically configured to:
  • the acquiring unit is specifically configured to:
  • the authentication parameter is used to verify or identify a valid wireless local area network control protocol application.
  • the first implementable manner to the third implementable, in the fourth implementable manner, the second message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA '-Notification, Extended Authentication Protocol - Authentication and Key Agreement' - Identity message EAP-AKA'-Identity, Extended Authentication Protocol - Request message EAP-REQ.
  • the first message is a message carried by the DIAMETER protocol.
  • the third message is an extended authentication protocol-authentication and key negotiation'-notification message EAP-AKA '-Notification, Extended Authentication Protocol - Authentication and Key Agreement' - Identity message EAP-AKA'-Identity, Extended Authentication Protocol - Response message EAP-RSP.
  • a communication system including:
  • the second device is configured to obtain an authentication parameter, where the authentication parameter is a token or a user datagram protocol UDP port number;
  • Integrity protects a first message, the first message including a second message and the authentication a parameter, the second message includes the encrypted authentication parameter,
  • the first message includes the second message, and the second message includes the encrypted authentication parameter;
  • the integrity protection second message and generating a first message
  • the first message includes the second message and the authentication parameter
  • the second message includes the encrypted authentication parameter
  • the integrity protection second message and generating a first message
  • the first message includes the second message
  • the second message includes the encrypted authentication parameter
  • the integrity protection second message and generating a first message, where the first message includes the second message and an authentication parameter;
  • the first device is configured to receive a first message sent by the second device, where the first message includes a second message and an authentication parameter, where the authentication parameter is a token or a user datagram protocol UDP port number, where the The second message includes the encrypted authentication parameter;
  • the second device Or receiving a first message sent by the second device, where the first message includes the second message, the second message includes the encrypted authentication parameter, and the authentication parameter is a token or a user datagram protocol UDP The port number;
  • the terminal is configured to receive a second message sent by the first device, where the second message includes an encrypted authentication parameter, where the authentication parameter is a token or a user datagram protocol UDP port number;
  • an authentication parameter corresponding to the identifier of the terminal is generated.
  • a first device is provided, where the first device is a trusted wireless local area network access gateway TWAG, or the first device includes a TWAG and a trusted wireless local area network authentication and authorization charging service agent TWAP,
  • the first device includes:
  • a receiver configured to receive a first message sent by the second device, where the first message packet is The second message and the authentication parameter, the authentication parameter is a token or a User Datagram Protocol UDP port number, and the second message includes the encrypted authentication parameter;
  • the receiver is further configured to: or receive the first message sent by the second device, where the first message includes the second message, the second message includes the encrypted authentication parameter, and the authentication parameter is Card or User Datagram Protocol UDP port number;
  • the receiver is further configured to receive a first message sent by the second device, where the first message includes a second message and an authentication parameter;
  • a transmitter configured to send the second message to the terminal.
  • the first device further includes:
  • the receiver is also used to:
  • the packet data network connection request message includes the authentication parameter
  • the packet data network connection request message is a packet data network connection establishment request message
  • the packet data network connection is disconnected.
  • the first device further includes:
  • a processor configured to verify whether the authentication parameter corresponding to the identifier of the terminal in the packet data network connection request message is the same as the locally stored authentication parameter corresponding to the identifier of the terminal;
  • the transmitter is also used to:
  • the packet data network connection response message is a packet data network connection setup response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the processor is further configured to:
  • the processor is further configured to:
  • the authentication parameter is included in the packet data network connection request message, whether the authentication parameter corresponding to the identifier of the terminal in the packet data network connection request message is compared with the locally stored identifier corresponding to the terminal.
  • the transmitter is also used to:
  • the packet data network connection response message is a packet data network connection setup response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the encrypted authentication parameter is included
  • the processor is further configured to: read the authentication parameter corresponding to the identifier of the terminal and the identifier of the terminal from the first message;
  • the processor is further configured to: store the authentication parameter corresponding to the identifier of the terminal, and the identifier of the terminal.
  • the first achievable manner, and the third achievable manner, in the fifth implementation manner when the first message includes the second message, the second message includes When encrypting the authentication parameters,
  • the processor is further configured to: generate the authentication parameter corresponding to the identifier of the terminal;
  • the processor is further configured to: store the authentication parameter corresponding to the identifier of the terminal, and the identifier of the terminal;
  • the transmitter is further configured to: send the authentication parameter to the second device.
  • the receiver is further configured to receive a third message sent by the terminal, where the third message includes the encrypted authentication parameter;
  • the transmitter is further configured to send the first message to the second device, where the first message includes the third message.
  • the authentication parameter is used to verify or identify a valid WLAN control protocol application.
  • the second message is an extended authentication protocol-authentication and key negotiation.
  • EAP-AKA '-Notification Extended Authentication Protocol - Authentication and Key Agreement' - Identity message
  • EAP-AKA'-Identity Extended Authentication Protocol - Request message EAP-REQ.
  • the first message is a message carried by the DIAMETER protocol.
  • the third message is an extended authentication protocol-authentication and key negotiation'-notification message EAP-AKA '-Notification, Extended Authentication Protocol - Authentication and Key Agreement' - Identity message EAP-AKA'-Identity, Extended Authentication Protocol - Response message EAP-RSP.
  • a ninth aspect provides a terminal, where the terminal includes:
  • a receiver configured to receive a second message sent by the first device, where the second message includes an encrypted authentication parameter, where the authentication parameter is a token or a User Datagram Protocol UDP port number;
  • the processor is configured to generate an authentication parameter corresponding to the identifier of the terminal, where the authentication parameter is a token or a User Datagram Protocol UDP port number.
  • the processor is further configured to encrypt the authentication parameter
  • the terminal further includes:
  • a transmitter configured to send a third message to the first device, where the third message includes the encrypted authentication parameter.
  • the terminal further includes:
  • a transmitter configured to send a packet data network connection request message to the first device, where the packet data network connection request message includes the authentication parameter, where the packet data network connection request message is a packet data network connection establishment request message, A packet data network connection disconnection request message or a packet data network connection release request message.
  • the receiver is also used to:
  • the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the authentication parameter is used to verify or identify a valid wireless local area network control protocol application.
  • the second message is an extended authentication protocol-authentication and key agreement--notification message EAP-AKA '-Notification, Extended Authentication Protocol - Authentication and Key Agreement' - Identity message EAP-AKA'-Identity, Extended Authentication Protocol - Request message EAP-REQ.
  • the third message is an extended authentication protocol-authentication and key agreement--notification message EAP-AKA'-Notification, extended authentication protocol-authentication, and key agreement--identity message EAP-AKA'-Identity, extended authentication protocol-response message EAP-RSP.
  • a second device is provided, where the second device is an authentication and authorization charging server AAA or a home subscriber server HSS, and the second device includes:
  • a processor configured to obtain an authentication parameter, where the authentication parameter is a token or a user datagram protocol UDP port number;
  • the processor is further configured to: encrypt the authentication parameter
  • the processor is further configured to: integrity protect the first message, the first message includes a second message and the authentication parameter, and the second message includes the encrypted authentication parameter,
  • the processor is further configured to: or: integrity protect the first message, the first message includes the second message, and the second message includes the encrypted authentication parameter;
  • the processor is further configured to: integrity protect the second message, and generate a first message, where the first message includes the second message and the authentication parameter, and the second message includes the encrypted authentication parameter;
  • processor is further configured to: integrity protect the second message, and generate a first message, where the first message includes the second message, and the second message includes the encrypted authentication parameter;
  • processor is further configured to: integrity protect the second message, and generate a first message, where the first message includes the second message and an authentication parameter;
  • a transmitter configured to send the first message to the first device, so that the first device obtains the second message or the authentication parameter from the first message.
  • the processor is specifically configured to:
  • the processor is specifically used to:
  • the authentication parameter is used to verify or identify a valid wireless local area network control protocol application.
  • the second message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA '-Notification, Extended Authentication Protocol - Authentication and Key Agreement' - Identity message EAP-AKA'-Identity, Extended Authentication Protocol - Request message EAP-REQ.
  • the first message is a message carried by the DIAMETER protocol.
  • the third message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA '-Notification, Extended Authentication Protocol - Authentication and Key Agreement' - Identity message EAP-AKA'-Identity, Extended Authentication Protocol - Response message EAP-RSP.
  • a communication system comprising:
  • the second device is configured to obtain an authentication parameter, where the authentication parameter is a token or a user datagram protocol UDP port number;
  • the integrity protection first message the first message includes a second message and the authentication parameter
  • the second message includes the encrypted authentication parameter
  • the first message includes the second message, and the second message includes the encrypted authentication parameter;
  • the integrity protection second message and generating a first message
  • the first message includes the second message and the authentication parameter
  • the second message includes the encrypted authentication parameter
  • the integrity protection second message and generating a first message
  • the first message includes the second message
  • the second message includes the encrypted authentication parameter
  • the integrity protection second message and generating a first message, where the first message includes the second message and an authentication parameter;
  • the first device is configured to receive a first message sent by the second device, where the first message includes a second message and an authentication parameter, where the authentication parameter is a token or a user datagram protocol UDP port number, where the The second message includes the encrypted authentication parameter;
  • the second device Or receiving a first message sent by the second device, where the first message includes the second message, the second message includes the encrypted authentication parameter, and the authentication parameter is a token or a user datagram protocol UDP The port number;
  • the terminal is configured to receive a second message sent by the first device, where the second message includes an encrypted authentication parameter, where the authentication parameter is a token or a user datagram protocol UDP port number;
  • an authentication parameter corresponding to the identifier of the terminal is generated.
  • Embodiments of the present invention provide a method, an apparatus, and a communication system for a terminal to access a communication network.
  • Sending the second message to the terminal Compared with the prior art, the terminal sends a packet data network connection request message carrying the authentication parameter to the first device, so that the first device can distinguish whether the packet data network connection request message is a message applied by the WLAN control protocol or a packet data of the malicious application.
  • the network connection request message effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering WLCP.
  • FIG. 1 is a flowchart 1 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • Figure 1a is a flowchart 2 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • FIG. 1b is a flowchart 3 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • FIG. 2 is a flowchart 4 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • FIG. 2a is a flowchart 5 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • 2b is a flowchart 6 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • FIG. 3 is a flowchart 7 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • Figure 3a is a flowchart 8 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • Figure 3b is a flowchart 9 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • Figure 3c is a flowchart 10 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • FIG. 4 is a flowchart 11 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • Figure 4a is a flowchart 12 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • FIG. 5 is a flowchart 13 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • Figure 5a is a flowchart 14 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • FIG. 6 is a schematic structural diagram 1 of a first device according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram 2 of a first device according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram 3 of a first device according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram 4 of a first device according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram 5 of a first device according to an embodiment of the present invention.
  • Figure 11 is a schematic structural diagram 1 of a terminal according to an embodiment of the present invention.
  • FIG. 12 is a schematic structural diagram 2 of a terminal according to an embodiment of the present invention.
  • FIG. 13 is a schematic structural diagram 1 of a second device according to an embodiment of the present invention.
  • Figure 14 is a schematic diagram 1 of a communication system according to an embodiment of the present invention.
  • Figure 15 is a schematic structural view 6 of a first device according to an embodiment of the present invention.
  • Figure 16 is a schematic structural diagram 7 of a first device according to an embodiment of the present invention.
  • FIG. 17 is a schematic structural diagram 3 of a terminal according to an embodiment of the present invention.
  • FIG. 18 is a schematic structural diagram 4 of a terminal according to an embodiment of the present invention.
  • FIG. 19 is a schematic structural diagram 2 of a second device according to an embodiment of the present invention.
  • Figure 20 is a schematic diagram 2 of a communication system according to an embodiment of the present invention.
  • Figure 21 is a flowchart 15 of a method for a terminal to access a communication network according to an embodiment of the present invention.
  • Figure 21a is a flowchart 16 of a method for a terminal to access a communication network according to an embodiment of the present invention
  • Figure 22 is a schematic structural diagram 8 of a first device according to an embodiment of the present invention.
  • FIG. 23 is a schematic structural diagram 9 of a first device according to an embodiment of the present invention.
  • Figure 24 is a schematic structural diagram 10 of a first device according to an embodiment of the present invention.
  • FIG. 25 is a schematic structural diagram 11 of a first device according to an embodiment of the present invention.
  • FIG. 26 is a schematic structural diagram 12 of a first device according to an embodiment of the present invention.
  • Figure 27 is a schematic structural diagram 13 of a first device according to an embodiment of the present invention.
  • Figure 28 is a schematic structural diagram 5 of a terminal according to an embodiment of the present invention.
  • FIG. 29 is a schematic structural diagram 6 of a terminal according to an embodiment of the present invention.
  • Figure 30 is a schematic structural view 3 of a second device according to an embodiment of the present invention.
  • Figure 31 is a schematic structural view 4 of a second device according to an embodiment of the present invention.
  • Figure 32 is a schematic structural diagram 14 of a first device according to an embodiment of the present invention.
  • FIG. 33 is a schematic structural diagram 7 of a terminal according to an embodiment of the present invention.
  • Figure 34 is a schematic structural diagram 8 of a terminal according to an embodiment of the present invention.
  • FIG. 35 is a schematic structural diagram 5 of a second device according to an embodiment of the present invention.
  • Figure 36 is a schematic structural view 6 of a second device according to an embodiment of the present invention.
  • FIG. 37 is a schematic diagram 3 of a communication system according to an embodiment of the present invention.
  • the first device of the present invention is a trusted wireless local area network access gateway TWAG, and the first device may further include a TWAG and a trusted wireless local area network authentication and authorization charging service agent TWAP.
  • An embodiment of the present invention provides a method for a terminal to access a communication network, where the first device is a trusted wireless local area network access gateway TWAG, or the first device includes a TWAG and a trusted wireless local area network.
  • the authentication and authorization charging service agent TWAP is as shown in FIG. 1 , and the method includes:
  • Step 101a Receive a first message sent by a second device, where the first message includes a second message and a token, and the second message includes the encrypted token.
  • the token corresponding to the identifier of the terminal and the identifier of the terminal may be read from the first message, and stored in the terminal The identifier corresponds to the token and the identifier of the terminal.
  • the token corresponding to the identifier of the terminal may be generated, and then the token corresponding to the identifier of the terminal and the terminal are stored. And the identifier is sent to the second device.
  • the DIAMETER-EAP-REQ-Command (DIAMETER-Extensible Authentication Protocol-Request-Command) message or AAA (Authentication Authorization Accounting) may be sent to the second device.
  • the message, the authentication and authorization charging message includes an EAP-RSP (Extensible Authentication Protocol-Response) message or an extended authentication protocol-identity message (EAP-Identity), the DIAMETER-Extended Authentication Protocol-Request-
  • EAP-RSP Extensible Authentication Protocol-Response
  • EAP-Identity extended authentication protocol-identity message
  • the command message includes the token
  • the extended authentication protocol-response message includes the token
  • the extended authentication protocol-identity message includes the token.
  • Step 101b or receiving a first message sent by the second device, where the first message includes the second message, and the second message includes the encrypted token.
  • Step 102 Send the second message to the terminal.
  • the packet data network connection request message sent by the terminal may be received, where the packet data network connection request message includes the token, and the packet data network connection request message is a packet data network connection establishment request message, a packet data network connection disconnection request message, or a packet data network connection release request message, and then verifying whether the token corresponding to the identifier of the terminal in the packet data network connection request message is The token corresponding to the identifier of the terminal that is stored locally is the same; if the token corresponding to the identifier of the terminal in the packet data network connection request message is corresponding to the identifier of the terminal that is locally stored The token is the same, and the packet data network connection response message is sent to the terminal, where the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the terminal establishes a connection with the first device, accesses a packet data network, or the terminal Device connected to the first release. It should be noted that, before verifying whether the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the token corresponding to the identifier of the terminal stored locally, Whether the token is included in the packet data network connection request message.
  • the first message sent by the second device is first received, where the first message includes a second message and a token, the second message includes the encrypted token, or receives a second message sent by the second device. a message, the first message includes the second message, the second message includes the encrypted token, and then the second message is sent to the terminal, which effectively reduces the malicious application trigger of the terminal.
  • WLCP causes waste of resources on the network side.
  • An embodiment of the present invention provides a method for a terminal to access a communication network, where the first device is a trusted wireless local area network access gateway TWAG, or the first device includes a TWAG and a trusted wireless local area network.
  • the authentication and authorization charging service agent TWAP is as shown in FIG. 1a, and the method includes:
  • Step 103a Receive a first message sent by the second device, where the first message includes a second message and a User Datagram Protocol UDP port number, and the second message includes the encrypted UDP port number.
  • Step 103b or receiving a first message sent by the second device, where the first message includes the second message, and the second message includes the encrypted UDP port number.
  • Step 104 Send the second message to the terminal.
  • the first device receives the first message sent by the second device, where the first message includes a second message and a UDP port number, the second message includes the encrypted UDP port number, and then sends the message to the terminal.
  • the second message is used to obtain the UDP port number of the WLCP application of the terminal, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP.
  • An embodiment of the present invention provides a method for a terminal to access a communication network, where the first device is a trusted wireless local area network access gateway TWAG, or the first device includes a TWAG and a trusted wireless local area network.
  • the authentication and authorization charging service agent TWAP is as shown in FIG. 1b, and the method includes:
  • Step 105 Receive a first message sent by the second device, where the first message includes a second message and an authentication parameter, where the authentication parameter is a token or a User Datagram Protocol UDP port number.
  • Step 106 Send the second message to the terminal.
  • the first device receives the first message sent by the second device, where the first message includes the second message and the authentication parameter, and the authentication parameter is generated by the terminal, so that the WLCP application of the terminal acquires the UDP port number or the command.
  • the card effectively reduces the malicious application of the terminal and triggers WLCP to cause waste of resources on the network side.
  • An embodiment of the present invention provides a method for a terminal to access a communication network, which is applied to a terminal. As shown in FIG. 2, the method includes:
  • Step 201 Receive a second message sent by the first device, where the second message includes the encrypted token.
  • the packet data network connection request message may be sent to the first device, where the packet data network connection request message includes the token, and the packet data network connection request message is a packet data network connection establishment request message, a packet data network connection disconnection request message or a packet data network connection release request message, and then receiving a packet data network connection response message sent by the first device, the packet data network connection response message Establishing a connection message with the first device, accessing the packet data network, or releasing the connection with the first device, for the packet data network connection establishment response message, the packet data network connection disconnection response message, or the packet data network connection release response message .
  • the second message sent by the first device is received, and the second message includes the encrypted token, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP.
  • An embodiment of the present invention provides a method for a terminal to access a communication network, which is applied to a terminal. As shown in FIG. 2a, the method includes:
  • Step 202 Receive a second message sent by the first device, where the second message includes an encrypted user datagram protocol UDP port number.
  • the terminal can obtain the UDP port number from the received second message sent by the first device, so that the WLCP application of the terminal obtains the UDP port number, which effectively reduces the malicious application of the terminal and triggers the WLCP to cause resources on the network side. waste.
  • An embodiment of the present invention provides a method for a terminal to access a communication network, which is applied to a terminal. As shown in FIG. 2b, the method includes:
  • Step 203 Generate an authentication parameter corresponding to the identifier of the terminal, where the authentication parameter is a token or a UDP port number of a user datagram protocol.
  • the terminal can generate a UDP port number or a token corresponding to the identifier of the terminal, so that the WLCP application of the terminal obtains the UDP port number, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP.
  • the embodiment of the invention provides a method for a terminal to access a communication network, which is applied to the second
  • the device is the authentication authorization charging server AAA or the home user server HSS. As shown in FIG. 3, the method includes:
  • Step 301 Acquire a token.
  • the token may be generated according to the identifier of the terminal, and then the token is obtained locally; or the token sent by the first device may be received, and the DIAMETER-extension authentication sent by the first device may be received.
  • the token is obtained in a protocol-request-command message DIAMETER-EAP-REQ-Command or an authentication authorization charging message AAA, and the authentication authorization charging message includes an extended authentication protocol-response message EAP-RSP or an extended authentication protocol-identity Message EAP-Identity, the DIAMETER-Extended Authentication Protocol-Request-Command message includes the token, the extended authentication protocol-response message includes the token, and the extended authentication protocol-identity message includes the token .
  • Step 302 Encrypt the token.
  • Step 303a The integrity protection first message, the first message includes a second message and the token, and the second message includes the encrypted token.
  • Step 303b or integrity protection first message
  • the first message includes the second message
  • the second message includes the encrypted token
  • Step 304 Send the first message to the first device, so that the first device obtains the second message from the first message.
  • the token is first acquired, and then the token is encrypted, the integrity protection first message, the first message includes a second message and the token, and the second message includes the encrypted command Card, or integrity protection first message, the first message includes the second message, the second message includes the encrypted token, and the first message is sent to the first device, so as to facilitate The first device obtains the second message from the first message, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP.
  • the embodiment of the invention provides a method for a terminal to access a communication network, which is applied to the second
  • the device is the authentication authorization charging server AAA or the home user server HSS. As shown in FIG. 3a, the method includes:
  • Step 305 Obtain a user datagram protocol UDP port number.
  • Step 306 Encrypt the UDP port number.
  • Step 307a The integrity protection first message, the first message includes a second message and the UDP port number, and the second message includes the encrypted UDP port number.
  • Step 307b or integrity protection first message
  • the first message includes the second message
  • the second message includes the encrypted UDP port number
  • Step 308 Send the first message to the first device, so that the first device obtains the second message from the first message.
  • the first device encrypts the obtained UDP port number, and integrity protects the first message, and sends the first message to the first device, so that the first device will carry the second port with the UDP port number.
  • the message is sent to the terminal, so that the WLCP application of the terminal acquires the UDP port number, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP.
  • the embodiment of the present invention provides a method for a terminal to access a communication network, which is applied to a second device, where the second device is an authentication and authorization accounting server AAA or a home user server HSS. As shown in FIG. 3b, the method includes:
  • Step 309 Acquire an authentication parameter, where the authentication parameter is a token or a UDP port number of a user datagram protocol.
  • Step 3010 Encrypt the authentication parameter.
  • Step 3011a Integrity protects the second message, and generates a first message, where the first message includes the second message and the authentication parameter, and the second message includes the encrypted authentication parameter.
  • Step 3011b Integrity protects the second message, and generates a first message, where the first message includes the second message, and the second message includes the encrypted authentication parameter. number.
  • Step 3012 Send the first message to the first device, so that the first device obtains the second message from the first message.
  • the first device encrypts the obtained UDP port number, and integrity protects the second message, generates a first message, and sends the first message to the first device, so that the first device will carry the UDP.
  • the second message of the port number is sent to the terminal, so that the WLCP application of the terminal obtains the authentication parameter, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP.
  • the embodiment of the present invention provides a method for a terminal to access a communication network, which is applied to a second device, where the second device is an authentication and authorization accounting server AAA or a home user server HSS. As shown in FIG. 3c, the method includes:
  • Step 3013 Acquire an authentication parameter, where the authentication parameter is a token or a User Datagram Protocol UDP port number.
  • Step 3014 Encrypt the authentication parameter.
  • Step 3015 Integrity protects the second message, and generates a first message, where the first message includes the second message and an authentication parameter.
  • Step 3016 Send the first message to the first device, so that the first device obtains the second message from the first message.
  • the second device obtains the authentication parameter, encrypts the authentication parameter, generates a first message, and sends the first message to the first device, so that the WLCP application of the terminal acquires the UDP port number or token, effectively reducing The malicious application of the terminal triggers WLCP to waste resources on the network side.
  • the embodiment of the present invention provides a method for a terminal to access a communication network, which is applied to a terminal, a first device, and a second device, and the first device is a trusted wireless local area network access gateway TWAG, or the first device includes a TWAG.
  • the trusted WLAN authentication and authorization charging service proxy TWAP assuming that the second device is an authentication and authorization accounting server (AAA) or a home subscriber server (HSS), as shown in FIG. 4, including:
  • Step 401 The first device generates a token corresponding to the identifier of the terminal.
  • the terminal performs a normal network access, and the EAP (Extensible Authentication Protocol) message exchanges between the terminal and the second device, so that the first device can obtain the identifier of the terminal from the second device, and then the first device A token corresponding to the identity of the terminal may be generated, the token being used to verify or identify the wireless local area network control protocol application (WLCP APP) of the terminal.
  • EAP Extensible Authentication Protocol
  • the first device may acquire the identifier of the terminal from the second device, regenerate the token corresponding to the identifier of the terminal, update the token of the terminal, and generate the token each time.
  • the communication network may be a third generation mobile communication cellular network or a fourth generation mobile communication cellular network.
  • the identifier of the terminal may be an IMSI (International Mobile Subscriber Identification Number), a MAC (Media Access Control) address, or an IP (Internet Protocol) address.
  • IMSI International Mobile Subscriber Identification Number
  • MAC Media Access Control
  • IP Internet Protocol
  • Step 402 The first device stores the token corresponding to the identifier of the terminal and the identifier of the terminal.
  • Step 403 The first device sends a token to the second device.
  • the first device sends a DIAMETER-Extended Authentication Protocol-Request-Command message to the second device, and the DIAMETER-Extended Authentication Protocol-Request-Command message carries an extended authentication protocol payload (EAP-payload), and the extended authentication protocol payload includes the first device according to the The token generated by the identity of the terminal.
  • EAP-payload extended authentication protocol payload
  • the first device may further send an authentication authorization charging message to the second device, where the authentication authorization charging message includes an extended authentication protocol-response message (EAP-RSP) or an extended authentication protocol-identity message (EAP-Identity),
  • EAP-RSP extended authentication protocol-response message
  • EAP-Identity extended authentication protocol-identity message
  • the extended authentication protocol-response message includes the token
  • the extended authentication protocol-identity message includes the token.
  • Step 404 The second device encrypts the token and integrity protects the first message.
  • the second device receives the token sent by the first device.
  • the second device may further receive a DIAMETER-Extension Authentication Protocol-Request-Command message or an Authentication Authorization Charging message sent by the first device, where the DIAMETER-Extended Authentication Protocol-Request-Command message includes the first device according to the terminal identifier.
  • the generated token, the authentication authorization charging message includes an extended authentication protocol-response message (EAP-RSP) or an extended authentication protocol-identity message (EAP-Identity), and the extended authentication protocol-response message includes the token
  • the extended authentication protocol-identity message includes the token.
  • the token is used to verify or identify the WLAN control protocol application of the terminal. First, the extended authentication protocol message is parsed to obtain a token, and then the second device may generate a key and encrypt the token to The other illegal users are prevented from listening to the token, and the key may be a TEK (Transient EAP Keys).
  • the second device can encrypt the token in CBC (Cipher Block Chaining) mode by using AES (advanced encryption standard) and a 128-bit key.
  • CBC Cipher Block Chaining
  • AES advanced encryption standard
  • the second device After the second device encrypts the token, generating a second message, where the second message includes the encrypted token, encapsulating the second message, generating a first message, and completing the first message Sexual protection to prevent other illegal users from listening to modify the first message, the first message including the second message.
  • the second device may generate a message authentication code according to the MAC (message authentication code) algorithm HMAC-SHA1-128 and the authentication key and the first message.
  • the second message is an EAP-AKA'-Notification (Extensible Authentication Protocol-Authentication and Key Agreement'-Notification) message, an extended authentication protocol-authentication and key agreement.
  • EAP-AKA'-Identity EAP-REQ (Extensible Authentication Protocol-Request) message.
  • the second message can also Think of other messages that extend the authentication protocol payload (EAP-payload).
  • Step 405 The second device sends the first message to the first device.
  • the second device and the first device exchange messages through the DIAMETER protocol, and the first message is a message carried by the DIAMETER protocol.
  • the first message may be any one of a DIAMETER-Extension Authentication-Response-Command message (DIAMETER-EAP-Answer-Command) and an Authentication Authorization Accounting Message (AAA), the DIAMETER-Extended Authentication Protocol-Response-Command message Carrying an extended authentication protocol payload (EAP-payload), the extended authentication protocol payload (EAP-payload) may be an extended authentication protocol-authentication and key agreement'-notification message (EAP-AKA'-Notification), an extended authentication protocol-authentication Negotiating with the key - any one of an EAP-AKA'-Identity, an Extended Authentication Protocol-Request message (EAP-REQ), the authentication and authentication charging message including an extended authentication protocol-authentication and key agreement - Any one of a notification message (EAP-AKA'-Notification),
  • Step 406 The first device sends a second message to the terminal.
  • the first device receives the first message sent by the second device, first parses the first message, obtains a second message, and then sends the second message to the terminal.
  • the first message includes a second message, the second message including the encrypted token.
  • the second message is an extended authentication protocol-authentication and key agreement--notification message (EAP-AKA'-Notification), extended authentication protocol-authentication and key agreement--identity message (EAP-AKA'-Identity), Extend any of the Authentication Protocol-Request Messages (EAP-REQ).
  • Step 407 The terminal transmits the token to the message queue of the application manager of the terminal.
  • the second message sent by the first device first, parsing the second message to obtain the encrypted token, the second message includes the encrypted token, and decrypting the token
  • the token is obtained, and then the token is transmitted to the message queue of the application manager of the terminal, so that the WLAN control protocol application passes an API (Application Programming Interface) of the operating system of the terminal
  • the programming interface calls the token from the message queue.
  • the first device determines that the packet data network connection release request message does not include the token, and the first device considers that the packet data network connection is released.
  • the request message is an illegal packet data network connection release request message, and the packet data network connection release request message is discarded, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP, and the malicious application maliciously disconnects the PDN connection. intention.
  • the token is used to verify or identify the wireless local area network control protocol application of the terminal.
  • the second message includes the encrypted token.
  • the second message is an extended authentication protocol-authentication and key agreement--notification message (EAP-AKA'-Notification), extended authentication protocol-authentication and key agreement--identity message (EAP-AKA'-Identity), Extend any of the Authentication Protocol-Request Messages (EAP-REQ).
  • Step 408 The terminal sends a packet data network connection request message to the first device.
  • a packet data network connection request (PDN Connection Request) message includes the token and an identifier of the terminal.
  • the packet data network connection request message is a packet data network connection establishment request message, a packet data network connection disconnection request message, or a packet data network connection release request message.
  • Step 409 The first device checks whether the token is included in the packet data network connection request message.
  • the first device After receiving the packet data network connection request message sent by the terminal, the first device parses the packet data network connection request message, and checks that the packet data network connection is established. Whether the token is included in the message.
  • step 4010 is performed.
  • the first device If the packet data network connection request message does not include the token, the first device considers that the packet data network connection request message is an illegal packet data network connection request message, and the first device discards or does not process the packet data network. Connection request message.
  • Step 4010 The first device verifies whether the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the token corresponding to the identifier of the terminal stored locally.
  • the first device obtains the same terminal identifier from the terminal according to the identifier of the terminal in the packet data network connection request message, and then obtains the identifier of the terminal according to the identifier of the terminal acquired locally.
  • Corresponding token verifying whether the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the token corresponding to the identifier of the terminal stored locally, if the packet data network connection request message is If the token corresponding to the identifier of the terminal is the same as the token corresponding to the identifier of the terminal, the first device considers that the packet data network connection request message is a valid packet data network connection request message, and step 4011 is performed. .
  • Step 4011 The first device sends a packet data network connection response message to the terminal.
  • the first device sends a packet data network connection establishment response message to the terminal, so that the terminal receives the packet data network connection establishment response message sent by the first device, establishes a connection with the first device, and accesses the packet data network.
  • the packet data network connection response message is a packet data network connection setup response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • Step 408 the 409 may not be directly executed.
  • Steps 4010 that is, after the terminal sends the packet data network connection request message to the first device, the first device verifies whether the token corresponding to the identifier of the terminal in the packet data network connection request message is locally stored with the token corresponding to the identifier of the terminal. the same. Any method that can be easily conceived within the scope of the present invention within the technical scope of the present invention is well within the scope of the present invention, and therefore will not be described again.
  • the second device integrity protection first message also performs integrity protection on the second message in the first message, or the second device may separately perform the first message and the second message respectively. Messages are integrity protected.
  • the first device In the method for the terminal to access the communication network, the first device generates a token corresponding to the identifier of the terminal, and stores the token corresponding to the identifier of the terminal and the identifier of the terminal.
  • Sending an extended authentication protocol message to the second device where the extended authentication protocol message includes the token, and then the second device acquires the token, encrypts the token, generates a first message, and integrity protects the first a message
  • the first message includes a second message
  • the second message includes the encrypted token
  • the first message is sent to the first device
  • the first device sends the message to the terminal Sending the second message, after receiving the second message, the terminal transmits the token to the message queue of the application manager of the terminal, the WLAN application protocol invokes the token, and the terminal sends a packet data network connection to the first device.
  • the first device checks that the packet data network connection request message includes the token, and verifies that the packet data network connection request message corresponds to the identifier of the terminal.
  • the token is the same as the token corresponding to the identifier of the terminal, and the packet data network connection response message is sent to the terminal.
  • the terminal sends the packet data carrying the token to the first device.
  • the network connection request message enables the first device to distinguish whether the packet data network connection request message is a message of the WLAN control protocol application or a packet data network connection request message of the malicious application, thereby effectively reducing the malicious application of the terminal to trigger the WLCP to cause the network side Waste of resources.
  • the first device may also generate a user corresponding to the identifier of the terminal. a datagram protocol (UDP) port number, so that the terminal sends a packet data network connection request message carrying the UDP port number to the first device, so that the first device can distinguish that the packet data network connection request message is a message applied by the WLAN control protocol. It is also a packet data network connection request message of a malicious application to reduce the waste of resources on the network side caused by the malicious application of the terminal triggering WLCP.
  • UDP datagram protocol
  • the method for the terminal to access the communication network according to the embodiment of the present invention includes:
  • Step 4012 The first device generates a User Datagram Protocol UDP port number corresponding to the identifier of the terminal.
  • Step 4013 The first device stores a UDP port number corresponding to the identifier of the terminal and an identifier of the terminal.
  • Step 4014 The first device sends a UDP port number to the second device.
  • Step 4015 Encrypt the UDP port number and integrity protect the second message.
  • Step 4016 The second device sends the first message to the first device.
  • Step 4017 The first device sends a second message to the terminal.
  • Step 4018 Transfer the UDP port number to the message queue of the application manager of the terminal.
  • Step 4019 The terminal sends a packet data network connection request message to the first device.
  • Step 4020 The UDP port number corresponding to the identifier of the terminal in the first device verification packet data network connection request message is the same as the UDP port number corresponding to the identifier of the terminal stored locally.
  • Step 4021 The first device sends a packet data network connection response message to the terminal.
  • the terminal sends a packet data network connection request message carrying the UDP port number to the first device, so that the first device can distinguish whether the packet data network connection request message is a message applied by the WLAN control protocol or a packet data network of malicious application.
  • the connection request message effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering WLCP.
  • An embodiment of the present invention provides a method for a terminal to access a communication network, which is applied to a terminal, a first device, and a second device, and the first device is a trusted wireless local area network access gateway TWAG, and the second device is authenticated.
  • Authorized Accounting Server (AAA) or Home Subscriber Server (HSS) includes:
  • Step 501 The second device generates a token corresponding to the identifier of the terminal.
  • the terminal performs normal network access, and the EAP (Extensible Authentication Protocol) message exchanges between the terminal and the second device, so that the second device acquires the identifier of the terminal, and then the second device can generate the terminal with the terminal.
  • a corresponding token is identified, which is used to verify or identify the wireless local area network control protocol application (WLCP APP) of the terminal.
  • WLCP APP wireless local area network control protocol application
  • the second device may acquire the identifier of the terminal, re-generate a token corresponding to the identifier of the terminal, and update the token of the terminal, and the token generated each time may be different.
  • the communication network may be a third generation mobile communication cellular network or a fourth generation mobile communication cellular network.
  • the identifier of the terminal may be an IMSI, a MAC address, or an IP address.
  • the tokens can be generated by the operator, and the uniqueness of the generated tokens needs to be ensured. The manner in which the tokens are generated is the prior art, and details are not described herein again.
  • Step 502 The second device encrypts the token, and integrity protects the first message.
  • the second device may generate a key and encrypt the token to prevent other illegal users from listening to see the token.
  • the key may be a TEK (Transient EAP Keys).
  • the second device can encrypt the token in CBC (Cipher Block Chaining) mode by using AES (advanced encryption standard) and a 128-bit key.
  • CBC Cipher Block Chaining
  • AES advanced encryption standard
  • the second device After the second device encrypts the token, generating a second message, where the second message includes the encrypted token, encapsulating the second message and the token, generating a first message, and The first message performs integrity protection to prevent other illegal users from intercepting and modifying the first message, where the first message includes a second message, an identifier of the terminal, and a token corresponding to the identifier of the terminal, where the terminal
  • the token corresponding to the identifier can be used for the first device to acquire.
  • the second device may generate a message authentication code according to the MAC (message authentication code) algorithm HMAC-SHA1-128 and the authentication key and the first message.
  • the second message is an extended authentication protocol-authentication and key agreement--notification message (EAP-AKA'-Notification), extended authentication protocol-authentication and key agreement--identity message (EAP-AKA'-Identity), Extend any of the Authentication Protocol-Request Messages (EAP-REQ).
  • the second message may also be other messages that extend the authentication protocol payload (EAP-payload).
  • Step 503 The second device sends the first message to the first device.
  • the second device and the first device exchange messages through the DIAMETER protocol, and the first message is a message carried by the DIAMETER protocol.
  • the first message may be any one of a DIAMETER-Extension Authentication-Response-Command message (DIAMETER-EAP-Answer-Command) and an Authentication Authorization Accounting Message (AAA), the DIAMETER-Extended Authentication Protocol-Response-Command message Carrying an extended authentication protocol payload (EAP-payload), the extended authentication protocol payload (EAP-payload) may be an extended authentication protocol-authentication and key agreement'-notification message (EAP-AKA'-Notification), an extended authentication protocol-authentication Negotiating with the key - any one of an EAP-AKA'-Identity, an Extended Authentication Protocol-Request message (EAP-REQ), the authentication and authentication charging message including an extended authentication protocol-authentication and key agreement - Any one of a notification message (EAP-AKA'-Notification),
  • Step 504 The first device stores the token corresponding to the identifier of the terminal and the identifier of the terminal.
  • the token is used to verify or identify the wireless local area network control protocol application of the terminal.
  • Step 505 The first device sends a second message to the terminal.
  • the first device receives the first message sent by the second device. First, the first message is parsed to obtain a second message, and then the second message is sent to the terminal. The first message includes a second message, the second message including the encrypted token.
  • the second message is an extended authentication protocol-authentication and key agreement--notification message (EAP-AKA'-Notification), extended authentication protocol-authentication and key agreement--identity message (EAP-AKA'-Identity), Extend any of the Authentication Protocol-Request Messages (EAP-REQ).
  • EAP-AKA'-Notification extended authentication protocol-authentication and key agreement--notification message
  • EAP-AKA'-Identity extended authentication protocol-authentication and key agreement--identity
  • EAP-REQ Extend any of the Authentication Protocol-Request Messages
  • Step 506 The terminal transmits the token to the message queue of the application manager of the terminal.
  • the first device determines that the packet data network connection release request message does not include the token, and the first device considers the packet data.
  • the network connection release request message is an illegal packet data network connection release request message, and the packet data network connection release request message is discarded, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering WLCP, and the malicious application malicious disconnection The intent of the PDN connection.
  • the token is used to verify or identify the wireless local area network control protocol application of the terminal.
  • the second message includes the encrypted token.
  • the second message is an extended authentication protocol-authentication and key agreement--notification message (EAP-AKA'-Notification), extended authentication protocol-authentication and key agreement--identity message (EAP-AKA'-Identity), Extend any of the Authentication Protocol-Request Messages (EAP-REQ).
  • Step 507 The terminal sends a packet data network connection request message to the first device.
  • a packet data network connection request (PDN Connection Request) message includes the token and an identifier of the terminal.
  • the packet data network connection request message is a packet data network connection establishment request message, a packet data network connection disconnection request message, or a packet data network connection release request message.
  • Step 508 The first device checks whether the token is included in the packet data network connection request message.
  • the first device After receiving the packet data network connection request message sent by the terminal, the first device parses the packet data network connection request message, and checks whether the token is included in the packet data network connection request message.
  • step 509 is performed.
  • the first device If the packet data network connection request message does not include the token, the first device considers that the packet data network connection request message is an illegal packet data network connection request message, and the first device discards or does not process the packet data network. Connection request message.
  • Step 509 The first device verifies whether the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the token corresponding to the identifier of the terminal stored locally.
  • the first device is configured according to the end in the packet data network connection request message.
  • the identifier of the terminal obtains the same terminal identifier as the identifier of the terminal, and then obtains the token corresponding to the identifier of the terminal according to the identifier of the terminal that is obtained locally, and verifies the packet data network connection request message and the terminal. Whether the token corresponding to the identifier is the same as the token corresponding to the identifier of the terminal, if the token corresponding to the identifier of the terminal in the packet data network connection request message is corresponding to the identifier of the terminal stored locally If the token is the same, the first device considers that the packet data network connection request message is a valid packet data network connection request message, and performs step 5010.
  • Step 5010 The first device sends a packet data network connection response message to the terminal.
  • the first device sends a packet data network connection response message to the terminal, so that the terminal receives the packet data network connection response message sent by the first device, and establishes a connection with the second device by using the first device to access the packet.
  • Data network is a packet data network connection setup response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • Step 507 the 508 may not be directly executed.
  • Step 509 is performed, that is, after the terminal sends the packet data network connection release request message to the first device, the first device verifies whether the token corresponding to the identifier of the terminal in the packet data network connection release request message is locally and the identifier of the terminal and the terminal.
  • the corresponding token is the same. Any method that can be easily conceived within the scope of the present invention within the technical scope of the present invention is well within the scope of the present invention, and therefore will not be described again.
  • the second device integrity protection first message also performs integrity protection on the second message in the first message, or the second device may separately perform the first message and the second message respectively. Messages are integrity protected.
  • the second device In the method for the terminal to access the communication network, the second device generates a token corresponding to the identifier of the terminal, encrypts the token, and generates a second message.
  • the second message includes the encrypted token, generates a first message, and performs integrity protection on the first message, where the first message includes a second message, an identifier of the terminal, and an identifier corresponding to the terminal.
  • the token sends a first message to the first device, where the first device stores the token corresponding to the identifier of the terminal and the identifier of the terminal, and sends a second message to the terminal, where the terminal receives the second message.
  • the token is transmitted to the message queue of the application manager of the terminal, and the WLAN control protocol application invokes the token, the terminal sends a packet data network connection request message to the first device, and the first device checks the packet.
  • the data network connection request message includes the token, and the token in the packet data network connection message corresponding to the identifier of the terminal is the same as the token corresponding to the identifier of the terminal stored locally, to the terminal.
  • the terminal sends a packet data network connection request message carrying the token to the first device, so that the first device is To distinguish a packet data network connection request message is a wireless LAN control message protocol application, or malicious application message packet data network connection, effectively reduce the waste of resources WLCP malicious application terminal triggers causing network side.
  • the second device may further generate a User Datagram Protocol (UDP) port number corresponding to the identifier of the terminal, so that the terminal sends a packet data network connection request message carrying the UDP port number to the first device, so that the first device
  • UDP User Datagram Protocol
  • the device can distinguish whether the packet data network connection request message is a message of the WLAN control protocol application or a packet data network connection request message of the malicious application, so as to reduce the waste of the network side caused by the malicious application of the terminal triggering the WLCP.
  • the method for the terminal to access the communication network according to the embodiment of the present invention includes:
  • Step 5011 The second device generates a UDP port number corresponding to the identifier of the terminal.
  • Step 5012 The second device encrypts the UDP port number, and integrity protects the second message.
  • Step 5013 The second device sends a first message to the first device.
  • Step 5014 The first device stores a UDP port number corresponding to the identifier of the terminal and an identifier of the terminal.
  • Step 5015 The first device sends a second message to the terminal.
  • Step 5016 The terminal transmits the UDP port number to the message queue of the application manager of the terminal.
  • Step 5017 The terminal sends a packet data network connection request message to the first device.
  • step 5018 the first device verifies that the UDP port number corresponding to the identifier of the terminal in the packet data network connection message is the same as the UDP port number corresponding to the identifier of the terminal stored locally.
  • Step 5019 The first device sends a packet data network connection response message to the terminal.
  • the terminal sends a packet data network connection request message carrying the UDP port number to the first device, so that the first device can distinguish whether the packet data network connection request message is a message applied by the WLAN control protocol or a packet data network of malicious application.
  • the connection message effectively reduces the malicious application of the terminal and triggers WLCP to cause waste of resources on the network side.
  • An embodiment of the present invention provides a method for a terminal to access a communication network, which is applied to a terminal, a first device, and a second device, and the first device is a trusted wireless local area network access gateway TWAG, and the second device is authenticated.
  • Authorized Accounting Server (AAA) or Home Subscriber Server (HSS) as shown in Figure 21, includes:
  • Step 1401 The terminal generates a User Datagram Protocol UDP port number corresponding to the identifier of the terminal.
  • the terminal performs normal network attachment.
  • a UDP port number corresponding to the identifier of the terminal may be generated, where the UDP port number is used to verify or identify the WLAN application protocol (WLCP APP) of the terminal.
  • WLCP APP WLAN application protocol
  • the terminal can regenerate and The UDP port number corresponding to the identifier of the terminal is updated, and the UDP port number of the terminal may be updated.
  • the UDP port number generated each time may be different.
  • the communication network may be a third generation mobile communication cellular network or a fourth generation mobile communication cellular network.
  • the identifier of the terminal may be an IMSI, a MAC address, or an IP address.
  • the UDP port number can be generated by the operator, and the uniqueness of the generated UDP port number needs to be ensured. The manner of generating the UDP port number is the prior art, and details are not described herein again.
  • Step 1402 The terminal encrypts the UDP port number, and integrity protects the third message.
  • the terminal may generate a key and encrypt the UDP port number to prevent other illegal users from listening to the UDP port number.
  • the key may be a TEK (Transient EAP Keys).
  • the terminal can encrypt the UDP port number in CBC (Cipher Block Chaining) mode by using AES (advanced encryption standard) and a 128-bit key.
  • CBC Cipher Block Chaining
  • AES advanced encryption standard
  • the third message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA'-Notification, extended authentication protocol-authentication and key agreement'-identity message EAP-AKA'-Identity, extended authentication protocol- Respond to any of the messages EAP-RSP.
  • the terminal After the terminal encrypts the UDP port number, generating a third message, where the third message includes the encrypted UDP port number, and performing integrity protection on the third message to prevent other illegal users from listening to modify the Third message.
  • Step 1403 The terminal sends a third message to the first device.
  • Step 1404 The first device sends a first message to the second device.
  • the first device After receiving the third message sent by the terminal, the first device generates a first message, where the first message includes the third message.
  • the first message is a message carried by the DIAMETER protocol.
  • Step 1405 The second device decrypts the encrypted UDP port number.
  • the first message sent by the first device where the first message includes a third message
  • the third message includes the encrypted UDP port number
  • first parsing the first message, and obtaining a complete message
  • the third message of the sexual protection decrypts the third message, obtains the encrypted UDP port number, and decrypts the encrypted UDP port number to obtain the UDP port number.
  • the third message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA'-Notification, extended authentication protocol-authentication and key agreement'-identity message EAP-AKA'-Identity, extended authentication protocol- Respond to any of the messages EAP-RSP.
  • Step 1406 The second device integrity protects the fourth message, and generates a first message.
  • the fourth message may be an Extended Authentication Protocol - EAP-success message, the first message being a message carried by the DIAMETER protocol.
  • the second device integrity protects the fourth message to prevent other illegal users from listening to modify the fourth message.
  • Step 1407 The second device sends the first message to the first device.
  • the first message includes the UDP port number.
  • Step 1408 The first device stores the UDP port number corresponding to the identifier of the terminal and the identifier of the terminal.
  • the UDP port number is used to verify or identify the WLAN control protocol application of the terminal.
  • Step 1409 The first device sends a fourth message to the terminal.
  • the first device receives the first message sent by the second device. First, the first message is parsed to obtain an integrity-protected fourth message, and then the fourth message is sent to the terminal.
  • the fourth message may be an extended authentication protocol-success (EAP-success) message.
  • Step 14010 The terminal transmits the UDP port number to the application manager of the terminal. message queue.
  • the first device determines that the UDP port number is not included in the packet data network connection release request message, and the first device considers the packet data network
  • the connection release request message is an illegal packet data network connection release request message, and the packet data network connection release request message is discarded, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP, and the malicious application maliciously disconnects the PDN.
  • the intent of the connection is an illegal packet data network connection release request message, and the packet data network connection release request message is discarded, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP, and the malicious application maliciously disconnects the PDN.
  • the UDP port number is used to verify or identify the wireless local area network control protocol application of the terminal.
  • the second message includes the encrypted UDP port number.
  • the second message is an extended authentication protocol-authentication and key agreement--notification message (EAP-AKA'-Notification), extended authentication protocol-authentication and key agreement--identity message (EAP-AKA'-Identity), Extend any of the Authentication Protocol-Request Messages (EAP-REQ).
  • Step 14011 The terminal sends a packet data network connection request message to the first device.
  • a packet data network connection request (PDN Connection Request) message includes the UDP port number and an identifier of the terminal.
  • the packet data network connection request message is a packet data network connection establishment request message, a packet data network connection disconnection request message, or a packet data network connection release request message.
  • the UDP port number is in a packet header of the packet data network connection request message, and the UDP port number is used as a source port number of the packet data network connection request message.
  • Step 14012 The first device verifies that the UDP port number corresponding to the identifier of the terminal in the packet data network connection request message is the same as the UDP port number corresponding to the identifier of the terminal stored locally.
  • the first device obtains the same terminal identifier from the terminal according to the identifier of the terminal in the packet data network connection request message, and then obtains the identifier of the terminal according to the identifier of the terminal acquired locally.
  • Corresponding UDP port number verifying whether the UDP port number corresponding to the identifier of the terminal in the packet data network connection request message is the same as the UDP port number corresponding to the identifier of the terminal stored locally, if the packet data network connection is The UDP port number corresponding to the identifier of the terminal in the request message is the same as the UDP port number corresponding to the identifier of the terminal stored locally, and the first device considers that the packet data network connection request message is a legitimate packet data network connection request.
  • the message is executed in step 14013.
  • Step 14013 The first device sends a packet data network connection response message to the terminal.
  • the first device sends a packet data network connection response message to the terminal, so that the terminal receives the packet data network connection response message sent by the first device, and establishes a connection with the second device by using the first device to access the packet.
  • Data network is a packet data network connection setup response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the terminal first generates a UDP port number corresponding to the identifier of the terminal, encrypts the UDP port number, generates a third message, and performs integrity protection on the third message.
  • the third message includes the encrypted UDP port number, and sends a third message to the first device.
  • the first device generates a first message according to the third message, and sends a first message to the second device, where the second device encrypts Decrypting the UDP port number, integrity protecting the fourth message, and generating a first message, sending the first message to the first device, where the first message includes the fourth message and the UDP port number
  • the first device stores the UDP corresponding to the identifier of the terminal
  • the port number and the identifier of the terminal the first device sends a fourth message to the terminal, the terminal transmits the UDP port number to the message queue of the application manager of the terminal, and the WLAN control protocol application invokes the UDP port number, the terminal Sending a packet data network connection request message to the first device, the first device verifies whether the UDP port number corresponding to the identifier of the terminal in the packet data network connection message is the same as the UDP port number corresponding to the locally stored identifier of the terminal.
  • the terminal sends a packet data network connection request message carrying a UDP port number to the first device, so that the first device can distinguish the packet data network connection request message.
  • the message applied by the WLAN control protocol is also a packet data network connection message of the malicious application, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering WLCP.
  • the terminal may further generate a token corresponding to the identifier of the terminal, so that the terminal sends a packet data network connection request message carrying the token to the first device, so that the first device can distinguish the packet data network connection request message.
  • the specific steps are as described in the embodiment of the present invention, and are not described here. The difference is that the UDP port number described in the steps of the embodiment of the present invention may be replaced by a token.
  • the method for the terminal to access the communication network according to the embodiment of the present invention includes:
  • Step 14014 The terminal generates a token corresponding to the identifier of the terminal.
  • Step 14015 The terminal encrypts the token and integrity protects the third message.
  • Step 14016 The terminal sends a third message to the first device.
  • Step 14017 The first device sends a first message to the second device.
  • Step 14018 The second device decrypts the encrypted token.
  • Step 14019 The second device integrity protects the fourth message, and generates a first message.
  • Step 14020 The second device sends the first message to the first device.
  • Step 14021 The first device stores the token corresponding to the identifier of the terminal and the identifier of the terminal.
  • Step 14022 The first device sends a fourth message to the terminal.
  • Step 14023 The terminal transmits the token to the message queue of the application manager of the terminal.
  • Step 14024 The terminal sends a packet data network connection request message to the first device.
  • Step 14025 The first device verifies whether the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the token corresponding to the identifier of the terminal stored locally.
  • Step 14026 The first device sends a packet data network connection response message to the terminal.
  • the terminal sends a packet data network connection request message carrying the token to the first device, so that the first device can distinguish whether the packet data network connection request message is a message of the WLAN control protocol application or a packet data network connection of the malicious application.
  • the message effectively reduces the malicious application of the terminal and triggers WLCP to cause waste of resources on the network side.
  • the embodiment of the present invention provides a first device 60, where the first device is a trusted wireless local area network access gateway TWAG, or the first device includes a TWAG and a trusted wireless local area network authentication and authorization charging service agent TWAP, such as As shown in Figure 6, it includes:
  • the first receiving unit 601 is configured to receive a first message sent by the second device, where the first message includes a second message and a token, and the second message includes the encrypted token.
  • the first receiving unit 601 is further configured to: or receive the first message sent by the second device, where the first message includes the second message, and the second message includes the encrypted token.
  • the second device and the first device exchange messages through the DIAMETER protocol
  • the first message is a message carried by the DIAMETER protocol.
  • the first message can be a DIAMETER-Extended Authentication Protocol-Response-Command message (DIAMETER-EAP-Answer-Command) and any one of the authentication and authorization charging messages (AAA), the DIAMETER-extended authentication protocol-response-command message carrying an extended authentication protocol payload (EAP-payload), the extended authentication protocol payload (EAP-payload) may be extended authentication protocol-authentication and key agreement'-notification message (EAP-AKA'-Notification), extended authentication protocol-authentication and key agreement'-identity message (EAP-AKA'-Identity) And an extended authentication protocol-request message (EAP-REQ), where the authentication authorization charging message includes an extended authentication protocol-authentication and key agreement'-notification message (EAP-AKA'-Notification), an extended authentication protocol- Authentication and Key Agreement '-E
  • the first sending unit 602 is configured to send the second message to the terminal.
  • the first device receives the first message sent by the second device, first parses the first message, obtains a second message, and then sends the second message to the terminal.
  • the first message includes a second message, the second message including the encrypted token.
  • the second message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA'-Notification, extended authentication protocol-authentication and key agreement'-identity message EAP-AKA'-Identity, extended authentication protocol- Request any one of the messages EAP-REQ.
  • the second message may also be other messages that extend the authentication protocol payload (EAP-payload).
  • the first message sent by the second device is first received, where the first message includes a second message and a token, the second message includes the encrypted token, or receives a second message sent by the second device. a message, the first message includes the second message, the second message includes the encrypted token, and then the second message is sent to the terminal, which effectively reduces the malicious application trigger of the terminal.
  • WLCP causes waste of resources on the network side.
  • the first device 60 further includes:
  • a second receiving unit 603 configured to receive a packet data network connection sent by the terminal a request message, the packet data network connection request message including the token, and the packet data network connection request message is a packet data network connection establishment request message, a packet data network connection disconnection request message, or a packet data network connection release request message .
  • the first verification unit 604 is configured to verify whether the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the locally stored token corresponding to the identifier of the terminal.
  • the second sending unit 605 is configured to: if the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the locally stored token corresponding to the identifier of the terminal, to the terminal And transmitting a packet data network connection response message, where the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the reading unit 609 is configured to read, from the first message, the token corresponding to the identifier of the terminal and the identifier of the terminal.
  • the first storage unit 6010 is configured to store the token corresponding to the identifier of the terminal and the identifier of the terminal.
  • the first device 60 further includes:
  • the second receiving unit 603 is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the token, and the packet data network connection request message is a packet data network connection establishment request.
  • the first verification unit 604 is configured to verify whether the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the locally stored token corresponding to the identifier of the terminal.
  • the second sending unit 605 is configured to: if the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the locally stored token corresponding to the identifier of the terminal, to the terminal Sending a packet data network connection response message, the packet data network connection response message is a packet data network connection establishment response message, packet data The network connection disconnect response message or the packet data network connection release response message.
  • the generating unit 6011 is configured to generate the token corresponding to the identifier of the terminal.
  • the terminal performs a normal network access, and the EAP (Extensible Authentication Protocol) message exchanges between the terminal and the second device, so that the first device can obtain the identifier of the terminal from the second device, and then the first device A token corresponding to the identity of the terminal can be generated.
  • EAP Extensible Authentication Protocol
  • the first device may acquire the identifier of the terminal from the second device, regenerate the token corresponding to the identifier of the terminal, update the token of the terminal, and generate the token each time.
  • the communication network may be a third generation mobile communication cellular network or a fourth generation mobile communication cellular network.
  • the identifier of the terminal may be an IMSI (International Mobile Subscriber Identification Number), a MAC (Media Access Control) address, or an IP (Internet Protocol) address.
  • IMSI International Mobile Subscriber Identification Number
  • MAC Media Access Control
  • IP Internet Protocol
  • the second storage unit 6012 is configured to store the token corresponding to the identifier of the terminal and the identifier of the terminal.
  • the fourth sending unit 6013 is configured to send the token to the second device.
  • the DIAMETER-Extended Authentication Protocol-Request-Command message DIAMETER-EAP-REQ-Command or the Authentication Authorization Charging message AAA may be sent to the second device, the authentication authorization charging message including an extended authentication protocol-response message EAP-RSP Or an extended authentication protocol-identity message EAP-Identity, the DIAMETER-extended authentication protocol-request-command message including the token, the extended authentication protocol-response message including the token, the extended authentication protocol-identity The message includes the token.
  • the first device 60 further includes:
  • the second receiving unit 603 is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the token, and the packet data network connection request message is a packet data network connection establishment request.
  • the checking unit 606 is configured to check whether the token is included in the packet data network connection request message.
  • the first device If the packet data network connection request message does not include the token, the first device considers that the packet data network connection request message is an illegal packet data network connection request message, and the first device discards or does not process the packet data network. Connection request message.
  • the second verification unit 607 is configured to: if the token is included in the packet data network connection request message, verify whether the token corresponding to the identifier of the terminal in the packet data network connection request message is locally stored The token corresponding to the identifier of the terminal is the same.
  • the first device obtains the same terminal identifier from the terminal according to the identifier of the terminal in the packet data network connection request message, and then obtains the identifier of the terminal according to the identifier of the terminal acquired locally.
  • Corresponding token verifying whether the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the token corresponding to the identifier of the terminal stored locally, if the packet data network connection request message is The token corresponding to the identifier of the terminal is the same as the token corresponding to the identifier of the terminal stored locally, and the first device considers that the packet data network connection request message is a valid packet data network connection request message.
  • the third sending unit 608 is configured to: if the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the locally stored token corresponding to the identifier of the terminal, to the terminal And transmitting a packet data network connection response message, where the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the reading unit 609 is configured to read, from the first message, the token corresponding to the identifier of the terminal and the identifier of the terminal.
  • the first storage unit 6010 is configured to store the token corresponding to the identifier of the terminal and the identifier of the terminal.
  • the first device 60 further includes:
  • the second receiving unit 603 is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the token and an identifier of the terminal, where the packet data network connection request message is A packet data network connection setup request message, a packet data network connection disconnection request message, or a packet data network connection release request message.
  • the checking unit 606 is configured to check whether the token is included in the packet data network connection request message.
  • the first device If the packet data network connection request message does not include the token, the first device considers that the packet data network connection request message is an illegal packet data network connection request message, and the first device discards or does not process the packet data network. Connection request message.
  • the second verification unit 607 is configured to: if the token is included in the packet data network connection request message, verify whether the token corresponding to the identifier of the terminal in the packet data network connection request message is locally stored The token corresponding to the identifier of the terminal is the same.
  • the first device obtains the same terminal identifier from the terminal according to the identifier of the terminal in the packet data network connection request message, and then obtains the identifier of the terminal according to the identifier of the terminal acquired locally.
  • Corresponding token verifying whether the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the token corresponding to the identifier of the terminal stored locally, if the packet data network connection request message is The token corresponding to the identifier of the terminal is the same as the token corresponding to the identifier of the terminal stored locally, and the first device considers that the packet data network connection request message is a valid packet data network connection request message.
  • the third sending unit 608 is configured to: if the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the locally stored token corresponding to the identifier of the terminal, to the terminal And transmitting a packet data network connection response message, where the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the generating unit 6011 is configured to generate the token corresponding to the identifier of the terminal.
  • the terminal performs a normal network access, and the EAP (Extensible Authentication Protocol) message exchanges between the terminal and the second device, so that the first device can obtain the identifier of the terminal from the second device, and then the first device A token corresponding to the identity of the terminal can be generated.
  • EAP Extensible Authentication Protocol
  • the first device may acquire the identifier of the terminal from the second device, regenerate the token corresponding to the identifier of the terminal, update the token of the terminal, and generate the token each time.
  • the communication network may be a third generation mobile communication cellular network or a fourth generation mobile communication cellular network.
  • the identifier of the terminal may be an IMSI (International Mobile Subscriber Identification Number), a MAC (Media Access Control) address, or an IP (Internet Protocol) address.
  • IMSI International Mobile Subscriber Identification Number
  • MAC Media Access Control
  • IP Internet Protocol
  • the second storage unit 6012 is configured to store the token corresponding to the identifier of the terminal and the identifier of the terminal.
  • the fourth sending unit 6013 is configured to send the token to the second device.
  • the DIAMETER-Extended Authentication Protocol-Request-Command message DIAMETER-EAP-REQ-Command or the Authentication Authorization Charging message AAA may be sent to the second device, the authentication authorization charging message including an extended authentication protocol-response message EAP-RSP or Extended Authentication Protocol - Identity Message EAP-Identity, the DIAMETER-Extended Authentication Protocol-Request-Command message includes the token, the Extended Authentication Protocol-Response message includes the token, the extended authentication The protocol-identity message includes the token.
  • the token is used to verify or identify a valid WLAN control protocol application.
  • the first device 61 provided by the embodiment of the present invention, the first device is a trusted wireless local area network access gateway TWAG, or the first device includes a TWAG and a trusted wireless local area network authentication and authorization charging service agent TWAP, as shown in the figure. 22, including:
  • the first receiving unit 611 is configured to receive a first message sent by the second device, where the first message includes a second message and a user datagram protocol UDP port number, and the second message includes the encrypted UDP port number.
  • the first receiving unit 611 is further configured to: or receive the first message sent by the second device, where the first message includes the second message, and the second message includes the encrypted UDP port number.
  • the first sending unit 612 is configured to send the second message to the terminal.
  • the first device receives the first message sent by the second device, where the first message includes a second message and a user datagram protocol UDP port number, and the second message includes the encrypted UDP port number, or The first message includes the second message, and then the second message is sent to the terminal, so that the WLCP application of the terminal acquires the UDP port number, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP.
  • the first device 61 further includes:
  • the second receiving unit 613 is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the UDP port number, and the packet data network connection request message is a packet data network connection establishment.
  • the request message, the packet data network connection disconnection request message, or the packet data network connection release request message is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the UDP port number, and the packet data network connection request message is a packet data network connection establishment.
  • the request message, the packet data network connection disconnection request message, or the packet data network connection release request message is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the UDP port number, and the packet data network connection request message is a packet data network connection establishment.
  • the request message, the packet data network connection disconnection request message, or the packet data network connection release request message is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes
  • the first verification unit 614 is configured to verify whether the UDP port number corresponding to the identifier of the terminal in the packet data network connection request message is the same as the locally stored UDP port number corresponding to the identifier of the terminal.
  • the second sending unit 615 is configured to: if the UDP port number corresponding to the identifier of the terminal in the packet data network connection request message is the same as the UDP port number corresponding to the identifier of the terminal stored locally, The terminal sends a packet data network connection response message, and the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the reading unit 619 is configured to read, from the first message, the UDP port number corresponding to the identifier of the terminal and the identifier of the terminal.
  • the first storage unit 6110 is configured to store the UDP port number corresponding to the identifier of the terminal and an identifier of the terminal.
  • the first device 61 further includes:
  • the second receiving unit 613 is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the UDP port number, and the packet data network connection request message is a packet data network connection establishment.
  • the request message, the packet data network connection disconnection request message, or the packet data network connection release request message is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the UDP port number, and the packet data network connection request message is a packet data network connection establishment.
  • the request message, the packet data network connection disconnection request message, or the packet data network connection release request message is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the UDP port number, and the packet data network connection request message is a packet data network connection establishment.
  • the request message, the packet data network connection disconnection request message, or the packet data network connection release request message is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes
  • the first verification unit 614 is configured to verify whether the UDP port number corresponding to the identifier of the terminal in the packet data network connection request message is the same as the locally stored UDP port number corresponding to the identifier of the terminal.
  • the second sending unit 615 is configured to: if the UDP port number corresponding to the identifier of the terminal in the packet data network connection request message is the same as the UDP port number corresponding to the identifier of the terminal stored locally, The terminal sends a packet data network connection response message, and the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the generating unit 6111 is configured to generate the UDP port number corresponding to the identifier of the terminal.
  • the second storage unit 6112 is configured to store the UDP port number corresponding to the identifier of the terminal and the identifier of the terminal.
  • the fourth sending unit 6113 is configured to send the UDP port number to the second device.
  • the first device 61 further includes:
  • the second receiving unit 613 is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the UDP port number, and the packet data network connection request message is a packet data network connection establishment.
  • the request message, the packet data network connection disconnection request message, or the packet data network connection release request message is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the UDP port number, and the packet data network connection request message is a packet data network connection establishment.
  • the request message, the packet data network connection disconnection request message, or the packet data network connection release request message is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the UDP port number, and the packet data network connection request message is a packet data network connection establishment.
  • the request message, the packet data network connection disconnection request message, or the packet data network connection release request message is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes
  • the checking unit 616 is configured to check whether the UDP port number is included in the packet data network connection request message.
  • the second verification unit 617 is configured to: if the UDP port number is included in the packet data network connection request message, verify whether the UDP port number corresponding to the identifier of the terminal in the packet data network connection request message is The locally stored UDP port number corresponding to the identifier of the terminal is the same.
  • the third sending unit 618 is configured to: if the UDP port number corresponding to the identifier of the terminal in the packet data network connection request message is the same as the UDP port number corresponding to the identifier of the terminal stored locally, The terminal sends a packet data network connection response message, and the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the reading unit 619 is configured to read, from the first message, the UDP port number corresponding to the identifier of the terminal and the identifier of the terminal.
  • the first storage unit 6110 is configured to store the UDP port number corresponding to the identifier of the terminal and an identifier of the terminal.
  • the first device 61 further includes:
  • the second receiving unit 613 is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the UDP port number and an identifier of the terminal, and the packet data network connection request message A packet data network connection setup request message, a packet data network connection disconnection request message, or a packet data network connection release request message.
  • the checking unit 616 is configured to check whether the UDP port number is included in the packet data network connection request message.
  • the second verification unit 617 is configured to: if the UDP port number is included in the packet data network connection request message, verify whether the UDP port number corresponding to the identifier of the terminal in the packet data network connection request message is The locally stored UDP port number corresponding to the identifier of the terminal is the same.
  • the third sending unit 618 is configured to: if the UDP port number corresponding to the identifier of the terminal in the packet data network connection request message is the same as the UDP port number corresponding to the identifier of the terminal stored locally, The terminal sends a packet data network connection response message, and the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the generating unit 6111 is configured to generate the UDP port number corresponding to the identifier of the terminal.
  • the second storage unit 6112 is configured to store the UDP port number corresponding to the identifier of the terminal and the identifier of the terminal.
  • the fourth sending unit 6113 is configured to send the UDP port number to the second device.
  • the UDP port number is used to verify or identify a valid WLAN control protocol application.
  • the embodiment of the present invention provides a first device 62, where the first device is a trusted wireless local area network access gateway TWAG, or the first device includes a TWAG and a trusted wireless local area network authentication and authorization charging service agent TWAP, such as Figure 27 shows:
  • the first receiving unit 621 is configured to receive a first message sent by the second device, where the first message includes a second message and an authentication parameter.
  • the first sending unit 622 is configured to send the second message to the terminal.
  • the second receiving unit 623 is configured to receive a third message sent by the terminal, where the third message includes the encrypted authentication parameter.
  • the second sending unit 624 is configured to send the first message to the second device, where the first message includes the third message.
  • the third receiving unit 625 is configured to receive a packet data network connection request message sent by the terminal, where the packet data network connection request message includes the authentication parameter, and the packet data network connection request message is a packet data network connection establishment request.
  • the verification unit 626 is configured to verify whether the authentication parameter corresponding to the identifier of the terminal in the packet data network connection request message is the same as the locally stored authentication parameter corresponding to the identifier of the terminal.
  • the third sending unit 627 is configured to: if the authentication parameter corresponding to the identifier of the terminal in the packet data network connection request message is the same as the authentication parameter corresponding to the identifier of the terminal stored locally, to the terminal And transmitting a packet data network connection response message, where the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the embodiment of the present invention provides a terminal 70, as shown in FIG.
  • the first receiving unit 701 is configured to receive a second message sent by the first device, where the second message includes the encrypted token.
  • the first device determines that the packet data network connection release request message does not include the token, and the first device considers that the packet data network connection is released.
  • the request message is an illegal packet data network connection release request message, and the packet data network connection release request message is discarded, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP, and the malicious application maliciously disconnects the PDN connection. intention.
  • the second message includes the encrypted token.
  • the second message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA'-Notification, extended authentication protocol-authentication and key agreement'-identity message EAP-AKA'-Identity, extended authentication protocol- Request any one of the messages EAP-REQ.
  • the second message may also be other messages that extend the authentication protocol payload (EAP-payload).
  • the second message sent by the first device is received, and the second message includes the encrypted token, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP.
  • the terminal 70 further includes:
  • the sending unit 702 is configured to send, to the first device, a packet data network connection request message, where the packet data network connection request message includes the token, and the packet data network connection request message is a packet data network connection establishment request message. Packet data network connection The disconnect request message or the packet data network connection release request message.
  • the second receiving unit 703 is configured to receive a packet data network connection response message sent by the first device, where the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet The data network connection releases the response message.
  • the token is used to verify or identify a valid WLAN control protocol application.
  • the embodiment of the present invention provides a terminal 71, as shown in FIG. 28, including:
  • the receiving unit 711 is configured to receive a second message sent by the first device, where the second message includes an encrypted User Datagram Protocol UDP port number.
  • the terminal can obtain the UDP port number from the received second message sent by the first device, so that the WLCP application of the terminal obtains the UDP port number or the token, which effectively reduces the malicious application of the terminal and triggers the WLCP to cause the network. Waste of resources on the side.
  • the embodiment of the present invention provides a terminal 72, as shown in FIG. 29, including:
  • the generating unit 721 is configured to generate an authentication parameter corresponding to the identifier of the terminal, where the authentication parameter is a token or a User Datagram Protocol UDP port number.
  • the encryption unit 722 is configured to encrypt the authentication parameter.
  • the sending unit 723 is configured to send a third message to the first device, where the third message includes the encrypted authentication parameter.
  • the sending unit 723 is further configured to send, to the first device, a packet data network connection request message, where the packet data network connection request message includes the authentication parameter, and the packet data network connection request message is a packet data network connection establishment.
  • the request message, the packet data network connection disconnection request message, or the packet data network connection release request message is further configured to send, to the first device, a packet data network connection request message, where the packet data network connection request message includes the authentication parameter, and the packet data network connection request message is a packet data network connection establishment.
  • the request message, the packet data network connection disconnection request message, or the packet data network connection release request message is further configured to send, to the first device, a packet data network connection request message, where the packet data network connection request message includes the authentication parameter, and the packet data network connection request message is a packet data network connection establishment.
  • the request message, the packet data network connection disconnection request message, or the packet data network connection release request message is further configured to send, to the first device, a packet data network connection request message, where the packet data
  • the receiving unit 724 is configured to receive a packet data network connection response message sent by the first device, where the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network.
  • the connection release response message is a packet data network connection response message sent by the first device, where the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network.
  • the connection release response message is configured to receive a packet data network connection response message sent by the first device, where the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network.
  • the third message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA'-Notification, extended authentication protocol-authentication and key agreement'-identity message EAP-AKA'-Identity, extended authentication protocol- Respond to any of the messages EAP-RSP.
  • the terminal generates an authentication parameter, and the terminal sends a packet data network connection request message carrying the authentication parameter to the first device, so that the first device can distinguish whether the packet data network connection request message is a message of the WLAN control protocol application or a malicious application.
  • the packet data network connection request message effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering WLCP.
  • the embodiment of the present invention provides a second device 80.
  • the second device is an authentication and authorization accounting server AAA or a home subscriber server HSS, and the second device includes:
  • the obtaining unit 801 is configured to acquire a token.
  • the encryption unit 802 is configured to encrypt the token.
  • the second device may generate a key and encrypt the token to prevent other illegal users from listening to see the token.
  • the key may be a TEK (Transient EAP Keys). It should be noted that the second device can encrypt the token in CBC (Cipher Block Chaining) mode by using AES (advanced encryption standard) and a 128-bit key.
  • the integrity protection unit 803 is configured to perform integrity protection on the first message, where the first message includes a second message and the token, and the second message includes the encrypted token.
  • the integrity protection unit 803 is further configured to: or, integrity protect the first message, The first message includes the second message, and the second message includes the encrypted token.
  • the second device After the second device encrypts the token, generating a second message, where the second message includes the encrypted token, encapsulating the second message, generating a first message, and completing the first message Sexual protection to prevent other illegal users from listening to modify the first message, the first message including the second message.
  • the second device may generate a message authentication code according to the MAC (message authentication code) algorithm HMAC-SHA1-128 and the authentication key and the first message.
  • the second message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA'-Notification, extended authentication protocol-authentication and key agreement'-identity message EAP-AKA'-Identity, extended authentication protocol- Request any one of the messages EAP-REQ.
  • the second message may also be other messages that extend the authentication protocol payload (EAP-payload).
  • the sending unit 804 is configured to send the first message to the first device, so that the first device obtains the second message from the first message.
  • the second device and the first device exchange messages through the DIAMETER protocol, and the first message is a message carried by the DIAMETER protocol.
  • the first message may be any one of a DIAMETER-Extension Authentication-Response-Command message (DIAMETER-EAP-Answer-Command) and an Authentication Authorization Accounting Message (AAA), the DIAMETER-Extended Authentication Protocol-Response-Command message Carrying an extended authentication protocol payload (EAP-payload), the extended authentication protocol payload (EAP-payload) may be an extended authentication protocol-authentication and key agreement'-notification message (EAP-AKA'-Notification), an extended authentication protocol-authentication Negotiating with the key - any one of an EAP-AKA'-Identity, an Extended Authentication Protocol-Request message (EAP-REQ), the authentication and authentication charging message including an extended authentication protocol-authentication and key agreement - Notification message (EAP-AKA'-Notification), extended authentication protocol-
  • the token is first acquired, and then the token is encrypted, the integrity protection first message, the first message includes a second message and the token, and the second message includes the encrypted command Card, or integrity protection first message, the first message includes the second message, the second message includes the encrypted token, and the first message is sent to the first device, so as to facilitate The first device obtains the second message from the first message, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP.
  • the obtaining unit 801 is specifically configured to:
  • the terminal performs normal network access, and the EAP (Extensible Authentication Protocol) message exchanges between the terminal and the second device, so that the second device acquires the identifier of the terminal, and then the second device can generate the terminal with the terminal.
  • a corresponding token is identified, which is used to verify or identify the wireless local area network control protocol application (WLCP APP) of the terminal.
  • WLCP APP wireless local area network control protocol application
  • the second device may acquire the identifier of the terminal, re-generate a token corresponding to the identifier of the terminal, and update the token of the terminal, and the token generated each time may be different.
  • the communication network may be a third generation mobile communication cellular network or a fourth generation mobile communication cellular network.
  • the identifier of the terminal may be an IMSI (International Mobile Subscriber Identification Number), a MAC (Media Access Control) address, or an IP (Internet Protocol) address.
  • IMSI International Mobile Subscriber Identification Number
  • MAC Media Access Control
  • IP Internet Protocol
  • the obtaining unit 801 is specifically configured to:
  • the token may be obtained by receiving a DIAMETER-extension authentication protocol-request-command message DIAMETER-EAP-REQ-Command or an authentication authorization charging message AAA sent by the first device, where the authentication authorization charging message includes extended authentication.
  • the authentication authorization charging message includes extended authentication.
  • a protocol-response message EAP-RSP or an extended authentication protocol-identity message EAP-Identity the DIAMETER-Extended Authentication Protocol-Request-Command message including the token
  • the extended authentication protocol-response message including the token
  • the extended authentication protocol-identity message includes the token.
  • the embodiment of the present invention provides a second device 81.
  • the second device is an authentication and authorization accounting server AAA or a home subscriber server HSS, and the second device includes:
  • the obtaining unit 811 is configured to obtain a user datagram protocol UDP port number.
  • the encryption unit 812 is configured to encrypt the UDP port number.
  • the integrity protection unit 813 is configured to perform integrity protection on the first message, where the first message includes a second message and the UDP port number, and the second message includes the encrypted UDP port number.
  • the integrity protection unit 813 is further configured to: or, the integrity protection first message, the first message includes the second message, and the second message includes the encrypted UDP port number;
  • the sending unit 814 is configured to send the first message to the first device, so that the first device acquires the second message or the UDP port number from the first message.
  • the second device obtains the UDP port number, encrypts the UDP port number, and sends the first message to the first device, so that the first device obtains the second message or the
  • the UDP port number is sent to the terminal, so that the WLCP application of the terminal obtains the UDP port number, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering WLCP.
  • An embodiment of the present invention provides a second device 82, as shown in FIG.
  • the device is an authentication and authorization accounting server AAA or a home subscriber server HSS, and the second device includes:
  • the obtaining unit 821 is configured to obtain an authentication parameter, where the authentication parameter is a token or a User Datagram Protocol UDP port number.
  • the encryption unit 822 is configured to encrypt the authentication parameter.
  • the integrity protection unit 823 is configured to perform integrity protection on the second message, and generate a first message, where the first message includes the second message and the authentication parameter, and the second message includes the encrypted authentication parameter ;
  • the integrity protection unit 823 is further configured to: or: integrity protect the second message, and generate a first message, where the first message includes the second message, and the second message includes the encrypted authentication parameter;
  • the sending unit 824 is configured to send the first message to the first device, so that the first device acquires the second message or the authentication parameter from the first message.
  • the obtaining unit 821 is specifically configured to:
  • the token or the UDP port number is used to verify or identify a valid WLAN control protocol application.
  • the third message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA'-Notification, extended authentication protocol-authentication and key agreement'-identity message EAP-AKA'-Identity, extended authentication protocol- Respond to any of the messages EAP-RSP.
  • EAP-AKA'-Notification extended authentication protocol-authentication and key agreement'-identity message
  • EAP-AKA'-Identity extended authentication protocol- Respond to any of the messages EAP-RSP.
  • the embodiment of the present invention provides a communication system 90, as shown in FIG. 14, comprising:
  • the second device 903 is configured to acquire a token.
  • the integrity protects the first message, the first message includes a second message and the token, and the second message includes the encrypted token,
  • the first message includes the second message
  • the second message includes the encrypted token
  • the first device 901 is configured to receive a first message sent by the second device, where the first message includes a second message and a token, and the second message includes the encrypted token;
  • the terminal 903 is configured to receive a second message sent by the first device, where the second message includes the encrypted token.
  • the first device 901, the terminal 902, and the second device 903 can also generate a UDP port number and a token corresponding to the identifier of the terminal.
  • the embodiment of the present invention provides a first device 100.
  • the first device is a trusted wireless local area network access gateway TWAG, and the first device includes:
  • the receiver 1001 is configured to receive a first message sent by the second device, where the first message includes a second message and a token, and the second message includes the encrypted token.
  • the receiver 1001 is further configured to: or receive the first message sent by the second device, where the first message includes the second message, and the second message includes the encrypted token.
  • the DIAMETER protocol is passed between the second device and the first device.
  • a message interaction is performed, and the first message is a message carried by the DIAMETER protocol.
  • the first message may be any one of a DIAMETER-Extension Authentication-Response-Command message (DIAMETER-EAP-Answer-Command) and an Authentication Authorization Accounting Message (AAA), the DIAMETER-Extended Authentication Protocol-Response-Command message Carrying an extended authentication protocol payload (EAP-payload), the extended authentication protocol payload (EAP-payload) may be an extended authentication protocol-authentication and key agreement'-notification message (EAP-AKA'-Notification), an extended authentication protocol-authentication Negotiating with the key - any one of an EAP-AKA'-Identity, an Extended Authentication Protocol-Request message (EAP-REQ), the authentication and authentication charging message including an extended authentication protocol-authentication and key agreement - Any one of a notification message (EAP-A
  • the transmitter 1002 is configured to send the second message to the terminal.
  • the first device receives the first message sent by the second device, first parses the first message, obtains a second message, and then sends the second message to the terminal.
  • the first message includes a second message, the second message including the encrypted token.
  • the second message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA'-Notification, extended authentication protocol-authentication and key agreement'-identity message EAP-AKA'-Identity, extended authentication protocol- Request any one of the messages EAP-REQ.
  • the second message may also be other messages that extend the authentication protocol payload (EAP-payload).
  • the first message sent by the second device is first received, where the first message includes a second message and a token, the second message includes the encrypted token, or receives a second message sent by the second device. a message, the first message includes the second message, the second message includes the encrypted token, and then the second message is sent to the terminal, which effectively reduces the malicious application trigger of the terminal.
  • WLCP causes waste of resources on the network side.
  • the receiver 1001 is further configured to:
  • the packet data network connection request message includes the token
  • the packet data network connection request message is a packet data network connection establishment request message
  • the packet data network connection is disconnected.
  • the first device 100 further includes:
  • the processor 1003 is configured to verify whether the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the locally stored token corresponding to the identifier of the terminal.
  • the transmitter 1002 is also used to:
  • the packet data network connection response message is a packet data network connection setup response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the processor 1003 is further configured to:
  • the first device If the packet data network connection request message does not include the token, the first device considers that the packet data network connection request message is an illegal packet data network connection request message, and the first device discards or does not process the packet data network. Connection request message.
  • the processor 1003 is further configured to:
  • the first device obtains the same terminal identifier from the terminal according to the identifier of the terminal in the packet data network connection request message, and then obtains the identifier of the terminal according to the identifier of the terminal acquired locally.
  • Corresponding token verification office Whether the token corresponding to the identifier of the terminal in the packet data network connection request message is the same as the token corresponding to the identifier of the terminal stored locally, if the packet data network connection request message corresponds to the identifier of the terminal The token is the same as the locally stored token corresponding to the identifier of the terminal, and the first device considers that the packet data network connection request message is a legitimate packet data network connection request message.
  • the transmitter 1002 is also used to:
  • the packet data network connection response message is a packet data network connection setup response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the processor 1003 is further configured to: read, from the first message, the token corresponding to the identifier of the terminal and an identifier of the terminal.
  • the processor 1003 is further configured to: store the token corresponding to the identifier of the terminal and an identifier of the terminal.
  • the processor 1003 is further configured to: generate the token corresponding to the identifier of the terminal;
  • the terminal performs a normal network access, and the EAP (Extensible Authentication Protocol) message exchanges between the terminal and the second device, so that the first device can obtain the identifier of the terminal from the second device, and then the first device A token corresponding to the identity of the terminal may be generated, the token being used to verify or identify the wireless local area network control protocol application (WLCP APP) of the terminal.
  • EAP Extensible Authentication Protocol
  • the first device may acquire the identifier of the terminal from the second device, regenerate the token corresponding to the identifier of the terminal, update the token of the terminal, and generate the token each time.
  • the communication network may be a third generation mobile communication cellular network or a fourth generation mobile communication cellular network.
  • the identifier of the terminal may be IMSI (International Mobile Subscriber Identification Number, MAC (Media Access Control) address or IP (Internet Protocol) address.
  • IMSI International Mobile Subscriber Identification Number
  • MAC Media Access Control
  • IP Internet Protocol
  • the processor 1003 is further configured to: store the token corresponding to the identifier of the terminal and an identifier of the terminal.
  • the transmitter 1002 is further configured to: send the token to the second device.
  • the DIAMETER-Extended Authentication Protocol-Request-Command message DIAMETER-EAP-REQ-Command or the Authentication Authorization Charging message AAA may be sent to the second device, the authentication authorization charging message including an extended authentication protocol-response message EAP-RSP Or an extended authentication protocol-identity message EAP-Identity, the DIAMETER-extended authentication protocol-request-command message including the token, the extended authentication protocol-response message including the token, the extended authentication protocol-identity The message includes the token.
  • the token or the UDP port number is used to verify or identify a valid WLAN control protocol application.
  • the first device 111 provided by the embodiment of the present invention is a trusted wireless local area network access gateway TWAG, or the first device includes TWAG and trusted wireless local area network authentication and authorization charging.
  • a service agent TWAP the first device includes:
  • the receiver 1111 is configured to receive a first message sent by the second device, where the first message includes a second message and a UDP port number, and the second message includes the encrypted UDP port number.
  • the receiver 1111 is further configured to: or receive the first message sent by the second device, where the first message includes the second message, and the second message includes the encrypted UDP port number.
  • the transmitter 1112 is configured to send the second message to the terminal.
  • the first message sent by the second device is first received, where the first message includes a second message and a UDP port number, the second message includes the encrypted UDP port number, or is received by the second device.
  • a malicious application triggers WLCP to waste resources on the network side.
  • the receiver 1111 is further configured to:
  • the packet data network connection request message includes the UDP port number
  • the packet data network connection request message is a packet data network connection establishment request message
  • the packet data network connection is disconnected.
  • the processor 1113 is configured to verify whether the UDP port number corresponding to the identifier of the terminal in the packet data network connection request message is the same as the locally stored UDP port number corresponding to the identifier of the terminal.
  • the transmitter 1112 is also used to:
  • the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the processor 1113 is further configured to:
  • the processor 1113 is further configured to:
  • the transmitter 1112 is also used to:
  • the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the first message includes a second message and an authentication parameter
  • the second message includes the encrypted authentication parameter
  • the processor 1113 is further configured to: read, from the first message, the UDP port number corresponding to the identifier of the terminal, and an identifier of the terminal.
  • the processor 1113 is further configured to: store the UDP port number corresponding to the identifier of the terminal, and an identifier of the terminal.
  • the processor 1113 is further configured to: generate the UDP port number corresponding to the identifier of the terminal;
  • the processor 1113 is further configured to: store the UDP port number corresponding to the identifier of the terminal, and an identifier of the terminal.
  • the transmitter 1112 is further configured to: send the UDP port number to the second device.
  • the receiver 1111 is further configured to receive a third message sent by the terminal, where the third message includes the encrypted authentication parameter;
  • the transmitter 1112 is further configured to send the first message to the second device, where the first message includes the third message.
  • the details of the first device are as described in the embodiment of the present invention, and are not described here. The difference is that the token in the embodiment of the present invention can be replaced with a UDP port number.
  • the embodiment of the present invention provides a terminal 110. As shown in FIG. 17, the terminal includes:
  • the receiver 1101 is configured to receive a second message sent by the first device, where the second message includes the encrypted token.
  • the first device determines that the packet data network connection release request message does not include the token, and the first device considers that the packet data network connection is released.
  • the request message is an illegal packet data network connection release request message, and the packet data network connection release request message is discarded, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP, and the malicious application maliciously disconnects the PDN connection. intention.
  • the second message includes the encrypted token.
  • the second message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA'-Notification, extended authentication protocol-authentication and key agreement'-identity message EAP-AKA'-Identity, extended authentication protocol- Request any one of the messages EAP-REQ.
  • the second message may also be other messages that extend the authentication protocol payload (EAP-payload).
  • receiving a second message sent by the first device, where the second message includes The encrypted token effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering WLCP.
  • the terminal 110 further includes:
  • the transmitter 1102 is configured to send, to the first device, a packet data network connection request message, where the packet data network connection request message includes the token, and the packet data network connection request message is a packet data network connection establishment request message. , a packet data network connection disconnection request message or a packet data network connection release request message.
  • the receiver 1101 is also used to:
  • the packet data network connection response message is a packet data network connection establishment response message, a packet data network connection disconnection response message, or a packet data network connection release response message.
  • the token or the UDP port number is used to verify or identify a valid WLAN control protocol application.
  • the embodiment of the present invention provides a terminal 112. As shown in FIG. 33, the terminal includes:
  • the receiver 1121 is configured to receive a second message sent by the first device, where the second message includes the encrypted UDP port number.
  • the second message sent by the first device is received, and the second message includes the encrypted UDP port number, which effectively reduces the waste of resources on the network side caused by the malicious application of the terminal triggering the WLCP.
  • the transmitter 1122 is configured to send a packet data network connection request message to the first device, where the packet data network connection request message includes the UDP port number, and the packet data network connection request message is a packet data network connection establishment request.
  • the receiver 1121 is also used to:
  • the packet data network connection response message is a packet data network connection establishment response message, and a packet data network
  • the connection disconnect response message or the packet data network connection release response message is
  • the embodiment of the present invention provides a terminal 113.
  • the terminal includes:
  • the processor 1131 is configured to generate an authentication parameter corresponding to the identifier of the terminal, where the authentication parameter is a token or a User Datagram Protocol UDP port number.
  • the processor 1131 is further configured to encrypt the authentication parameter.
  • the transmitter 1132 is configured to send a third message to the first device, where the third message includes the encrypted authentication parameter.
  • the embodiment of the present invention provides a second device 120.
  • the second device is an authentication and authorization accounting server AAA or a home subscriber server HSS, and the second device includes:
  • the processor 1201 is configured to acquire a token.
  • the processor 1201 is further configured to: encrypt the token.
  • the second device may generate a key and encrypt the token to prevent other illegal users from listening to see the token.
  • the key may be a TEK (Transient EAP Keys). It should be noted that the second device can encrypt the token in CBC (Cipher Block Chaining) mode by using AES (advanced encryption standard) and a 128-bit key.
  • the processor 1201 is further configured to: integrity protect the first message, the first message includes a second message and the token, and the second message includes the encrypted token,
  • the processor 1201 is further configured to: or, integrity protect the first message, the first message includes the second message, and the second message includes the encrypted token.
  • the second device After the second device encrypts the token, generating a second message, where the second message includes the encrypted token, and the second message is encapsulated to generate a first message, and The first message is integrity protected to prevent other illegal users from listening to modify the first message, and the first message includes a second message.
  • the second device may generate a message authentication code according to the MAC (message authentication code) algorithm HMAC-SHA1-128 and the authentication key and the first message.
  • the second message is an extended authentication protocol-authentication and key agreement'-notification message EAP-AKA'-Notification, extended authentication protocol-authentication and key agreement'-identity message EAP-AKA'-Identity, extended authentication protocol- Request any one of the messages EAP-REQ.
  • the second message may also be other messages that extend the authentication protocol payload (EAP-payload).
  • the transmitter 1202 is configured to send the first message to the first device, so that the first device obtains the second message from the first message.
  • the second device and the first device exchange messages through the DIAMETER protocol, and the first message is a message carried by the DIAMETER protocol.
  • the first message may be any one of a DIAMETER-Extension Authentication-Response-Command message (DIAMETER-EAP-Answer-Command) and an Authentication Authorization Accounting Message (AAA), the DIAMETER-Extended Authentication Protocol-Response-Command message Carrying an extended authentication protocol payload (EAP-payload), the extended authentication protocol payload (EAP-payload) may be an extended authentication protocol-authentication and key agreement'-notification message (EAP-AKA'-Notification), an extended authentication protocol-authentication Negotiating with the key - any one of an EAP-AKA'-Identity, an Extended Authentication Protocol-Request message (EAP-REQ), the authentication and authentication charging message including an extended authentication protocol-authentication and key agreement - Any one of a notification message (EAP-AKA'-Notification),
  • the token is first acquired, and then the token is encrypted, the integrity protection first message, the first message includes a second message and the token, and the second message includes the encrypted command Card, or integrity protection first message, the first message
  • the second message is included, the second message includes the encrypted token, and the first message is sent to the first device, so that the first device obtains the first message from the first message.
  • the second message effectively reduces the malicious application of the terminal and triggers WLCP to cause waste of resources on the network side.
  • the processor 1201 is specifically configured to: generate the token corresponding to the identifier of the terminal.
  • the terminal performs normal network access, and the EAP (Extensible Authentication Protocol) message exchanges between the terminal and the second device, so that the second device acquires the identifier of the terminal, and then the second device can generate the terminal with the terminal.
  • a corresponding token is identified, which is used to verify or identify the wireless local area network control protocol application (WLCP APP) of the terminal.
  • WLCP APP wireless local area network control protocol application
  • the second device may acquire the identifier of the terminal, re-generate a token corresponding to the identifier of the terminal, and update the token of the terminal, and the token generated each time may be different.
  • the communication network may be a third generation mobile communication cellular network or a fourth generation mobile communication cellular network.
  • the identifier of the terminal may be an IMSI (International Mobile Subscriber Identification Number), a MAC (Media Access Control) address, or an IP (Internet Protocol) address.
  • IMSI International Mobile Subscriber Identification Number
  • MAC Media Access Control
  • IP Internet Protocol
  • the processor 1201 is specifically configured to:
  • the token may be obtained by receiving a DIAMETER-extension authentication protocol-request-command message DIAMETER-EAP-REQ-Command or an authentication authorization charging message AAA sent by the first device, where the authentication authorization charging message includes extended authentication.
  • Protocol-response message EAP-RSP or extended authentication protocol-identity message EAP-Identity said The DIAMETER-Extended Authentication Protocol-Request-Command message includes the token, the Extended Authentication Protocol-Response message includes the token, and the Extended Authentication Protocol-identity message includes the token.
  • the token is used to verify or identify a valid WLAN control protocol application.
  • the embodiment of the present invention provides a second device 121.
  • the second device is an authentication and authorization accounting server AAA or a home subscriber server HSS, and the second device includes:
  • the processor 1211 is configured to obtain a UDP port number.
  • the processor 1211 is further configured to: encrypt the UDP port number.
  • the processor 1211 is further configured to: integrity protect the first message, the first message includes a second message and the UDP port number, and the second message includes the encrypted UDP port number,
  • the processor 1211 is further configured to: or, the integrity protection first message, the first message includes the second message, and the second message includes the encrypted UDP port number.
  • the transmitter 1212 is configured to send the first message to the first device, so that the first device obtains the second message from the first message.
  • the UDP port number is first obtained, and then the UDP port number is encrypted, the integrity protection first message, the first message includes a second message and the UDP port number, and the second message includes an encrypted message.
  • the processor 1211 is specifically configured to: generate the UDP port number corresponding to the identifier of the terminal.
  • the processor 1211 is specifically configured to:
  • the UDP port number is used to verify or identify a valid WLAN control protocol application.
  • the embodiment of the present invention provides a second device 122.
  • the second device is an authentication and authorization accounting server AAA or a home user server HSS, and the second device includes:
  • the processor 1221 is configured to obtain an authentication parameter, where the authentication parameter is a token or a User Datagram Protocol UDP port number.
  • the processor 1221 is further configured to encrypt the authentication parameter.
  • the processor 1221 is further configured to: integrity protect the second message, and generate a first message, where the first message includes the second message and the authentication parameter, and the second message includes the encrypted authentication parameter ;
  • the processor 1221 is further configured to: or perform integrity protection of the second message, and generate a first message, where the first message includes the second message, and the second message includes the encrypted authentication parameter;
  • the transmitter 1222 is configured to send the first message to the first device, so that the first device obtains the second message or the authentication parameter from the first message.
  • the processor 1221 is specifically configured to:
  • the details of the second device are as described in the embodiment of the present invention, and are not described here. The difference is that the token in the embodiment of the present invention can be replaced with a UDP port number.
  • the embodiment of the present invention provides a communication system 130, as shown in FIG. 20, including:
  • the second device 1303 is configured to acquire a token
  • the integrity protects the first message, the first message includes a second message and the token, and the second message includes the encrypted token,
  • the first message includes the second message
  • the second message includes the encrypted token
  • the first device 1301 is configured to receive a first message sent by the second device, where the first message includes a second message and a token, and the second message includes the encrypted token;
  • the terminal 1302 is configured to receive a second message sent by the first device, where the second message includes the encrypted token.
  • the first device 1301, the terminal 1302, and the second device 1303 can also generate a User Datagram Protocol (UDP) port number and a token corresponding to the identifier of the terminal.
  • UDP User Datagram Protocol
  • the embodiment of the present invention provides a communication system 131, as shown in FIG. 37, including:
  • the second device 1313 is configured to obtain an authentication parameter, where the authentication parameter is a token or a user datagram protocol UDP port number.
  • the integrity protection first message the first message includes a second message and the authentication parameter
  • the second message includes the encrypted authentication parameter
  • the integrity protection first message the first message including the second message
  • the second message includes the encrypted authentication parameter
  • the integrity protection second message and generating a first message
  • the first message includes the second message and the authentication parameter
  • the second message includes the encrypted authentication parameter
  • the integrity protection second message and generating a first message
  • the first message includes the second message
  • the second message includes the encrypted authentication parameter
  • the integrity protection second message and generating a first message, where the first message includes the second message and an authentication parameter;
  • the first device 1311 is configured to receive a first message sent by the second device, where the first message includes a second message and an authentication parameter, where the authentication parameter is a token or a user datagram protocol UDP port number, The second message includes the encrypted authentication parameter;
  • the second device Or receiving a first message sent by the second device, where the first message includes the second message, the second message includes the encrypted authentication parameter, and the authentication parameter is a token or a user datagram protocol UDP The port number;
  • the terminal 1312 is configured to receive a second message sent by the first device, where the second message includes an encrypted authentication parameter, where the authentication parameter is a token or a user datagram protocol UDP port number;
  • an authentication parameter corresponding to the identifier of the terminal is generated.
  • packet data network connection establishment request message described in the present invention may be represented by a WLCP PDN connection request or a PDN connectivity request
  • packet data network connection establishment response message may be represented by a WLCP PDN connection response or a PDN connectivity response
  • the packet data network connection disconnection request message may be represented by a WLCP PDN disconnection request, and the packet data network connection disconnection response message may be represented by a WLCP PDN disconnection response;
  • the packet data network connection release request message may be represented by a WLCP PDN connection release request or a PDN connection release request
  • the packet data network connection release response message may be represented by a WLCP PDN connection release response or a PDN connection release response.
  • the first device checks that the packet data network connection request message does not include the token, the first device considers that the packet data network connection request message is an illegal packet data network connection request message, and the first device discards or does not process
  • the packet data network connection request message may further send a packet data network connection establishment rejection message, a packet data network connection disconnection rejection message or a packet data network connection release rejection message to the terminal, where the packet data network connection establishment rejection message may be used.
  • PDN CONNECTIVITY REJECT indicates that the packet data network connection disconnection rejection message can be represented by PDN DISCONNECTIVITY REJECT.
  • the first device in the present invention may include a TWAP (Trusted WLAN AAA Proxy) and a trusted WLAN access gateway TWAG.
  • TWAP Trusted WLAN AAA Proxy
  • TWAG trusted WLAN access gateway
  • the disclosed apparatus and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • Another point, the mutual coupling or direct coupling or communication connection shown or discussed The connection may be an indirect coupling or communication connection through some interface, device or unit, and may be in electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
  • the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed.
  • the foregoing steps include the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明的实施例提供一种终端接入通信网络的方法、装置及通信系统，涉及通信领域，能够有效降低终端的恶意应用触发WLCP造成网络侧的资源浪费。接收第二设备发送的第一消息，第一消息包括第二消息和认证参数，所述认证参数为令牌或用户数据报协议UDP端口号，第二消息包括加密的认证参数，或者，第一消息包括第二消息，第二消息包括加密的认证参数，或者，第一消息包括第二消息和认证参数；向终端发送第二消息。本发明实施例提供的终端接入通信网络的方法、装置及通信系统用于终端接入通信网络。

Description

一种终端接入通信网络的方法、装置及通信系统
本申请要求于2014年04月30日提交中国专利局、申请号为PCT/CN2014/076661、发明名称为“一种终端接入通信网络的方法、装置及通信系统”的PCT专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信领域，尤其涉及一种终端接入通信网络的方法、装置及通信系统。
背景技术
EPC(Evolved Packet Core，演进分组核心)是第四代移动通信网LTE(Long Term Evolution，长期演进)的核心网，包括PGW(Packet Data Network Gateway，分组数据网网关)、AAA(Authentication Authorization Accounting server，认证授权计费服务器)和HSS(Home Subscriber Server，归属用户服务器)。PGW用于承载终端接入通信网络的建立过程中为用户设备分配IP地址，同时作为用户面移动的锚点。AAA用于管理访问LTE网的终端，提供认证授权和账户服务。HSS是用户数据库，用于存储用户相关信息，所述相关信息可以是对用户认证和授权以及提供用户位置IP地址等相关信息。
随着802.1X、802.11u和Hotspot2.0的部署，3GPP(the 3rd Generation Partnership Project，第三代合作伙伴计划)运营商允许UE(User Equipment，用户设备)通过TWAN(Trusted WLAN Access Network，可信WLAN接入网络)使用S2a接口接入EPC网络，所述WLAN为WLAN(Wireless Local Area Networks，无线局域网)，所述TWAN包括TWAG(Trusted WLAN access gateway，可信WLAN 接入网关)，在UE和TWAG之间定义了一个新的控制面协议WLCP(WLAN Control Protocol，WLAN控制协议)，用于提供控制面管理功能，WLCP可以有两种传输方式，UDP(User Datagram Protocol，用户数据报协议)/IP(Internet Protocol，互连网协议)传输，或以太网络帧(Ethernet frame)传输。目前标准上选定了UDP/IP作为WLCP的传输方式。
现有技术中，如果使用APP(Application，应用)去实现WLCP，终端可以预先安装WLCP APP(WLAN Control Protocol application，WLAN控制协议应用)，当终端通过TWAN接入EPC时，运行WLCP APP调用UDP(User Datagram Protocol，用户数据报协议)端口向TWAG发起建立或释放PDN连接流程。所述WLCP APP可以是运营商预先安装在终端上的，并且该WLCP APP获得运营商授权，且WLCP APP需要有和OS(Operating System，操作系统)的私有API(Application Programming Interface，应用程序编程接口)，或者终端定制私有API，以实现其它APP无法得到WLCP APP的参数信息。OS被攻破而私有API被调用的情况不在本发明讨论范围之内。
当终端有恶意应用时，恶意的应用可能会不停地调用WLCP使用的UDP端口向TWAG发起PDN建立连接请求消息来触发WLCP，这会造成网络侧的资源浪费，导致TWAG无法处理合法的WLCP APP发起的请求；或者恶意应用不停地发起连接释放请求消息，恶意断掉终端的PDN连接。
发明内容
本发明的实施例提供一种终端接入通信网络的方法、装置及通信系统，能够有效降低终端的恶意应用触发WLCP造成网络侧的资源浪费。
为达到上述目的，本发明的实施例采用如下技术方案：
第一方面，提供一种终端接入通信网络的方法，应用于第一设备，所述第一设备为可信无线局域网接入网关TWAG，或者，所述第一设备包括TWAG和可信无线局域网认证授权计费服务代理TWAP，所述方法包括：
接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数，所述认证参数为令牌或用户数据报协议UDP端口号，所述第二消息包括加密的所述认证参数；
或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
或者，接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数；
向所述终端发送所述第二消息。
结合第一方面，在第一种可实现方式中，在所述向所述终端发送所述第二消息之后，所述方法还包括：
接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述认证参数，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
结合第一种可实现方式，在第二种可实现方式中，在所述接收所述终端发送的分组数据网连接请求消息之后，所述方法还包括：
验证所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数是否与本地存储的与所述终端的标识对应的认证参数相同；
若所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数与本地存储的与所述终端的标识对应的认证参数相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响 应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
结合第一种可实现方式，在第三种可实现方式中，在所述接收所述终端发送的分组数据网连接请求消息之后，所述方法还包括：
检查所述分组数据网连接请求消息中是否包含所述认证参数；
若所述分组数据网连接请求消息中包含所述认证参数，验证所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数是否与本地存储的与所述终端的标识对应的认证参数相同；
若所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数与本地存储的与所述终端的标识对应的认证参数相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
结合第一方面、第一种可实现方式至第三种可实现中任意一种，在第四种可实现方式中，当所述第一消息包括第二消息和认证参数，所述第二消息包括加密的所述认证参数时，在所述接收第二设备发送的第一消息之后，所述方法还包括：
从所述第一消息中读取与所述终端的标识对应的所述认证参数和所述终端的标识；
存储与所述终端的标识对应的所述认证参数和所述终端的标识。
结合第一方面、第一种可实现方式至第三种可实现中任意一种，在第五种可实现方式中，当所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数时，在所述接收第二设备发送的第一消息之前，所述方法还包括：
生成与所述终端的标识对应的所述认证参数；
存储与所述终端的标识对应的所述认证参数和所述终端的标 识；
向所述第二设备发送所述认证参数。
结合第一方面、第一种可实现方式至第三种可实现中任意一种，在第六种可实现方式中，当所述第一消息包括第二消息和认证参数时，在所述接收第二设备发送的第一消息之前，所述方法还包括：
接收所述终端发送的第三消息，所述第三消息包括加密的所述认证参数；
向所述第二设备发送所述第一消息，所述第一消息包括所述第三消息。
结合第一方面、第一种可实现方式至第六种可实现中任意一种，在第七种可实现方式中，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
结合第一方面、第一种可实现方式至第七种可实现中任意一种，在第八种可实现方式中，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
结合第一方面、第一种可实现方式至第八种可实现中任意一种，在第九种可实现方式中，所述第一消息为DIAMETER协议所承载的消息。
结合第一方面、第一种可实现方式至第九种可实现中任意一种，在第十种可实现方式中，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
第二方面，提供一种终端接入通信网络的方法，应用于终端， 所述方法包括：
接收第一设备发送的第二消息，所述第二消息包括加密的所述认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
或者，生成与所述终端的标识对应的认证参数。
结合第二方面，在第一种可实现方式中，在所述生成与所述终端的标识对应的用户数据报协议UDP端口号之后，所述方法还包括：
加密所述认证参数；
向所述第一设备发送第三消息，所述第三消息包括加密的所述认证参数。
结合第一种可实现方式中，在第二种可实现方式中，在所述接收第一设备发送的第二消息之后，所述方法还包括：
向所述第一设备发送分组数据网连接请求消息，所述分组数据网连接请求消息包括所述认证参数，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
结合第二种可实现方式，在第三种可实现方式中，在所述向所述第一设备发送分组数据网连接请求消息之后，所述方法还包括：
接收所述第一设备发送的分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
结合第二方面、第一种可实现方式至第三种可实现中任意一种，在第四种可实现方式中，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
结合第二方面、第一种可实现方式至第四种可实现中任意一种，在第五种可实现方式中，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议- 认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
结合第二方面、第一种可实现方式至第五种可实现中任意一种，在第六种可实现方式中，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
第三方面，提供一种终端接入通信网络的方法，应用于第二设备，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，所述方法包括：
获取认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
加密所述认证参数；
完整性保护第一消息，所述第一消息包括第二消息和所述认证参数，所述第二消息包括加密的所述认证参数，
或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和所述认证参数，所述第二消息包括加密的所述认证参数；
或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和认证参数；
向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息或所述认证参数。
结合第三方面，在第一种可实现方式中，所述获取认证参数包括：
生成与所述终端的标识对应的所述认证参数。
结合第三方面，在第二种可实现方式中，所述获取认证参数包括：
接收所述第一设备发送的所述认证参数；
或者，接收所述第一设备发送的第一消息，所述第一消息包括第三消息，所述第三消息包括加密的所述认证参数，并对所述加密的所述认证参数进行解密操作。
结合第三方面、第一种可实现方式至第二种可实现中任意一种，在第三种可实现方式中，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
结合第三方面、第一种可实现方式至第三种可实现中任意一种，在第四种可实现方式中，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
结合第三方面、第一种可实现方式至第四种可实现中任意一种，在第五种可实现方式中，所述第一消息为DIAMETER协议所承载的消息。
结合第三方面、第一种可实现方式至第五种可实现中任意一种，在第六种可实现方式中，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
第四方面，提供一种第一设备，所述第一设备为可信无线局域网接入网关TWAG，或者，所述第一设备包括TWAG和可信无线局域网认证授权计费服务代理TWAP，所述第一设备包括：
第一接收单元，用于接收第二设备发送的第一消息，所述第一 消息包括第二消息和认证参数，所述认证参数为令牌或用户数据报协议UDP端口号，所述第二消息包括加密的所述认证参数；
所述第一接收单元还用于或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
或者，所述第一接收单元还用于接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数；
第一发送单元，用于向所述终端发送所述第二消息。
结合第四方面，在第一种可实现方式中，所述第一设备还包括：
第二接收单元，用于接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述认证参数，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
结合第一种可实现方式，在第二种可实现方式中，所述第一设备还包括：
第一验证单元，用于验证所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数是否与本地存储的与所述终端的标识对应的认证参数相同；
第二发送单元，用于若所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数与本地存储的与所述终端的标识对应的认证参数相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
结合第一种可实现方式，在第三种可实现方式中，所述第一设备还包括：
检查单元，用于检查所述分组数据网连接请求消息中是否包含 所述认证参数；
第二验证单元，用于若所述分组数据网连接请求消息中包含所述认证参数，验证所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数是否与本地存储的与所述终端的标识对应的认证参数相同；
第三发送单元，用于若所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数与本地存储的与所述终端的标识对应的认证参数相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
结合第四方面、第一种可实现方式至第三种可实现中任意一种，在第四种可实现方式中，当所述第一消息包括第二消息和认证参数，所述第二消息包括加密的所述认证参数时，所述第一设备还包括：
读取单元，用于从所述第一消息中读取与所述终端的标识对应的所述认证参数和所述终端的标识；
第一存储单元，用于存储与所述终端的标识对应的所述认证参数和所述终端的标识。
结合第四方面、第一种可实现方式至第三种可实现中任意一种，在第五种可实现方式中，当所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数时，所述第一设备还包括：
生成单元，用于生成与所述终端的标识对应的所述认证参数；
第二存储单元，用于存储与所述终端的标识对应的所述认证参数和所述终端的标识；
第四发送单元，用于向所述第二设备发送所述认证参数。
结合第四方面、第一种可实现方式至第三种可实现中任意一种，在第六种可实现方式中，当所述第一消息包括第二消息和认证 参数时，所述第一设备还包括：
第三接收单元，用于接收所述终端发送的第三消息，所述第三消息包括加密的所述认证参数；
第五发送单元，用于向所述第二设备发送所述第一消息，所述第一消息包括所述第三消息。
结合第四方面、第一种可实现方式至第六种可实现中任意一种，在第七种可实现方式中，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
结合第四方面、第一种可实现方式至第七种可实现中任意一种，在第八种可实现方式中，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
结合第四方面、第一种可实现方式至第八种可实现中任意一种，在第九种可实现方式中，所述第一消息为DIAMETER协议所承载的消息。
结合第四方面、第一种可实现方式至第九种可实现中任意一种，在第十种可实现方式中所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
第五方面，提供一种终端，所述终端包括：
第一接收单元，用于接收第一设备发送的第二消息，所述第二消息包括加密的所述认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
或者，生成单元，用于生成与所述终端的标识对应的认证参数。
结合第五方面，在第一种可实现方式中，所述终端还包括：
加密单元，用于加密所述认证参数；
发送单元，用于向所述第一设备发送第三消息，所述第三消息包括加密的所述认证参数。
结合第一种可实现方式中，在第二种可实现方式中，所述终端还包括：
所述发送单元还用于向所述第一设备发送分组数据网连接请求消息，所述分组数据网连接请求消息包括所述认证参数，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
结合第二种可实现方式，在第三种可实现方式中，所述终端还包括：
第二接收单元，用于接收所述第一设备发送的分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
结合第五方面、第一种可实现方式至第三种可实现中任意一种，在第四种可实现方式中，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
结合第五方面、第一种可实现方式至第四种可实现中任意一种，在第五种可实现方式中，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
结合第五方面、第一种可实现方式至第五种可实现中任意一种，在第六种可实现方式中，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议- 认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
第六方面，提供一种第二设备，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，所述第二设备包括：
获取单元，用于获取认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
加密单元，用于加密所述认证参数；
完整性保护单元，用于完整性保护第一消息，所述第一消息包括第二消息和所述认证参数，所述第二消息包括加密的所述认证参数，
所述完整性保护单元还用于或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
或者，所述完整性保护单元还用于完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和所述认证参数，所述第二消息包括加密的所述认证参数；
或者，所述完整性保护单元还用于完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
或者，所述完整性保护单元还用于完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和认证参数；
发送单元，用于向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息或所述认证参数。
结合第六方面，在第一种可实现方式中，所述获取单元具体用于：
生成与所述终端的标识对应的所述认证参数。
结合第六方面，在第二种可实现方式中，所述获取单元具体用于：
接收所述第一设备发送的所述认证参数；
或者，接收所述第一设备发送的第一消息，所述第一消息包括第三消息，所述第三消息包括加密的所述认证参数，并对所述加密的所述认证参数进行解密操作。
结合第六方面、第一种可实现方式至第二种可实现中任意一种，在第三种可实现方式中，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
结合第六方面、第一种可实现方式至第三种可实现中任意一种，在第四种可实现方式中，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
结合第六方面、第一种可实现方式至第四种可实现中任意一种，在第五种可实现方式中，所述第一消息为DIAMETER协议所承载的消息。
结合第六方面、第一种可实现方式至第五种可实现中任意一种，在第六种可实现方式中，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
第七方面，提供一种通信系统，包括：
如以上任意所述的第一设备、如以上任意所述的终端和如以上任意所述的第二设备，其中，
所述第二设备，用于获取认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
加密所述认证参数；
完整性保护第一消息，所述第一消息包括第二消息和所述认证 参数，所述第二消息包括加密的所述认证参数，
或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和所述认证参数，所述第二消息包括加密的所述认证参数；
或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和认证参数；
向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息或所述认证参数；
所述第一设备，用于接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数，所述认证参数为令牌或用户数据报协议UDP端口号，所述第二消息包括加密的所述认证参数；
或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
或者，接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数；
向所述终端发送所述第二消息；
所述终端，用于接收第一设备发送的第二消息，所述第二消息包括加密的认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
或者，生成与所述终端的标识对应的认证参数。
第八方面，提供一种第一设备，所述第一设备为可信无线局域网接入网关TWAG，或者，所述第一设备包括TWAG和可信无线局域网认证授权计费服务代理TWAP，所述第一设备包括：
接收机，用于接收第二设备发送的第一消息，所述第一消息包 括第二消息和认证参数，所述认证参数为令牌或用户数据报协议UDP端口号，所述第二消息包括加密的所述认证参数；
所述接收机还用于或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
或者，所述接收机还用于接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数；
发射机，用于向所述终端发送所述第二消息。
结合第八方面，在第一种可实现方式中，所述第一设备还包括：
所述接收机还用于：
接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述认证参数，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
结合第一种可实现方式，在第二种可实现方式中，所述第一设备还包括：
处理器，用于验证所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数是否与本地存储的与所述终端的标识对应的认证参数相同；
所述发射机还用于：
若所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数与本地存储的与所述终端的标识对应的认证参数相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
结合第一种可实现方式，在第三种可实现方式中，
所述处理器还用于：
检查所述分组数据网连接请求消息中是否包含所述认证参数；
所述处理器还用于：
若所述分组数据网连接请求消息中包含所述认证参数，验证所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数是否与本地存储的与所述终端的标识对应的认证参数相同；
所述发射机还用于：
若所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数与本地存储的与所述终端的标识对应的认证参数相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
结合第八方面、第一种可实现方式至第三种可实现中任意一种，在第四种可实现方式中，当所述第一消息包括第二消息和认证参数，所述第二消息包括加密的所述认证参数时，
所述处理器还用于：从所述第一消息中读取与所述终端的标识对应的所述认证参数和所述终端的标识；
所述处理器还用于：存储与所述终端的标识对应的所述认证参数和所述终端的标识。
结合第八方面、第一种可实现方式至第三种可实现中任意一种，在第五种可实现方式中，当所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数时，
所述处理器还用于：生成与所述终端的标识对应的所述认证参数；
所述处理器还用于：存储与所述终端的标识对应的所述认证参数和所述终端的标识；
所述发射机还用于：向所述第二设备发送所述认证参数。
结合第八方面、第一种可实现方式至第三种可实现中任意一种，在第六种可实现方式中，当所述第一消息包括第二消息和认证参数时，
所述接收机还用于接收所述终端发送的第三消息，所述第三消息包括加密的所述认证参数；
所述发射机还用于向所述第二设备发送所述第一消息，所述第一消息包括所述第三消息。
结合第八方面、第一种可实现方式至第六种可实现中任意一种，在第七种可实现方式中，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
结合第八方面、第一种可实现方式至第七种可实现中任意一种，在第八种可实现方式中，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
结合第八方面、第一种可实现方式至第八种可实现中任意一种，在第九种可实现方式中，所述第一消息为DIAMETER协议所承载的消息。
结合第八方面、第一种可实现方式至第九种可实现中任意一种，在第十种可实现方式中，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
第九方面，提供一种终端，所述终端包括：
接收机，用于接收第一设备发送的第二消息，所述第二消息包括加密的认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
或者，处理器，用于生成与所述终端的标识对应的认证参数，所述认证参数为令牌或用户数据报协议UDP端口号。
结合第九方面，在第一种可实现方式中，
所述处理器还用于加密所述认证参数；
所述终端还包括：
发射机，用于向所述第一设备发送第三消息，所述第三消息包括加密的所述认证参数。
结合第一种可实现方式中，在第二种可实现方式中，所述终端还包括：
发射机，用于向所述第一设备发送分组数据网连接请求消息，所述分组数据网连接请求消息包括所述认证参数，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
结合第二种可实现方式，在第三种可实现方式中，
所述接收机还用于：
接收所述第一设备发送的分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
结合第九方面、第一种可实现方式至第三种可实现中任意一种，在第四种可实现方式中，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
结合第九方面、第一种可实现方式至第四种可实现中任意一种，在第五种可实现方式中，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
结合第九方面、第一种可实现方式至第五种可实现中任意一 种，在第六种可实现方式中，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
第十方面，提供一种第二设备，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，所述第二设备包括：
处理器，用于获取认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
所述处理器还用于：加密所述认证参数；
所述处理器还用于：完整性保护第一消息，所述第一消息包括第二消息和所述认证参数，所述第二消息包括加密的所述认证参数，
所述处理器还用于：或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
或者，所述处理器还用于完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和所述认证参数，所述第二消息包括加密的所述认证参数；
或者，所述处理器还用于完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
或者，所述处理器还用于完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和认证参数；
发射机，用于向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息或所述认证参数。
结合第十方面，在第一种可实现方式中，所述处理器具体用于：
生成与所述终端的标识对应的所述认证参数。
结合第十方面，在第二种可实现方式中，所述处理器具体用 于：
接收所述第一设备发送的所述认证参数；
或者，接收所述第一设备发送的第一消息，所述第一消息包括第三消息，所述第三消息包括加密的所述认证参数，并对所述加密的所述认证参数进行解密操作。
结合第四方面、第一种可实现方式至第二种可实现中任意一种，在第三种可实现方式中，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
结合第十方面、第一种可实现方式至第三种可实现中任意一种，在第四种可实现方式中，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
结合第十方面、第一种可实现方式至第四种可实现中任意一种，在第五种可实现方式中，所述第一消息为DIAMETER协议所承载的消息。
结合第十方面、第一种可实现方式至第五种可实现中任意一种，在第六种可实现方式中，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
第十一方面，提供一种通信系统，包括：
如以上任意所述的第一设备、如以上任意所述的终端和如以上任意所述的第二设备，其中，
所述第二设备，用于获取认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
加密所述认证参数；
完整性保护第一消息，所述第一消息包括第二消息和所述认证参数，所述第二消息包括加密的所述认证参数，
或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和所述认证参数，所述第二消息包括加密的所述认证参数；
或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和认证参数；
向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息或所述认证参数；
所述第一设备，用于接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数，所述认证参数为令牌或用户数据报协议UDP端口号，所述第二消息包括加密的所述认证参数；
或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
或者，接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数；
向所述终端发送所述第二消息；
所述终端，用于接收第一设备发送的第二消息，所述第二消息包括加密的认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
或者，生成与所述终端的标识对应的认证参数。
本发明的实施例提供一种终端接入通信网络的方法、装置及通信系统。通过第一设备接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数，所述认证参数为令牌或用户数据报协 议UDP端口号，或者，所述第一消息包括第二消息，其中，所述第二消息包括加密的所述认证参数；或者，所述第一消息包括所述第二消息和认证参数；再向终端发送所述第二消息。相对于现有技术，终端向第一设备发送携带认证参数的分组数据网连接请求消息，使得第一设备可以分辨分组数据网连接请求消息是无线局域网控制协议应用的消息，还是恶意应用的分组数据网连接请求消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供一种终端接入通信网络的方法流程图1；
图1a为本发明实施例提供一种终端接入通信网络的方法流程图2；
图1b为本发明实施例提供一种终端接入通信网络的方法流程图3；
图2为本发明实施例提供一种终端接入通信网络的方法流程图4；
图2a为本发明实施例提供一种终端接入通信网络的方法流程图5；
图2b为本发明实施例提供一种终端接入通信网络的方法流程图6；
图3为本发明实施例提供一种终端接入通信网络的方法流程图7；
图3a为本发明实施例提供一种终端接入通信网络的方法流程图8；
图3b为本发明实施例提供一种终端接入通信网络的方法流程图9；
图3c为本发明实施例提供一种终端接入通信网络的方法流程图10；
图4为本发明实施例提供一种终端接入通信网络的方法流程图11；
图4a为本发明实施例提供一种终端接入通信网络的方法流程图12；
图5为本发明实施例提供一种终端接入通信网络的方法流程图13；
图5a为本发明实施例提供一种终端接入通信网络的方法流程图14；
图6为本发明实施例提供一种第一设备结构示意图1；
图7为本发明实施例提供一种第一设备结构示意图2；
图8为本发明实施例提供一种第一设备结构示意图3；
图9为本发明实施例提供一种第一设备结构示意图4；
图10为本发明实施例提供一种第一设备结构示意图5；
图11为本发明实施例提供一种终端结构示意图1；
图12为本发明实施例提供一种终端结构示意图2；
图13为本发明实施例提供一种第二设备结构示意图1；
图14为本发明实施例提供一种通信系统示意图1；
图15为本发明实施例提供一种第一设备结构示意图6；
图16为本发明实施例提供一种第一设备结构示意图7；
图17为本发明实施例提供一种终端结构示意图3；
图18为本发明实施例提供一种终端结构示意图4；
图19为本发明实施例提供一种第二设备结构示意图2；
图20为本发明实施例提供一种通信系统示意图2；
图21为本发明实施例提供一种终端接入通信网络的方法流程图15；
图21a为本发明实施例提供一种终端接入通信网络的方法流程图16；
图22为本发明实施例提供一种第一设备结构示意图8；
图23为本发明实施例提供一种第一设备结构示意图9；
图24为本发明实施例提供一种第一设备结构示意图10；
图25为本发明实施例提供一种第一设备结构示意图11；
图26为本发明实施例提供一种第一设备结构示意图12；
图27为本发明实施例提供一种第一设备结构示意图13；
图28为本发明实施例提供一种终端结构示意图5；
图29为本发明实施例提供一种终端结构示意图6；
图30为本发明实施例提供一种第二设备结构示意图3；
图31为本发明实施例提供一种第二设备结构示意图4；
图32为本发明实施例提供一种第一设备结构示意图14；
图33为本发明实施例提供一种终端结构示意图7；
图34为本发明实施例提供一种终端结构示意图8；
图35为本发明实施例提供一种第二设备结构示意图5；
图36为本发明实施例提供一种第二设备结构示意图6；
图37为本发明实施例提供一种通信系统示意图3。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他 实施例，都属于本发明保护的范围。
本发明所述的第一设备为可信无线局域网接入网关TWAG，所述第一设备还可以包括TWAG和可信无线局域网认证授权计费服务代理TWAP。
本发明实施例提供一种终端接入通信网络的方法，应用于第一设备，所述第一设备为可信无线局域网接入网关TWAG，或者，所述第一设备包括TWAG和可信无线局域网认证授权计费服务代理TWAP，如图1所示，所述方法包括：
步骤101a、接收第二设备发送的第一消息，所述第一消息包括第二消息和令牌，所述第二消息包括加密的所述令牌。
可选的，在接收第二设备发送的第一消息之后，可以从所述第一消息中读取与所述终端的标识对应的所述令牌和所述终端的标识，存储与所述终端的标识对应的所述令牌和所述终端的标识。
可选的，在接收第二设备发送的第一消息之前，可以生成与所述终端的标识对应的所述令牌，然后，存储与所述终端的标识对应的所述令牌和所述终端的标识，再向所述第二设备发送所述令牌。还可以向所述第二设备发送DIAMETER-EAP-REQ-Command(DIAMETER-Extensible Authentication Protocol-Request -Command，DIAMETER-扩展认证协议-请求-命令)消息或AAA(Authentication Authorization Accounting，认证授权计费)消息，所述认证授权计费消息包括EAP-RSP(Extensible Authentication Protocol-Response，扩展认证协议-响应)消息或扩展认证协议-身份消息(EAP-Identity)，所述DIAMETER-扩展认证协议-请求-命令消息包括所述令牌，所述扩展认证协议-响应消息包括所述令牌，所述扩展认证协议-身份消息包括所述令牌。
步骤101b、或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌。
步骤102、向所述终端发送所述第二消息。
在向所述终端发送所述第二消息之后，可以接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述令牌，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息，然后，验证所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌是否与本地存储的与所述终端的标识对应的令牌相同；若所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌与本地存储的与所述终端的标识对应的令牌相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息，以便于所述终端与所述第一设备建立连接，接入分组数据网，或者所述终端与所述第一设备释放连接。需要说明的是，在验证所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌是否与本地存储的与所述终端的标识对应的令牌相同之前，还可以检查所述分组数据网连接请求消息中是否包含所述令牌。
这样一来，首先接收第二设备发送的第一消息，所述第一消息包括第二消息和令牌，所述第二消息包括加密的所述令牌，或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌，然后，向所述终端发送所述第二消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例提供一种终端接入通信网络的方法，应用于第一设备，所述第一设备为可信无线局域网接入网关TWAG，或者，所述第一设备包括TWAG和可信无线局域网认证授权计费服务代理TWAP，如图1a所示，所述方法包括：
步骤103a、接收第二设备发送的第一消息，所述第一消息包括第二消息和用户数据报协议UDP端口号，所述第二消息包括加密的所述UDP端口号。
步骤103b、或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述UDP端口号。
步骤104、向所述终端发送所述第二消息。
这样一来，第一设备接收第二设备发送的第一消息，所述第一消息包括第二消息和UDP端口号，所述第二消息包括加密的所述UDP端口号，然后，向终端发送所述第二消息，以便于终端的WLCP应用获取UDP端口号，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例提供一种终端接入通信网络的方法，应用于第一设备，所述第一设备为可信无线局域网接入网关TWAG，或者，所述第一设备包括TWAG和可信无线局域网认证授权计费服务代理TWAP，如图1b所示，所述方法包括：
步骤105、接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数，所述认证参数为令牌或用户数据报协议UDP端口号。
步骤106、向所述终端发送所述第二消息。
这样一来，第一设备接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数，所述认证参数由终端生成，以便于终端的WLCP应用获取UDP端口号或令牌，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例提供一种终端接入通信网络的方法，应用于终端，如图2所示，所述方法包括：
步骤201、接收第一设备发送的第二消息，所述第二消息包括加密的所述令牌。
在接收第一设备发送的第二消息之后，可以向所述第一设备发送分组数据网连接请求消息，所述分组数据网连接请求消息包括所述令牌，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息，然后，接收所述第一设备发送的分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息，与所述第一设备建立连接，接入分组数据网，或者与所述第一设备释放连接。
这样一来，接收第一设备发送的第二消息，所述第二消息包括加密的所述令牌，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例提供一种终端接入通信网络的方法，应用于终端，如图2a所示，所述方法包括：
步骤202、接收第一设备发送的第二消息，所述第二消息包括加密的用户数据报协议UDP端口号。
这样一来，终端可以从接收到的第一设备发送的第二消息中获取UDP端口号，以便于终端的WLCP应用获取UDP端口号，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例提供一种终端接入通信网络的方法，应用于终端，如图2b所示，所述方法包括：
步骤203、生成与所述终端的标识对应的认证参数，所述认证参数为令牌或用户数据报协议UDP端口号。
这样一来，终端可以生成与所述终端的标识对应的UDP端口号或者令牌，以便于终端的WLCP应用获取UDP端口号，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例提供一种终端接入通信网络的方法，应用于第二 设备，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，如图3所示，所述方法包括：
步骤301、获取令牌。
可以先根据所述终端的标识生成所述令牌，然后，从本地获取所述令牌；或者，接收所述第一设备发送的令牌，可以接收所述第一设备发送的DIAMETER-扩展认证协议-请求-命令消息DIAMETER-EAP-REQ-Command或认证授权计费消息AAA中获取所述令牌，所述认证授权计费消息包括扩展认证协议-响应消息EAP-RSP或扩展认证协议-身份消息EAP-Identity，所述DIAMETER-扩展认证协议-请求-命令消息包括所述令牌，所述扩展认证协议-响应消息包括所述令牌，所述扩展认证协议-身份消息包括所述令牌。
步骤302、加密所述令牌。
步骤303a、完整性保护第一消息，所述第一消息包括第二消息和所述令牌，所述第二消息包括加密的所述令牌。
步骤303b、或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌。
步骤304、向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息。
这样一来，首先获取令牌，然后，加密所述令牌，完整性保护第一消息，所述第一消息包括第二消息和所述令牌，所述第二消息包括加密的所述令牌，或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌，再向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例提供一种终端接入通信网络的方法，应用于第二 设备，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，如图3a所示，所述方法包括：
步骤305、获取用户数据报协议UDP端口号。
步骤306、加密所述UDP端口号。
步骤307a、完整性保护第一消息，所述第一消息包括第二消息和所述UDP端口号，所述第二消息包括加密的所述UDP端口号。
步骤307b、或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述UDP端口号。
步骤308、向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息。
这样一来，第一设备将获取到的UDP端口号进行加密，并完整性保护第一消息，向第一设备发送所述第一消息，以便于第一设备将携带有UDP端口号的第二消息发送至终端，以便于终端的WLCP应用获取UDP端口号，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例提供一种终端接入通信网络的方法，应用于第二设备，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，如图3b所示，所述方法包括：
步骤309、获取认证参数，所述认证参数为令牌或用户数据报协议UDP端口号。
步骤3010、加密所述认证参数。
步骤3011a、完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和所述认证参数，所述第二消息包括加密的所述认证参数。
步骤3011b、完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参 数。
步骤3012、向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息。
这样一来，第一设备将获取到的UDP端口号进行加密，并完整性保护第二消息，生成第一消息，向第一设备发送所述第一消息，以便于第一设备将携带有UDP端口号的第二消息发送至终端，以便于终端的WLCP应用获取认证参数，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例提供一种终端接入通信网络的方法，应用于第二设备，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，如图3c所示，所述方法包括：
步骤3013、获取认证参数，所述认证参数为令牌或用户数据报协议UDP端口号。
步骤3014、加密所述认证参数。
步骤3015、完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和认证参数。
步骤3016、向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息。
这样一来，第二设备获取认证参数，并对认证参数加密，生成第一消息，向第一设备发送所述第一消息，以便于终端的WLCP应用获取UDP端口号或令牌，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例提供一种终端接入通信网络的方法，应用于终端、第一设备和第二设备，假设第一设备为可信无线局域网接入网关TWAG，或者，所述第一设备包括TWAG和可信无线局域网认证授权计费服务代理TWAP，假设第二设备为认证授权计费服务器(AAA)或归属用户服务器(HSS)，如图4所示，包括：
步骤401、第一设备生成与终端的标识对应的令牌。
首先，终端进行正常的入网附着，该终端与第二设备之间进行EAP(Extensible Authentication Protocol，扩展认证协议)消息交互，使得第一设备可以从第二设备获取终端的标识，然后，第一设备可以生成与终端的标识对应的令牌(Token)，所述令牌用于验证或标识所述终端的无线局域网控制协议应用(WLCP APP)。
特别的，每当终端需要接入通信网络时，第一设备可以从第二设备获取终端的标识，重新生成与终端的标识对应的令牌，更新该终端的令牌，每次生成的令牌可以不同，所述通信网络可以是第三代移动通信蜂窝网络或第四代移动通信蜂窝网络。
需要说明的是，终端的标识可以是IMSI(International Mobile Subscriber Identification Number，国际移动用户识别码)、MAC(Media Access Control，媒体介入控制层)地址或IP(Internet Protocol，互连网协议)地址。令牌可以由运营商定义生成，且需要保证生成的令牌的唯一性，具体生成令牌的方式为现有技术，本发明实施例在此不再赘述。
步骤402、第一设备存储与终端的标识对应的所述令牌和所述终端的标识。
步骤403、第一设备向第二设备发送令牌。
第一设备向第二设备发送DIAMETER-扩展认证协议-请求-命令消息，DIAMETER-扩展认证协议-请求-命令消息承载扩展认证协议载荷(EAP-payload)，扩展认证协议载荷包括第一设备根据所述终端的标识生成的令牌。
第一设备还可以向第二设备发送认证授权计费消息，所述认证授权计费消息包括扩展认证协议-响应消息(EAP-RSP)或扩展认证协议-身份消息(EAP-Identity)，所述扩展认证协议-响应消息包括所述令牌，所述扩展认证协议-身份消息包括所述令牌。
步骤404、第二设备加密令牌，并完整性保护第一消息。
第二设备接收到第一设备发送的令牌。第二设备还可以接收到第一设备发送的DIAMETER-扩展认证协议-请求-命令消息或认证授权计费消息，所述DIAMETER-扩展认证协议-请求-命令消息包括第一设备根据所述终端标识生成的令牌，所述认证授权计费消息包括扩展认证协议-响应消息(EAP-RSP)或扩展认证协议-身份消息(EAP-Identity)，所述扩展认证协议-响应消息包括所述令牌，所述扩展认证协议-身份消息包括所述令牌。所述令牌用于验证或标识所述终端的无线局域网控制协议应用，首先，解析所述扩展认证协议消息，得到令牌，然后，第二设备可以生成密钥，对该令牌加密，以防止其他非法用户监听看到所述令牌，所述密钥可以是TEK(Transient EAP Keys，临时EAP密钥)。
需要说明的是，第二设备可以通过使用AES(advanced Encryption standard，高级加密标准)和一个128bit的密钥在CBC(Cipher Block Chaining，加密块链接)模式下对token进行加密。
第二设备对所述令牌进行加密之后，生成第二消息，所述第二消息包括加密的所述令牌，将该第二消息封装，生成第一消息，且对该第一消息进行完整性保护，以防止其他非法用户监听修改所述第一消息，所述第一消息包括第二消息。
需说明的是，第二设备可以根据MAC(message authentication code，消息认证码)算法HMAC-SHA1-128和认证密钥以及第一消息生成消息认证码。所述第二消息为EAP-AKA’-Notification(Extensible Authentication Protocol-Authentication and Key Agreement’-Notification，扩展认证协议-认证和密钥协商’-通知)消息、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、EAP-REQ(Extensible Authentication Protocol-Request，扩展认证协议-请求)消息中任意一个。特别的，所述第二消息还可 以为扩展认证协议载荷(EAP-payload)的其他消息。
步骤405、第二设备向第一设备发送第一消息。
需要说明的是，第二设备与第一设备之间通过DIAMETER协议进行消息交互，所述第一消息为DIAMETER协议所承载的消息。该第一消息可以为DIAMETER-扩展认证协议-响应-命令消息(DIAMETER-EAP-Answer-Command)和认证授权计费消息(AAA)中任意一个，所述DIAMETER-扩展认证协议-响应-命令消息承载扩展认证协议载荷(EAP-payload)，该扩展认证协议载荷(EAP-payload)可以为扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个，所述认证授权计费消息包括扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个。
步骤406、第一设备向终端发送第二消息。
第一设备接收到第二设备发送的第一消息，首先，解析所述第一消息，得到第二消息，然后，向终端发送所述第二消息。
所述第一消息包括第二消息，所述第二消息包括加密的所述令牌。所述第二消息为扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个。
步骤407、终端将令牌传输至该终端的应用管理器的消息队列。
终端接收到第一设备发送的第二消息，首先，解析该第二消息得到加密的所述令牌，所述第二消息包括加密的所述令牌，解密该 令牌，得到该令牌，然后，将所述令牌传输至该终端的应用管理器的消息队列，使得所述无线局域网控制协议应用通过与该终端的操作系统的API(Application Programming Interface，应用程序编程接口)从消息队列调用所述令牌。这样一来，由于终端中的其他恶意应用无法使用该终端中无线局域网控制协议应用和操作系统的私有API，因此其他恶意应用无法通过调用所述令牌，当其他恶意应用调用WLCP APP使用的UDP端口向第一设备发送分组数据网连接释放请求消息来触发WLCP时，第一设备判断所述分组数据网连接释放请求消息中没有包含所述令牌，则第一设备认为该分组数据网连接释放请求消息为非法分组数据网连接释放请求消息，丢弃所述分组数据网连接释放请求消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费，以及恶意的应用恶意断开PDN连接的意图。
所述令牌用于验证或标识终端的无线局域网控制协议应用。所述第二消息包括加密的所述令牌。所述第二消息为扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个。
步骤408、终端向第一设备发送分组数据网连接请求消息。
分组数据网连接请求(PDN Connection Request)消息包括所述令牌和所述终端的标识。所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
步骤409、第一设备检查所述分组数据网连接请求消息中是否包含所述令牌。
第一设备接收到所述终端发送的分组数据网连接请求消息之后，解析该分组数据网连接请求消息，检查所述分组数据网连接建 立消息中是否包含所述令牌。
若所述分组数据网连接请求消息中包含所述令牌，执行步骤4010。
若所述分组数据网连接请求消息中没有包含所述令牌，则第一设备认为该分组数据网连接请求消息为非法分组数据网连接请求消息，第一设备丢弃或不处理所述分组数据网连接请求消息。
步骤4010、第一设备验证分组数据网连接请求消息中与终端的标识对应的令牌是否与本地存储的与终端的标识对应的令牌相同。
首先，第一设备根据所述分组数据网连接请求消息中的所述终端的标识从本地获取与该终端的标识相同的终端标识，然后，根据本地获取的所述终端的标识获取该终端的标识对应的令牌，验证所述分组数据网连接请求消息中与所述终端的标识对应的令牌是否与本地存储的与终端的标识对应的令牌相同，若所述分组数据网连接请求消息中与所述终端的标识对应的令牌与本地存储的与终端的标识对应的令牌相同，则第一设备认为所述分组数据网连接请求消息为合法的分组数据网连接请求消息，执行步骤4011。
步骤4011、第一设备向所述终端发送分组数据网连接响应消息。
第一设备向所述终端发送分组数据网连接建立响应消息，使得终端接收所述第一设备发送的分组数据网连接建立响应消息，与所述第一设备建立连接，接入分组数据网。所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
需要说明的是，本发明实施例提供的终端接入通信网络的方法步骤的先后顺序可以进行适当调整，步骤也可以根据情况进行相应增减，示例的，如在步骤408之后可以不执行409直接执行步骤 4010，即在终端向第一设备发送分组数据网连接请求消息之后，第一设备验证分组数据网连接请求消息中与终端的标识对应的令牌是否与本地存储的与终端的标识对应的令牌相同。任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化的方法，都应涵盖在本发明的保护范围之内，因此不再赘述。
特别的，本发明实施例所述的第二设备完整性保护第一消息，也对第一消息中的第二消息进行了完整性保护，或者第二设备也可以分别对第一消息和第二消息均进行完整性保护。
本发明实施例所述的终端接入通信网络的方法，首先，第一设备生成与终端的标识对应的令牌，存储与所述终端的标识对应的所述令牌和所述终端的标识，向第二设备发送扩展认证协议消息，所述扩展认证协议消息包括所述令牌，然后，第二设备获取所述令牌，对该令牌加密，生成第一消息，完整性保护该第一消息，所述第一消息包括第二消息，所述第二消息包括加密的所述令牌，向第一设备发送所述第一消息，第一设备接收到第一消息后，向所述终端发送第二消息，终端接收到第二消息后，将令牌传输至该终端的应用管理器的消息队列，无线局域网控制协议应用调用所述令牌，该终端向第一设备发送分组数据网连接请求消息，第一设备检查所述分组数据网连接请求消息中包含所述令牌，验证所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌与本地存储的与所述终端的标识对应的令牌相同，向所述终端发送分组数据网连接响应消息，相对于现有技术，终端向第一设备发送携带令牌的分组数据网连接请求消息，使得第一设备可以分辨分组数据网连接请求消息是无线局域网控制协议应用的消息，还是恶意应用的分组数据网连接请求消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
需要说明的是，第一设备还可以生成与终端的标识对应的用户 数据报协议(UDP)端口号，以便于终端向第一设备发送携带UDP端口号的分组数据网连接请求消息，使得第一设备可以分辨分组数据网连接请求消息是无线局域网控制协议应用的消息，还是恶意应用的分组数据网连接请求消息，来降低终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例所述的终端接入通信网络的方法，如图4a所示，包括：
步骤4012、第一设备生成与终端的标识对应的用户数据报协议UDP端口号。
步骤4013、第一设备存储与终端的标识对应的UDP端口号和所述终端的标识。
步骤4014、第一设备向第二设备发送UDP端口号。
步骤4015、加密UDP端口号，并完整性保护该第二消息。
步骤4016、第二设备向第一设备发送所述第一消息。
步骤4017、第一设备向终端发送第二消息。
步骤4018、将UDP端口号传输至该终端的应用管理器的消息队列。
步骤4019、终端向第一设备发送分组数据网连接请求消息。
步骤4020、第一设备验证分组数据网连接请求消息中与终端的标识对应的UDP端口号与本地存储的与终端的标识对应的UDP端口号相同。
步骤4021、第一设备向终端发送分组数据网连接响应消息。
这样一来，终端向第一设备发送携带UDP端口号的分组数据网连接请求消息，使得第一设备可以分辨分组数据网连接请求消息是无线局域网控制协议应用的消息，还是恶意应用的分组数据网连接请求消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。其中，步骤中详细内容如本发明实施例所述，在此不再 赘述，不同点在于本发明实施例的步骤中所述的令牌可以换为UDP端口号。
本发明实施例提供一种终端接入通信网络的方法，应用于终端、第一设备和第二设备，假设所述第一设备为可信无线局域网接入网关TWAG，所述第二设备为认证授权计费服务器(AAA)或归属用户服务器(HSS)，如图5所示，包括：
步骤501、第二设备生成与终端的标识对应的令牌。
首先，终端进行正常的入网附着，该终端与第二设备之间进行EAP(Extensible Authentication Protocol，扩展认证协议)消息交互，使得第二设备获取终端的标识，然后，第二设备可以生成与终端的标识对应的令牌(Token)，所述令牌用于验证或标识所述终端的无线局域网控制协议应用(WLCP APP)。
特别的，每当终端需要接入通信网络时，第二设备可以获取终端的标识，重新可以生成与终端的标识对应的令牌，更新该终端的令牌，每次生成的令牌可以不同，所述通信网络可以是第三代移动通信蜂窝网络或第四代移动通信蜂窝网络。
需要说明的是，终端的标识可以是IMSI、MAC地址或IP地址。令牌可以由运营商定义生成，且需要保证生成的令牌的唯一性，具体生成令牌的方式为现有技术，本发明实施例在此不再赘述。
步骤502、第二设备加密令牌，并完整性保护第一消息。
第二设备可以生成密钥，对该令牌加密，以防止其他非法用户监听看到所述令牌，所述密钥可以是TEK(Transient EAP Keys，临时EAP密钥)。
需要说明的是，第二设备可以通过使用AES(advanced Encryption standard，高级加密标准)和一个128bit的密钥在CBC(Cipher Block Chaining，加密块链接)模式下对token进行加密。
第二设备对所述令牌进行加密之后，生成第二消息，所述第二消息包括加密的所述令牌，将该第二消息和所述令牌封装，生成第一消息，且对该第一消息进行完整性保护，以防止其他非法用户监听修改所述第一消息，所述第一消息包括第二消息、终端的标识以及与所述终端的标识对应的令牌，所述终端的标识对应的令牌可以用于第一设备获取。
需说明的是，第二设备可以根据MAC(message authentication code，消息认证码)算法HMAC-SHA1-128和认证密钥以及第一消息生成消息认证码。所述第二消息为扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个。特别的，所述第二消息还可以为扩展认证协议载荷(EAP-payload)的其他消息。
步骤503、第二设备向第一设备发送第一消息。
需要说明的是，第二设备与第一设备之间通过DIAMETER协议进行消息交互，所述第一消息为DIAMETER协议所承载的消息。该第一消息可以为DIAMETER-扩展认证协议-响应-命令消息(DIAMETER-EAP-Answer-Command)和认证授权计费消息(AAA)中任意一个，所述DIAMETER-扩展认证协议-响应-命令消息承载扩展认证协议载荷(EAP-payload)，该扩展认证协议载荷(EAP-payload)可以为扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个，所述认证授权计费消息包括扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个。
步骤504、第一设备存储与终端的标识对应的所述令牌和所述终端的标识。
第一设备接收到第二设备发送的第一消息，首先，解析所述第一消息，得到令牌，然后第一设备存储与所述终端的标识对应的所述令牌和所述终端的标识。所述令牌用于验证或标识所述终端的无线局域网控制协议应用。
步骤505、第一设备向终端发送第二消息。
第一设备接收到第二设备发送的第一消息，首先，解析所述第一消息，得到第二消息，然后，向终端发送第二消息。所述第一消息包括第二消息，所述第二消息包括加密的所述令牌。
所述第二消息为扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个。
步骤506、终端将令牌传输至该终端的应用管理器的消息队列。
终端接收到第一设备发送的第二消息，首先，解析该第二消息，得到加密的所述令牌，所述第二消息包括加密的所述令牌，解密该令牌，得到该令牌，然后，将所述令牌传输至该终端的应用管理器的消息队列，使得所述无线局域网控制协议应用通过与该终端的操作系统的API(Application Programming Interface，应用程序编程接口)从消息队列调用所述令牌。这样一来，由于终端中的其他恶意应用无法使用该终端中无线局域网控制协议应用和操作系统的私有API，因此其他恶意应用无法通过调用所述令牌，当其他恶意应用调用WLCP APP使用的UDP端口向第一设备发送分组数据网连接释放请求消息来触发WLCP时，第一设备判断所述分组数据网连接释放请求消息中没有包含所述令牌，则第一设备认为该分组数据 网连接释放请求消息为非法分组数据网连接释放请求消息，丢弃所述分组数据网连接释放请求消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费，以及恶意的应用恶意断开PDN连接的意图。
所述令牌用于验证或标识终端的无线局域网控制协议应用。所述第二消息包括加密的所述令牌。所述第二消息为扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个。
步骤507、终端向第一设备发送分组数据网连接请求消息。
分组数据网连接请求(PDN Connection Request)消息包括所述令牌和所述终端的标识。所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
步骤508、第一设备检查所述分组数据网连接请求消息中是否包含所述令牌。
第一设备接收到所述终端发送的分组数据网连接请求消息之后，解析该分组数据网连接请求消息，检查所述分组数据网连接请求消息中是否包含所述令牌。
若所述分组数据网连接请求消息中包含所述令牌，执行步骤509。
若所述分组数据网连接请求消息中没有包含所述令牌，则第一设备认为该分组数据网连接请求消息为非法分组数据网连接请求消息，第一设备丢弃或不处理所述分组数据网连接请求消息。
步骤509、第一设备验证分组数据网连接请求消息中与终端的标识对应的令牌是否与本地存储的与终端的标识对应的令牌相同。
首先，第一设备根据所述分组数据网连接请求消息中的所述终 端的标识从本地获取与该终端的标识相同的终端标识，然后，根据本地获取的所述终端的标识获取该终端的标识对应的令牌，验证所述分组数据网连接请求消息中与所述终端的标识对应的令牌是否与本地存储的与终端的标识对应的令牌相同，若所述分组数据网连接请求消息中与所述终端的标识对应的令牌与本地存储的与终端的标识对应的令牌相同，则第一设备认为所述分组数据网连接请求消息为合法的分组数据网连接请求消息，执行步骤5010。
步骤5010、第一设备向所述终端发送分组数据网连接响应消息。
第一设备向所述终端发送分组数据网连接响应消息，使得终端接收所述第一设备发送的分组数据网连接响应消息，通过所述第一设备与所述第二设备建立连接，接入分组数据网。所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
需要说明的是，本发明实施例提供的终端接入通信网络的方法步骤的先后顺序可以进行适当调整，步骤也可以根据情况进行相应增减，示例的，如在步骤507之后可以不执行508直接执行步骤509，即在终端向第一设备发送分组数据网连接释放请求消息之后，第一设备验证分组数据网连接释放请求消息中与终端的标识对应的令牌是否与本地存储的与终端的标识对应的令牌相同。任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化的方法，都应涵盖在本发明的保护范围之内，因此不再赘述。
特别的，本发明实施例所述的第二设备完整性保护第一消息，也对第一消息中的第二消息进行了完整性保护，或者第二设备也可以分别对第一消息和第二消息均进行完整性保护。
本发明实施例所述的终端接入通信网络的方法，首先，第二设备生成与终端的标识对应的令牌，对该令牌加密，生成第二消息， 所述第二消息包括加密的所述令牌，生成第一消息，且对该第一消息进行完整性保护，所述第一消息包括第二消息、终端的标识以及与所述终端的标识对应的令牌，向第一设备发送第一消息，第一设备存储与所述终端的标识对应的所述令牌和所述终端的标识，向所述终端发送第二消息，终端接收到第二消息后，将令牌传输至该终端的应用管理器的消息队列，无线局域网控制协议应用调用所述令牌，该终端向第一设备发送分组数据网连接请求消息，第一设备检查所述分组数据网连接请求消息中包含所述令牌，验证分组数据网连接消息中与所述终端的标识对应的所述令牌是否与本地存储的与终端的标识对应的令牌相同，向所述终端发送分组数据网连接响应消息，相对于现有技术，终端向第一设备发送携带令牌的分组数据网连接请求消息，使得第一设备可以分辨分组数据网连接请求消息是无线局域网控制协议应用的消息，还是恶意应用的分组数据网连接消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
需要说明的是，第二设备还可以生成与终端的标识对应的用户数据报协议(UDP)端口号，以便于终端向第一设备发送携带UDP端口号的分组数据网连接请求消息，使得第一设备可以分辨分组数据网连接请求消息是无线局域网控制协议应用的消息，还是恶意应用的分组数据网连接请求消息，来降低终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例所述的终端接入通信网络的方法，如图5a所示，包括：
步骤5011、第二设备生成与终端的标识对应的UDP端口号。
步骤5012、第二设备加密UDP端口号，并完整性保护第二消息。
步骤5013、第二设备向第一设备发送第一消息。
步骤5014、第一设备存储与终端的标识对应的UDP端口号和所述终端的标识。
步骤5015、第一设备向终端发送第二消息。
步骤5016、终端将UDP端口号传输至该终端的应用管理器的消息队列。
步骤5017、终端向第一设备发送分组数据网连接请求消息。
步骤5018、第一设备验证分组数据网连接消息中与终端的标识对应的UDP端口号与本地存储的与终端的标识对应的UDP端口号相同。
步骤5019、第一设备向终端发送分组数据网连接响应消息。
这样一来，终端向第一设备发送携带UDP端口号的分组数据网连接请求消息，使得第一设备可以分辨分组数据网连接请求消息是无线局域网控制协议应用的消息，还是恶意应用的分组数据网连接消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。其中，步骤中详细内容如本发明实施例所述，在此不再赘述，不同点在于本发明实施例的步骤中所述的令牌可以换为UDP端口号。
本发明实施例提供一种终端接入通信网络的方法，应用于终端、第一设备和第二设备，假设所述第一设备为可信无线局域网接入网关TWAG，所述第二设备为认证授权计费服务器(AAA)或归属用户服务器(HSS)，如图21所示，包括：
步骤1401、终端生成与所述终端的标识对应的用户数据报协议UDP端口号。
首先，终端进行正常的入网附着，认证成功后，可以生成与终端的标识对应的UDP端口号，所述UDP端口号用于验证或标识所述终端的无线局域网控制协议应用(WLCP APP)。
特别的，每当终端需要接入通信网络时，终端重新可以生成与 终端的标识对应的UDP端口号，更新该终端的UDP端口号，每次生成的UDP端口号可以不同，所述通信网络可以是第三代移动通信蜂窝网络或第四代移动通信蜂窝网络。
需要说明的是，终端的标识可以是IMSI、MAC地址或IP地址。UDP端口号可以由运营商定义生成，且需要保证生成的UDP端口号的唯一性，具体生成UDP端口号的方式为现有技术，本发明实施例在此不再赘述。
步骤1402、终端加密UDP端口号，并完整性保护第三消息。
终端可以生成密钥，对该UDP端口号加密，以防止其他非法用户监听看到所述UDP端口号，所述密钥可以是TEK(Transient EAP Keys，临时EAP密钥)。
需要说明的是，终端可以通过使用AES(advanced Encryption standard，高级加密标准)和一个128bit的密钥在CBC(Cipher Block Chaining，加密块链接)模式下对UDP端口号进行加密。
所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
终端对所述UDP端口号进行加密之后，生成第三消息，所述第三消息包括加密的所述UDP端口号，且对该第三消息进行完整性保护，以防止其他非法用户监听修改所述第三消息。
步骤1403、终端向第一设备发送第三消息。
步骤1404、第一设备向第二设备发送第一消息。
第一设备接收到终端发送的第三消息后，生成第一消息，所述第一消息包括所述第三消息。所述第一消息为DIAMETER协议所承载的消息。
步骤1405、第二设备对加密的所述UDP端口号进行解密。
第二设备接收到第一设备发送的第一消息，所述第一消息包括第三消息，所述第三消息包括加密的所述UDP端口号，首先，解析所述第一消息，得到经过完整性保护的第三消息，对第三消息进行解密，获取到加密的所述UDP端口号，再对加密的所述UDP端口号进行解密，获取到所述UDP端口号。
所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
步骤1406、第二设备完整性保护第四消息，并生成第一消息。
第四消息可以是扩展认证协议-成功(EAP-success)消息，所述第一消息为DIAMETER协议所承载的消息。第二设备完整性保护第四消息，以防止其他非法用户监听修改所述第四消息。
步骤1407、第二设备向第一设备发送第一消息。
所述第一消息包括所述UDP端口号。
步骤1408、第一设备存储与终端的标识对应的所述UDP端口号和所述终端的标识。
第一设备接收到第二设备发送的第一消息，首先，解析所述第一消息，得到UDP端口号，然后第一设备存储与所述终端的标识对应的所述UDP端口号和所述终端的标识。所述UDP端口号用于验证或标识所述终端的无线局域网控制协议应用。
步骤1409、第一设备向终端发送第四消息。
第一设备接收到第二设备发送的第一消息，首先，解析所述第一消息，得到经过完整性保护的第四消息，然后，向终端发送第四消息。第四消息可以是扩展认证协议-成功(EAP-success)消息。
步骤14010、终端将UDP端口号传输至该终端的应用管理器的 消息队列。
终端将所述UDP端口号传输至该终端的应用管理器的消息队列，使得所述无线局域网控制协议应用通过与该终端的操作系统的API(Application Programming Interface，应用程序编程接口)从消息队列调用所述UDP端口号。这样一来，由于终端中的其他恶意应用无法使用该终端中无线局域网控制协议应用和操作系统的私有API，因此其他恶意应用无法通过调用所述UDP端口号，当其他恶意应用调用WLCP APP使用的UDP端口向第一设备发送分组数据网连接释放请求消息来触发WLCP时，第一设备判断所述分组数据网连接释放请求消息中没有包含所述UDP端口号，则第一设备认为该分组数据网连接释放请求消息为非法分组数据网连接释放请求消息，丢弃所述分组数据网连接释放请求消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费，以及恶意的应用恶意断开PDN连接的意图。
所述UDP端口号用于验证或标识终端的无线局域网控制协议应用。所述第二消息包括加密的所述UDP端口号。所述第二消息为扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个。
步骤14011、终端向第一设备发送分组数据网连接请求消息。
分组数据网连接请求(PDN Connection Request)消息包括所述UDP端口号和所述终端的标识。所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。所述UDP端口号在分组数据网连接请求消息的报文头中，将该UDP端口号作为分组数据网连接请求消息的源端口号。
步骤14012、第一设备验证分组数据网连接请求消息中与终端的标识对应的UDP端口号是否与本地存储的与终端的标识对应的UDP端口号相同。
首先，第一设备根据所述分组数据网连接请求消息中的所述终端的标识从本地获取与该终端的标识相同的终端标识，然后，根据本地获取的所述终端的标识获取该终端的标识对应的UDP端口号，验证所述分组数据网连接请求消息中与所述终端的标识对应的UDP端口号是否与本地存储的与终端的标识对应的UDP端口号相同，若所述分组数据网连接请求消息中与所述终端的标识对应的UDP端口号与本地存储的与终端的标识对应的UDP端口号相同，则第一设备认为所述分组数据网连接请求消息为合法的分组数据网连接请求消息，执行步骤14013。
步骤14013、第一设备向所述终端发送分组数据网连接响应消息。
第一设备向所述终端发送分组数据网连接响应消息，使得终端接收所述第一设备发送的分组数据网连接响应消息，通过所述第一设备与所述第二设备建立连接，接入分组数据网。所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
本发明实施例所述的终端接入通信网络的方法，首先，终端生成与终端的标识对应的UDP端口号，对该UDP端口号加密，生成第三消息，对该第三消息进行完整性保护，所述第三消息包括加密的所述UDP端口号，向第一设备发送第三消息，第一设备根据第三消息生成第一消息，向第二设备发送第一消息，第二设备对加密的所述UDP端口号进行解密，完整性保护第四消息，并生成第一消息，向第一设备发送所述第一消息，所述第一消息包括所述第四消息和所述UDP端口号，第一设备存储与终端的标识对应的所述UDP 端口号和所述终端的标识，第一设备向终端发送第四消息，终端将UDP端口号传输至该终端的应用管理器的消息队列，无线局域网控制协议应用调用所述UDP端口号，该终端向第一设备发送分组数据网连接请求消息，第一设备验证分组数据网连接消息中与所述终端的标识对应的所述UDP端口号是否与本地存储的与终端的标识对应的UDP端口号相同，向所述终端发送分组数据网连接响应消息，相对于现有技术，终端向第一设备发送携带UDP端口号的分组数据网连接请求消息，使得第一设备可以分辨分组数据网连接请求消息是无线局域网控制协议应用的消息，还是恶意应用的分组数据网连接消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
需要说明的是，终端还可以生成与该终端的标识对应的令牌，以便于终端向第一设备发送携带令牌的分组数据网连接请求消息，使得第一设备可以分辨分组数据网连接请求消息是无线局域网控制协议应用的消息，还是恶意应用的分组数据网连接请求消息，来降低终端的恶意应用触发WLCP造成网络侧的资源浪费。其中，具体步骤如本发明实施例所述的步骤，在此不再赘述，不同点在于本发明实施例的步骤中所述的UDP端口号可以换为令牌。
本发明实施例所述的终端接入通信网络的方法，如图21a所示，包括：
步骤14014、终端生成与终端的标识对应的令牌。
步骤14015、终端加密令牌，并完整性保护第三消息。
步骤14016、终端向第一设备发送第三消息。
步骤14017、第一设备向第二设备发送第一消息。
步骤14018、第二设备对加密的所述令牌进行解密。
步骤14019、第二设备完整性保护第四消息，并生成第一消息。
步骤14020、第二设备向第一设备发送第一消息。
步骤14021、第一设备存储与终端的标识对应的所述令牌和所述终端的标识。
步骤14022、第一设备向终端发送第四消息。
步骤14023、终端将令牌传输至该终端的应用管理器的消息队列。
步骤14024、终端向第一设备发送分组数据网连接请求消息。
步骤14025、第一设备验证分组数据网连接请求消息中与终端的标识对应的令牌是否与本地存储的与终端的标识对应的令牌相同。
步骤14026、第一设备向终端发送分组数据网连接响应消息。
这样一来，终端向第一设备发送携带令牌的分组数据网连接请求消息，使得第一设备可以分辨分组数据网连接请求消息是无线局域网控制协议应用的消息，还是恶意应用的分组数据网连接消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例提供一种第一设备60，所述第一设备为可信无线局域网接入网关TWAG，或者，所述第一设备包括TWAG和可信无线局域网认证授权计费服务代理TWAP，如图6所示，包括：
第一接收单元601，用于接收第二设备发送的第一消息，所述第一消息包括第二消息和令牌，所述第二消息包括加密的所述令牌。
所述第一接收单元601还用于或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌。
需要说明的是，第二设备与第一设备之间通过DIAMETER协议进行消息交互，所述第一消息为DIAMETER协议所承载的消息。该第一消息可以为DIAMETER-扩展认证协议-响应-命令消息 (DIAMETER-EAP-Answer-Command)和认证授权计费消息(AAA)中任意一个，所述DIAMETER-扩展认证协议-响应-命令消息承载扩展认证协议载荷(EAP-payload)，该扩展认证协议载荷(EAP-payload)可以为扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个，所述认证授权计费消息包括扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个。
第一发送单元602，用于向所述终端发送所述第二消息。
第一设备接收到第二设备发送的第一消息，首先，解析所述第一消息，得到第二消息，然后，向终端发送所述第二消息。
所述第一消息包括第二消息，所述第二消息包括加密的所述令牌。所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。特别的，所述第二消息还可以为扩展认证协议载荷(EAP-payload)的其他消息。
这样一来，首先接收第二设备发送的第一消息，所述第一消息包括第二消息和令牌，所述第二消息包括加密的所述令牌，或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌，然后，向所述终端发送所述第二消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
基于图6如图7所示，所述第一设备60还包括：
第二接收单元603，用于接收所述终端发送的分组数据网连接 请求消息，所述分组数据网连接请求消息包括所述令牌，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
第一验证单元604，用于验证所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌是否与本地存储的与所述终端的标识对应的令牌相同。
第二发送单元605，用于若所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌与本地存储的与所述终端的标识对应的令牌相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
读取单元609，用于从所述第一消息中读取与所述终端的标识对应的所述令牌和所述终端的标识。
第一存储单元6010，用于存储与所述终端的标识对应的所述令牌和所述终端的标识。
基于图6如图8所示，所述第一设备60还包括：
第二接收单元603，用于接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述令牌，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
第一验证单元604，用于验证所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌是否与本地存储的与所述终端的标识对应的令牌相同。
第二发送单元605，用于若所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌与本地存储的与所述终端的标识对应的令牌相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据 网连接断开响应消息或分组数据网连接释放响应消息。
生成单元6011，用于生成与所述终端的标识对应的所述令牌。
首先，终端进行正常的入网附着，该终端与第二设备之间进行EAP(Extensible Authentication Protocol，扩展认证协议)消息交互，使得第一设备可以从第二设备获取终端的标识，然后，第一设备可以生成与终端的标识对应的令牌(Token)。
特别的，每当终端需要接入通信网络时，第一设备可以从第二设备获取终端的标识，重新生成与终端的标识对应的令牌，更新该终端的令牌，每次生成的令牌可以不同，所述通信网络可以是第三代移动通信蜂窝网络或第四代移动通信蜂窝网络。
需要说明的是，终端的标识可以是IMSI(International Mobile Subscriber Identification Number，国际移动用户识别码)、MAC(Media Access Control，媒体介入控制层)地址或IP(Internet Protocol，互连网协议)地址。令牌可以由运营商定义生成，且需要保证生成的令牌的唯一性，具体生成令牌的方式为现有技术，本发明实施例在此不再赘述。
第二存储单元6012，用于存储与所述终端的标识对应的所述令牌和所述终端的标识。
第四发送单元6013，用于向所述第二设备发送所述令牌。
可以向所述第二设备发送DIAMETER-扩展认证协议-请求-命令消息DIAMETER-EAP-REQ-Command或认证授权计费消息AAA，所述认证授权计费消息包括扩展认证协议-响应消息EAP-RSP或扩展认证协议-身份消息EAP-Identity，所述DIAMETER-扩展认证协议-请求-命令消息包括所述令牌，所述扩展认证协议-响应消息包括所述令牌，所述扩展认证协议-身份消息包括所述令牌。
基于图6如图9所示，所述第一设备60还包括：
第二接收单元603，用于接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述令牌，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
检查单元606，用于检查所述分组数据网连接请求消息中是否包含所述令牌。
若所述分组数据网连接请求消息中没有包含所述令牌，则第一设备认为该分组数据网连接请求消息为非法分组数据网连接请求消息，第一设备丢弃或不处理所述分组数据网连接请求消息。
第二验证单元607，用于若所述分组数据网连接请求消息中包含所述令牌，验证所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌是否与本地存储的与所述终端的标识对应的令牌相同。
首先，第一设备根据所述分组数据网连接请求消息中的所述终端的标识从本地获取与该终端的标识相同的终端标识，然后，根据本地获取的所述终端的标识获取该终端的标识对应的令牌，验证所述分组数据网连接请求消息中与所述终端的标识对应的令牌是否与本地存储的与终端的标识对应的令牌相同，若所述分组数据网连接请求消息中与所述终端的标识对应的令牌与本地存储的与终端的标识对应的令牌相同，则第一设备认为所述分组数据网连接请求消息为合法的分组数据网连接请求消息。
第三发送单元608，用于若所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌与本地存储的与所述终端的标识对应的令牌相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
读取单元609，用于从所述第一消息中读取与所述终端的标识对应的所述令牌和所述终端的标识。
第一存储单元6010，用于存储与所述终端的标识对应的所述令牌和所述终端的标识。
基于图6如图10所示，所述第一设备60还包括：
第二接收单元603，用于接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述令牌和所述终端的标识，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
检查单元606，用于检查所述分组数据网连接请求消息中是否包含所述令牌。
若所述分组数据网连接请求消息中没有包含所述令牌，则第一设备认为该分组数据网连接请求消息为非法分组数据网连接请求消息，第一设备丢弃或不处理所述分组数据网连接请求消息。
第二验证单元607，用于若所述分组数据网连接请求消息中包含所述令牌，验证所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌是否与本地存储的与所述终端的标识对应的令牌相同。
首先，第一设备根据所述分组数据网连接请求消息中的所述终端的标识从本地获取与该终端的标识相同的终端标识，然后，根据本地获取的所述终端的标识获取该终端的标识对应的令牌，验证所述分组数据网连接请求消息中与所述终端的标识对应的令牌是否与本地存储的与终端的标识对应的令牌相同，若所述分组数据网连接请求消息中与所述终端的标识对应的令牌与本地存储的与终端的标识对应的令牌相同，则第一设备认为所述分组数据网连接请求消息为合法的分组数据网连接请求消息。
第三发送单元608，用于若所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌与本地存储的与所述终端的标识对应的令牌相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
生成单元6011，用于生成与所述终端的标识对应的所述令牌。
首先，终端进行正常的入网附着，该终端与第二设备之间进行EAP(Extensible Authentication Protocol，扩展认证协议)消息交互，使得第一设备可以从第二设备获取终端的标识，然后，第一设备可以生成与终端的标识对应的令牌(Token)。
特别的，每当终端需要接入通信网络时，第一设备可以从第二设备获取终端的标识，重新生成与终端的标识对应的令牌，更新该终端的令牌，每次生成的令牌可以不同，所述通信网络可以是第三代移动通信蜂窝网络或第四代移动通信蜂窝网络。
需要说明的是，终端的标识可以是IMSI(International Mobile Subscriber Identification Number，国际移动用户识别码)、MAC(Media Access Control，媒体介入控制层)地址或IP(Internet Protocol，互连网协议)地址。令牌可以由运营商定义生成，且需要保证生成的令牌的唯一性，具体生成令牌的方式为现有技术，本发明实施例在此不再赘述。
第二存储单元6012，用于存储与所述终端的标识对应的所述令牌和所述终端的标识。
第四发送单元6013，用于向所述第二设备发送所述令牌。
可以向所述第二设备发送DIAMETER-扩展认证协议-请求-命令消息DIAMETER-EAP-REQ-Command或认证授权计费消息AAA，所述认证授权计费消息包括扩展认证协议-响应消息 EAP-RSP或扩展认证协议-身份消息EAP-Identity，所述DIAMETER-扩展认证协议-请求-命令消息包括所述令牌，所述扩展认证协议-响应消息包括所述令牌，所述扩展认证协议-身份消息包括所述令牌。
需要说明的是，所述令牌用于验证或标识合法的无线局域网控制协议应用。
本发明实施例提供的第一设备61，所述第一设备为可信无线局域网接入网关TWAG，或者，所述第一设备包括TWAG和可信无线局域网认证授权计费服务代理TWAP，如图22所示，包括：
第一接收单元611，用于接收第二设备发送的第一消息，所述第一消息包括第二消息和用户数据报协议UDP端口号，所述第二消息包括加密的所述UDP端口号；
所述第一接收单元611还用于或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述UDP端口号。
第一发送单元612，用于向所述终端发送所述第二消息。
这样一来，第一设备接收第二设备发送的第一消息，所述第一消息包括第二消息和用户数据报协议UDP端口号，所述第二消息包括加密的所述UDP端口号，或者，所述第一消息包括第二消息，然后，向终端发送所述第二消息，以便于终端的WLCP应用获取UDP端口号，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
基于图22如图23所示，所述第一设备61还包括：
第二接收单元613，用于接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述UDP端口号，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
第一验证单元614，用于验证所述分组数据网连接请求消息中与所述终端的标识对应的所述UDP端口号是否与本地存储的与所述终端的标识对应的UDP端口号相同。
第二发送单元615，用于若所述分组数据网连接请求消息中与所述终端的标识对应的所述UDP端口号与本地存储的与所述终端的标识对应的UDP端口号相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
读取单元619，用于从所述第一消息中读取与所述终端的标识对应的所述UDP端口号和所述终端的标识。
第一存储单元6110，用于存储与所述终端的标识对应的所述UDP端口号和所述终端的标识。
基于图22如图24所示，所述第一设备61还包括：
第二接收单元613，用于接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述UDP端口号，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
第一验证单元614，用于验证所述分组数据网连接请求消息中与所述终端的标识对应的所述UDP端口号是否与本地存储的与所述终端的标识对应的UDP端口号相同。
第二发送单元615，用于若所述分组数据网连接请求消息中与所述终端的标识对应的所述UDP端口号与本地存储的与所述终端的标识对应的UDP端口号相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
生成单元6111，用于生成与所述终端的标识对应的所述UDP端口号。
第二存储单元6112，用于存储与所述终端的标识对应的所述UDP端口号和所述终端的标识。
第四发送单元6113，用于向所述第二设备发送所述UDP端口号。
基于图22如图25所示，所述第一设备61还包括：
第二接收单元613，用于接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述UDP端口号，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
检查单元616，用于检查所述分组数据网连接请求消息中是否包含所述UDP端口号。
第二验证单元617，用于若所述分组数据网连接请求消息中包含所述UDP端口号，验证所述分组数据网连接请求消息中与所述终端的标识对应的所述UDP端口号是否与本地存储的与所述终端的标识对应的UDP端口号相同。
第三发送单元618，用于若所述分组数据网连接请求消息中与所述终端的标识对应的所述UDP端口号与本地存储的与所述终端的标识对应的UDP端口号相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
读取单元619，用于从所述第一消息中读取与所述终端的标识对应的所述UDP端口号和所述终端的标识。
第一存储单元6110，用于存储与所述终端的标识对应的所述UDP端口号和所述终端的标识。
基于图22如图26所示，所述第一设备61还包括：
第二接收单元613，用于接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述UDP端口号和所述终端的标识，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
检查单元616，用于检查所述分组数据网连接请求消息中是否包含所述UDP端口号。
第二验证单元617，用于若所述分组数据网连接请求消息中包含所述UDP端口号，验证所述分组数据网连接请求消息中与所述终端的标识对应的所述UDP端口号是否与本地存储的与所述终端的标识对应的UDP端口号相同。
第三发送单元618，用于若所述分组数据网连接请求消息中与所述终端的标识对应的所述UDP端口号与本地存储的与所述终端的标识对应的UDP端口号相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
生成单元6111，用于生成与所述终端的标识对应的所述UDP端口号。
第二存储单元6112，用于存储与所述终端的标识对应的所述UDP端口号和所述终端的标识。
第四发送单元6113，用于向所述第二设备发送所述UDP端口号。
需要说明的是，所述UDP端口号用于验证或标识合法的无线局域网控制协议应用。
其中，第一设备的各个单元执行的详细内容如本发明实施例所 述，在此不再赘述，不同点在于本发明实施例所述的令牌可以换为UDP端口号。
本发明实施例提供一种第一设备62，所述第一设备为可信无线局域网接入网关TWAG，或者，所述第一设备包括TWAG和可信无线局域网认证授权计费服务代理TWAP，如图27所示，包括：
第一接收单元621，用于接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数。
第一发送单元622，用于向所述终端发送所述第二消息。
第二接收单元623，用于接收所述终端发送的第三消息，所述第三消息包括加密的所述认证参数。
第二发送单元624，用于向所述第二设备发送所述第一消息，所述第一消息包括所述第三消息。
第三接收单元625，用于接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述认证参数，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
验证单元626，用于验证所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数是否与本地存储的与所述终端的标识对应的认证参数相同。
第三发送单元627，用于若所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数与本地存储的与所述终端的标识对应的认证参数相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
本发明实施例提供一种终端70，如图11所示，包括：
第一接收单元701，用于接收第一设备发送的第二消息，所述第二消息包括加密的所述令牌。
终端接收到第一设备发送的第二消息，首先，解析该第二消息得到加密的所述令牌，所述第二消息包括加密的所述令牌，解密该令牌，得到该令牌，然后，将所述令牌传输至该终端的应用管理器的消息队列，使得所述无线局域网控制协议应用通过与该终端的操作系统的API(Application Programming Interface，应用程序编程接口)从消息队列调用所述令牌。这样一来，由于终端中的其他恶意应用无法使用该终端中无线局域网控制协议应用和操作系统的私有API，因此其他恶意应用无法通过调用所述令牌，当其他恶意应用调用WLCP APP使用的UDP端口向第一设备发送分组数据网连接释放请求消息来触发WLCP时，第一设备判断所述分组数据网连接释放请求消息中没有包含所述令牌，则第一设备认为该分组数据网连接释放请求消息为非法分组数据网连接释放请求消息，丢弃所述分组数据网连接释放请求消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费，以及恶意的应用恶意断开PDN连接的意图。
所述第二消息包括加密的所述令牌。所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。特别的，所述第二消息还可以为扩展认证协议载荷(EAP-payload)的其他消息。
这样一来，接收第一设备发送的第二消息，所述第二消息包括加密的所述令牌，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
如图12所示，所述终端70还包括：
发送单元702，用于向所述第一设备发送分组数据网连接请求消息，所述分组数据网连接请求消息包括所述令牌，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接 断开请求消息或分组数据网连接释放请求消息。
第二接收单元703，用于接收所述第一设备发送的分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
需要说明的是，所述令牌用于验证或标识合法的无线局域网控制协议应用。
本发明实施例提供一种终端71，如图28所示，包括：
接收单元711，用于接收第一设备发送的第二消息，所述第二消息包括加密的用户数据报协议UDP端口号。
这样一来，终端可以从接收到的第一设备发送的第二消息中获取UDP端口号，以便于终端的WLCP应用获取UDP端口号或令牌，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
终端的各个单元执行的详细内容如本发明实施例所述，在此不再赘述，不同点在于本发明实施例所述的令牌可以换为UDP端口号。
本发明实施例提供一种终端72，如图29所示，包括：
生成单元721，终端生成与所述终端的标识对应的认证参数，所述认证参数为令牌或用户数据报协议UDP端口号。
加密单元722，用于加密所述认证参数；
发送单元723，用于向所述第一设备发送第三消息，所述第三消息包括加密的所述认证参数。
所述发送单元723还用于向所述第一设备发送分组数据网连接请求消息，所述分组数据网连接请求消息包括所述认证参数，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
接收单元724，用于接收所述第一设备发送的分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
这样一来，终端生成认证参数，终端向第一设备发送携带认证参数的分组数据网连接请求消息，使得第一设备可以分辨分组数据网连接请求消息是无线局域网控制协议应用的消息，还是恶意应用的分组数据网连接请求消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例提供一种第二设备80，如图13所示，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，所述第二设备包括：
获取单元801，用于获取令牌。
加密单元802，用于加密所述令牌。
第二设备可以生成密钥，对该令牌加密，以防止其他非法用户监听看到所述令牌，所述密钥可以是TEK(Transient EAP Keys，临时EAP密钥)。需要说明的是，第二设备可以通过使用AES(advanced Encryption standard，高级加密标准)和一个128bit的密钥在CBC(Cipher Block Chaining，加密块链接)模式下对token进行加密。
完整性保护单元803，用于完整性保护第一消息，所述第一消息包括第二消息和所述令牌，所述第二消息包括加密的所述令牌，
所述完整性保护单元803还用于或者，完整性保护第一消息， 所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌。
第二设备对所述令牌进行加密之后，生成第二消息，所述第二消息包括加密的所述令牌，将该第二消息封装，生成第一消息，且对该第一消息进行完整性保护，以防止其他非法用户监听修改所述第一消息，所述第一消息包括第二消息。
需说明的是，第二设备可以根据MAC(message authentication code，消息认证码)算法HMAC-SHA1-128和认证密钥以及第一消息生成消息认证码。所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。特别的，所述第二消息还可以为扩展认证协议载荷(EAP-payload)的其他消息。
发送单元804，用于向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息。
需要说明的是，第二设备与第一设备之间通过DIAMETER协议进行消息交互，所述第一消息为DIAMETER协议所承载的消息。该第一消息可以为DIAMETER-扩展认证协议-响应-命令消息(DIAMETER-EAP-Answer-Command)和认证授权计费消息(AAA)中任意一个，所述DIAMETER-扩展认证协议-响应-命令消息承载扩展认证协议载荷(EAP-payload)，该扩展认证协议载荷(EAP-payload)可以为扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个，所述认证授权计费消息包括扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩 展认证协议-请求消息(EAP-REQ)中任意一个。
这样一来，首先获取令牌，然后，加密所述令牌，完整性保护第一消息，所述第一消息包括第二消息和所述令牌，所述第二消息包括加密的所述令牌，或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌，再向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
所述获取单元801具体用于：
生成与所述终端的标识对应的所述令牌。
首先，终端进行正常的入网附着，该终端与第二设备之间进行EAP(Extensible Authentication Protocol，扩展认证协议)消息交互，使得第二设备获取终端的标识，然后，第二设备可以生成与终端的标识对应的令牌(Token)，所述令牌用于验证或标识所述终端的无线局域网控制协议应用(WLCP APP)。
特别的，每当终端需要接入通信网络时，第二设备可以获取终端的标识，重新可以生成与终端的标识对应的令牌，更新该终端的令牌，每次生成的令牌可以不同，所述通信网络可以是第三代移动通信蜂窝网络或第四代移动通信蜂窝网络。
需要说明的是，终端的标识可以是IMSI(International Mobile Subscriber Identification Number，国际移动用户识别码)、MAC(Media Access Control，媒体介入控制层)地址或IP(Internet Protocol，互连网协议)地址。令牌可以由运营商定义生成，且需要保证生成的令牌的唯一性，具体生成令牌的方式为现有技术，本发明实施例在此不再赘述。
所述获取单元801具体用于：
接收所述第一设备发送的所述令牌。
可以接收所述第一设备发送的DIAMETER-扩展认证协议-请求-命令消息DIAMETER-EAP-REQ-Command或认证授权计费消息AAA中获取所述令牌，所述认证授权计费消息包括扩展认证协议-响应消息EAP-RSP或扩展认证协议-身份消息EAP-Identity，所述DIAMETER-扩展认证协议-请求-命令消息包括所述令牌，所述扩展认证协议-响应消息包括所述令牌，所述扩展认证协议-身份消息包括所述令牌。
本发明实施例提供一种第二设备81，如图30所示，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，所述第二设备包括：
获取单元811，用于获取用户数据报协议UDP端口号。
加密单元812，用于加密所述UDP端口号。
完整性保护单元813，用于完整性保护第一消息，所述第一消息包括第二消息和所述UDP端口号，所述第二消息包括加密的所述UDP端口号，
所述完整性保护单元813还用于或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述UDP端口号；
发送单元814，用于向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息或所述UDP端口号。
这样一来，第二设备获取UDP端口号，并对UDP端口号加密，向第一设备发送所述第一消息，以便于第一设备从该第一消息中获取所述第二消息或所述UDP端口号，并发送至终端，以便于终端的WLCP应用获取UDP端口号，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
本发明实施例提供一种第二设备82，如图31所示，所述第二 设备为认证授权计费服务器AAA或归属用户服务器HSS，所述第二设备包括：
获取单元821，用于获取认证参数，所述认证参数为令牌或用户数据报协议UDP端口号。
加密单元822，用于加密所述认证参数。
完整性保护单元823，用于完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和所述认证参数，所述第二消息包括加密的所述认证参数；
所述完整性保护单元823还用于或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
发送单元824，用于向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息或所述认证参数。
所述获取单元821具体用于：
生成与所述终端的标识对应的所述认证参数；
或者，接收所述第一设备发送的所述认证参数；
或者，接收所述第一设备发送的第一消息，所述第一消息包括第三消息，所述第三消息包括加密的所述认证参数，并对所述加密的所述认证参数进行解密操作。
需要说明的是，所述令牌或者所述UDP端口号用于验证或标识合法的无线局域网控制协议应用。所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。其中，第二设备的各个单元执行的详细内容如本发明实施例所述，在此不再赘述，不同点在于本发明实施例所述的令牌可以换为UDP端口号。
本发明实施例提供一种通信系统90，如图14所示，包括：
第一设备901、终端902和第二设备903，其中，
所述第二设备903，用于获取令牌；
加密所述令牌；
完整性保护第一消息，所述第一消息包括第二消息和所述令牌，所述第二消息包括加密的所述令牌，
或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌；
向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息。
所述第一设备901，用于接收第二设备发送的第一消息，所述第一消息包括第二消息和令牌，所述第二消息包括加密的所述令牌；
或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌；
向所述终端发送所述第二消息。
所述终端903，用于接收第一设备发送的第二消息，所述第二消息包括加密的所述令牌。
其中，第一设备901、终端902和第二设备903均还可以生成与终端的标识对应的UDP端口号和令牌。
本发明实施例提供一种第一设备100，如图15所示，所述第一设备为可信无线局域网接入网关TWAG，所述第一设备包括：
接收机1001，用于接收第二设备发送的第一消息，所述第一消息包括第二消息和令牌，所述第二消息包括加密的所述令牌。
所述接收机1001还用于或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌。
需要说明的是，第二设备与第一设备之间通过DIAMETER协 议进行消息交互，所述第一消息为DIAMETER协议所承载的消息。该第一消息可以为DIAMETER-扩展认证协议-响应-命令消息(DIAMETER-EAP-Answer-Command)和认证授权计费消息(AAA)中任意一个，所述DIAMETER-扩展认证协议-响应-命令消息承载扩展认证协议载荷(EAP-payload)，该扩展认证协议载荷(EAP-payload)可以为扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个，所述认证授权计费消息包括扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个。
发射机1002，用于向所述终端发送所述第二消息。
第一设备接收到第二设备发送的第一消息，首先，解析所述第一消息，得到第二消息，然后，向终端发送所述第二消息。
所述第一消息包括第二消息，所述第二消息包括加密的所述令牌。所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。特别的，所述第二消息还可以为扩展认证协议载荷(EAP-payload)的其他消息。
这样一来，首先接收第二设备发送的第一消息，所述第一消息包括第二消息和令牌，所述第二消息包括加密的所述令牌，或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌，然后，向所述终端发送所述第二消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
所述接收机1001还用于：
接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述令牌，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
如图16所示，所述第一设备100还包括：
处理器1003，用于验证所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌是否与本地存储的与所述终端的标识对应的令牌相同。
所述发射机1002还用于：
若所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌与本地存储的与所述终端的标识对应的令牌相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
所述处理器1003还用于：
检查所述分组数据网连接请求消息中是否包含所述令牌。
若所述分组数据网连接请求消息中没有包含所述令牌，则第一设备认为该分组数据网连接请求消息为非法分组数据网连接请求消息，第一设备丢弃或不处理所述分组数据网连接请求消息。
所述处理器1003还用于：
若所述分组数据网连接请求消息中包含所述令牌，验证所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌是否与本地存储的与所述终端的标识对应的令牌相同。
首先，第一设备根据所述分组数据网连接请求消息中的所述终端的标识从本地获取与该终端的标识相同的终端标识，然后，根据本地获取的所述终端的标识获取该终端的标识对应的令牌，验证所 述分组数据网连接请求消息中与所述终端的标识对应的令牌是否与本地存储的与终端的标识对应的令牌相同，若所述分组数据网连接请求消息中与所述终端的标识对应的令牌与本地存储的与终端的标识对应的令牌相同，则第一设备认为所述分组数据网连接请求消息为合法的分组数据网连接请求消息。
所述发射机1002还用于：
若所述分组数据网连接请求消息中与所述终端的标识对应的所述令牌与本地存储的与所述终端的标识对应的令牌相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
所述处理器1003还用于：从所述第一消息中读取与所述终端的标识对应的所述令牌和所述终端的标识。
所述处理器1003还用于：存储与所述终端的标识对应的所述令牌和所述终端的标识。
所述处理器1003还用于：生成与所述终端的标识对应的所述令牌；
首先，终端进行正常的入网附着，该终端与第二设备之间进行EAP(Extensible Authentication Protocol，扩展认证协议)消息交互，使得第一设备可以从第二设备获取终端的标识，然后，第一设备可以生成与终端的标识对应的令牌(Token)，所述令牌用于验证或标识所述终端的无线局域网控制协议应用(WLCP APP)。
特别的，每当终端需要接入通信网络时，第一设备可以从第二设备获取终端的标识，重新生成与终端的标识对应的令牌，更新该终端的令牌，每次生成的令牌可以不同，所述通信网络可以是第三代移动通信蜂窝网络或第四代移动通信蜂窝网络。
需要说明的是，终端的标识可以是IMSI(International Mobile  Subscriber Identification Number，国际移动用户识别码)、MAC(Media Access Control，媒体介入控制层)地址或IP(Internet Protocol，互连网协议)地址。令牌可以由运营商定义生成，且需要保证生成的令牌的唯一性，具体生成令牌的方式为现有技术，本发明实施例在此不再赘述。
所述处理器1003还用于：存储与所述终端的标识对应的所述令牌和所述终端的标识。
所述发射机1002还用于：向所述第二设备发送所述令牌。
可以向所述第二设备发送DIAMETER-扩展认证协议-请求-命令消息DIAMETER-EAP-REQ-Command或认证授权计费消息AAA，所述认证授权计费消息包括扩展认证协议-响应消息EAP-RSP或扩展认证协议-身份消息EAP-Identity，所述DIAMETER-扩展认证协议-请求-命令消息包括所述令牌，所述扩展认证协议-响应消息包括所述令牌，所述扩展认证协议-身份消息包括所述令牌。
需要说明的是，所述令牌或者所述UDP端口号用于验证或标识合法的无线局域网控制协议应用。
本发明实施例提供的第一设备111，如图32所示，所述第一设备为可信无线局域网接入网关TWAG，或者，所述第一设备包括TWAG和可信无线局域网认证授权计费服务代理TWAP，所述第一设备包括；
接收机1111，用于接收第二设备发送的第一消息，所述第一消息包括第二消息和UDP端口号，所述第二消息包括加密的所述UDP端口号。
所述接收机1111还用于或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述UDP端口号。
发射机1112，用于向所述终端发送所述第二消息。
这样一来，首先接收第二设备发送的第一消息，所述第一消息包括第二消息和UDP端口号，所述第二消息包括加密的所述UDP端口号，或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述UDP端口号，然后，向所述终端发送所述第二消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
所述接收机1111还用于：
接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述UDP端口号，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
处理器1113，用于验证所述分组数据网连接请求消息中与所述终端的标识对应的所述UDP端口号是否与本地存储的与所述终端的标识对应的UDP端口号相同。
所述发射机1112还用于：
若所述分组数据网连接请求消息中与所述终端的标识对应的所述UDP端口号与本地存储的与所述终端的标识对应的UDP端口号相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
所述处理器1113还用于：
检查所述分组数据网连接请求消息中是否包含所述UDP端口号。
所述处理器1113还用于：
若所述分组数据网连接请求消息中包含所述UDP端口号，验证所述分组数据网连接请求消息中与所述终端的标识对应的所述 UDP端口号是否与本地存储的与所述终端的标识对应的UDP端口号相同。
所述发射机1112还用于：
若所述分组数据网连接请求消息中与所述终端的标识对应的所述UDP端口号与本地存储的与所述终端的标识对应的UDP端口号相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
当所述第一消息包括第二消息和认证参数，所述第二消息包括加密的所述认证参数时，
所述处理器1113还用于：从所述第一消息中读取与所述终端的标识对应的所述UDP端口号和所述终端的标识。
所述处理器1113还用于：存储与所述终端的标识对应的所述UDP端口号和所述终端的标识。
当所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数时，
所述处理器1113还用于：生成与所述终端的标识对应的所述UDP端口号；
所述处理器1113还用于：存储与所述终端的标识对应的所述UDP端口号和所述终端的标识。
所述发射机1112还用于：向所述第二设备发送所述UDP端口号。
当所述第一消息包括第二消息和认证参数时，
所述接收机1111还用于接收所述终端发送的第三消息，所述第三消息包括加密的所述认证参数；
所述发射机1112还用于向所述第二设备发送所述第一消息，所述第一消息包括所述第三消息。
第一设备执行的详细内容如本发明实施例所述，在此不再赘述，不同点在于本发明实施例所述的令牌可以换为UDP端口号。
本发明实施例提供一种终端110，如图17所示，所述终端包括：
接收机1101，用于接收第一设备发送的第二消息，所述第二消息包括加密的所述令牌。
终端接收到第一设备发送的第二消息，首先，解析该第二消息得到加密的所述令牌，所述第二消息包括加密的所述令牌，解密该令牌，得到该令牌，然后，将所述令牌传输至该终端的应用管理器的消息队列，使得所述无线局域网控制协议应用通过与该终端的操作系统的API(Application Programming Interface，应用程序编程接口)从消息队列调用所述令牌。这样一来，由于终端中的其他恶意应用无法使用该终端中无线局域网控制协议应用和操作系统的私有API，因此其他恶意应用无法通过调用所述令牌，当其他恶意应用调用WLCP APP使用的UDP端口向第一设备发送分组数据网连接释放请求消息来触发WLCP时，第一设备判断所述分组数据网连接释放请求消息中没有包含所述令牌，则第一设备认为该分组数据网连接释放请求消息为非法分组数据网连接释放请求消息，丢弃所述分组数据网连接释放请求消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费，以及恶意的应用恶意断开PDN连接的意图。
所述第二消息包括加密的所述令牌。所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。特别的，所述第二消息还可以为扩展认证协议载荷(EAP-payload)的其他消息。
这样一来，接收第一设备发送的第二消息，所述第二消息包括 加密的所述令牌，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
如图18所示，所述终端110还包括：
发射机1102，用于向所述第一设备发送分组数据网连接请求消息，所述分组数据网连接请求消息包括所述令牌，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
所述接收机1101还用于：
接收所述第一设备发送的分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
需要说明的是，所述令牌或者所述UDP端口号用于验证或标识合法的无线局域网控制协议应用。
本发明实施例提供一种终端112，如图33所示，所述终端包括：
接收机1121，用于接收第一设备发送的第二消息，所述第二消息包括加密的所述UDP端口号。
这样一来，接收第一设备发送的第二消息，所述第二消息包括加密的所述UDP端口号，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
发射机1122，用于向所述第一设备发送分组数据网连接请求消息，所述分组数据网连接请求消息包括所述UDP端口号，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
所述接收机1121还用于：
接收所述第一设备发送的分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网 连接断开响应消息或分组数据网连接释放响应消息。
终端执行的详细内容如本发明实施例所述，在此不再赘述，不同点在于本发明实施例所述的令牌可以换为UDP端口号。
本发明实施例提供一种终端113，如图34所示，所述终端包括：
处理器1131，用于生成与所述终端的标识对应的认证参数，所述认证参数为令牌或用户数据报协议UDP端口号。
所述处理器1131还用于加密所述认证参数；
发射机1132，用于向所述第一设备发送第三消息，所述第三消息包括加密的所述认证参数。
本发明实施例提供一种第二设备120，如图19所示，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，所述第二设备包括：
处理器1201，用于获取令牌。
所述处理器1201还用于：加密所述令牌。
第二设备可以生成密钥，对该令牌加密，以防止其他非法用户监听看到所述令牌，所述密钥可以是TEK(Transient EAP Keys，临时EAP密钥)。需要说明的是，第二设备可以通过使用AES(advanced Encryption standard，高级加密标准)和一个128bit的密钥在CBC(Cipher Block Chaining，加密块链接)模式下对token进行加密。
所述处理器1201还用于：完整性保护第一消息，所述第一消息包括第二消息和所述令牌，所述第二消息包括加密的所述令牌，
所述处理器1201还用于：或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌。
第二设备对所述令牌进行加密之后，生成第二消息，所述第二消息包括加密的所述令牌，将该第二消息封装，生成第一消息，且 对该第一消息进行完整性保护，以防止其他非法用户监听修改所述第一消息，所述第一消息包括第二消息。
需说明的是，第二设备可以根据MAC(message authentication code，消息认证码)算法HMAC-SHA1-128和认证密钥以及第一消息生成消息认证码。所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。特别的，所述第二消息还可以为扩展认证协议载荷(EAP-payload)的其他消息。
发射机1202，用于向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息。
需要说明的是，第二设备与第一设备之间通过DIAMETER协议进行消息交互，所述第一消息为DIAMETER协议所承载的消息。该第一消息可以为DIAMETER-扩展认证协议-响应-命令消息(DIAMETER-EAP-Answer-Command)和认证授权计费消息(AAA)中任意一个，所述DIAMETER-扩展认证协议-响应-命令消息承载扩展认证协议载荷(EAP-payload)，该扩展认证协议载荷(EAP-payload)可以为扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个，所述认证授权计费消息包括扩展认证协议-认证和密钥协商’-通知消息(EAP-AKA’-Notification)、扩展认证协议-认证和密钥协商’-身份消息(EAP-AKA’-Identity)、扩展认证协议-请求消息(EAP-REQ)中任意一个。
这样一来，首先获取令牌，然后，加密所述令牌，完整性保护第一消息，所述第一消息包括第二消息和所述令牌，所述第二消息包括加密的所述令牌，或者，完整性保护第一消息，所述第一消息 包括所述第二消息，所述第二消息包括加密的所述令牌，再向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
所述处理器1201具体用于：生成与所述终端的标识对应的所述令牌。
首先，终端进行正常的入网附着，该终端与第二设备之间进行EAP(Extensible Authentication Protocol，扩展认证协议)消息交互，使得第二设备获取终端的标识，然后，第二设备可以生成与终端的标识对应的令牌(Token)，所述令牌用于验证或标识所述终端的无线局域网控制协议应用(WLCP APP)。
特别的，每当终端需要接入通信网络时，第二设备可以获取终端的标识，重新可以生成与终端的标识对应的令牌，更新该终端的令牌，每次生成的令牌可以不同，所述通信网络可以是第三代移动通信蜂窝网络或第四代移动通信蜂窝网络。
需要说明的是，终端的标识可以是IMSI(International Mobile Subscriber Identification Number，国际移动用户识别码)、MAC(Media Access Control，媒体介入控制层)地址或IP(Internet Protocol，互连网协议)地址。令牌可以由运营商定义生成，且需要保证生成的令牌的唯一性，具体生成令牌的方式为现有技术，本发明实施例在此不再赘述。
所述处理器1201具体用于：
接收所述第一设备发送的所述令牌。
可以接收所述第一设备发送的DIAMETER-扩展认证协议-请求-命令消息DIAMETER-EAP-REQ-Command或认证授权计费消息AAA中获取所述令牌，所述认证授权计费消息包括扩展认证协议-响应消息EAP-RSP或扩展认证协议-身份消息EAP-Identity，所述 DIAMETER-扩展认证协议-请求-命令消息包括所述令牌，所述扩展认证协议-响应消息包括所述令牌，所述扩展认证协议-身份消息包括所述令牌。
需要说明的是，所述令牌用于验证或标识合法的无线局域网控制协议应用。
本发明实施例提供一种第二设备121，如图35所示，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，所述第二设备包括：
处理器1211，用于获取UDP端口号。
所述处理器1211还用于：加密所述UDP端口号。
所述处理器1211还用于：完整性保护第一消息，所述第一消息包括第二消息和所述UDP端口号，所述第二消息包括加密的所述UDP端口号，
所述处理器1211还用于：或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述UDP端口号。
发射机1212，用于向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息。
这样一来，首先获取UDP端口号，然后，加密所述UDP端口号，完整性保护第一消息，所述第一消息包括第二消息和所述UDP端口号，所述第二消息包括加密的所述UDP端口号，或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述UDP端口号，再向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息，有效地降低了终端的恶意应用触发WLCP造成网络侧的资源浪费。
所述处理器1211具体用于：生成与所述终端的标识对应的所述UDP端口号。
所述处理器1211具体用于：
接收所述第一设备发送的所述UDP端口号。
需要说明的是，所述UDP端口号用于验证或标识合法的无线局域网控制协议应用。
本发明实施例提供一种第二设备122，如图36所示，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，所述第二设备包括：
处理器1221，用于获取认证参数，所述认证参数为令牌或用户数据报协议UDP端口号。
所述处理器1221还用于加密所述认证参数。
所述处理器1221还用于完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和所述认证参数，所述第二消息包括加密的所述认证参数；
所述处理器1221还用于或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
发射机1222，用于向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息或所述认证参数。
所述处理器1221具体用于：
生成与所述终端的标识对应的所述认证参数；
或者，接收所述第一设备发送的所述认证参数；
或者，接收所述第一设备发送的第一消息，所述第一消息包括第三消息，所述第三消息包括加密的所述认证参数，并对所述加密的所述认证参数进行解密操作。
第二设备执行的详细内容如本发明实施例所述，在此不再赘述，不同点在于本发明实施例所述的令牌可以换为UDP端口号。
本发明实施例提供一种通信系统130，如图20所示，包括：
第一设备1301、终端1302和第二设备1303，其中，
所述第二设备1303，用于获取令牌；
加密所述令牌；
完整性保护第一消息，所述第一消息包括第二消息和所述令牌，所述第二消息包括加密的所述令牌，
或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌；
向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息。
所述第一设备1301，用于接收第二设备发送的第一消息，所述第一消息包括第二消息和令牌，所述第二消息包括加密的所述令牌；
或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述令牌；
向所述终端发送所述第二消息。
所述终端1302，用于接收第一设备发送的第二消息，所述第二消息包括加密的所述令牌。
其中，第一设备1301、终端1302和第二设备1303均还可以生成与终端的标识对应的用户数据报协议(UDP)端口号和令牌。
本发明实施例提供一种通信系统131，如图37所示，包括：
第一设备1311、终端1312和第二设备1313，其中，
所述第二设备1313，用于获取认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
加密所述认证参数；
完整性保护第一消息，所述第一消息包括第二消息和所述认证参数，所述第二消息包括加密的所述认证参数，
或者，完整性保护第一消息，所述第一消息包括所述第二消息， 所述第二消息包括加密的所述认证参数；
或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和所述认证参数，所述第二消息包括加密的所述认证参数；
或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和认证参数；
向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息或所述认证参数；
所述第一设备1311，用于接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数，所述认证参数为令牌或用户数据报协议UDP端口号，所述第二消息包括加密的所述认证参数；
或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
或者，接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数；
向所述终端发送所述第二消息；
所述终端1312，用于接收第一设备发送的第二消息，所述第二消息包括加密的认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
或者，生成与所述终端的标识对应的认证参数。
需要说明的是，本发明中所述的分组数据网连接建立请求消息可以用WLCP PDN connection request或PDN connectivity request表示，分组数据网连接建立响应消息可以用WLCP PDN connection response或PDN connectivity response表示；
分组数据网连接断开请求消息可以用WLCP PDN disconnection request表示，分组数据网连接断开响应消息可以用WLCP PDN disconnection response表示；
分组数据网连接释放请求消息可以用WLCP PDN connection release request或PDN connection release request表示，分组数据网连接释放响应消息可以用WLCP PDN connection release response或PDN connection release response表示。
特别的，若第一设备检查分组数据网连接请求消息中没有包含所述令牌，则第一设备认为该分组数据网连接请求消息为非法分组数据网连接请求消息，第一设备丢弃或不处理所述分组数据网连接请求消息，还可以向终端发送分组数据网连接建立拒绝消息、分组数据网连接断开拒绝消息或分组数据网连接释放拒绝消息，其中，分组数据网连接建立拒绝消息可以用PDN CONNECTIVITY REJECT表示，分组数据网连接断开拒绝消息可以用PDN DISCONNECTIVITY REJECT表示。
需要说明的是，本发明中所述的第一设备可以包括TWAP(Trusted WLAN AAA Proxy，可信WLAN认证授权计费服务器代理)和可信WLAN接入网关TWAG。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连 接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理包括，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于一计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保护范围为准。

Claims (76)

  1. 一种终端接入通信网络的方法，其特征在于，应用于第一设备，所述第一设备为可信无线局域网接入网关TWAG，或者，所述第一设备包括TWAG和可信无线局域网认证授权计费服务代理TWAP，所述方法包括：
    接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数，所述认证参数为令牌或用户数据报协议UDP端口号，所述第二消息包括加密的所述认证参数；
    或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
    或者，接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数；
    向所述终端发送所述第二消息。
  2. 根据权利要求1所述的终端接入通信网络的方法，其特征在于，在所述向所述终端发送所述第二消息之后，所述方法还包括：
    接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述认证参数，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
  3. 根据权利要求2所述的终端接入通信网络的方法，其特征在于，在所述接收所述终端发送的分组数据网连接请求消息之后，所述方法还包括：
    验证所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数是否与本地存储的与所述终端的标识对应的认证参数相同；
    若所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数与本地存储的与所述终端的标识对应的认证参数相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响 应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
  4. 根据权利要求2所述的终端接入通信网络的方法，其特征在于，在所述接收所述终端发送的分组数据网连接请求消息之后，所述方法还包括：
    检查所述分组数据网连接请求消息中是否包含所述认证参数；
    若所述分组数据网连接请求消息中包含所述认证参数，验证所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数是否与本地存储的与所述终端的标识对应的认证参数相同；
    若所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数与本地存储的与所述终端的标识对应的认证参数相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
  5. 根据权利要求1至4任意一项权利要求所述的终端接入通信网络的方法，其特征在于，当所述第一消息包括第二消息和认证参数，所述第二消息包括加密的所述认证参数时，在所述接收第二设备发送的第一消息之后，所述方法还包括：
    从所述第一消息中读取与所述终端的标识对应的所述认证参数和所述终端的标识；
    存储与所述终端的标识对应的所述认证参数和所述终端的标识。
  6. 根据权利要求1至4任意一项权利要求所述的终端接入通信网络的方法，其特征在于，当所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数时，在所述接收第二设备发送的第一消息之前，所述方法还包括：
    生成与所述终端的标识对应的所述认证参数；
    存储与所述终端的标识对应的所述认证参数和所述终端的标识；
    向所述第二设备发送所述认证参数。
  7. 根据权利要求1至4任意一项权利要求所述的终端接入通信网络的方法，其特征在于，当所述第一消息包括第二消息和认证参数时，在所述接收第二设备发送的第一消息之前，所述方法还包括：
    接收所述终端发送的第三消息，所述第三消息包括加密的所述认证参数；
    向所述第二设备发送所述第一消息，所述第一消息包括所述第三消息。
  8. 根据权利要求1至7任意一项权利要求所述的终端接入通信网络的方法，其特征在于，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
  9. 根据权利要求1至8任意一项权利要求所述的终端接入通信网络的方法，其特征在于，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
  10. 根据权利要求1至9任意一项权利要求所述的终端接入通信网络的方法，其特征在于，所述第一消息为DIAMETER协议所承载的消息。
  11. 根据权利要求1至10任意一项权利要求所述的终端接入通信网络的方法，其特征在于，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
  12. 一种终端接入通信网络的方法，其特征在于，应用于终端，所述方法包括：
    接收第一设备发送的第二消息，所述第二消息包括加密的认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
    或者，生成与所述终端的标识对应的认证参数。
  13. 根据权利要求12所述的终端接入通信网络的方法，其特征在于，在所述生成与所述终端的标识对应的认证参数之后，所述方法还包括：
    加密所述认证参数；
    向所述第一设备发送第三消息，所述第三消息包括加密的所述认证参数。
  14. 根据权利要求13所述的终端接入通信网络的方法，其特征在于，在所述接收第一设备发送的第二消息之后，所述方法还包括：
    向所述第一设备发送分组数据网连接请求消息，所述分组数据网连接请求消息包括所述认证参数，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
  15. 根据权利要求14所述的终端接入通信网络的方法，其特征在于，在所述向所述第一设备发送分组数据网连接请求消息之后，所述方法还包括：
    接收所述第一设备发送的分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
  16. 根据权利要求12至15任意一项权利要求所述的终端接入通信网络的方法，其特征在于，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
  17. 根据权利要求12至16任意一项权利要求所述的终端接入通信网络的方法，其特征在于，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
  18. 根据权利要求12至17任意一项权利要求所述的终端接入通信网络的方法，其特征在于，所述第三消息为扩展认证协议-认证和 密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
  19. 一种终端接入通信网络的方法，其特征在于，应用于第二设备，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，所述方法包括：
    获取认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
    加密所述认证参数；
    完整性保护第一消息，所述第一消息包括第二消息和所述认证参数，所述第二消息包括加密的所述认证参数，
    或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
    或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和所述认证参数，所述第二消息包括加密的所述认证参数；
    或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
    或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和认证参数；
    向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息或所述认证参数。
  20. 根据权利要求19所述的终端接入通信网络的方法，其特征在于，所述获取认证参数包括：
    生成与所述终端的标识对应的所述认证参数。
  21. 根据权利要求19所述的终端接入通信网络的方法，其特征在于，所述获取认证参数包括：
    接收所述第一设备发送的所述认证参数；
    或者，接收所述第一设备发送的第一消息，所述第一消息包括 第三消息，所述第三消息包括加密的所述认证参数，并对所述加密的所述认证参数进行解密操作。
  22. 根据权利要求19至21任意一项权利要求所述的终端接入通信网络的方法，其特征在于，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
  23. 根据权利要求19至22任意一项权利要求所述的终端接入通信网络的方法，其特征在于，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
  24. 根据权利要求19至23任意一项权利要求所述的终端接入通信网络的方法，其特征在于，所述第一消息为DIAMETER协议所承载的消息。
  25. 根据权利要求19至24任意一项权利要求所述的终端接入通信网络的方法，其特征在于，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
  26. 一种第一设备，其特征在于，所述第一设备为可信无线局域网接入网关TWAG，或者，所述第一设备包括TWAG和可信无线局域网认证授权计费服务代理TWAP，所述第一设备包括：
    第一接收单元，用于接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数，所述认证参数为令牌或用户数据报协议UDP端口号，所述第二消息包括加密的所述认证参数；
    所述第一接收单元还用于或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
    或者，所述第一接收单元还用于接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数；
    第一发送单元，用于向所述终端发送所述第二消息。
  27. 根据权利要求26所述的第一设备，其特征在于，所述第一设备还包括：
    第二接收单元，用于接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述认证参数，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
  28. 根据权利要求27所述的第一设备，其特征在于，所述第一设备还包括：
    第一验证单元，用于验证所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数是否与本地存储的与所述终端的标识对应的认证参数相同；
    第二发送单元，用于若所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数与本地存储的与所述终端的标识对应的认证参数相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
  29. 根据权利要求27所述的第一设备，其特征在于，所述第一设备还包括：
    检查单元，用于检查所述分组数据网连接请求消息中是否包含所述认证参数；
    第二验证单元，用于若所述分组数据网连接请求消息中包含所述认证参数，验证所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数是否与本地存储的与所述终端的标识对应的认证参数相同；
    第三发送单元，用于若所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数与本地存储的与所述终端的标识对应的认证参数相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组 数据网连接断开响应消息或分组数据网连接释放响应消息。
  30. 根据权利要求26至29任意一项权利要求所述的第一设备，其特征在于，当所述第一消息包括第二消息和认证参数，所述第二消息包括加密的所述认证参数时，所述第一设备还包括：
    读取单元，用于从所述第一消息中读取与所述终端的标识对应的所述认证参数和所述终端的标识；
    第一存储单元，用于存储与所述终端的标识对应的所述认证参数和所述终端的标识。
  31. 根据权利要求26至29任意一项权利要求所述的第一设备，其特征在于，当所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数时，所述第一设备还包括：
    生成单元，用于生成与所述终端的标识对应的所述认证参数；
    第二存储单元，用于存储与所述终端的标识对应的所述认证参数和所述终端的标识；
    第四发送单元，用于向所述第二设备发送所述认证参数。
  32. 根据权利要求26至29任意一项权利要求所述的第一设备，其特征在于，当所述第一消息包括第二消息和认证参数时，所述第一设备还包括：
    第三接收单元，用于接收所述终端发送的第三消息，所述第三消息包括加密的所述认证参数；
    第五发送单元，用于向所述第二设备发送所述第一消息，所述第一消息包括所述第三消息。
  33. 根据权利要求26至32任意一项权利要求所述的第一设备，其特征在于，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
  34. 根据权利要求26至33任意一项权利要求所述的第一设备，其特征在于，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任 意一个。
  35. 根据权利要求26至34任意一项权利要求所述的第一设备，其特征在于，所述第一消息为DIAMETER协议所承载的消息。
  36. 根据权利要求26至35任意一项权利要求所述的第一设备，其特征在于，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
  37. 一种终端，其特征在于，所述终端包括：
    第一接收单元，用于接收第一设备发送的第二消息，所述第二消息包括加密的所述认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
    或者，生成单元，用于生成与所述终端的标识对应的认证参数。
  38. 根据权利要求37所述的终端，其特征在于，所述终端还包括：
    加密单元，用于加密所述认证参数；
    发送单元，用于向所述第一设备发送第三消息，所述第三消息包括加密的所述认证参数。
  39. 根据权利要求38所述的终端，其特征在于，所述终端还包括：
    所述发送单元还用于向所述第一设备发送分组数据网连接请求消息，所述分组数据网连接请求消息包括所述认证参数，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
  40. 根据权利要求39所述的终端，其特征在于，所述终端还包括：
    第二接收单元，用于接收所述第一设备发送的分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响 应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
  41. 根据权利要求37至40任意一项权利要求所述的终端，其特征在于，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
  42. 根据权利要求37至41任意一项权利要求所述的终端，其特征在于，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
  43. 根据权利要求37至42任意一项权利要求所述的终端，其特征在于，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
  44. 一种第二设备，其特征在于，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，所述第二设备包括：
    获取单元，用于获取认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
    加密单元，用于加密所述认证参数；
    完整性保护单元，用于完整性保护第一消息，所述第一消息包括第二消息和所述认证参数，所述第二消息包括加密的所述认证参数，
    所述完整性保护单元还用于或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
    或者，所述完整性保护单元还用于完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和所述认证参数，所述第二消息包括加密的所述认证参数；
    或者，所述完整性保护单元还用于完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
    或者，所述完整性保护单元还用于完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和认证参数；
    发送单元，用于向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息或所述认证参数。
  45. 根据权利要求44所述的第二设备，其特征在于，所述获取单元具体用于：
    生成与所述终端的标识对应的所述认证参数。
  46. 根据权利要求44所述的第二设备，其特征在于，所述获取单元具体用于：
    接收所述第一设备发送的所述认证参数；
    或者，接收所述第一设备发送的第一消息，所述第一消息包括第三消息，所述第三消息包括加密的所述认证参数，并对所述加密的所述认证参数进行解密操作。
  47. 根据权利要求44至46任意一项权利要求所述的第二设备，其特征在于，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
  48. 根据权利要求44至47任意一项权利要求所述的第二设备，其特征在于，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
  49. 根据权利要求44至48任意一项权利要求所述的第二设备，其特征在于，所述第一消息为DIAMETER协议所承载的消息。
  50. 根据权利要求44至49任意一项权利要求所述的第二设备，其特征在于，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身 份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
  51. 一种第一设备，其特征在于，所述第一设备为可信无线局域网接入网关TWAG，或者，所述第一设备包括TWAG和可信无线局域网认证授权计费服务代理TWAP，所述第一设备包括：
    接收机，用于接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数，所述认证参数为令牌或用户数据报协议UDP端口号，所述第二消息包括加密的所述认证参数；
    所述接收机还用于或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
    或者，所述接收机还用于接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数；
    发射机，用于向所述终端发送所述第二消息。
  52. 根据权利要求51所述的第一设备，其特征在于，
    所述接收机还用于：
    接收所述终端发送的分组数据网连接请求消息，所述分组数据网连接请求消息包括所述认证参数，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
  53. 根据权利要求52所述的第一设备，其特征在于，所述第一设备还包括：
    处理器，用于验证所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数是否与本地存储的与所述终端的标识对应的认证参数相同；
    所述发射机还用于：
    若所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数与本地存储的与所述终端的标识对应的认证参数相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响 应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
  54. 根据权利要求52所述的第一设备，其特征在于，
    所述处理器还用于：
    检查所述分组数据网连接请求消息中是否包含所述认证参数；
    所述处理器还用于：
    若所述分组数据网连接请求消息中包含所述认证参数，验证所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数是否与本地存储的与所述终端的标识对应的认证参数相同；
    所述发射机还用于：
    若所述分组数据网连接请求消息中与所述终端的标识对应的所述认证参数与本地存储的与所述终端的标识对应的认证参数相同，向所述终端发送分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
  55. 根据权利要求51至54任意一项权利要求所述的第一设备，其特征在于，当所述第一消息包括第二消息和认证参数，所述第二消息包括加密的所述认证参数时，
    所述处理器还用于：从所述第一消息中读取与所述终端的标识对应的所述认证参数和所述终端的标识；
    所述处理器还用于：存储与所述终端的标识对应的所述认证参数和所述终端的标识。
  56. 根据权利要求51至54任意一项权利要求所述的第一设备，其特征在于，当所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数时，
    所述处理器还用于：生成与所述终端的标识对应的所述认证参数；
    所述处理器还用于：存储与所述终端的标识对应的所述认证参数和所述终端的标识；
    所述发射机还用于：向所述第二设备发送所述认证参数。
  57. 根据权利要求51至56任意一项权利要求所述的第一设备，其特征在于，当所述第一消息包括第二消息和认证参数时，
    所述接收机还用于接收所述终端发送的第三消息，所述第三消息包括加密的所述认证参数；
    所述发射机还用于向所述第二设备发送所述第一消息，所述第一消息包括所述第三消息。
  58. 根据权利要求51至57任意一项权利要求所述的第一设备，其特征在于，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
  59. 根据权利要求51至58任意一项权利要求所述的第一设备，其特征在于，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
  60. 根据权利要求51至59任意一项权利要求所述的第一设备，其特征在于，所述第一消息为DIAMETER协议所承载的消息。
  61. 根据权利要求51至60任意一项权利要求所述的第一设备，其特征在于，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
  62. 一种终端，其特征在于，所述终端包括：
    接收机，用于接收第一设备发送的第二消息，所述第二消息包括加密的认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
    或者，处理器，用于生成与所述终端的标识对应的认证参数，所述认证参数为令牌或用户数据报协议UDP端口号。
  63. 根据权利要求62所述的终端，其特征在于，
    所述处理器还用于加密所述认证参数；
    所述终端还包括：
    发射机，用于向所述第一设备发送第三消息，所述第三消息包括加密的所述认证参数。
  64. 根据权利要求63所述的终端，其特征在于，
    所述发射机还用于向所述第一设备发送分组数据网连接请求消息，所述分组数据网连接请求消息包括所述认证参数，所述分组数据网连接请求消息为分组数据网连接建立请求消息、分组数据网连接断开请求消息或分组数据网连接释放请求消息。
  65. 根据权利要求64所述的终端，其特征在于，
    所述接收机还用于：
    接收所述第一设备发送的分组数据网连接响应消息，所述分组数据网连接响应消息为分组数据网连接建立响应消息、分组数据网连接断开响应消息或分组数据网连接释放响应消息。
  66. 根据权利要求62至65任意一项权利要求所述的终端，其特征在于，所述认证参数用于验证或标识合法的无线局域网控制协议应用。
  67. 根据权利要求62至66任意一项权利要求所述的终端，其特征在于，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
  68. 根据权利要求62至67任意一项权利要求所述的终端，其特征在于，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
  69. 一种第二设备，其特征在于，所述第二设备为认证授权计费服务器AAA或归属用户服务器HSS，所述第二设备包括：
    处理器，用于获取认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
    所述处理器还用于：加密所述认证参数；
    所述处理器还用于：完整性保护第一消息，所述第一消息包括第二消息和所述认证参数，所述第二消息包括加密的所述认证参数，
    所述处理器还用于：或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
    或者，所述处理器还用于完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和所述认证参数，所述第二消息包括加密的所述认证参数；
    或者，所述处理器还用于完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
    或者，所述处理器还用于完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和认证参数；
    发射机，用于向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息或所述认证参数。
  70. 根据权利要求69所述的第二设备，其特征在于，
    所述处理器具体用于：生成与所述终端的标识对应的所述认证参数。
  71. 根据权利要求70所述的第二设备，其特征在于，所述处理器具体用于：
    接收所述第一设备发送的所述认证参数；
    或者，接收所述第一设备发送的第一消息，所述第一消息包括第三消息，所述第三消息包括加密的所述认证参数，并对所述加密的所述认证参数进行解密操作。
  72. 根据权利要求69至71任意一项权利要求所述的第二设备，其特征在于，所述认证参数用于验证或标识合法的无线局域网控制 协议应用。
  73. 根据权利要求69至72任意一项权利要求所述的第二设备，其特征在于，所述第二消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-请求消息EAP-REQ中任意一个。
  74. 根据权利要求69至73任意一项权利要求所述的第二设备，其特征在于，所述第一消息为DIAMETER协议所承载的消息。
  75. 根据权利要求69至74任意一项权利要求所述的第二设备，其特征在于，所述第三消息为扩展认证协议-认证和密钥协商’-通知消息EAP-AKA’-Notification、扩展认证协议-认证和密钥协商’-身份消息EAP-AKA’-Identity、扩展认证协议-响应消息EAP-RSP中任意一个。
  76. 一种通信系统，其特征在于，包括：
    如权利要求26至权利要求36任意一项权利要求或权利要求51至权利要求61任意一项权利要求所述的第一设备、如权利要求37至权利要求43任意一项权利要求或权利要求62至权利要求68任意一项权利要求所述的终端和如权利要求44至权利要求50任意一项权利要求或权利要求69至权利要求75任意一项权利要求所述的第二设备，其中，
    所述第二设备，用于获取认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
    加密所述认证参数；
    完整性保护第一消息，所述第一消息包括第二消息和所述认证参数，所述第二消息包括加密的所述认证参数，
    或者，完整性保护第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
    或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和所述认证参数，所述第二消息包括加密的所述 认证参数；
    或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数；
    或者，完整性保护第二消息，并生成第一消息，所述第一消息包括所述第二消息和认证参数；
    向第一设备发送所述第一消息，以便于所述第一设备从所述第一消息中获取所述第二消息或所述认证参数；
    所述第一设备，用于接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数，所述认证参数为令牌或用户数据报协议UDP端口号，所述第二消息包括加密的所述认证参数；
    或者，接收第二设备发送的第一消息，所述第一消息包括所述第二消息，所述第二消息包括加密的所述认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
    或者，接收第二设备发送的第一消息，所述第一消息包括第二消息和认证参数；
    向所述终端发送所述第二消息；
    所述终端，用于接收第一设备发送的第二消息，所述第二消息包括加密的认证参数，所述认证参数为令牌或用户数据报协议UDP端口号；
    或者，生成与所述终端的标识对应的认证参数。
PCT/CN2014/091004 2014-04-30 2014-11-13 一种终端接入通信网络的方法、装置及通信系统 WO2015165250A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
CN201480078488.8A CN106465117B (zh) 2014-04-30 2014-11-13 一种终端接入通信网络的方法、装置及通信系统
EP14890620.9A EP3131325A4 (en) 2014-04-30 2014-11-13 Method, device and communication system for terminal to access communication network
US15/337,830 US20170078288A1 (en) 2014-04-30 2016-10-28 Method for accessing communications network by terminal, apparatus, and communications system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2014076661 2014-04-30
CNPCT/CN2014/076661 2014-04-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/337,830 Continuation US20170078288A1 (en) 2014-04-30 2016-10-28 Method for accessing communications network by terminal, apparatus, and communications system

Publications (1)

Publication Number Publication Date
WO2015165250A1 true WO2015165250A1 (zh) 2015-11-05

Family

ID=54358120

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/091004 WO2015165250A1 (zh) 2014-04-30 2014-11-13 一种终端接入通信网络的方法、装置及通信系统

Country Status (4)

Country Link
US (1) US20170078288A1 (zh)
EP (1) EP3131325A4 (zh)
CN (1) CN106465117B (zh)
WO (1) WO2015165250A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11223932B2 (en) * 2017-01-31 2022-01-11 Qualcomm Incorporated Vehicle-to-everything feedback channel design
US11706583B2 (en) * 2020-01-21 2023-07-18 Sensyus Networks, Inc. Apparatus and locale-based method for thwarting deceptions and/or denial of services
US20230007926A1 (en) * 2021-07-09 2023-01-12 Genetec Europe Computer-assisted wait time estimation
CN114157707B (zh) * 2021-11-25 2023-07-25 北京煜邦电力技术股份有限公司 一种通信连接方法、装置及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102893669A (zh) * 2012-07-02 2013-01-23 华为技术有限公司 接入移动网络的方法、装置及系统
CN103096317A (zh) * 2011-11-08 2013-05-08 中国电信股份有限公司 一种基于共享加密数据的双向鉴权方法及系统
WO2013082245A1 (en) * 2011-11-29 2013-06-06 Interdigital Patent Holdings, Inc. Methods for ip mobility management
US20140071969A1 (en) * 2011-11-04 2014-03-13 Telefonaktiebolaget L M Ericsson (Publ) Method and Apparatus for Establishing and Using PDN Connections
CN103716770A (zh) * 2012-09-29 2014-04-09 中兴通讯股份有限公司 网络接入处理方法及系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7171460B2 (en) * 2001-08-07 2007-01-30 Tatara Systems, Inc. Method and apparatus for integrating billing and authentication functions in local area and wide area wireless data networks
EP2166724A1 (en) * 2008-09-23 2010-03-24 Panasonic Corporation Optimization of handovers to untrusted non-3GPP networks
CN101815296A (zh) * 2009-02-23 2010-08-25 华为技术有限公司 一种进行接入认证的方法、装置及系统
CN102238484B (zh) * 2010-04-22 2016-03-30 中兴通讯股份有限公司 机器对机器的通信系统中基于组的认证方法及系统
US8713589B2 (en) * 2010-12-23 2014-04-29 Microsoft Corporation Registration and network access control

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140071969A1 (en) * 2011-11-04 2014-03-13 Telefonaktiebolaget L M Ericsson (Publ) Method and Apparatus for Establishing and Using PDN Connections
CN103096317A (zh) * 2011-11-08 2013-05-08 中国电信股份有限公司 一种基于共享加密数据的双向鉴权方法及系统
WO2013082245A1 (en) * 2011-11-29 2013-06-06 Interdigital Patent Holdings, Inc. Methods for ip mobility management
CN102893669A (zh) * 2012-07-02 2013-01-23 华为技术有限公司 接入移动网络的方法、装置及系统
CN103716770A (zh) * 2012-09-29 2014-04-09 中兴通讯股份有限公司 网络接入处理方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3131325A4 *

Also Published As

Publication number Publication date
CN106465117B (zh) 2020-11-06
EP3131325A4 (en) 2017-04-05
CN106465117A (zh) 2017-02-22
US20170078288A1 (en) 2017-03-16
EP3131325A1 (en) 2017-02-15

Similar Documents

Publication Publication Date Title
US11212676B2 (en) User identity privacy protection in public wireless local access network, WLAN, access
US10455414B2 (en) User-plane security for next generation cellular networks
US9843575B2 (en) Wireless network authentication method and wireless network authentication apparatus
JP2018532325A (ja) ユーザ機器ｕｅのアクセス方法、アクセスデバイス、およびアクセスシステム
JP2012217207A (ja) 鍵マテリアルの交換
US8788821B2 (en) Method and apparatus for securing communication between a mobile node and a network
US10218698B2 (en) Using a mobile device number (MDN) service in multifactor authentication
EP3883279A1 (en) Communication method and related product
JP7461515B2 (ja) データ伝送方法及びシステム、電子機器、並びにコンピュータ可読記憶媒体
Kwon et al. Evolution of Wi-Fi protected access: security challenges
US20230354013A1 (en) Secure communication method and device
WO2021063304A1 (zh) 通信认证方法和相关设备
WO2015165250A1 (zh) 一种终端接入通信网络的方法、装置及通信系统
JP6123035B1 (ja) Ｔｗａｇとｕｅとの間でのｗｌｃｐメッセージ交換の保護
WO2012024905A1 (zh) 一种移动通讯网中数据加解密方法、终端和ggsn
WO2019219209A1 (en) Establishing new ipsec sas
Zhou et al. A hybrid authentication protocol for LTE/LTE-A network
CN109428852B (zh) 通信隧道端点地址分离方法、终端、ePDG及存储介质
CA3190801A1 (en) Key management method and communication apparatus
KR102209289B1 (ko) 이동 통신 시스템 환경에서 프록시미티 기반 서비스를 위한 보안 및 정보 지원 방법 및 시스템
WO2020147602A1 (zh) 一种认证方法、装置和系统
Caragata et al. Security of mobile Internet access with UMTS/HSDPA/LTE
WO2018032984A1 (zh) 一种接入认证方法、ue和接入设备
GB2551358A (en) Low latency security
Caragata et al. " Infonomics Society, United Kingdom and Ireland

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14890620

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2014890620

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2014890620

Country of ref document: EP