WO2015184870A1 - 分组通信管理方法、装置和系统 - Google Patents

分组通信管理方法、装置和系统 Download PDF

Info

Publication number
WO2015184870A1
WO2015184870A1 PCT/CN2015/073362 CN2015073362W WO2015184870A1 WO 2015184870 A1 WO2015184870 A1 WO 2015184870A1 CN 2015073362 W CN2015073362 W CN 2015073362W WO 2015184870 A1 WO2015184870 A1 WO 2015184870A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
application
network entity
information
user
Prior art date
Application number
PCT/CN2015/073362
Other languages
English (en)
French (fr)
Inventor
余万涛
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2015184870A1 publication Critical patent/WO2015184870A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/06—Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
    • H04W4/08—User group management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/047—Key management, e.g. using generic bootstrapping architecture [GBA] without using a trusted network node as an anchor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Definitions

  • the present invention relates to the field of communications, and in particular, to a packet communication management method, apparatus, and system.
  • Machine to Machine (M2M) communication is a general term for a series of technologies and combinations of application communication technologies that realize data communication and communication between machines and machines, machines and people.
  • the M2M system architecture can be divided into an M2M application layer, an M2M service capability layer, an M2M communication network layer, an M2M terminal, and a perceptual extension layer, as shown in FIG.
  • MTC integrates communication technology and information technology, and can be used for two-way communication, such as collecting information over long distances, setting parameters, and sending commands, it can implement different application scenarios, such as security monitoring, vending, and goods tracking. It can be seen that almost all the equipment involved in daily life has the potential to become a potential service target.
  • the entities involved in M2M communication include a large number of M2M devices and M2M applications.
  • M2M devices and M2M applications need to be managed and optimized in groups.
  • M2M Equipment and M2M applications can be controlled, managed, and billed in groups to meet the needs of operators.
  • the MTC device and the M2M application can be grouped according to whether the areas in the area are the same, or whether they have the same M2M feature, or whether they belong to the same M2M user.
  • the same set of M2M devices and M2M applications share the same M2M packet key, such as access key and base key.
  • the group information After grouping the MTC device and the M2M application, the group information needs to be secured. Otherwise, an attacker may pretend to be a group member to obtain group information. At the same time, it is necessary to implement secure remote management of a group of M2M devices and M2M applications and their shared M2M packet keys.
  • Embodiments of the present invention provide a packet communication management method, apparatus, and system, which solve the problem of lacking packetization of M2M devices and M2M applications and performing a security management mechanism.
  • a packet communication management method includes:
  • the network entity receives the request information for creating the M2M packet, where the information carries the M2M user information, and the information also carries the identity information of the M2M device and/or the M2M application;
  • the network entity authenticates the M2M user
  • the network entity When the M2M user passes the authentication, the network entity creates an M2M packet containing the M2M device and/or the M2M application indicated in the request information.
  • the acquiring, by the network entity, the M2M packet that includes the M2M device and/or the M2M application indicated in the request information includes:
  • the network entity creates a group identity for the M2M packet
  • the network entity maintains an association list of the M2M packet identifier and the identity information of the M2M device and/or the identity information of the M2M application in the M2M packet.
  • the method further includes:
  • the network entity feeds back the creation completion information to the M2M user requesting to create the packet.
  • the method further includes:
  • the network entity receives M2M packet add update request information, requesting to add a new M2M device and/or an M2M application to the M2M packet that the network entity has created, the M2M packet
  • the adding update request information carries M2M user information of the M2M user that issues the M2M packet adding update request information, M2M packet identification information that is required to be updated, and identity information of the M2M device and/or the M2M application to be added to the M2M packet;
  • the network entity authenticates the M2M user that sends the update request information by sending the M2M packet;
  • the network entity determines a corresponding M2M packet according to the M2M packet identification information, and adds the M2M device and/or the M2M application indicated by the M2M packet adding the update request information to the M2M.
  • the network entity feeds back the completion information to the M2M user.
  • the method further includes:
  • the network entity receives the M2M packet deletion update request information, and requests to delete the M2M device and/or the M2M application from the M2M packet that has been created by the network entity, where the M2M packet deletion update request information carries the M2M packet deletion update request M2M user information of the M2M user of the information, M2M packet identification information requiring updating, and identity information of the M2M device and/or the M2M application to be deleted;
  • the network entity authenticates the M2M user that sends the M2M packet deletion update request information
  • the network entity determines a corresponding M2M packet according to the M2M packet identification information, and deletes the M2M device and/or the M2M application indicated by the M2M packet update request information from the M2M packet. Deleted
  • the network entity feeds back the deletion completion information to the M2M user.
  • the method further includes:
  • the network entity generates a corresponding M2M packet key for the created M2M packet identifier, and saves a correspondence between the M2M packet key and the M2M packet identifier.
  • the method further includes:
  • the network entity sends an M2M packet notification to the M2M device or the M2M application in the created M2M packet;
  • the network entity After receiving the acknowledgment information returned by the M2M device or the M2M application, the network entity delivers the packet identifier and the M2M packet key corresponding to the M2M device or the M2M application to the M2M device or the M2M application.
  • the M2M packet identifier and the M2M packet key are simultaneously delivered to the M2M device or the M2M application in the same process.
  • the M2M packet identifier and the M2M packet key are respectively sent to the M2M device or the M2M application in different processes.
  • the network entity is an MME, or an SGSN, or an HSS, or an MTC-IWF, or an M2M service management platform.
  • the embodiment of the invention further provides another packet communication management method, the method comprising:
  • the M2M device or the M2M application receives the request information for creating the M2M packet sent by the M2M user, where the information carries the M2M user information of the M2M user requesting to create the packet, and the M2M device identity information of the M2M user request packet, and/or the M2M application.
  • Identity Information
  • the M2M device or the M2M application sends the request information for creating an M2M packet to a network entity.
  • the method further includes:
  • the M2M device or the M2M application receives the creation completion information of the network entity feedback, indicating that the M2M packet requested to be created is successfully created.
  • the method further includes:
  • the information carries the M2M user information of the M2M user that sends the M2M packet adding update request information, the M2M packet identification information that is required to be updated, and the identity information of the M2M device and/or the M2M application to be added to the M2M packet;
  • the M2M device or the M2M application receives the addition completion information fed back by the network entity.
  • the method further includes:
  • the M2M device or the M2M application sends the M2M packet deletion update request information to the network entity, requesting to delete the M2M device and/or the M2M application from the M2M packet that has been created by the network entity, where the M2M packet adds the update request information to be carried.
  • the M2M communication entity receives deletion completion information fed back by the network entity.
  • the method further includes:
  • the M2M device or the M2M application returns the confirmation information to the network entity after the M2M packet notification passes the authentication;
  • the M2M device or the M2M application receives and saves a packet identifier and an M2M packet key corresponding to the M2M communication entity delivered by the network entity.
  • the embodiment of the invention further provides a packet communication management apparatus, comprising:
  • An M2M group identifier generating module is configured to: generate an M2M group identifier, and create an association list between the M2M group and the M2M device or the M2M application;
  • the M2M group identifier management module is configured to: store and maintain an M2M group identifier, and save and maintain an association list between the M2M group and the M2M device or the M2M application;
  • the M2M packet key generation module is configured to: generate an M2M packet key corresponding to the M2M packet identifier, where the M2M packet key includes an access key and a base key;
  • An M2M packet key management module configured to: store and maintain an M2M packet key
  • a distribution module configured to: distribute the M2M packet identifier and the M2M packet key.
  • the embodiment of the invention further provides a packet communication management apparatus, comprising:
  • the M2M group identifier management module is configured to: store and maintain an M2M group identifier, and save and maintain an association list between the M2M group and the M2M device or the M2M application;
  • An M2M packet key management module configured to: store and maintain an M2M packet key
  • the receiving module is configured to: receive the M2M packet identifier and the M2M packet key.
  • the embodiment of the invention further provides a packet communication management system, including a network entity, an M2M device and an M2M application;
  • the network entity is configured to: receive request information for creating an M2M packet, where the information carries M2M user information of an M2M user requesting to create a packet, and M2M device identity information of the M2M user request packet, and/or an M2M application identity. Information, the M2M user is authenticated, and when the M2M user passes the authentication, an M2M packet including the M2M device and/or the M2M application indicated in the request information is created;
  • the M2M device or the M2M device is configured to: receive request information for creating an M2M packet sent by an M2M user, where the information carries M2M user information of an M2M user requesting to create a packet, and the M2M device that the M2M user requests a packet.
  • the identity information, and/or the M2M application identity information will send the request information for creating the M2M packet to the network entity.
  • the network entity is further configured to: generate a corresponding M2M group key for the created M2M group identifier, and save a correspondence between the M2M group key and the M2M group identifier.
  • the network entity is further configured to: send an M2M packet notification to the M2M device or the M2M application in the created M2M packet, and after receiving the confirmation information returned by the M2M device or the M2M application,
  • the packet identifier and the M2M packet key corresponding to the M2M device or the M2M application are delivered to the M2M device or the M2M application;
  • the M2M device or the M2M application is further configured to: receive an M2M packet notification sent by the network entity, perform authentication on the M2M packet notification, and notify the network entity after the M2M packet notification is authenticated. Returning the confirmation information, receiving and storing the packet identifier and the M2M packet key corresponding to the M2M communication entity delivered by the network entity.
  • the embodiment of the invention implements grouping and security management of the M2M device and the M2M application, and solves the problem of lacking grouping of the M2M device and the M2M application and performing a security management mechanism.
  • FIG. 1 is a schematic diagram of an architecture model of an M2M communication system in the related art
  • FIG. 2 is a schematic diagram of a process of creating an MTC packet according to Embodiment 1 of the present invention
  • FIG. 3 is a schematic diagram of a process of adding and updating an MTC packet according to Embodiment 1 of the present invention
  • FIG. 4 is a schematic diagram of an MTC packet deletion update process according to Embodiment 1 of the present invention.
  • FIG. 5 is a first schematic diagram of an MTC packet identifier and an M2M packet key distribution process according to Embodiment 1 of the present invention
  • FIG. 6 is a second schematic diagram of an MTC packet identifier and an M2M packet key distribution process according to Embodiment 1 of the present invention
  • FIG. 7 is a third schematic diagram of an MTC packet identifier and an M2M packet key distribution process according to Embodiment 1 of the present invention.
  • FIG. 8 is a schematic structural diagram of a packet communication management apparatus according to Embodiment 2 of the present invention.
  • FIG. 9 is a schematic structural diagram of still another packet communication management apparatus according to Embodiment 2 of the present invention.
  • FIG. 10 is a schematic structural diagram of a packet communication management system according to Embodiment 2 of the present invention.
  • embodiments of the present invention provide a packet communication management method, apparatus, and system.
  • Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Need to explain Yes, in the case of no conflict, the features in the embodiments and the embodiments in the present application can be arbitrarily combined with each other.
  • the embodiment of the present invention provides a packet communication management method.
  • the M2M packet creation process of the present invention includes:
  • Step 201 The M2M user sends the request information for creating the M2M packet to the network entity by using the M2M device or the M2M application.
  • the request information includes M2M user information, and also includes M2M device identity information of the M2M user request packet, and/or M2M application identity information.
  • Step 202 The network entity authenticates the M2M user, and determines that all the M2M devices and the M2M application in the request information can create an M2M packet for the M2M user.
  • Step 203 The network entity creates a group identifier for the M2M user according to the M2M user request information, and is used to mark all the M2M devices and the M2M application in the M2M user request information.
  • the M2M packet identification information is used as M2M packet identification information.
  • a corresponding M2M packet key is generated for the created group identifier, such as generating an access key and a base key.
  • the network entity saves and manages the packet identity and its corresponding M2M packet key.
  • Step 204 Create and save an association list of the M2M packet identifier and the M2M device identity information or the M2M application identity information.
  • Step 205 The network entity feeds back the creation completion information to the M2M user.
  • the M2M group identification information may be included in the creation completion information.
  • the M2M packet adding update process in the embodiment of the present invention includes:
  • Step 301 The M2M user sends an M2M packet add update request to the network entity by using the M2M device or the M2M application.
  • the request information includes M2M user information, and M2M packet identification information requested by the M2M user, and also includes M2M device and/or M2M application identity information to be added.
  • Step 302 The network entity authenticates the M2M user, and determines that all the M2M devices and the M2M application in the request information can be added to the M2M packet.
  • Step 303 The network entity adds the update request information according to the M2M packet, and creates an association relationship between the M2M packet identifier and the M2M device and/or the M2M application identity information to be added, and creates the association relationship.
  • the association relationship is added to the existing M2M group association relationship list, and the update of the M2M group association relationship list is completed;
  • Step 304 The network entity feeds back the completion information to the M2M user.
  • the process of the M2M packet deletion update process in the embodiment of the present invention includes:
  • Step 401 The M2M user sends an M2M packet deletion update request to the network entity by using the M2M device or the M2M application.
  • the request information includes M2M user information, and M2M packet identification information requested by the M2M user to delete, and M2M device and/or M2M application identity information to be deleted.
  • Step 402 The network entity authenticates the M2M user, and determines that all the M2M devices and the M2M application in the request information can be deleted from the M2M group.
  • Step 403 The network entity deletes the update request information according to the M2M packet, and deletes the association relationship between the M2M packet identifier in the existing M2M packet association list and the M2M device or the M2M application identity information, and completes the update of the M2M packet association relationship list.
  • Step 404 The network entity feeds back the deletion completion information to the M2M user.
  • the MTC packet identifier and the M2M packet key distribution process in the embodiment of the present invention include:
  • Step 501 The network entity sends an M2M packet notification to the M2M device or the M2M application.
  • Step 502 The M2M device or the M2M application authenticates the received packet notification message.
  • Step 503 After the authentication is passed, the M2M device or the M2M application returns the confirmation information to the network entity.
  • Step 504 The network entity sends the M2M packet identifier and the corresponding M2M packet key to the M2M device or the M2M application by using a security method.
  • Step 505 After receiving the M2M packet identifier and the M2M packet key, the M2M device or the M2M application securely saves the M2M packet identifier and the M2M packet key.
  • Step 506 The M2M device or the M2M application returns an acknowledgement message to the network entity.
  • another process of distributing the MTC packet identifier and the M2M packet key in the embodiment of the present invention includes:
  • Step 601 The network entity sends an M2M packet notification to the M2M device or the M2M application.
  • Step 602 The M2M device or the M2M application authenticates the received packet notification message.
  • Step 603 After the authentication is passed, the M2M device or the M2M application returns the confirmation information to the network entity.
  • Step 604 The network entity sends the M2M packet identifier to the M2M device or the M2M application by using a security method.
  • Step 605 After the M2M device or the M2M application receives the M2M packet identifier, the M2M device or the M2M application returns an acknowledgement message to the network entity.
  • Step 606 The M2M device or the M2M application securely saves the M2M group identifier.
  • another process of distributing the MTC packet identifier and the M2M packet key in the embodiment of the present invention includes:
  • Step 701 The network entity sends an M2M packet notification to the M2M device or the M2M application.
  • Step 702 The M2M device or the M2M application authenticates the received packet notification message.
  • Step 703 After the authentication is passed, the M2M device or the M2M application returns the confirmation information to the network entity.
  • Step 704 The network entity sends the M2M packet key corresponding to the M2M packet identifier of the M2M device or the M2M application to the M2M device or the M2M application.
  • Step 705 After the M2M device or the M2M application receives the M2M packet key, the M2M device or the M2M application returns an acknowledgement message to the network entity.
  • step 706 the M2M device or the M2M application securely saves the M2M packet key.
  • the embodiment of the present invention provides a packet communication management apparatus, and the structure of the apparatus includes:
  • the M2M group identifier generation module 801 is configured to: generate an M2M group identifier, and create an association relationship list between the M2M group and the M2M device or the M2M application;
  • the M2M group identity management module 802 is configured to: store and maintain an M2M packet identifier, and save and maintain an association list between the M2M packet and the M2M device or the M2M application;
  • the M2M packet key generation module 803 is configured to: generate an M2M packet key corresponding to the M2M packet identifier, where the M2M packet key may include an access key and a base key;
  • the M2M packet key management module 804 is configured to: store and maintain an M2M packet key
  • the distribution module 805 is configured to: distribute the M2M packet identifier and the M2M packet key;
  • the packet communication management apparatus shown in FIG. 8 can be integrated in a network entity, and the network entity performs the corresponding function.
  • An embodiment of the present invention further provides a packet communication management apparatus.
  • the structure of the apparatus is as shown in FIG. 9, and includes:
  • the M2M group identifier management module 901 is configured to: store and maintain an M2M group identifier, and save and maintain an association list between the M2M group and the M2M device or the M2M application;
  • the M2M packet key management module 902 is configured to: store and maintain an M2M packet key
  • the receiving module 903 is configured to: receive the M2M packet identifier and the M2M packet key.
  • the packet communication management device shown in FIG. 9 can be integrated into an M2M application or an M2M device, and the corresponding function is performed by the M2M application or the M2M device.
  • the embodiment of the present invention further provides a packet communication management system, which is shown in FIG. 10, and includes a network entity, an M2M device, and an M2M application.
  • the network entity is configured to: receive request information for creating an M2M packet, where the information carries M2M user information of an M2M user requesting to create a packet, and M2M device identity information of the M2M user request packet, and/or an M2M application identity. Information, the M2M user is authenticated, and when the M2M user passes the authentication, an M2M packet including the M2M device and/or the M2M application indicated in the request information is created;
  • the M2M device or the M2M device is configured to: receive request information for creating an M2M packet sent by an M2M user, where the information carries M2M user information of an M2M user requesting to create a packet, and the M2M device that the M2M user requests a packet.
  • the identity information, and/or the M2M application identity information will send the request information for creating the M2M packet to the network entity.
  • the network entity may be further configured to: generate a corresponding M2M group key for the created M2M group identifier, and save a correspondence between the M2M group key and the M2M group identifier.
  • the network entity may be configured to: send an M2M packet notification to the M2M device or the M2M application in the created M2M packet, and after receiving the confirmation information returned by the M2M device or the M2M application, the M2M device Or the M2M device or the M2M application is sent to the M2M device or the M2M application;
  • the M2M device or the M2M application may be configured to: receive an M2M packet notification sent by the network entity, perform authentication on the M2M packet notification, and send the M2M packet notification to the network after the authentication is passed.
  • the entity returns an acknowledgement message, and receives and saves the packet identifier and the M2M packet key corresponding to the M2M communication entity delivered by the network entity.
  • the MTC device is configured to: receive and save the M2M packet identifier and the M2M packet key;
  • the M2M application is configured to: receive and save the M2M packet identifier and the M2M packet key;
  • the network entity is configured to: create an M2M packet, generate an M2M packet identifier and an M2M packet key, and manage and maintain the M2M packet identifier and the M2M packet key; the network entity is further responsible for distributing the M2M packet identifier and the M2M packet key.
  • the network entity involved in the embodiment of the present invention is a mobility management entity (MME), or a serving GPRS support node (SGSN), or a home subscription subscriber server (HSS), or a machine type communication interconnection function (MTC-IWF). , or M2M business management platform.
  • MME mobility management entity
  • SGSN serving GPRS support node
  • HSS home subscription subscriber server
  • MTC-IWF machine type communication interconnection function
  • An embodiment of the present invention provides a packet communication management method, apparatus, and system, where a network entity receives request information for creating an M2M packet, where the information carries M2M user information, and the information further carries an M2M device and/or an M2M application. Identity information; authenticating the M2M user, and when the M2M user passes the authentication, the network entity creates an M2M packet containing the M2M device and/or the M2M application indicated in the request information.
  • the grouping and security management of the M2M device and the M2M application are realized, and the problem of lacking the grouping of the M2M device and the M2M application and performing the security management mechanism is solved.
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve. Thus, the invention is not limited to any specific combination of hardware and software.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • each device/function module/functional unit in the above embodiment When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • the embodiment of the invention implements grouping and security management of the M2M device and the M2M application, and solves the problem of lacking grouping of the M2M device and the M2M application and performing a security management mechanism.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Multimedia (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种分组通信管理方法、装置和系统，涉及通信领域；解决了缺乏对M2M设备和M2M应用的分组并进行安全管理机制的问题，该方法包括：网络实体接收创建M2M分组的请求信息，该信息中携带有M2M用户信息，该信息中还携带有M2M设备和/或M2M应用的身份信息；所述网络实体对所述M2M用户进行鉴权；在所述M2M用户通过鉴权时，所述网络实体创建包含所述请求信息中指示的M2M设备和/或M2M应用的M2M分组。

Description

分组通信管理方法、装置和系统 技术领域
本发明涉及通信领域，尤其涉及一种分组通信管理方法、装置和系统。
背景技术
未来的通信网络中的通信将更多的以设备与设备，及设备与数据中心之间的通信为主。越来越便宜的存储技术将使得人与设备获得海量信息成为可能。伴随着芯片处理能力和实时在线技术的发展，设备将成为未来移动通信中的主要参与者。机器到机器(M2M，Machine to Machine)通信是指应用通信技术，实现机器与机器、机器与人之间的数据通信和交流的一系列技术及其组合的总称。
M2M系统架构可以划分为M2M应用层、M2M业务能力层、M2M通信网络层、M2M终端及感知延伸层，如图1所示。
由于MTC整合了通信技术和信息技术，且可用于双向通信，如远距离收集信息、设置参数并发送指令，因此能够实现不同的应用方案，如安全监测、自动售货、货物跟踪等。由此可见，几乎所有日常生活中涉及到的设备都有可能成为潜在的服务对象。
在物联网M2M通信系统中，参与M2M通信的实体包括数量众多的M2M设备和M2M应用，为了降低网络负载，节省网络资源，需要对M2M设备和M2M应用以组的方式进行管理优化，这样，M2M设备和M2M应用就可以按组的方式进行控制、管理及计费等，从而适应运营商的需求。目前，提出了MTC设备和M2M应用可以按照所在区域是否相同、或者是否具有相同的M2M特征、或者是否属于相同的M2M用户进行分组。同一组的M2M设备和M2M应用共享相同的M2M分组密钥，如接入密钥和基础密钥。在对MTC设备和M2M应用进行分组后，需要对组信息进行安全保护，否则，一个攻击者可能伪装成组成员获得组信息。同时，需要实现对一组M2M设备和M2M应用及其共享的M2M分组密钥进行安全远程管理。
目前虽然提出了M2M设备按区域、M2M特征或M2M用户进行分组的建议，但是还没有基于这些建议的针对一组M2M设备和M2M应用及其共享的M2M分组密钥进行安全远程管理的具体实现方案，因此如何实现M2M设备和M2M应用的分组，并对M2M分组中的M2M设备和M2M应用进行安全管理是需要解决的问题。
发明内容
本发明实施例提供了一种分组通信管理方法、装置和系统，解决了缺乏对M2M设备和M2M应用的分组并进行安全管理机制的问题。
一种分组通信管理方法，包括：
网络实体接收创建M2M分组的请求信息，该信息中携带有M2M用户信息，该信息中还携带有M2M设备和/或M2M应用的身份信息；
所述网络实体对所述M2M用户进行鉴权；
在所述M2M用户通过鉴权时，所述网络实体创建包含所述请求信息中指示的M2M设备和/或M2M应用的M2M分组。
可选地，在所述M2M用户通过鉴权时，所述网络实体创建包含所述请求信息中指示的M2M设备和/或M2M应用的M2M分组包括：
所述网络实体为所述M2M分组创建分组标识；
所述网络实体保存所述M2M分组标识和所述M2M分组中M2M设备的身份信息和/或M2M应用的身份信息的关联关系列表。
可选地，所述在所述M2M用户通过鉴权时，所述网络实体创建包含所述请求信息中指示的M2M设备和/或M2M应用的M2M分组的步骤之后，还包括：
所述网络实体向请求创建分组的M2M用户反馈创建完成信息。
可选地，该方法还包括：
所述网络实体接收M2M分组添加更新请求信息，请求向所述网络实体已创建的M2M分组中添加新的M2M设备和/或M2M应用，所述M2M分组 添加更新请求信息携带有发出该M2M分组添加更新请求信息的M2M用户的M2M用户信息、要求更新的M2M分组标识信息以及要增加至所述M2M分组的M2M设备和/或M2M应用的身份信息；
所述网络实体对发出所述M2M分组添加更新请求信息的M2M用户进行鉴权；
所述网络实体在所述M2M用户通过鉴权时，根据所述M2M分组标识信息确定相应的M2M分组，并将所述M2M分组添加更新请求信息指示的M2M设备和/或M2M应用添加至所述M2M分组；
所述网络实体向所述M2M用户反馈添加完成信息。
可选地，该方法还包括：
所述网络实体接收M2M分组删除更新请求信息，请求自所述网络实体已创建的M2M分组中删除M2M设备和/或M2M应用，所述M2M分组删除更新请求信息携带有发出该M2M分组删除更新请求信息的M2M用户的M2M用户信息、要求更新的M2M分组标识信息以及要删除的M2M设备和/或M2M应用的身份信息；
所述网络实体对发出所述M2M分组删除更新请求信息的M2M用户进行鉴权；
所述网络实体在所述M2M用户通过鉴权时，根据所述M2M分组标识信息确定相应的M2M分组，并将所述M2M分组删除更新请求信息指示的M2M设备和/或M2M应用自所述M2M分组中删除；
所述网络实体向所述M2M用户反馈删除完成信息。
可选地，该方法还包括：
所述网络实体针对创建的M2M分组标识生成对应的M2M分组密钥，并保存该M2M分组密钥与所述M2M分组标识的对应关系。
可选地，该方法还包括：
所述网络实体向已创建的M2M分组中的M2M设备或M2M应用下发M2M分组通知；
所述网络实体在接收到所述M2M设备或M2M应用返回的确认信息后，将该M2M设备或M2M应用对应的分组标识及M2M分组密钥下发到该M2M设备或M2M应用。
可选地，所述M2M分组标识和M2M分组密钥在同一过程中同时下发到M2M设备或M2M应用。
可选地，所述M2M分组标识和M2M分组密钥分别在不同过程中下发到M2M设备或M2M应用。
可选地，所述网络实体为MME，或者SGSN，或者HSS，或者MTC-IWF，或者M2M业务管理平台。
本发明实施例还提供了另一种分组通信管理方法，该方法包括：
M2M设备或M2M应用接收M2M用户发送的创建M2M分组的请求信息，该信息中携带有请求创建分组的M2M用户的M2M用户信息，以及该M2M用户请求分组的M2M设备身份信息，和/或M2M应用身份信息；
所述M2M设备或M2M应用向网络实体发送所述创建M2M分组的请求信息。
可选地，所述M2M设备或M2M应用向网络实体发送所述创建M2M分组的请求信息的步骤之后，还包括：
所述M2M设备或M2M应用接收所述网络实体反馈的创建完成信息，指示请求创建的M2M分组创建成功。
可选地，该方法还包括：
所述M2M设备或M2M应用向所述网络实体发送M2M分组添加更新请求信息，请求向所述网络实体已创建的M2M分组中添加新的M2M设备和/或M2M应用，所述M2M分组添加更新请求信息携带有发出该M2M分组添加更新请求信息的M2M用户的M2M用户信息、要求更新的M2M分组标识信息以及要增加至所述M2M分组的M2M设备和/或M2M应用的身份信息；
所述M2M设备或M2M应用接收所述网络实体反馈的添加完成信息。
可选地，该方法还包括：
所述M2M设备或M2M应用向所述网络实体发送M2M分组删除更新请求信息，请求自所述网络实体已创建的M2M分组中删除M2M设备和/或M2M应用，所述M2M分组添加更新请求信息携带有发出该M2M分组删除更新请求信息的M2M用户的M2M用户信息、要求更新的M2M分组标识信息以及要删除的M2M设备和/或M2M应用的身份信息；
所述M2M通信实体接收所述网络实体反馈的删除完成信息。
可选地，所述M2M设备或M2M应用向网络实体发送所述创建M2M分组的请求信息的步骤之后，还包括：
所述M2M设备或M2M应用接收所述网络实体下发的M2M分组通知，对所述M2M分组通知进行鉴权；
所述M2M设备或M2M应用在所述M2M分组通知通过鉴权后，向所述网络实体返回确认信息；
所述M2M设备或M2M应用接收并保存所述网络实体下发的与该M2M通信实体相对应的分组标识及M2M分组密钥。
本发明实施例还提供了一种分组通信管理装置，包括：
M2M分组标识生成模块，设置为：生成M2M分组标识，创建M2M分组与M2M设备或M2M应用的关联关系列表；
M2M分组标识管理模块，设置为：存储和维护M2M分组标识，保存和维护M2M分组与M2M设备或M2M应用的关联关系列表；
M2M分组密钥生成模块，设置为：生成对应于M2M分组标识的M2M分组密钥，M2M分组密钥包括接入密钥和基础密钥；
M2M分组密钥管理模块，设置为：存储和维护M2M分组密钥；以及
分发模块，设置为：分发M2M分组标识和M2M分组密钥。
本发明实施例还提供了一种分组通信管理装置，包括：
M2M分组标识管理模块，设置为：存储和维护M2M分组标识，保存和维护M2M分组与M2M设备或M2M应用的关联关系列表；
M2M分组密钥管理模块，设置为：存储和维护M2M分组密钥；以及
接收模块，设置为：接收M2M分组标识和M2M分组密钥。
本发明实施例还提供了一种分组通信管理系统，包括网络实体，M2M设备和M2M应用；
所述网络实体，设置为：接收创建M2M分组的请求信息，该信息中携带有请求创建分组的M2M用户的M2M用户信息，以及该M2M用户请求分组的M2M设备身份信息，和/或M2M应用身份信息，对所述M2M用户进行鉴权，在所述M2M用户通过鉴权时，创建包含所述请求信息中指示的M2M设备和/或M2M应用的M2M分组；
所述M2M设备或所述M2M应用，设置为：接收M2M用户发送的创建M2M分组的请求信息，该信息中携带有请求创建分组的M2M用户的M2M用户信息，以及该M2M用户请求分组的M2M设备身份信息，和/或M2M应用身份信息，将向网络实体发送所述创建M2M分组的请求信息。
可选地，所述网络实体，还设置为：针对创建的M2M分组标识生成对应的M2M分组密钥，并保存该M2M分组密钥与所述M2M分组标识的对应关系。
可选地，所述网络实体，还设置为：向已创建的M2M分组中的M2M设备或M2M应用下发M2M分组通知，并在接收到所述M2M设备或M2M应用返回的确认信息后，将该M2M设备或M2M应用对应的分组标识及M2M分组密钥下发到该M2M设备或M2M应用；
所述M2M设备或M2M应用，还设置为：接收所述网络实体下发的M2M分组通知，对所述M2M分组通知进行鉴权，在所述M2M分组通知通过鉴权后，向所述网络实体返回确认信息，接收并保存所述网络实体下发的与该M2M通信实体相对应的分组标识及M2M分组密钥。
本发明实施例实现了对M2M设备和M2M应用的分组并进行安全管理，解决了缺乏对M2M设备和M2M应用的分组并进行安全管理机制的问题。
附图概述
图1为相关技术中的一种M2M通信系统架构模型示意图；
图2为本发明实施例一的MTC分组创建过程示意图；
图3为本发明实施例一的MTC分组添加更新过程示意图；
图4为本发明实施例一的MTC分组删除更新过程示意图；
图5为本发明实施例一的MTC分组标识和M2M分组密钥分发过程第一示意图；
图6为本发明实施例一的MTC分组标识和M2M分组密钥分发过程第二示意图；
图7为本发明实施例一的MTC分组标识和M2M分组密钥分发过程第三示意图；
图8为本发明的实施例二提供的一种分组通信管理装置的结构示意图；
图9为本发明的实施例二提供的又一种分组通信管理装置的结构示意图；
图10为本发明的实施例二提供的一种分组通信管理系统的结构示意图。
本发明的较佳实施方式
目前虽然提出了M2M设备按区域、M2M特征或M2M用户进行分组的建议，但是还没有基于这些建议的针对一组M2M设备和M2M应用及其共享的M2M分组密钥进行安全远程管理的具体实现方案，因此如何实现M2M设备和M2M应用的分组，并对M2M分组中的M2M设备和M2M应用进行安全管理是需要解决的问题。
为了解决上述问题，本发明的实施例提供了一种分组通信管理方法、装置和系统。下文中将结合附图对本发明的实施例进行详细说明。需要说明的 是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
首先结合附图，对本发明的实施例一进行说明。
本发明实施例提供了一种分组通信管理方法，如图2所示，本发明M2M分组创建过程包括：
步骤201，M2M用户通过M2M设备或M2M应用向网络实体发送创建M2M分组的请求信息。请求信息包括M2M用户信息，还包括M2M用户请求分组的M2M设备身份信息，和/或M2M应用身份信息。
步骤202，网络实体对M2M用户进行鉴权，确定可以用请求信息中的所有M2M设备和M2M应用为该M2M用户创建M2M分组。
步骤203，网络实体根据M2M用户请求信息为M2M用户创建一个分组标识，用于标记M2M用户请求信息中所有的M2M设备和M2M应用。M2M分组标识信息即作为M2M分组标识信息。同时针对创建的分组标识生成对应的M2M分组密钥，如生成一个接入密钥和一个基础密钥。网络实体保存并管理分组标识及其对应的M2M分组密钥。
步骤204，创建并保存M2M分组标识和M2M设备身份信息或M2M应用身份信息的关联关系列表。
步骤205，网络实体向M2M用户反馈创建完成信息。创建完成信息中可以包括M2M分组标识信息。
如图3所示，本发明实施例的M2M分组添加更新流程包括：
步骤301，M2M用户通过M2M设备或M2M应用向网络实体发送M2M分组添加更新请求。请求信息包括M2M用户信息，以及M2M用户请求更新的M2M分组标识信息，还包括要增加的M2M设备和/或M2M应用身份信息。
步骤302，网络实体对M2M用户进行鉴权，确定可以将请求信息中的所有M2M设备和M2M应用添加到M2M分组中；
步骤303，网络实体根据M2M分组添加更新请求信息，创建M2M分组标识和要添加的M2M设备和/或M2M应用身份信息的关联关系，并将创建 的所述关联关系添加到已有的M2M分组关联关系列表中，完成M2M分组关联关系列表的更新；
步骤304，网络实体向M2M用户反馈添加完成信息；
如图4所示，本发明实施例M2M分组删除更新过程的流程包括：
步骤401，M2M用户通过M2M设备或M2M应用向网络实体发送M2M分组删除更新请求。请求信息包括M2M用户信息，以及M2M用户请求删除的M2M分组标识信息，以及要删除的M2M设备和/或M2M应用身份信息。
步骤402，网络实体对M2M用户进行鉴权，确定可以将请求信息中的所有M2M设备和M2M应用从M2M分组中删除；
步骤403，网络实体根据M2M分组删除更新请求信息，将已有的M2M分组关联关系列表中的M2M分组标识与M2M设备或M2M应用身份信息的关联关系删除，完成M2M分组关联关系列表的更新；
步骤404，网络实体向M2M用户反馈删除完成信息；
如图5所示，本发明实施例的MTC分组标识和M2M分组密钥分发过程包括：
步骤501，网络实体向M2M设备或M2M应用下发M2M分组通知；
步骤502，M2M设备或M2M应用对接收到的分组通知报文进行鉴权；
步骤503，鉴权通过后，M2M设备或M2M应用向网络实体返回确认信息；
步骤504，网络实体将M2M分组标识及其对应的M2M分组密钥通过安全方法下发到M2M设备或M2M应用；
步骤505，M2M设备或M2M应用接收到M2M分组标识和M2M分组密钥后，安全保存M2M分组标识和M2M分组密钥；
步骤506，M2M设备或M2M应用向网络实体返回确认消息；
如图6所示，本发明实施例MTC分组标识和M2M分组密钥另一分发过程包括：
步骤601，网络实体向M2M设备或M2M应用下发M2M分组通知；
步骤602，M2M设备或M2M应用对接收到的分组通知报文进行鉴权；
步骤603，鉴权通过后，M2M设备或M2M应用向网络实体返回确认信息；
步骤604，网络实体将M2M分组标识通过安全方法下发到M2M设备或M2M应用；
步骤605，M2M设备或M2M应用接收到M2M分组标识后，M2M设备或M2M应用向网络实体返回确认消息；
步骤606，M2M设备或M2M应用安全保存M2M分组标识；
如图7所示，本发明实施例的MTC分组标识和M2M分组密钥又一分发过程包括：
步骤701，网络实体向M2M设备或M2M应用下发M2M分组通知；
步骤702，M2M设备或M2M应用对接收到的分组通知报文进行鉴权；
步骤703，鉴权通过后，M2M设备或M2M应用向网络实体返回确认信息；
步骤704，网络实体将M2M设备或M2M应用所属M2M分组标识对应的M2M分组密钥通过安全方法下发到M2M设备或M2M应用；
步骤705，M2M设备或M2M应用接收到M2M分组密钥后，M2M设备或M2M应用向网络实体返回确认消息；
步骤706，M2M设备或M2M应用安全保存M2M分组密钥。
下面结合附图，对本发明的实施例二进行说明。
如图8所示，本发明实施例提供了一种分组通信管理装置，该装置的结构包括：
M2M分组标识生成模块801，设置为：生成M2M分组标识，创建M2M分组与M2M设备或M2M应用的关联关系列表；
M2M分组标识管理模块802，设置为：存储和维护M2M分组标识，保存和维护M2M分组与M2M设备或M2M应用的关联关系列表；
M2M分组密钥生成模块803，设置为：生成对应于M2M分组标识的M2M分组密钥，M2M分组密钥可以包括接入密钥，基础密钥；
M2M分组密钥管理模块804，设置为：存储和维护M2M分组密钥；
分发模块805，设置为：分发M2M分组标识和M2M分组密钥；
图8所示的分组通信管理装置可集成于网络实体中，由网络实体完成相应功能。
本发明实施例还提供了一种分组通信管理装置，该装置的结构如图9所示，包括：
M2M分组标识管理模块901，设置为：存储和维护M2M分组标识，保存和维护M2M分组与M2M设备或M2M应用的关联关系列表；
M2M分组密钥管理模块902，设置为：存储和维护M2M分组密钥；
接收模块903，设置为：接收M2M分组标识和M2M分组密钥。
如图9所示的分组通信管理装置可集成于M2M应用或M2M设备中，由M2M应用或M2M设备完成相应功能。
本发明实施例还提供了一种分组通信管理系统，该系统如图10所示，包括网络实体，M2M设备和M2M应用；
所述网络实体，设置为：接收创建M2M分组的请求信息，该信息中携带有请求创建分组的M2M用户的M2M用户信息，以及该M2M用户请求分组的M2M设备身份信息，和/或M2M应用身份信息，对所述M2M用户进行鉴权，在所述M2M用户通过鉴权时，创建包含所述请求信息中指示的M2M设备和/或M2M应用的M2M分组；
所述M2M设备或所述M2M应用，设置为：接收M2M用户发送的创建M2M分组的请求信息，该信息中携带有请求创建分组的M2M用户的M2M用户信息，以及该M2M用户请求分组的M2M设备身份信息，和/或M2M应用身份信息，将向网络实体发送所述创建M2M分组的请求信息。
所述网络实体，还可设置为：针对创建的M2M分组标识生成对应的M2M分组密钥，并保存该M2M分组密钥与所述M2M分组标识的对应关系。
所述网络实体，还可设置为：向已创建的M2M分组中的M2M设备或M2M应用下发M2M分组通知，并在接收到所述M2M设备或M2M应用返回的确认信息后，将该M2M设备或M2M应用对应的分组标识及M2M分组密钥下发到该M2M设备或M2M应用；
所述M2M设备或M2M应用，还可设置为：接收所述网络实体下发的M2M分组通知，对所述M2M分组通知进行鉴权，在所述M2M分组通知通过鉴权后，向所述网络实体返回确认信息，接收并保存所述网络实体下发的与该M2M通信实体相对应的分组标识及M2M分组密钥。
MTC设备，设置为：接收和保存M2M分组标识和M2M分组密钥；
M2M应用，设置为：接收和保存M2M分组标识和M2M分组密钥；
网络实体，设置为：创建M2M分组，生成M2M分组标识和M2M分组密钥，并对M2M分组标识和M2M分组密钥进行管理和维护；网络实体还负责M2M分组标识和M2M分组密钥的分发。
本发明的实施例中所涉及的所述网络实体为移动管理实体(MME)，或者服务GPRS支持节点(SGSN)，或者归属签约用户服务器(HSS)，或者机器类型通信互联功能(MTC-IWF)，或者M2M业务管理平台。
本发明的实施例提供了一种分组通信管理方法、装置和系统，网络实体接收创建M2M分组的请求信息，该信息中携带有M2M用户信息，该信息中还携带有M2M设备和/或M2M应用的身份信息；对所述M2M用户进行鉴权，并在所述M2M用户通过鉴权时，所述网络实体创建包含所述请求信息中指示的M2M设备和/或M2M应用的M2M分组。实现了对M2M设备和M2M应用的分组并进行安全管理，解决了缺乏对M2M设备和M2M应用的分组并进行安全管理机制的问题。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
上述实施例中的各装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的各装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以权利要求所述的保护范围为准。
工业实用性
本发明实施例实现了对M2M设备和M2M应用的分组并进行安全管理，解决了缺乏对M2M设备和M2M应用的分组并进行安全管理机制的问题。

Claims (21)

  1. 一种分组通信管理方法，包括：
    网络实体接收创建机器到机器(M2M)分组的请求信息，该请求信息携带M2M用户信息，该信息还携带M2M设备和/或M2M应用的身份信息；
    所述网络实体对所述M2M用户进行鉴权；
    在所述M2M用户通过鉴权时，所述网络实体创建包含所述请求信息指示的M2M设备和/或M2M应用的M2M分组。
  2. 根据权利要求1所述的分组通信管理方法，其中，在所述M2M用户通过鉴权时，所述网络实体创建包含所述请求信息指示的M2M设备和/或M2M应用的M2M分组包括：
    所述网络实体为所述M2M分组创建分组标识；
    所述网络实体保存所述M2M分组标识和所述M2M分组中M2M设备的身份信息和/或M2M应用的身份信息的关联关系列表。
  3. 根据权利要求2所述的分组通信管理方法，其中，所述在所述M2M用户通过鉴权时，所述网络实体创建包含所述请求信息指示的M2M设备和/或M2M应用的M2M分组的步骤之后，还包括：
    所述网络实体向请求创建分组的M2M用户反馈创建完成信息。
  4. 根据权利要求3所述的分组通信管理方法，该方法还包括：
    所述网络实体接收M2M分组添加更新请求信息，请求向所述网络实体已创建的M2M分组中添加新的M2M设备和/或M2M应用，所述M2M分组添加更新请求信息携带有发出该M2M分组添加更新请求信息的M2M用户的M2M用户信息、要求更新的M2M分组标识信息以及要增加至所述M2M分组的M2M设备和/或M2M应用的身份信息；
    所述网络实体对发出所述M2M分组添加更新请求信息的M2M用户进行鉴权；
    所述网络实体在所述M2M用户通过鉴权时，根据所述M2M分组标识信 息确定相应的M2M分组，并将所述M2M分组添加更新请求信息指示的M2M设备和/或M2M应用添加至所述M2M分组；
    所述网络实体向所述M2M用户反馈添加完成信息。
  5. 根据权利要求3所述的分组通信管理方法，该方法还包括：
    所述网络实体接收M2M分组删除更新请求信息，请求自所述网络实体已创建的M2M分组中删除M2M设备和/或M2M应用，所述M2M分组删除更新请求信息携带有发出该M2M分组删除更新请求信息的M2M用户的M2M用户信息、要求更新的M2M分组标识信息以及要删除的M2M设备和/或M2M应用的身份信息；
    所述网络实体对发出所述M2M分组删除更新请求信息的M2M用户进行鉴权；
    所述网络实体在所述M2M用户通过鉴权时，根据所述M2M分组标识信息确定相应的M2M分组，并将所述M2M分组删除更新请求信息指示的M2M设备和/或M2M应用自所述M2M分组中删除；
    所述网络实体向所述M2M用户反馈删除完成信息。
  6. 根据权利要求1至5任一所述的分组通信管理方法，该方法还包括：
    所述网络实体针对创建的M2M分组标识生成对应的M2M分组密钥，并保存该M2M分组密钥与所述M2M分组标识的对应关系。
  7. 根据权利要求6所述的分组通信管理方法，该方法还包括：
    所述网络实体向已创建的M2M分组中的M2M设备或M2M应用下发M2M分组通知；
    所述网络实体在接收到所述M2M设备或M2M应用返回的确认信息后，将该M2M设备或M2M应用对应的分组标识及M2M分组密钥下发到该M2M设备或M2M应用。
  8. 根据权利要求7所述的分组通信管理方法，其中，所述M2M分组标识和M2M分组密钥在同一过程中同时下发到M2M设备或M2M应用。
  9. 根据权利要求7所述的分组通信管理方法，其中，所述M2M分组标识和M2M分组密钥分别在不同过程中下发到M2M设备或M2M应用。
  10. 根据权利要求1所述的分组通信管理方法，其中，所述网络实体为移动管理实体(MME)，或者服务GPRS支持节点(SGSN)，或者归属签约用户服务器(HSS)，或者机器类型通信互联功能(MTC-IWF)，或者M2M业务管理平台。
  11. 一种分组通信管理方法，包括：
    机器对机器(M2M)设备或M2M应用接收M2M用户发送的创建M2M分组的请求信息，该请求信息携带请求创建分组的M2M用户的M2M用户信息，该请求信息还携带该M2M用户请求分组的M2M设备身份信息，和/或M2M应用身份信息；
    所述M2M设备或M2M应用向网络实体发送所述创建M2M分组的请求信息。
  12. 根据权利要求11所述的分组通信管理方法，其中，所述M2M设备或M2M应用向网络实体发送所述创建M2M分组的请求信息的步骤之后，还包括：
    所述M2M设备或M2M应用接收所述网络实体反馈的创建完成信息，指示请求创建的M2M分组创建成功。
  13. 根据权利要求11所述的分组通信管理方法，该方法还包括：
    所述M2M设备或M2M应用向所述网络实体发送M2M分组添加更新请求信息，请求向所述网络实体已创建的M2M分组中添加新的M2M设备和/或M2M应用，所述M2M分组添加更新请求信息携带有发出该M2M分组添加更新请求信息的M2M用户的M2M用户信息、要求更新的M2M分组标识信息以及要增加至所述M2M分组的M2M设备和/或M2M应用的身份信息；
    所述M2M设备或M2M应用接收所述网络实体反馈的添加完成信息。
  14. 根据权利要求11所述的分组通信管理方法，该方法还包括：
    所述M2M设备或M2M应用向所述网络实体发送M2M分组删除更新请求信息，请求自所述网络实体已创建的M2M分组中删除M2M设备和/或M2M应用，所述M2M分组添加更新请求信息携带有发出该M2M分组删除更新请求信息的M2M用户的M2M用户信息、要求更新的M2M分组标识信息以及要删除的M2M设备和/或M2M应用的身份信息；
    所述M2M通信实体接收所述网络实体反馈的删除完成信息。
  15. 根据权利要求11所述的分组通信管理方法，其中，所述M2M设备或M2M应用向网络实体发送所述创建M2M分组的请求信息的步骤之后，还包括：
    所述M2M设备或M2M应用接收所述网络实体下发的M2M分组通知，对所述M2M分组通知进行鉴权；
    所述M2M设备或M2M应用在所述M2M分组通知通过鉴权后，向所述网络实体返回确认信息；
    所述M2M设备或M2M应用接收并保存所述网络实体下发的与该M2M通信实体相对应的分组标识及M2M分组密钥。
  16. 一种分组通信管理装置，包括：
    机器对机器(M2M)分组标识生成模块，设置为：生成M2M分组标识，创建M2M分组与M2M设备或M2M应用的关联关系列表；
    M2M分组标识管理模块，设置为：存储和维护M2M分组标识，保存和维护M2M分组与M2M设备或M2M应用的关联关系列表；
    M2M分组密钥生成模块，设置为：生成对应于M2M分组标识的M2M分组密钥，M2M分组密钥包括接入密钥和基础密钥；
    M2M分组密钥管理模块，设置为：存储和维护M2M分组密钥；以及
    分发模块，设置为：分发M2M分组标识和M2M分组密钥。
  17. 一种分组通信管理装置，包括：
    M2M分组标识管理模块，设置为：存储和维护M2M分组标识，保存和 维护M2M分组与M2M设备或M2M应用的关联关系列表；
    M2M分组密钥管理模块，设置为：存储和维护M2M分组密钥；以及
    接收模块，设置为：接收M2M分组标识和M2M分组密钥。
  18. 一种分组通信管理系统，包括网络实体，M2M设备和M2M应用；
    所述网络实体，设置为：接收创建M2M分组的请求信息，该信息携带请求创建分组的M2M用户的M2M用户信息，还携带该M2M用户请求分组的M2M设备身份信息，和/或M2M应用身份信息，对所述M2M用户进行鉴权，在所述M2M用户通过鉴权时，创建包含所述请求信息中指示的M2M设备和/或M2M应用的M2M分组；
    所述M2M设备或所述M2M应用，设置为：接收M2M用户发送的创建M2M分组的请求信息，该信息携带请求创建分组的M2M用户的M2M用户信息，还携带该M2M用户请求分组的M2M设备身份信息，和/或M2M应用身份信息，将向网络实体发送所述创建M2M分组的请求信息。
  19. 根据权利要求18所述的分组通信管理系统，其中，
    所述网络实体，还设置为：针对创建的M2M分组标识生成对应的M2M分组密钥，并保存该M2M分组密钥与所述M2M分组标识的对应关系。
  20. 根据权利要求19所述的分组通信管理系统，其中，
    所述网络实体，还设置为：向已创建的M2M分组中的M2M设备或M2M应用下发M2M分组通知，并在接收到所述M2M设备或M2M应用返回的确认信息后，将该M2M设备或M2M应用对应的分组标识及M2M分组密钥下发到该M2M设备或M2M应用；
    所述M2M设备或M2M应用，还设置为：接收所述网络实体下发的M2M分组通知，对所述M2M分组通知进行鉴权，在所述M2M分组通知通过鉴权后，向所述网络实体返回确认信息，接收并保存所述网络实体下发的与该M2M通信实体相对应的分组标识及M2M分组密钥。
  21. 一种计算机可读存储介质，存储有程序指令，当该程序指令被执行时可实现权利要求1-15任一项所述的方法。
PCT/CN2015/073362 2014-11-05 2015-02-27 分组通信管理方法、装置和系统 WO2015184870A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410618050.6A CN105636031A (zh) 2014-11-05 2014-11-05 分组通信管理方法、装置和系统
CN201410618050.6 2014-11-05

Publications (1)

Publication Number Publication Date
WO2015184870A1 true WO2015184870A1 (zh) 2015-12-10

Family

ID=54766096

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/073362 WO2015184870A1 (zh) 2014-11-05 2015-02-27 分组通信管理方法、装置和系统

Country Status (2)

Country Link
CN (1) CN105636031A (zh)
WO (1) WO2015184870A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107566325A (zh) * 2016-07-01 2018-01-09 中兴通讯股份有限公司 接入网络的方法及装置
CN109788011B (zh) * 2017-11-13 2021-11-26 京东方科技集团股份有限公司 对资源进行关联的方法、通信终端和通信节点设备
CN111862494B (zh) * 2020-07-15 2021-06-11 深圳市海恒智能科技有限公司 一种基于终端自助设备人脸识别的借还书方法及系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120030358A1 (en) * 2010-01-29 2012-02-02 Mackenzie James A Group-based machine to machine communication
CN102469455A (zh) * 2010-11-08 2012-05-23 中兴通讯股份有限公司 基于通用引导架构的机器类通信设备分组管理方法及系统
CN102638866A (zh) * 2012-04-16 2012-08-15 东南大学 一种基于m2m业务特征的移动通信网络接入方法

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP5844794B2 (ja) * 2010-08-05 2016-01-20 日本電気株式会社 マシンタイプ通信におけるグループセキュリティ
CN102469458B (zh) * 2010-11-19 2015-08-12 中兴通讯股份有限公司 一种m2m通信中的组认证方法和系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120030358A1 (en) * 2010-01-29 2012-02-02 Mackenzie James A Group-based machine to machine communication
CN102469455A (zh) * 2010-11-08 2012-05-23 中兴通讯股份有限公司 基于通用引导架构的机器类通信设备分组管理方法及系统
CN102638866A (zh) * 2012-04-16 2012-08-15 东南大学 一种基于m2m业务特征的移动通信网络接入方法

Also Published As

Publication number Publication date
CN105636031A (zh) 2016-06-01

Similar Documents

Publication Publication Date Title
US20210133359A1 (en) Permission management method, permission verification method, and related apparatus
CN107579958B (zh) 数据管理方法、装置及系统
US20230316273A1 (en) Data processing method and apparatus, computer device, and storage medium
WO2016026330A1 (zh) 共享许可证的方法和装置
CN111742531B (zh) 简档信息共享
US10454909B2 (en) Key negotiation method and system, network entity and computer storage medium
CN104468518A (zh) 业务管理方法、装置和系统
US10142805B2 (en) Method for managing child resource of group member in wireless communication system and device for same
CN104184713A (zh) 终端识别方法、机器识别码注册方法及相应系统、设备
CN111338906B (zh) 终端设备、边缘节点及基于区块链的应用监管方法和系统
CN102693455A (zh) 一种基于金融ic卡的数据准备全自动化系统及方法
WO2021088882A1 (zh) 数据共享的方法、设备及系统
WO2015184870A1 (zh) 分组通信管理方法、装置和系统
TW202240445A (zh) 可將取用訊標由區塊鏈子系統移轉給資料請求者裝置的去中心化資料授權控管系統
CN111339130A (zh) 一种数据查询方法、相关设备及可读存储介质
KR101931851B1 (ko) M2m 시스템에서 위치정보 업데이트 주기를 변경하는 방법
WO2015117362A1 (zh) 终端上个人信息的共享方法及装置
US9232078B1 (en) Method and system for data usage accounting across multiple communication networks
CN106162515B (zh) 一种机器类通信安全通信的方法、装置和系统
WO2016101429A1 (zh) 一种mtc分组管理方法、装置及系统，网络实体
WO2016165443A1 (zh) 一种保护机器类通信设备的方法、网络实体及mtc设备
CN113966602A (zh) 区块链中区块的分布式存储
TWI672037B (zh) 用於識別網路中的設備的方法及裝置
CN105071959A (zh) 一种基于电网设备统一注册的即插即用的管理方法和系统
KR20220156429A (ko) M2m 시스템에서 디지털 권한 관리를 지원하기 위한 방법 및 장치

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15803608

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15803608

Country of ref document: EP

Kind code of ref document: A1