WO2016141794A1 - 一种实现分组认证的方法及系统 - Google Patents

一种实现分组认证的方法及系统 Download PDF

Info

Publication number
WO2016141794A1
WO2016141794A1 PCT/CN2016/073650 CN2016073650W WO2016141794A1 WO 2016141794 A1 WO2016141794 A1 WO 2016141794A1 CN 2016073650 W CN2016073650 W CN 2016073650W WO 2016141794 A1 WO2016141794 A1 WO 2016141794A1
Authority
WO
WIPO (PCT)
Prior art keywords
mtc
packet
mtc packet
network entity
authentication
Prior art date
Application number
PCT/CN2016/073650
Other languages
English (en)
French (fr)
Inventor
余万涛
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016141794A1 publication Critical patent/WO2016141794A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/76—Group identity

Definitions

  • This document relates to, but is not limited to, IoT communication technology, especially a method and system for implementing packet authentication based on Machine Type Communication (MTC).
  • MTC Machine Type Communication
  • Machine-to-machine communication is a general term for a series of technologies and combinations of applications that use communication technology to implement data communication between machines and machines, machines and people.
  • MTC integrates communication technology and information technology, and can be used for two-way communication, such as collecting information over long distances, setting parameters and sending instructions; therefore, MTC can implement different application programs, such as security monitoring, vending, cargo tracking, etc. . It can be seen that almost all the equipment involved in daily life may become a potential service target of MTC.
  • the entities participating in the MTC include a large number of MTC devices and MTC applications.
  • the MTC devices and the MTC applications need to be managed and optimized in groups.
  • the MTC devices and the MTC applications are used. It can be controlled, managed and billed in groups to meet the needs of operators.
  • the MTC packet needs to be uniformly authenticated.
  • the MTC packet authentication mode generally includes, first, the network separately authenticates each MTC device, and then associates one or more MTC devices with one MTC packet.
  • each MTC device in the MTC packet needs to be separately authenticated separately, and then, for each MTC device, it needs to be associated with the MTC packet. This complicates the process of MTC packet authentication and increases the signaling load of the MTC system.
  • Embodiments of the present invention provide a method and system for implementing packet authentication, which can implement MTC packet authentication by a simple procedure, and reduce signaling load of the MTC communication system.
  • An embodiment of the present invention provides a method for implementing packet authentication, including:
  • the MTC packet member that has received the packet authentication request information performs mutual authentication with the network entity according to the MTC packet identifier in the packet authentication request information and the MTC packet key of the MTC packet.
  • the method also includes:
  • the network entity pre-creates an MTC packet
  • the network entity pre-establishes an association relationship between the created MTC packet and the MTC packet member.
  • the group authentication request information for sending the MTC packet includes:
  • the MBS mode is pushed by the universal bootstrap GBA-push process or the multimedia broadcast multicast service, and the network entity sends the packet authentication request information to one of the MTC packet members associated with the MTC packet.
  • the two-way authentication includes:
  • the method before the sending, by the network entity, one of the MTC packet members associated with the MTC packet, the group authentication request information of the MTC packet, the method further includes:
  • Each of the MTC packet members associated with the MTC packet saves the MTC packet Identification and the MTC packet key.
  • it also includes:
  • the network entity After the network entity sends the MTC packet identifier and the corresponding MTC packet key to all MTC packet members, the network entity is in front of the network entity sending the packet authentication request information of the MTC packet to one of the MTC packet members. Adding a new MTC packet member to the MTC packet, or deleting an MTC packet member in the MTC packet.
  • association relationship between the pre-established created MTC packet and the MTC packet member includes:
  • the MTC member identifier includes an MTC device identity identifier
  • the MTC member identity includes an MTC application identity.
  • the method further includes:
  • the network entity After pre-establishing the association relationship between the created MTC packet and the MTC packet member, the network entity before the network entity sends the packet authentication request information of the MTC packet to one of the MTC packet members associated with the MTC packet Sending the MTC packet identifier and the MTC packet key corresponding to the MTC packet identifier to all MTC packet members.
  • the method further includes:
  • the network entity After the MTC packet member and the network entity complete the mutual authentication, the network entity sends the authentication result corresponding to the MTC packet identifier to the other MTC packet member associated with the MTC packet by using the GBA-push process or the MBMS mode.
  • the other MTC packet members After receiving the MTC packet authentication result, the other MTC packet members perform related services of the MTC packet communication based on the authentication result.
  • the method further includes: after completing the mutual authentication of the network entity and the MTC group member, adding a new MTC packet member to the MTC packet that completes the mutual authentication.
  • the adding the new MTC group member includes:
  • the network entity establishes an association relationship between the new MTC packet member and the MTC packet, that is, the network entity establishes a correspondence between the new MTC member and the MTC packet;
  • the MTC packet identifier, the MTC packet key corresponding to the MTC packet identifier, and the packet authentication result corresponding to the MTC packet identifier are sent by using a GBA-push process or an MBMS manner.
  • the method further includes: deleting the MTC packet member in the MTC packet that completes the mutual authentication after completing the mutual authentication with the MTC packet member.
  • the deleting the MTC packet members in the MTC packet that completes the mutual authentication includes:
  • the updated MTC packet key corresponding to the MTC packet identifier and the MTC packet identifier is distributed by using a GBA-push process or an MBMS.
  • the method further includes re-establishing an association relationship between the MTC packet and the MTC packet member according to a preset trigger condition.
  • An embodiment of the present invention further provides a method for implementing packet authentication, including:
  • the network entity performs mutual authentication with the MTC packet member that receives the packet authentication request information.
  • the method also includes:
  • the network entity pre-creates the MTC packet, and establishes an association relationship between the created MTC packet and the MTC packet member.
  • the method further includes:
  • the network entity sends an MTC packet identifier and a corresponding MTC packet key to all MTC packet members.
  • it also includes:
  • the network entity After the network entity sends the MTC packet identifier and the corresponding MTC packet key to all MTC packet members, the network entity is in front of the network entity sending the packet authentication request information of the MTC packet to one of the MTC packet members. Adding a new MTC packet member to the MTC packet, or deleting an MTC packet member in the MTC packet.
  • the method further includes:
  • the network entity sends the authentication result to other MTC packet members associated with the MTC packet.
  • the method further includes:
  • the network entity After completing the mutual authentication with the MTC packet member, the network entity adds a new MTC packet member to the MTC packet that completes the mutual authentication.
  • the method further includes:
  • the network entity After completing the mutual authentication with the MTC packet member, the network entity deletes the MTC packet member in the MTC packet that completes the mutual authentication.
  • the method further includes:
  • the network entity After completing the mutual authentication with the MTC packet member, the network entity re-establishes the association relationship between the MTC packet and the MTC packet member according to a preset trigger condition.
  • An embodiment of the present invention further provides a method for implementing packet authentication, including:
  • the machine type communication MTC packet member receives the packet authentication request information from the network entity;
  • the MTC packet member performs mutual authentication with the network entity according to the MTC packet identifier in the packet authentication request information and the MTC packet key of the MTC packet.
  • the method also includes:
  • the MTC packet member receives the MTC packet identifier corresponding to the MTC packet identifier and the MTC packet identifier from the network entity, and saves the received MTC packet identifier and the MTC packet key.
  • the embodiment of the invention further provides a system for implementing group authentication, comprising: a network entity and one or more MTC group members; wherein
  • the network entity includes an authentication request unit,
  • An authentication requesting unit configured to send, to one of the MTC packet members associated with the MTC packet, packet authentication request information of the MTC packet;
  • the MTC packet member includes an authentication unit configured to perform mutual authentication of the MTC packet member and the network entity according to the MTC packet identifier in the packet authentication request information and the MTC packet key corresponding to the MTC packet.
  • the network entity further includes a creating unit and an associating unit, where
  • the association unit is configured to establish an association relationship between the created MTC packet and the MTC packet member.
  • the creating unit is configured to create a MTC packet by creating a packet that includes an MTC packet identifier and an MTC packet key corresponding to the MTC packet identifier.
  • the authentication requesting unit is configured to send, by using, the following, a group authentication request information for sending an MTC packet to an MTC packet member that is associated with the MTC packet, where
  • the packet authentication request information is sent to an MTC packet member by a GBA-push process or an MBMS method.
  • association unit is set to:
  • the MTC packet member further includes a saving unit configured to save the MTC packet identifier and the MTC packet key.
  • the network entity further includes:
  • Adding a unit configured to send an MTC packet identifier, an MTC packet key, to all MTC packet members associated with the MTC packet, and add a new MTC packet member to the MTC packet before performing the mutual authentication;
  • the deleting unit is configured to send the MTC packet identifier and the MTC packet key to all MTC packet members associated with the MTC packet, and delete the MTC packet member in the MTC packet before performing the mutual authentication.
  • the association unit is configured to establish an association relationship between the created MTC packet and the MTC packet member by establishing, according to the member identifier of the MTC packet member and the MTC packet identifier of the MTC packet, An association relationship between the MTC packet and the MTC packet member.
  • the association unit is further configured to
  • the MTC packet identifier and the MTC packet key corresponding to the MTC packet identifier are sent to all MTC packet members by the GBA-push process or the MBMS method.
  • the network entity further includes an authentication result sending unit, configured to send the authentication result corresponding to the MTC group identifier to other MTC group members associated with the MTC group after completing the mutual authentication;
  • the MTC group member also includes a receiving unit, which is set to
  • the related service of the MTC packet communication is performed based on the authentication result.
  • the network entity further includes an adding unit, configured to add a new MTC packet member in the MTC packet that completes the mutual authentication after completing the mutual authentication with the MTC group member.
  • the network entity further includes a deleting unit, configured to delete the MTC packet member in the MTC packet that completes the mutual authentication after completing the mutual authentication with the MTC group member.
  • a deleting unit configured to delete the MTC packet member in the MTC packet that completes the mutual authentication after completing the mutual authentication with the MTC group member.
  • the network entity further includes a reestablishing unit, configured to re-establish a group association relationship according to a preset trigger condition after completing the bidirectional authentication with the MTC group member.
  • a reestablishing unit configured to re-establish a group association relationship according to a preset trigger condition after completing the bidirectional authentication with the MTC group member.
  • the embodiment of the invention further provides a network entity, including:
  • the authentication requesting unit is configured to transmit the packet authentication request information of the MTC packet to one of the MTC packet members associated with the MTC packet; and perform mutual authentication with the MTC packet member that receives the packet authentication request information.
  • it also includes:
  • the association unit is configured to establish an association relationship between the created MTC packet and the MTC packet member.
  • it also includes:
  • the authentication result sending unit is configured to, after completing the mutual authentication, send the authentication result corresponding to the MTC group identifier to other MTC group members associated with the MTC group.
  • it also includes:
  • the adding unit is set to add a new MTC packet member in the MTC packet that completes the mutual authentication after completing the mutual authentication with the MTC group member.
  • it also includes:
  • the deleting unit is configured to delete the MTC group member in the MTC packet that completes the mutual authentication after completing the mutual authentication with the MTC group member.
  • it also includes:
  • the reconstruction unit is configured to re-establish the group association relationship according to the preset trigger condition after completing the mutual authentication with the MTC group member.
  • the embodiment of the invention also proposes a machine type communication MTC group member, comprising:
  • the authentication unit is configured to receive the packet authentication request information from the network entity, perform bidirectional authentication of the MTC packet member and the network entity according to the MTC packet identifier in the packet authentication request information, and the MTC packet key corresponding to the MTC packet.
  • it also includes:
  • a saving unit configured to save the received MTC packet identifier and the MTC packet key from the network entity.
  • it also includes:
  • the receiving unit is configured to perform related services of the MTC packet communication based on the authentication result after receiving the authentication result from the network entity.
  • the technical solution of the present application includes: the network entity sends the packet authentication request information of the MTC packet to the MTC packet member associated with the machine type communication (MTC) packet; the MTC packet member according to the MTC packet in the packet authentication request information
  • MTC packet key identifying the MTC packet performs bidirectional authentication with the network entity; the MTC packet member includes: an MTC device and/or an MTC application.
  • the embodiment of the present invention performs the MTC packet creation, the packet association, and the packet authentication process by the network entity, which simplifies the packet authentication process of the MTC system and reduces the signaling consumption of the system for performing MTC authentication.
  • FIG. 1 is a flowchart of a method for implementing packet authentication according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a method for implementing packet authentication according to another embodiment of the present invention.
  • FIG. 3 is a flowchart of a method for implementing packet authentication according to another embodiment of the present invention.
  • FIG. 4 is a structural block diagram of a system for implementing packet authentication according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a network entity according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a structure of an MTC packet member according to an embodiment of the present invention.
  • Figure 7 is a flow chart showing the method of the first embodiment of the present invention.
  • Figure 8 is a flow chart of a method of a second embodiment of the present invention.
  • Figure 9 is a flow chart of a method of a third embodiment of the present invention.
  • Figure 10 is a flow chart of a method according to a fourth embodiment of the present invention.
  • Figure 11 is a flow chart showing the method of the fifth embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for implementing packet authentication according to an embodiment of the present invention, as shown in FIG. include:
  • Step 100 The network entity sends the packet authentication request information of the MTC packet to one of the MTC packet members associated with the MTC packet.
  • the network entity includes a communication entity set in the core network to manage the MTC packet.
  • the MTC packet members include: an MTC device and/or an MTC application.
  • the group authentication request information for sending the MTC packet includes:
  • the network entity sends the packet authentication request information to an MTC packet member through a GBA-push (General Bootstrapping Architecture push) process or an MBMS mode.
  • GBA-push General Bootstrapping Architecture push
  • the network entity includes: a communication entity set in the core network to manage the MTC packet.
  • the network entity may be a Mobility Management Entity (MME), a Serving GPRS Support Node (SGSN), a Local Subscriber Server (HSS), and a machine type communication-interworking device.
  • MME Mobility Management Entity
  • SGSN Serving GPRS Support Node
  • HSS Local Subscriber Server
  • MTC-IWF MTC InterWorking Function
  • MTC business management platform MTC business management platform.
  • the network entity may be a network element that is set by the MTC user, the operator, or the MTC application provider, and is configured to perform group management on the MTC device or the MTC application.
  • Step 101 The MTC packet member that receives the packet authentication request information performs bidirectional authentication with the network entity according to the MTC packet identifier in the packet authentication request information and the MTC packet key of the MTC packet.
  • the two-way authentication includes:
  • HTTP digest Two-way authentication based on the MTC packet key using the HTTP (Hypertext Transfer Protocol) digest authentication mechanism (HTTP digest).
  • the two-way authentication process between the MTC packet member and the network entity is a two-way authentication process between the MTC packet member and the MTC packet.
  • an MTC packet member may be associated with one or more MTC packets.
  • the method of the embodiment of the present invention further includes:
  • the network entity pre-creates an MTC packet; the network entity pre-establishes an association relationship between the created MTC packet and the MTC packet member.
  • the created MTC packet includes: a packet including an MTC packet identifier and a packet key corresponding to the MTC packet identifier.
  • the association between the created MTC packet and the MTC packet member is established in advance, that is, the correspondence between the MTC packet and the MTC packet member is established, including:
  • the network entity establishes a correspondence between the MTC packet identifier and the MTC packet member identifier according to the member identifier of the MTC packet member and the MTC packet identifier of the MTC packet.
  • the mapping between the established MTC packet and all the MTC packet members may be specifically implemented by using the configured MTC packet and the correspondence relationship list associated with the MTC packet member.
  • the MTC device member identifier includes an MTC device identity identifier
  • the MTC device identity identifier may be an MTC device identity information, such as an IMEI (International Mobile Equipment Identity), etc. It may be MTC device user identity information, such as International Mobile Subscriber Identification Number (IMSI).
  • IMSI International Mobile Subscriber Identification Number
  • the method further includes:
  • the network entity sends the MTC packet identifier and the MTC packet key corresponding to the MTC packet identifier to all MTC packet members that are associated with the MTC packet.
  • the MTC packet member holds the MTC packet identifier and the MTC packet key.
  • the network entity may send the MTC packet identifier and the MTC packet key corresponding to the MTC packet identifier to all MTC packet members by using a GBA-push process or an MBMS manner.
  • the MTC packet identifier and the MTC packet key are stored in a Universal Integrated Circuit Card (UICC) in an MTC device, an MTC application, or an MTC device.
  • UICC Universal Integrated Circuit Card
  • the method further includes: after creating the association relationship between the MTC packet and the MTC packet member, and completing the MTC packet identification and the MTC packet key distribution, before the two-way authentication is performed, the network entity adds a new in the MTC packet. Member of the MTC group.
  • adding a new MTC group member includes:
  • the network entity establishes an association relationship between the new MTC packet member and the MTC packet, that is, the network entity establishes a correspondence between the new MTC packet member and the MTC packet; and sends the MTC packet identifier and the MTC packet key corresponding to the MTC packet identifier. Go to the new MTC group member.
  • the correspondence between the new MTC member and the MTC packet is added to the corresponding relationship list by updating the correspondence list associated with the MTC packet member.
  • the MTC packet identifier corresponding to the MTC packet identifier and the MTC packet identifier is sent by using a GBA-push process or an MBMS manner.
  • the method of the embodiment of the present invention further includes: after creating the association relationship between the MTC packet and the MTC packet member, and completing the MTC packet identifier and the MTC packet key distribution, before the two-way authentication, the network entity deletes the MTC packet. Member of the MTC group.
  • the deleting MTC packet members in the MTC packet includes:
  • the network entity deletes the association relationship between the MTC packet member and the MTC packet, that is, the correspondence between the MTC packet member and the MTC packet deleted from the correspondence list of the MTC packet and the MTC packet member by the network entity, and updates the corresponding relationship List of relationships;
  • the updated MTC packet key corresponding to the MTC packet identifier and the MTC packet identifier is distributed to the MTC packet member associated with the MTC packet.
  • the method of the embodiment of the present invention further includes:
  • the network entity After the MTC packet member and the network entity complete the mutual authentication, the network entity sends the authentication result corresponding to the MTC packet identifier to other MTC packet members that are associated with the MTC packet.
  • the other MTC packet members After receiving the MTC packet authentication result, the other MTC packet members perform related services of the MTC packet communication based on the authentication result.
  • the network entity sends the authentication result corresponding to the MTC packet identifier to other MTC packet members associated with the MTC packet through the GBA-push process or the MBMS mode.
  • the authentication result includes: a session key generated during the authentication process, and may further include information indicating that the authentication is successful;
  • the authentication result includes: information indicating that the authentication failed.
  • the specific service for performing the MTC packet communication based on the authentication result may be implemented by using a well-known technology of a person skilled in the art, and is not intended to limit the scope of the present invention, and details are not described herein again.
  • the method of the embodiment of the present invention further includes: after completing the mutual authentication of the network entity and the MTC group member, adding a new MTC packet member to the MTC packet that completes the mutual authentication.
  • adding a new MTC group member includes:
  • the network entity establishes an association relationship between the new MTC packet member and the MTC packet, that is, the network entity establishes a correspondence between the new MTC packet member and the MTC packet; and the MTC packet identifier, the MTC packet key corresponding to the MTC packet identifier, and The packet authentication result corresponding to the MTC packet identifier is sent to the new MTC packet member.
  • the correspondence between the new MTC member and the MTC packet is added to the corresponding relationship list by updating the correspondence list associated with the MTC packet member.
  • the MTC packet identifier, the MTC packet key corresponding to the MTC packet identifier, and the packet authentication result corresponding to the MTC packet identifier are sent by using a GBA-push process or an MBMS manner.
  • the method of the embodiment of the present invention further includes: deleting the MTC packet member in the MTC packet that completes the mutual authentication after completing the mutual authentication with the MTC group member.
  • the MTC group member in the MTC packet that completes the mutual authentication is deleted:
  • the network entity deletes the association relationship between the MTC packet member and the MTC packet that completes the mutual authentication, that is, the correspondence between the MTC packet member and the MTC packet that can be deleted from the correspondence list of the MTC packet and the MTC packet member by the network entity. And update the corresponding relationship list;
  • the updated MTC packet key corresponding to the MTC packet identifier and the MTC packet identifier is distributed to each MTC packet member associated with the MTC packet.
  • the updated MTC packet key corresponding to the MTC packet identifier and the MTC packet identifier is distributed by using a GBA-push process or an MBMS.
  • the method of the embodiment of the present invention further includes: after completing the mutual authentication with the MTC group member, re-establishing the association relationship between the MTC packet and the MTC packet member according to the preset trigger condition.
  • the preset trigger condition here may be a setting in which the MTC system needs to be reset or the MTC has a security problem.
  • the network entity sends the MTC packet authentication request information to one MTC packet member in the MTC packet.
  • the MTC packet authentication request information may be sent to the MTC packet member by using a GBA-push process or an MBMS.
  • the MTC packet member After receiving the MTC packet authentication request information, the MTC packet member initiates a two-way authentication process with the network entity according to the MTC packet key corresponding to the MTC packet identifier included in the MTC packet authentication request information.
  • the two-way authentication process may be an AKA two-way authentication process based on the MTC packet key, or a GBA two-way authentication process based on the MTC packet key, or an HTTP digest two-way authentication process based on the MTC packet key.
  • the network entity After the mutual authentication process between the MTC packet member and the network entity ends, the network entity sends the authentication result corresponding to the MTC packet identifier to other MTC packet members associated with the MTC packet through the GBA-push process or the MBMS mode.
  • the other MTC packet members may perform the MTC packet communication related service according to the received MTC packet authentication result.
  • FIG. 2 is a flow chart of a method for implementing packet authentication according to another embodiment of the present invention. As shown in Figure 2, it includes:
  • Step 200 The network entity in the MTC group member that establishes an association relationship with the MTC packet A packet authentication request message that transmits an MTC packet.
  • Step 201 The network entity performs mutual authentication with the MTC packet member that receives the packet authentication request information.
  • the method also includes:
  • the network entity pre-creates the MTC packet, and establishes an association relationship between the created MTC packet and the MTC packet member.
  • the method further includes:
  • the network entity sends the MTC packet identifier and the corresponding MTC packet key to all MTC packet members.
  • the method further includes:
  • the network entity sends the authentication result corresponding to the MTC packet identifier to other MTC packet members associated with the MTC packet.
  • the method further includes:
  • the network entity After completing the mutual authentication with the MTC packet member, the network entity adds a new MTC packet member to the MTC packet that completes the mutual authentication.
  • the network entity adds a new MTC packet member to the MTC packet that completes the mutual authentication, including:
  • the network entity establishes an association relationship between the new MTC packet member and the MTC packet, that is, the network entity establishes a correspondence between the new MTC packet member and the MTC packet; and the MTC packet identifier, the MTC packet key corresponding to the MTC packet identifier, and The packet authentication result corresponding to the MTC packet identifier is sent to the new MTC packet member.
  • the method further includes:
  • the network entity After completing the mutual authentication with the MTC packet member, the network entity deletes the MTC packet member in the MTC packet that completes the mutual authentication.
  • the MTC packet member in the MTC packet in which the network entity deletes the mutual authentication includes:
  • the network entity deletes the association relationship between the MTC packet member and the MTC packet that completes the mutual authentication, that is, the network entity can delete the correspondence between the MTC packet member and the MTC packet from the correspondence list associated with the MTC packet and the MTC packet member, and update Correspondence list;
  • the updated MTC packet key corresponding to the MTC packet identifier and the MTC packet identifier is distributed to the MTC packet member associated with the MTC packet.
  • the method further includes: after creating the association relationship between the MTC packet and the MTC packet member, and completing the MTC packet identification and the MTC packet key distribution, before the two-way authentication is performed, the network entity adds a new in the MTC packet. Member of the MTC group.
  • adding a new MTC group member includes:
  • the network entity establishes an association relationship between the new MTC packet member and the MTC packet, that is, the network entity establishes a correspondence between the new MTC packet member and the MTC packet; and sends the MTC packet identifier and the MTC packet key corresponding to the MTC packet identifier. Go to the new MTC group member.
  • the correspondence between the new MTC member and the MTC packet is added to the corresponding relationship list by updating the correspondence list associated with the MTC packet member.
  • the MTC packet identifier corresponding to the MTC packet identifier and the MTC packet identifier is sent by using a GBA-push process or an MBMS manner.
  • the method of the embodiment of the present invention further includes: after creating the association relationship between the MTC packet and the MTC packet member, and completing the MTC packet identifier and the MTC packet key distribution, before the two-way authentication, the network entity deletes the MTC packet. Member of the MTC group.
  • the deleting MTC packet members in the MTC packet includes:
  • the network entity deletes the association relationship between the MTC packet member and the MTC packet, that is, the correspondence between the MTC packet member and the MTC packet deleted from the correspondence list of the MTC packet and the MTC packet member by the network entity, and updates the corresponding relationship List of relationships;
  • the method further includes:
  • the network entity re-establishes the association relationship between the MTC packet and the MTC packet member according to the preset trigger condition.
  • FIG. 3 is a flowchart of a method for implementing packet authentication according to another embodiment of the present invention. As shown in Figure 3, it includes:
  • Step 300 The MTC packet member receives the packet authentication request information from the network entity.
  • the packet authentication request information includes an MTC packet identifier.
  • Step 301 The MTC packet member performs mutual authentication with the network entity according to the MTC packet identifier in the packet authentication request information and the MTC packet key of the MTC packet.
  • the method also includes:
  • the MTC packet member receives the MTC packet identifier from the network entity and the MTC packet key corresponding to the MTC packet identifier, and stores the received MTC packet identifier and the MTC packet key.
  • Embodiments of the present invention also provide a computer readable storage medium storing computer executable instructions for performing any of the methods described above.
  • FIG. 4 is a structural block diagram of a system for implementing group authentication according to an embodiment of the present invention. As shown in FIG. 4, the method includes:
  • the network entity includes an authentication request unit,
  • An authentication requesting unit configured to send, to one of the MTC packet members that are associated with the MTC packet, packet authentication request information of the MTC packet;
  • the MTC group member includes an authentication unit configured to perform mutual authentication of the MTC packet member and the network entity according to the MTC packet identifier in the MTC packet authentication request information and the MTC packet key corresponding to the MTC packet.
  • the network entity further includes a creating unit and an associating unit; wherein
  • the creating unit is configured to create a MTC packet by creating a packet including the MTC packet identifier and the MTC packet key corresponding to the MTC packet identifier.
  • the authentication requesting unit is configured to send, by using the following manner, packet authentication request information for transmitting an MTC packet to an MTC packet member that associates with the MTC packet, where
  • the packet authentication request information is sent to an MTC packet member by a GBA-push process or an MBMS method.
  • association unit is set to:
  • the MTC packet member also includes a save unit configured to acquire and save the MTC packet identifier and the MTC packet key.
  • the association unit is configured to establish an association relationship between the created MTC packet and the MTC packet member by establishing the MTC packet and the MTC packet member according to the member identifier of the MTC packet member and the MTC packet identifier of the MTC packet.
  • the association relationship between the MTC packet identifier and the MTC packet member identifier may be established by establishing a correspondence between the MTC packet and the MTC packet member by establishing a correspondence between the MTC packet and all MTC packet members.
  • the member identifier of the MTC device is the MTC device identity identifier
  • the member identifier of the MTC application is the MTC application identity.
  • the associated unit is also set to,
  • the network entity further includes an authentication result sending unit, configured to complete mutual authentication,
  • the MTC packet is identified by the GBA-push process or the MBMS mode, and the authentication result is corresponding to Sent to other MTC packet members associated with the MTC packet;
  • the MTC group member further includes a receiving unit, configured to
  • the related service of the MTC packet communication is performed based on the authentication result.
  • the network entity further includes an adding unit, configured to complete the mutual authentication with the MTC group member,
  • the association unit is further configured to establish an association relationship between the new MTC packet member and the MTC packet that completes the mutual authentication, that is, the correspondence between the new MTC member and the MTC packet that completes the mutual authentication, and specifically, may be updated.
  • a correspondence list of the MTC group and the MTC group member that is, adding a correspondence between the new MTC member and the MTC group to the corresponding relationship list;
  • the network entity further includes: a distribution unit, configured to send the MTC packet identifier, the MTC packet key corresponding to the MTC packet identifier, and the packet authentication result corresponding to the MTC packet identifier to the new MTC packet member;
  • a distribution unit configured to send the MTC packet identifier, the MTC packet key corresponding to the MTC packet identifier, and the packet authentication result corresponding to the MTC packet identifier to the new MTC packet member;
  • the MTC packet identifier, the MTC packet key corresponding to the MTC packet identifier, and the packet authentication result corresponding to the MTC packet identifier are sent by using a GBA-push process or an MBMS manner.
  • the network entity further includes a deleting unit, configured to delete the MTC packet member in the MTC packet that completes the mutual authentication after completing the mutual authentication with the MTC group member.
  • the association unit is further configured to
  • Deleting the association relationship between the MTC packet member and the MTC packet that completes the mutual authentication specifically, deleting the correspondence between the MTC packet member and the MTC packet from the correspondence list associated with the MTC packet member and updating the MTC packet a list of correspondences associated with MTC group members;
  • the updated MTC packet key corresponding to the MTC packet identifier and the MTC packet identifier is distributed by means of a GBA-push process or an MBMS.
  • the network entity further includes a reconstruction unit configured to re-establish the group association relationship according to a preset trigger condition after completing the mutual authentication with the MTC group member.
  • the network entity further includes:
  • Adding a unit configured to send an MTC packet identifier, an MTC packet key, to all MTC packet members associated with the MTC packet, and add a new MTC packet member to the MTC packet before performing the mutual authentication;
  • the deleting unit is configured to send the MTC packet identifier and the MTC packet key to all MTC packet members associated with the MTC packet, and delete the MTC packet member in the MTC packet before performing the mutual authentication.
  • an embodiment of the present invention further provides a network entity, including:
  • the authentication requesting unit is configured to transmit the packet authentication request information of the MTC packet to one of the MTC packet members associated with the MTC packet; and perform mutual authentication with the MTC packet member that receives the packet authentication request information.
  • the association unit is configured to establish an association relationship between the created MTC packet and the MTC packet member.
  • the authentication result sending unit is configured to, after completing the mutual authentication, send the authentication result corresponding to the MTC group identifier to other MTC group members associated with the MTC group.
  • the adding unit is set to add a new MTC packet member in the MTC packet that completes the mutual authentication after completing the mutual authentication with the MTC group member.
  • the reconstruction unit is configured to re-establish the group association relationship according to the preset trigger condition after completing the mutual authentication with the MTC group member.
  • a saving unit configured to save the received MTC packet identifier and the MTC packet key from the network entity.
  • the related service of the MTC packet communication is performed based on the authentication result.
  • FIG. 7 is a flowchart of a method according to a first embodiment of the present invention. As shown in FIG. 7, the method includes:
  • the correspondence between the MTC packet and the MTC packet member refers to the correspondence between the MTC packet identifier and the MTC packet member identifier.
  • the correspondence between all MTC packets and MTC packet members constitutes a correspondence list of MTC packets associated with MTC packet members.
  • Step 702 After receiving the MTC packet identifier and the MTC packet key, the MTC packet member saves the MTC packet identifier and its corresponding MTC packet key.
  • the MTC packet identifier and the MTC packet key may be stored on the MTC device, or in the MTC application, or may be stored on the UICC in the MTC device;
  • Step 800 The network entity managing the MTC packet generates MTC packet authentication request information for the MTC packet.
  • the MTC authentication request information may include an MTC packet identifier
  • Step 801 The network entity sends the generated MTC packet authentication request information to an MTC packet member in the MTC packet, that is, an MTC device or an MTC application.
  • the network entity may send the MTC packet authentication request information to the MTC device or the MTC application by using a GBA-push process or by using an MBMS manner;
  • the two-way authentication may be an AKA process based on an MTC packet key, a GBA process based on an MTC packet key, or an HTTP digest authentication process based on an MTC packet key.
  • the mutual authentication process between the MTC packet member and the network entity is a mutual authentication process between the MTC packet member and the MTC packet;
  • the network entity After the MTC packet member and the network entity are mutually authenticated, the network entity sends the authentication result corresponding to the MTC packet identifier to another MTC device or MTC application associated with the MTC packet through the GBA-push process or the MBMS mode.
  • FIG. 9 is a flowchart of a method according to a third embodiment of the present invention. As shown in FIG. 9, the method includes:
  • Step 900 The network entity establishes a relationship between the new MTC packet member and the MTC packet.
  • the network entity establishes a correspondence between the new MTC device or the new MTC application and the MTC packet, and adds the correspondence between the new MTC device or the new MTC application and the MTC packet to the corresponding association between the MTC packet and the MTC packet member. List of relationships.
  • a new MTC member that is associated with the MTC packet becomes a new MTC packet member;
  • the network entity distributes the MTC packet identifier and the MTC packet key corresponding to the MTC packet identifier and the authentication result corresponding to the MTC packet identifier to the new MTC device or new associated with the MTC packet by means of the GBA-push process or by means of MBMS.
  • MTC application ;
  • Step 902 After receiving the MTC packet authentication result, the new MTC packet member performs the MTC packet communication related service according to the MTC packet authentication result.
  • the new MTC packet member after receiving the MTC packet identifier and the MTC packet key corresponding to the MTC packet identifier, the new MTC packet member saves the MTC packet identifier and the MTC packet key.
  • the MTC packet identifier and the MTC packet key may be stored on the MTC device or in the MTC application, or may be stored on the UICC in the MTC device.
  • Step 1000 After completing the mutual authentication with the MTC packet member, the network entity deletes the association between the MTC packet and one MTC packet member; that is, the network entity deletes the MTC packet and an MTC from the correspondence list associated with the MTC packet and the MTC packet member.
  • the correspondence between group members The deleted MTC device or the MTC application will no longer belong to the MTC packet, that is, the deleted MTC device or the MTC application will no longer be a member of the MTC packet;
  • Step 1001 The network entity updates the MTC packet key corresponding to the MTC packet identifier according to the deletion of the association relationship.
  • Step 1003 After receiving the MTC packet identifier and the new MTC packet key, the MTC packet member updates the MTC packet key corresponding to the MTC packet identifier saved on the MTC device, or in the MTC application, or saved on the UICC.
  • Step 1101 The network entity sends the generated MTC packet authentication request information to one MTC packet member in the MTC packet.
  • the network entity may send the MTC packet authentication request information to an MTC packet member by using a GBA-push process or by means of MBMS;
  • Step 1102 After receiving the MTC packet authentication request information, the MTC packet member performs mutual authentication with the network entity according to the new MTC packet key corresponding to the MTC packet identifier included in the MTC packet authentication request information.
  • the two-way authentication process may be an AKA process based on the MTC packet key, or a GBA process based on the MTC packet key, or an HTTP digest authentication process based on the MTC packet key, completing the mutual interaction between the MTC device and the network entity.
  • Certification process ;
  • Step 1103 After the mutual authentication process between the MTC packet member and the network entity ends, the authentication result corresponding to the MTC packet identifier is sent to other MTC packet members associated with the MTC packet.
  • the network entity After the mutual authentication process between the MTC group member and the network entity is completed, the network entity sends the authentication result corresponding to the MTC packet identifier to the other MTC device or the MTC application associated with the MTC packet through the GBA-push process or through the MBMS mode.
  • the embodiment of the invention simplifies the packet authentication process of the MTC system, and reduces the signaling consumption of the system for performing MTC authentication.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本文公布了一种实现分组认证的方法及系统，包括：网络实体向与机器类通信(MTC)分组建立关联的MTC分组成员发送MTC分组的分组认证请求信息；MTC分组成员根据分组认证请求信息中的MTC分组标识及该MTC分组的MTC分组密钥进行与网络实体的双向认证；MTC分组成员包括：MTC设备和/或MTC应用。

Description

一种实现分组认证的方法及系统 技术领域
本文涉及但不限于物联网通信技术，尤指一种基于机器类通信(MTC，Machine Type Communication)的实现分组认证的方法及系统。
背景技术
未来通信网络中的通信将更多的以设备与设备，及设备与数据中心之间的通信为主，而越来越便宜的存储技术将使得人与设备获得海量信息成为可能。伴随着芯片处理能力和实时在线技术的发展，设备将成为未来移动通信中的主要参与者。机器到机器通信是指应用通信技术实现机器与机器、机器与人之间的数据通信的一系列技术及其组合的总称。
由于MTC整合了通信技术和信息技术，且可用于双向通信，如远距离收集信息、设置参数并发送指令等；因此，MTC能够实现不同的应用方案，如安全监测、自动售货、货物跟踪等。由此可见，几乎所有日常生活中涉及到的设备都有可能成为MTC潜在的服务对象。
在MTC系统中，参与MTC的实体包括数量众多的MTC设备和MTC应用，为了降低网络负载，节省网络资源，需要对MTC设备和MTC应用以组的方式进行管理优化，这样，MTC设备和MTC应用就可以按组的方式进行控制、管理及计费等，从而适应运营商的需求。在对MTC设备和MTC应用进行分组后，为降低网络信令负载，需要对MTC分组进行统一认证。
相关技术中，MTC分组认证方式大致包括，首先，网络对每个MTC设备进行单独认证，然后，将一个或多个MTC设备与一个MTC分组进行关联。采用这种解决方案，需要分别对MTC分组中的所有MTC设备进行单独认证，然后，针对每一个MTC设备，都需要与MTC分组进行关联。这使得MTC分组认证的流程变得复杂，同时增加了MTC系统的信令负载。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权力要求的保护范围。
本发明实施例提供一种实现分组认证的方法及系统，能够通过简单流程实现MTC分组认证，降低MTC通信系统的信令负载。
本发明实施例提供了一种实现分组认证的方法，包括：
网络实体向与机器类通信MTC分组建立关联的MTC分组成员中的一个发送MTC分组的分组认证请求信息；
接收到分组认证请求信息的MTC分组成员根据分组认证请求信息中的MTC分组标识，以及该MTC分组的MTC分组密钥进行与网络实体的双向认证。
可选的，该方法之前还包括：
所述网络实体预先创建MTC分组；
所述网络实体预先建立创建的MTC分组与MTC分组成员之间的关联关系。
可选的，所述发送MTC分组的分组认证请求信息包括：
通过通用自举推送GBA-push过程或多媒体广播多播业务MBMS方式，所述网络实体发送所述分组认证请求信息至所述与MTC分组建立关联的MTC分组成员中的一个MTC分组成员。
可选的，所述双向认证包括：
基于MTC分组密钥的第三代移动通讯网络的认证与密钥协商协议AKA双向认证；或，
基于MTC分组密钥的通用自举架构GBA双向认证；或，
基于MTC分组密钥采用HTTP摘要认证机制HTTP digest进行的双向认证。
可选的，所述网络实体向与MTC分组建立关联的MTC分组成员中的一个发送MTC分组的分组认证请求信息之前还包括：
所述网络实体发送所述MTC分组标识及MTC分组标识对应的MTC分组密钥到与MTC分组建立关联的所有MTC分组成员；
所述与MTC分组建立关联的每一个MTC分组成员保存所述MTC分组 标识和所述MTC分组密钥。
可选的，还包括：
所述网络实体向所有MTC分组成员发送MTC分组标识及对应的MTC分组密钥后，在所述网络实体向MTC分组成员中的一个发送MTC分组的分组认证请求信息之前，所述网络实体在所述MTC分组中添加新的MTC分组成员，或删除所述MTC分组中的MTC分组成员。
可选的，所述预先建立创建的MTC分组与MTC分组成员之间的关联关系包括：
所述网络实体根据所述MTC分组成员的成员标识和所述MTC分组的MTC分组标识，建立MTC分组标识和MTC分组成员标识之间的对应关系；
其中，当所述MTC分组成员包含MTC设备时，所述MTC成员标识包括MTC设备身份标识；
当所述MTC分组成员包含MTC应用时，所述MTC成员标识包括MTC应用身份标识。
可选的，该方法还包括：
在预先建立创建的MTC分组与MTC分组成员之间的关联关系后，在所述网络实体向与MTC分组建立关联的MTC分组成员中的一个发送MTC分组的分组认证请求信息之前，所述网络实体发送所述MTC分组标识及MTC分组标识对应的MTC分组密钥到所有MTC分组成员。
可选的，该方法还包括：
MTC分组成员与网络实体完成双向认证后，网络实体通过GBA-push过程或MBMS方式，将MTC分组标识对应的认证结果，发送到与MTC分组关联的其他MTC分组成员；
其他MTC分组成员接收到MTC分组认证结果后，基于认证结果执行MTC分组通信的相关业务。
可选的，该方法还包括，在完成网络实体与MTC分组成员双向认证后，在完成双向认证的MTC分组中添加新的MTC分组成员。
可选的，所述添加新的MTC分组成员包括：
网络实体建立新的MTC分组成员与MTC分组之间的关联关系，即网络实体建立新的MTC成员与MTC分组之间的对应关系；
将所述MTC分组标识、所述MTC分组标识对应的MTC分组密钥及MTC分组标识对应的分组认证结果发送到新的MTC分组成员；
其中，所述MTC分组标识、MTC分组标识对应的MTC分组密钥及MTC分组标识对应的分组认证结果通过GBA-push过程或MBMS方式发送。
可选的，该方法还包括：在完成与MTC分组成员双向认证后，删除所述完成双向认证的MTC分组中的MTC分组成员。
可选的，所述删除完成双向认证的MTC分组中的MTC分组成员包括：
所述网络实体删除所述MTC分组成员与完成双向认证的MTC分组之间的关联关系并更新；
根据MTC分组成员与MTC分组关联的更新更新MTC分组标识对应的MTC分组密钥；
将MTC分组标识及MTC分组标识对应的更新的MTC分组密钥分发到与MTC分组关联的MTC分组成员；
其中，所述MTC分组标识及MTC分组标识对应的更新的MTC分组密钥通过GBA-push过程或MBMS的方式分发。
可选的，该方法还包括，根据预先设定的触发条件，重新建立所述MTC分组与所述MTC分组成员之间的关联关系。
本发明实施例还提出了一种实现分组认证的方法，包括：
网络实体向与机器类通信MTC分组建立关联的MTC分组成员中的一个发送MTC分组的分组认证请求信息；
网络实体与接收到分组认证请求信息的MTC分组成员进行双向认证。
可选的，该方法之前还包括：
所述网络实体预先创建所述MTC分组，建立创建的MTC分组与MTC分组成员之间的关联关系。
可选的，所述建立创建的MTC分组与MTC分组成员之间的关联关系后，在所述网络实体向MTC分组成员中的一个发送MTC分组的分组认证请求信息之前还包括：
所述网络实体向所有MTC分组成员发送MTC分组标识及对应的MTC分组密钥。
可选的，还包括：
所述网络实体向所有MTC分组成员发送MTC分组标识及对应的MTC分组密钥后，在所述网络实体向MTC分组成员中的一个发送MTC分组的分组认证请求信息之前，所述网络实体在所述MTC分组中添加新的MTC分组成员，或删除所述MTC分组中的MTC分组成员。
可选的，该方法还包括：
所述网络实体将认证结果发送到与所述MTC分组关联的其他MTC分组成员。
可选的，该方法还包括：
在完成与MTC分组成员双向认证后，所述网络实体在完成双向认证的MTC分组中添加新的MTC分组成员。
可选的，该方法还包括：
在完成与MTC分组成员双向认证后，所述网络实体删除完成双向认证的MTC分组中的MTC分组成员。
可选的，该方法还包括：
在完成与MTC分组成员双向认证后，所述网络实体根据预先设定的触发条件，重新建立所述MTC分组与MTC分组成员之间的关联关系。
本发明实施例还提出了一种实现分组认证的方法，包括：
机器类通信MTC分组成员接收到来自网络实体的分组认证请求信息；
MTC分组成员根据分组认证请求信息中的MTC分组标识，以及该MTC分组的MTC分组密钥进行与网络实体的双向认证。
可选的，该方法之前还包括：
所述MTC分组成员接收到来自所述网络实体的MTC分组标识及MTC分组标识对应的MTC分组密钥，保存接收到的MTC分组标识和MTC分组密钥。
本发明实施例还提出了一种实现分组认证的系统，包括：网络实体及一个或一个以上MTC分组成员；其中，
网络实体包括认证请求单元，
认证请求单元，设置为向与MTC分组建立关联的MTC分组成员中的一个发送MTC分组的分组认证请求信息；
MTC分组成员包括认证单元，设置为根据分组认证请求信息中的MTC分组标识，以及所述MTC分组对应的MTC分组密钥进行MTC分组成员与网络实体的双向认证。
可选的，所述网络实体还包括创建单元、关联单元；其中，
创建单元，设置为预先创建MTC分组；
关联单元，设置为建立创建的MTC分组与MTC分组成员之间的关联关系。
可选的，所述创建单元是设置为通过如下方式实现创建MTC分组，创建包含有MTC分组标识及与MTC分组标识相对应的MTC分组密钥的分组。
可选的，所述认证请求单元是设置为通过如下方式实现向与MTC分组建立关联的MTC分组成员发送MTC分组的分组认证请求信息，
通过GBA-push过程或MBMS方式发送所述分组认证请求信息至一个MTC分组成员。
可选的，所述关联单元是设置为：
发送所述MTC分组标识及MTC分组标识对应的MTC分组密钥到与MTC分组建立关联的所有MTC分组成员；
所述MTC分组成员还包括保存单元，设置为保存MTC分组标识和MTC分组密钥。
可选的，所述网络实体还包括：
添加单元，设置为发送MTC分组标识、MTC分组密钥到与MTC分组建立关联的所有MTC分组成员后，在所述进行双向认证之前，在所述MTC分组中添加新的MTC分组成员；
或者，删除单元，设置为发送MTC分组标识、MTC分组密钥到与MTC分组建立关联的所有MTC分组成员后，在所述进行双向认证之前，删除所述MTC分组中的MTC分组成员。
可选的，所述关联单元是设置为通过如下方式实现建立创建的MTC分组与MTC分组成员之间的关联关系，根据所述MTC分组成员的成员标识和所述MTC分组的MTC分组标识，建立所述MTC分组与所述MTC分组成员之间的关联关系。
可选的，所述关联单元还设置为，
通过GBA-push过程或MBMS方式发送MTC分组标识及MTC分组标识对应的MTC分组密钥到所有MTC分组成员。
可选的，所述网络实体还包括认证结果发送单元，设置为完成互认证后，将MTC分组标识对应的认证结果，发送到与MTC分组关联的其他MTC分组成员；
MTC分组成员还包括接收单元，设置为
接收到所述认证结果后，基于所述认证结果执行MTC分组通信的相关业务。
可选的，所述网络实体还包括添加单元，设置为在完成与MTC分组成员双向认证后，在完成双向认证的MTC分组中添加新的MTC分组成员。
可选的，所述网络实体还包括删除单元，设置为在完成与MTC分组成员双向认证后，删除完成双向认证的MTC分组中的MTC分组成员。
可选的，所述网络实体还包括重建单元，设置为在完成与MTC分组成员双向认证后，根据预先设定的触发条件，重新建立分组关联关系。
本发明实施例还提出了一种网络实体，包括：
认证请求单元，设置为向与MTC分组建立关联的MTC分组成员中的一个发送MTC分组的分组认证请求信息；与接收到分组认证请求信息的MTC分组成员进行双向认证。
可选的，还包括：
创建单元，设置为预先创建MTC分组；
关联单元，设置为建立创建的MTC分组与MTC分组成员之间的关联关系。
可选的，还包括：
认证结果发送单元，设置为完成互认证后，将MTC分组标识对应的认证结果，发送到与MTC分组关联的其他MTC分组成员。
可选的，还包括：
添加单元，设置为在完成与MTC分组成员双向认证后，在完成双向认证的MTC分组中添加新的MTC分组成员。
可选的，还包括：
删除单元，设置为在完成与MTC分组成员双向认证后，删除完成双向认证的MTC分组中的MTC分组成员。
可选的，还包括：
重建单元，设置为在完成与MTC分组成员双向认证后，根据预先设定的触发条件，重新建立分组关联关系。
本发明实施例还提出了一种机器类通信MTC分组成员，包括：
认证单元，设置为接收到来自网络实体的分组认证请求信息，根据分组认证请求信息中的MTC分组标识，以及所述MTC分组对应的MTC分组密钥进行MTC分组成员与网络实体的双向认证。
可选的，还包括：
保存单元，设置为保存接收到的来自所述网络实体的MTC分组标识和MTC分组密钥。
可选的，还包括：
接收单元，设置为接收到来自所述网络实体的认证结果后，基于所述认证结果执行MTC分组通信的相关业务。
与相关技术相比，本申请技术方案包括：网络实体向与机器类通信(MTC)分组建立关联的MTC分组成员发送MTC分组的分组认证请求信息；MTC分组成员根据分组认证请求信息中的MTC分组标识及该MTC分组的MTC分组密钥进行与网络实体的双向认证；MTC分组成员包括：MTC设备和/或MTC应用。本发明实施例通过网络实体进行MTC分组创建、分组关联及分组认证过程处理，简化了MTC系统的分组认证过程，降低了系统进行MTC认证的信令消耗。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1为本发明实施例实现分组认证的方法的流程图；
图2为本发明另一实施例实现分组认证的方法的流程图；
图3为本发明另一实施例实现分组认证的方法的流程图；
图4为本发明实施例实现分组认证的系统的结构框图；
图5为本发明实施例网络实体的结构组成示意图；
图6为本发明实施例MTC分组成员的结构组成示意图；
图7为本发明第一实施例方法的流程图；
图8为本发明第二实施例方法的流程图；
图9为本发明第三实施例方法的流程图；
图10为本发明第四实施例方法的流程图；
图11为本发明第五实施例方法的流程图。
本发明的实施方式
下文中将结合附图对本发明的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
图1为本发明实施例实现分组认证的方法的流程图，如图1所示，包 括：
步骤100、网络实体向与MTC分组建立关联的MTC分组成员中的一个发送MTC分组的分组认证请求信息。
本步骤中，网络实体包括核心网中设置为管理MTC分组的通信实体。
本步骤中，MTC分组成员包括：MTC设备和/或MTC应用。
本步骤中，发送MTC分组的分组认证请求信息包括：
通过通用自举推送(GBA-push，General Bootstrapping Architecture push)过程或MBMS方式，网络实体发送分组认证请求信息至一个MTC分组成员。
本发明实施例方法中，网络实体包括：核心网中设置为管理MTC分组的通信实体。
本步骤中，网络实体可以是移动管理实体(MME，Mobility Management Entity)、服务GPRS支持节点(SGSN，Serving GPRS Support Node)、本地签约用户服务器(HSS，Home Subscriber Server)、机器类通信-互通设备(MTC-IWF，MTC InterWorking Function)或MTC业务管理平台等。
需要说明的是，网络实体可以是由MTC用户、运营商、或MTC应用提供商等预先确定的设置为对MTC设备或MTC应用进行分组管理的网元。
步骤101、接收到分组认证请求信息的MTC分组成员根据分组认证请求信息中的MTC分组标识，以及该MTC分组的MTC分组密钥进行与网络实体的双向认证。
本步骤中，双向认证包括：
基于MTC分组密钥的第三代移动通讯网络的认证与密钥协商协议(AKA，Authentication and Key Agreement)双向认证；或，
基于MTC分组密钥的通用自举架构(GBA，General Bootstrapping Architecture，)双向认证；或，
基于MTC分组密钥采用超文本传送协议(HTTP，Hypertext Transfer Protocol)摘要认证机制(HTTP digest)进行的双向认证。
MTC分组成员与网络实体之间的双向认证过程就是MTC分组成员与MTC分组之间的双向认证过程。
本发明实施例方法中，MTC分组成员可以关联至一个或一个以上MTC分组。
可选地，步骤100之前，本发明实施例方法还包括：
网络实体预先创建MTC分组；网络实体预先建立创建的MTC分组与MTC分组成员之间的关联关系。
可选的，创建的MTC分组包括：包含有MTC分组标识及与MTC分组标识相对应的分组密钥的分组。
可选的，预先建立创建的MTC分组与MTC分组成员之间的关联关系，即建立MTC分组与MTC分组成员之间的对应关系，包括：
网络实体根据MTC分组成员的成员标识和MTC分组的MTC分组标识，建立MTC分组标识和MTC分组成员标识之间的对应关系。
其中，建立MTC分组与所有MTC分组成员的对应关系具体可以通过构成的MTC分组与MTC分组成员关联的对应关系列表实现。
其中，当MTC分组成员包含MTC设备时，MTC分组成员标识包括MTC设备身份标识；MTC设备身份标识具体可以是MTC设备身份信息，如移动设备国际身份码(IMEI，International Mobile Equipment Identity)等，也可以是MTC设备用户身份信息，如国际移动用户识别码(IMSI，International Mobile Subscriber Identification Number)等。当MTC分组成员包含MTC应用时，MTC分组成员标识包括MTC应用身份标识。
可选地，在预先建立创建的MTC分组与MTC分组成员之间的关联关系后，该方法还包括：
网络实体发送MTC分组标识及MTC分组标识对应的MTC分组密钥到与MTC分组建立关联关系的所有MTC分组成员。相应地，
MTC分组成员保存MTC分组标识和MTC分组密钥。
其中，网络实体可以通过GBA-push过程或MBMS方式发送MTC分组标识及MTC分组标识对应的MTC分组密钥到所有MTC分组成员。
其中，MTC分组标识和MTC分组密钥保存在MTC设备、MTC应用或MTC设备中的通用集成电路卡(UICC)中。
可选地，该方法还包括：在创建MTC分组与MTC分组成员之间的关联关系，并完成MTC分组标识和MTC分组密钥分发之后，在进行双向认证之前，网络实体在MTC分组中添加新的MTC分组成员。
可选的，添加新的MTC分组成员包括：
网络实体建立新的MTC分组成员与MTC分组之间的关联关系，即网络实体建立新的MTC分组成员与MTC分组之间的对应关系；将MTC分组标识、MTC分组标识对应的MTC分组密钥发送到新的MTC分组成员。
其中，可以通过更新MTC分组与MTC分组成员关联的对应关系列表，即将新的MTC成员与MTC分组之间的对应关系添加到对应关系列表实现。
其中，MTC分组标识、MTC分组标识对应的MTC分组密钥通过GBA-push过程或MBMS方式发送。
可选的，本发明实施例方法还包括：在创建MTC分组与MTC分组成员之间的关联关系，并完成MTC分组标识和MTC分组密钥分发之后，在进行双向认证之前，网络实体删除MTC分组中的MTC分组成员。
其中，删除MTC分组中的MTC分组成员包括：
网络实体删除MTC分组成员与MTC分组之间的关联关系，即可以通过网络实体从MTC分组与MTC分组成员关联的对应关系列表中删除的MTC分组成员与MTC分组之间的对应关系，并更新对应关系列表；
根据MTC分组成员与MTC分组关联关系的更新更新MTC分组标识对应的MTC分组密钥；
将MTC分组标识及MTC分组标识对应的更新的MTC分组密钥分发到与MTC分组关联的MTC分组成员。
可选地，本发明实施例方法还包括：
MTC分组成员与网络实体完成双向认证后，网络实体将MTC分组标识对应的认证结果，发送到与MTC分组关联关系的其他MTC分组成员；
其他MTC分组成员接收到MTC分组认证结果后，基于认证结果执行MTC分组通信的相关业务。
其中，网络实体通过GBA-push过程或MBMS方式，将MTC分组标识对应的认证结果，发送到与MTC分组关联的其他MTC分组成员。
其中，如果认证成功，认证结果包括：认证过程中产生的会话密钥，还可以包括表示认证成功的信息；
如果认证失败，认证结果包括：表示认证失败的信息。
其中，具体如何基于认证结果执行MTC分组通信的相关业务可以采用本领域技术人员的熟知技术实现，并不用于限定本发明的保护范围，这里不再赘述。
本发明实施例方法还包括，在完成网络实体与MTC分组成员双向认证后，在完成双向认证的MTC分组中添加新的MTC分组成员。
可选的，添加新的MTC分组成员包括：
网络实体建立新的MTC分组成员与MTC分组之间的关联关系，即网络实体建立新的MTC分组成员与MTC分组之间的对应关系；将MTC分组标识、MTC分组标识对应的MTC分组密钥及MTC分组标识对应的分组认证结果发送到新的MTC分组成员。
其中，可以通过更新MTC分组与MTC分组成员关联的对应关系列表，即将新的MTC成员与MTC分组之间的对应关系添加到对应关系列表实现。
其中，MTC分组标识、MTC分组标识对应的MTC分组密钥及MTC分组标识对应的分组认证结果通过GBA-push过程或MBMS方式发送。
本发明实施例方法还包括：在完成与MTC分组成员双向认证后，删除完成双向认证的MTC分组中的MTC分组成员。
其中，删除完成双向认证的MTC分组中的MTC分组成员包括：
网络实体删除MTC分组成员与完成双向认证的MTC分组之间的关联关系，即可以通过网络实体从MTC分组与MTC分组成员关联的对应关系列表中删除的MTC分组成员与MTC分组之间的对应关系，并更新对应关系列表；
更新MTC分组标识对应的MTC分组密钥；
将MTC分组标识及MTC分组标识对应的更新的MTC分组密钥分发到与MTC分组关联的每一个MTC分组成员。
其中，MTC分组标识及MTC分组标识对应的更新的MTC分组密钥通过GBA-push过程或MBMS的方式分发。
本发明实施例方法还包括，在完成与MTC分组成员双向认证后，根据预先设定的触发条件，重新建立MTC分组与MTC分组成员之间的关联关系。
需要说明的是，这里预先设定的触发条件可以是MTC系统需要进行重新设置或者MTC出现安全问题等情况设定。
重新建立分组关联关系后，相当于分组认证过程等都需要重新处理，具体的：
网络实体将MTC分组认证请求信息发送到MTC分组中的一个MTC分组成员，具体的，可以通过GBA-push过程或MBMS的方式将MTC分组认证请求信息发送到MTC分组成员。
MTC分组成员收到MTC分组认证请求信息后，根据MTC分组认证请求信息中包含的MTC分组标识对应的MTC分组密钥启动与网络实体之间的双向认证过程。双向认证过程可以是基于MTC分组密钥的AKA双向认证过程，也可以是基于MTC分组密钥的GBA双向认证过程，也可以是基于MTC分组密钥采用HTTP digest双向认证过程。
MTC分组成员与网络实体之间的互认证过程结束后，网络实体通过GBA-push过程或MBMS方式，将MTC分组标识对应的认证结果，发送到与MTC分组关联的其他MTC分组成员。
其他MTC分组成员收到MTC分组的认证结果后，可以根据收到的MTC分组认证结果执行MTC分组通信相关的业务。
图2为本发明另一实施例实现分组认证的方法的流程图。如图2所示，包括：
步骤200、网络实体向与MTC分组建立关联关系的MTC分组成员中的 一个发送MTC分组的分组认证请求信息。
步骤201、网络实体与接收到分组认证请求信息的MTC分组成员进行双向认证。
可选的，该方法之前还包括：
网络实体预先创建MTC分组，建立创建的MTC分组与MTC分组成员之间的关联关系。
可选的，在建立创建的MTC分组与MTC分组成员之间的关联关系后，在网络实体向MTC分组成员中的一个发送MTC分组的分组认证请求信息之前还包括：
网络实体向所有MTC分组成员发送MTC分组标识及对应的MTC分组密钥。
可选的，该方法还包括：
网络实体将MTC分组标识对应的认证结果发送到与MTC分组关联的其他MTC分组成员。
可选的，该方法还包括：
在完成与MTC分组成员双向认证后，网络实体在完成双向认证的MTC分组中添加新的MTC分组成员。
其中，网络实体在完成双向认证的MTC分组中添加新的MTC分组成员包括：
网络实体建立新的MTC分组成员与MTC分组之间的关联关系，即网络实体建立新的MTC分组成员与MTC分组之间的对应关系；将MTC分组标识、MTC分组标识对应的MTC分组密钥及MTC分组标识对应的分组认证结果发送到新的MTC分组成员。
可选的，该方法还包括：
在完成与MTC分组成员双向认证后，网络实体删除完成双向认证的MTC分组中的MTC分组成员。
其中，网络实体删除完成双向认证的MTC分组中的MTC分组成员包括：
网络实体删除MTC分组成员与完成双向认证的MTC分组之间的关联关系，即可以通过网络实体从MTC分组与MTC分组成员关联的对应关系列表中删除MTC分组成员与MTC分组的对应关系，并更新对应关系列表；
根据MTC分组成员与MTC分组关联关系的更新更新MTC分组标识对应的MTC分组密钥；
将MTC分组标识及MTC分组标识对应的更新的MTC分组密钥分发到与MTC分组关联的MTC分组成员。
可选地，该方法还包括：在创建MTC分组与MTC分组成员之间的关联关系，并完成MTC分组标识和MTC分组密钥分发之后，在进行双向认证之前，网络实体在MTC分组中添加新的MTC分组成员。
可选的，添加新的MTC分组成员包括：
网络实体建立新的MTC分组成员与MTC分组之间的关联关系，即网络实体建立新的MTC分组成员与MTC分组之间的对应关系；将MTC分组标识、MTC分组标识对应的MTC分组密钥发送到新的MTC分组成员。
其中，可以通过更新MTC分组与MTC分组成员关联的对应关系列表，即将新的MTC成员与MTC分组之间的对应关系添加到对应关系列表实现。
其中，MTC分组标识、MTC分组标识对应的MTC分组密钥通过GBA-push过程或MBMS方式发送。
可选的，本发明实施例方法还包括：在创建MTC分组与MTC分组成员之间的关联关系，并完成MTC分组标识和MTC分组密钥分发之后，在进行双向认证之前，网络实体删除MTC分组中的MTC分组成员。
其中，删除MTC分组中的MTC分组成员包括：
网络实体删除MTC分组成员与MTC分组之间的关联关系，即可以通过网络实体从MTC分组与MTC分组成员关联的对应关系列表中删除的MTC分组成员与MTC分组之间的对应关系，并更新对应关系列表；
根据MTC分组成员与MTC分组关联关系的更新更新MTC分组标识对应的MTC分组密钥；
将MTC分组标识及MTC分组标识对应的更新的MTC分组密钥分发到 与MTC分组关联的MTC分组成员。
可选的，该方法还包括：
网络实体根据预先设定的触发条件，重新建立MTC分组与MTC分组成员之间的关联关系。
图3为本发明另一实施例实现分组认证的方法的流程图。如图3所示，包括：
步骤300、MTC分组成员接收到来自网络实体的分组认证请求信息。
本步骤中，分组认证请求信息包括MTC分组标识。
步骤301、MTC分组成员根据分组认证请求信息中的MTC分组标识，以及该MTC分组的MTC分组密钥进行与网络实体的双向认证。
可选的，该方法之前还包括：
MTC分组成员接收到来自网络实体的MTC分组标识及MTC分组标识对应的MTC分组密钥，保存接收到的MTC分组标识和MTC分组密钥。
本发明实施例还提出了一种计算机可读存储介质，存储有计算机可执行指令，计算机可执行指令用于执行上述描述的任意一个方法。
图4为本发明实施例实现分组认证的系统的结构框图，如图4所示，包括：
网络实体及一个或一个以上MTC分组成员；其中，
网络实体包括认证请求单元，
认证请求单元，设置为向与MTC分组建立关联关系的MTC分组成员中的一个发送MTC分组的分组认证请求信息；
MTC分组成员包括认证单元，设置为根据MTC分组认证请求信息中的MTC分组标识及该MTC分组对应的MTC分组密钥进行MTC分组成员与网络实体的双向认证。
可选地，网络实体还包括创建单元、关联单元；其中，
创建单元，设置为预先创建MTC分组；
关联单元，设置为预先建立创建的MTC分组与MTC分组成员之间的关 联关系。
可选地，创建单元是设置为通过如下方式实现创建MTC分组，创建包含有MTC分组标识及与MTC分组标识相对应的MTC分组密钥的分组。
可选地，认证请求单元是设置为通过如下方式实现向与MTC分组建立关联关系的MTC分组成员发送MTC分组的分组认证请求信息，
通过GBA-push过程或MBMS方式发送分组认证请求信息至一个MTC分组成员。
可选地，关联单元是设置为：
发送MTC分组标识及MTC分组标识对应的MTC分组密钥到与MTC分组建立关联的所有MTC分组成员；
MTC分组成员还包括保存单元，设置为获取并保存MTC分组标识和MTC分组密钥。
可选地，关联单元是设置为通过如下方式实现建立创建的MTC分组与MTC分组成员之间的关联关系，根据MTC分组成员的成员标识和MTC分组的MTC分组标识建立MTC分组与MTC分组成员之间的关联关系，即可以通过建立MTC分组标识与MTC分组成员标识之间的对应关系；其中，可以通过建立MTC分组与所有MTC分组成员的对应关系构成的MTC分组与MTC分组成员关联的对应关系列表；
其中，当MTC分组成员包含MTC设备时，MTC设备的成员标识为MTC设备身份标识；
当MTC分组成员包含MTC应用时，MTC应用的成员标识为MTC应用身份标识。
关联单元还设置为，
通过GBA-push过程或MBMS方式发送MTC分组密钥到所有MTC分组成员；
可选地，网络实体还包括认证结果发送单元，设置为完成互认证后，
通过GBA-push过程或MBMS方式，将MTC分组标识对应的认证结果， 发送到与MTC分组关联的其他MTC分组成员；
可选地，MTC分组成员还包括接收单元，设置为
接收到MTC分组的认证结果后，基于认证结果执行MTC分组通信的相关业务。
可选地，网络实体还包括添加单元，设置为在完成与MTC分组成员双向认证后，
在完成双向认证的MTC分组中添加新的MTC分组成员。
关联单元还设置为，建立新的MTC分组成员与完成双向认证的MTC分组之间的关联关系，即建立新的MTC成员与完成双向认证的MTC分组之间的对应关系，具体的，可以通过更新MTC分组与MTC分组成员关联的对应关系列表，即将新的MTC成员与MTC分组之间的对应关系添加到所述对应关系列表实现；
可选地，网络实体还包括分发单元，设置为将MTC分组标识、MTC分组标识对应的MTC分组密钥及MTC分组标识对应的分组认证结果发送到新的MTC分组成员；
其中，MTC分组标识、MTC分组标识对应的MTC分组密钥及MTC分组标识对应的分组认证结果通过GBA-push过程或MBMS方式发送。
网络实体还包括删除单元，设置为在完成与MTC分组成员双向认证后，删除完成双向认证的MTC分组中的MTC分组成员。
可选地，关联单元还设置为，
删除MTC分组成员与完成双向认证的MTC分组之间的关联关系；具体的，可以通过从MTC分组与MTC分组成员关联的对应关系列表中删除MTC分组成员与MTC分组的对应关系，并更新MTC分组与MTC分组成员关联的对应关系列表；
根据MTC分组成员与已完成双向认证的MTC分组关联的更新更新MTC分组标识对应的MTC分组密钥；
将MTC分组标识及MTC分组标识对应的更新的MTC分组密钥分发到与MTC分组关联的MTC分组成员；
MTC分组标识及MTC分组标识对应的更新的MTC分组密钥通过GBA-push过程或MBMS的方式分发。
网络实体还包括重建单元，设置为在完成与MTC分组成员双向认证后，根据预先设定的触发条件，重新建立分组关联关系。
可选的，所述网络实体还包括：
添加单元，设置为发送MTC分组标识、MTC分组密钥到与MTC分组建立关联的所有MTC分组成员后，在所述进行双向认证之前，在所述MTC分组中添加新的MTC分组成员；
或者，删除单元，设置为发送MTC分组标识、MTC分组密钥到与MTC分组建立关联的所有MTC分组成员后，在所述进行双向认证之前，删除所述MTC分组中的MTC分组成员。
参见图5，本发明实施例还提出了一种网络实体，包括：
认证请求单元，设置为向与MTC分组建立关联的MTC分组成员中的一个发送MTC分组的分组认证请求信息；与接收到分组认证请求信息的MTC分组成员进行双向认证。
本发明实施例的网络实体，还包括：
创建单元，设置为预先创建MTC分组；
关联单元，设置为建立创建的MTC分组与MTC分组成员之间的关联关系。
本发明实施例的网络实体，还包括：
认证结果发送单元，设置为完成互认证后，将MTC分组标识对应的认证结果，发送到与MTC分组关联的其他MTC分组成员。
本发明实施例的网络实体，还包括：
添加单元，设置为在完成与MTC分组成员双向认证后，在完成双向认证的MTC分组中添加新的MTC分组成员。
本发明实施例的网络实体，还包括：
删除单元，设置为在完成与MTC分组成员双向认证后，删除完成双向认 证的MTC分组中的MTC分组成员。
本发明实施例的网络实体，还包括：
重建单元，设置为在完成与MTC分组成员双向认证后，根据预先设定的触发条件，重新建立分组关联关系。
参见图6，本发明实施例还提出了一种机器类通信MTC分组成员，包括：
认证单元，设置为接收到来自网络实体的分组认证请求信息，根据分组认证请求信息中的MTC分组标识，以及所述MTC分组对应的MTC分组密钥进行MTC分组成员与网络实体的双向认证。
本发明实施例的MTC分组成员，还包括：
保存单元，设置为保存接收到的来自所述网络实体的MTC分组标识和MTC分组密钥。
本发明实施例的MTC分组成员，还包括：
接收单元，设置为
接收到来自所述网络实体的认证结果后，基于所述认证结果执行MTC分组通信的相关业务。
以下通过具体实施例对本发明实施例的方法进行清楚详细的说明，实施例只用于陈述本发明，并不用于限制本发明保护范围。
实施例1
图7为本发明第一实施例方法的流程图，如图7所示，包括：
步骤700、网络实体建立MTC分组与MTC分组成员之间的关联关系；即网络实体建立MTC分组与MTC分组成员之间的对应关系。
本步骤中，MTC分组与MTC分组成员之间的对应关系是指MTC分组标识与MTC分组成员标识之间的对应关系。所有MTC分组与MTC分组成员之间的对应关系构成MTC分组与MTC分组成员关联的对应关系列表。
步骤701、网络实体通过GBA-push过程或通过MBMS的方式，将MTC分组标识及MTC分组标识对应的MTC分组密钥发送到与MTC分组关联的MTC分组成员。
本步骤中，MTC分组成员可以是MTC设备，或者是MTC应用；
步骤702、MTC分组成员收到MTC分组标识和MTC分组密钥后，保存MTC分组标识及其对应的MTC分组密钥。
本步骤中，MTC分组标识和MTC分组密钥可以存储在MTC设备上、或MTC应用中、也可以存储在MTC设备中的UICC上；
图8为本发明第二实施例方法的流程图，如图8所示，包括：
步骤800、管理MTC分组的网络实体针对MTC分组生成MTC分组认证请求信息；
MTC认证请求信息可以包含MTC分组标识；
步骤801、网络实体将生成的MTC分组认证请求信息发送到MTC分组中的一个MTC分组成员，即MTC设备或MTC应用。
如，网络实体可以通过GBA-push过程或通过MBMS的方式将MTC分组认证请求信息发送到MTC设备或MTC应用；
步骤802、MTC分组成员收到MTC分组认证请求信息后，根据MTC分组认证请求信息中包含的MTC分组标识对应的MTC分组密钥与网络实体进行双向认证。
所述双向认证可以是基于MTC分组密钥的AKA过程，也可以是基于MTC分组密钥的GBA过程，也可以是基于MTC分组密钥采用HTTP digest认证过程完成。MTC分组成员与网络实体之间的互认证过程就是MTC分组成员与MTC分组之间的互认证过程；
步骤803、网络实体将MTC分组标识对应的认证结果，发送到与MTC分组关联的其他MTC分组成员；具体的，
MTC分组成员与网络实体互认证过程结束后，网络实体通过GBA-push过程或MBMS方式，将MTC分组标识对应的认证结果发送到与MTC分组关联的其他MTC设备或MTC应用；
图9为本发明第三实施例方法的流程图，如图9所示，包括：
步骤900、网络实体建立新的MTC分组成员与MTC分组之间的关联关 系；即网络实体建立新的MTC设备或新的MTC应用与MTC分组的对应关系，并将新的MTC设备或新的MTC应用与MTC分组的对应关系添加到MTC分组与MTC分组成员关联的对应关系列表。与MTC分组建立关联关系的新的MTC成员成为新的MTC分组成员；
步骤901、网络实体将MTC分组标识及MTC分组标识对应的MTC分组密钥及MTC分组标识对应的认证结果分发到与MTC分组关联的新的MTC分组成员；具体的，
网络实体通过GBA-push过程或通过MBMS的方式，将MTC分组标识及MTC分组标识对应的MTC分组密钥，以及MTC分组标识对应的认证结果分发到与MTC分组关联的新的MTC设备或新的MTC应用；
步骤902，新的MTC分组成员收到MTC分组认证结果后，根据MTC分组认证结果执行MTC分组通信相关的业务；
本实施例中，新的MTC分组成员收到MTC分组标识和MTC分组标识对应的MTC分组密钥后，保存MTC分组标识及MTC分组密钥。MTC分组标识和MTC分组密钥可以存储在MTC设备上或MTC应用中，也可以存储在MTC设备中的UICC上。
图10为本发明第四实施例方法的流程图，如图10所示，包括：
步骤1000，在完成与MTC分组成员双向认证后，网络实体删除MTC分组与一个MTC分组成员之间的关联；即网络实体从MTC分组与MTC分组成员关联的对应关系列表中删除MTC分组与一个MTC分组成员之间的对应关系。被删除的MTC设备或MTC应用将不再属于MTC分组，即被删除的MTC设备或MTC应用将不再是MTC分组成员；
步骤1001，网络实体根据关联关系的删除，更新MTC分组标识对应的MTC分组密钥；
步骤1002、网络实体将MTC分组标识及MTC分组标识对应的新的MTC分组密钥发送到与MTC分组关联的MTC分组成员；
具体的，网络实体通过GBA-push过程或通过MBMS的方式，将MTC分组标识及MTC分组标识对应的新的MTC分组密钥，分发到与MTC分组 关联的MTC设备或MTC应用；
步骤1003、MTC分组成员收到MTC分组标识和新的MTC分组密钥后，更新MTC设备上、或MTC应用中，或UICC上保存的MTC分组标识对应的MTC分组密钥；
图11为本发明第五实施例方法的流程图，如图11所示，包括：
步骤1100、网络实体完成删除MTC分组的MTC分组成员后，针对MTC分组生成MTC分组认证请求信息。
本步骤中，MTC认证请求信息可以包含MTC分组标识信息；
步骤1101、网络实体将生成的MTC分组认证请求信息发送到MTC分组中的一个MTC分组成员。如，网络实体可以通过GBA-push过程或通过MBMS的方式将MTC分组认证请求信息发送到一个MTC分组成员；
步骤1102、MTC分组成员收到MTC分组认证请求信息后，根据MTC分组认证请求信息中包含的MTC分组标识对应的新的MTC分组密钥与网络实体进行双向认证。双向认证过程可以是基于MTC分组密钥的AKA过程，也可以是基于MTC分组密钥的GBA过程，也可以是基于MTC分组密钥采用HTTP digest认证过程，完成MTC设备与网络实体之间的互认证过程；
步骤1103、MTC分组成员与网络实体之间的互认证过程结束后，将MTC分组标识对应的认证结果，发送到与MTC分组关联的其他MTC分组成员。具体的，
MTC分组成员与网络实体之间的互认证过程结束后，网络实体通过GBA-push过程或通过MBMS方式，将MTC分组标识对应的认证结果，发送到与MTC分组关联的其他MTC设备或MTC应用。
本领域普通技术人员可以理解上述方法中的全部或部分步骤可通过程序来指令相关硬件(例如处理器)完成，所述程序可以存储于计算机可读存储介质中，如只读存储器、磁盘或光盘等。可选地，上述实施例的全部或部分步骤也可以使用一个或多个集成电路来实现。相应地，上述实施例中的各模块/单元可以采用硬件的形式实现，例如通过集成电路来实现其相应功能，也可以采用软件功能模块的形式实现，例如通过处理器执行存储与存储器中 的程序/指令来实现其相应功能。本发明不限于任何特定形式的硬件和软件的结合。
虽然本发明所揭露的实施方式如上，但所述的内容仅为便于理解本发明而采用的实施方式，并非用以限定本发明。任何本发明所属领域内的技术人员，在不脱离本发明所揭露的精神和范围的前提下，可以在实施的形式及细节上进行任何的修改与变化，但本发明的专利保护范围，仍须以所附的权利要求书所界定的范围为准。
工业实用性
本发明实施例简化了MTC系统的分组认证过程，降低了系统进行MTC认证的信令消耗。

Claims (39)

  1. 一种实现分组认证的方法，包括：
    网络实体向与机器类通信MTC分组建立关联的MTC分组成员中的一个发送MTC分组的分组认证请求信息；
    接收到分组认证请求信息的MTC分组成员根据分组认证请求信息中的MTC分组标识，以及该MTC分组的MTC分组密钥进行与网络实体的双向认证。
  2. 根据权利要求1所述的方法，该方法之前还包括：
    所述网络实体预先创建MTC分组；
    所述网络实体预先建立创建的MTC分组与MTC分组成员之间的关联关系。
  3. 根据权利要求1或2所述的方法，其中，所述双向认证包括：
    基于MTC分组密钥的第三代移动通讯网络的认证与密钥协商协议AKA双向认证；或，
    基于MTC分组密钥的通用自举架构GBA双向认证；或，
    基于MTC分组密钥采用超文本传送协议HTTP摘要认证机制digest进行的双向认证。
  4. 根据权利要求1或2所述的方法，还包括：
    所述网络实体向与MTC分组建立关联的MTC分组成员中的一个发送MTC分组的分组认证请求信息之前，
    所述网络实体发送所述MTC分组标识及MTC分组标识对应的MTC分组密钥到与MTC分组建立关联的所有MTC分组成员；
    所述与MTC分组建立关联的每一个MTC分组成员保存所述MTC分组标识和所述MTC分组密钥。
  5. 根据权利要求4所述的方法，还包括：
    所述网络实体发送MTC分组标识、MTC分组密钥到与MTC分组建立 关联的所有MTC分组成员后，在所述进行双向认证之前，
    所述网络实体在所述MTC分组中添加新的MTC分组成员；或所述网络实体删除所述MTC分组中的MTC分组成员。
  6. 根据权利要求2所述的方法，其中，所述预先建立创建的MTC分组与MTC分组成员之间的关联关系包括：
    所述网络实体根据所述MTC分组成员的成员标识和所述MTC分组的MTC分组标识，建立MTC分组标识和MTC分组成员标识之间的对应关系；
    其中，当所述MTC分组成员包含MTC设备时，所述MTC成员标识包括MTC设备身份标识；
    当所述MTC分组成员包含MTC应用时，所述MTC成员标识包括MTC应用身份标识。
  7. 根据权利要求6所述的方法，该方法还包括：
    在预先建立创建的MTC分组与MTC分组成员之间的关联关系后，在所述网络实体向与MTC分组建立关联的MTC分组成员中的一个发送MTC分组的分组认证请求信息之前，所述网络实体发送所述MTC分组标识及MTC分组标识对应的MTC分组密钥到所有MTC分组成员。
  8. 根据权利要求1或2所述的方法，该方法还包括：
    MTC分组成员与网络实体完成双向认证后，网络实体将MTC分组标识对应的认证结果，发送到与MTC分组关联的其他MTC分组成员；
    其他MTC分组成员接收到MTC分组认证结果后，基于认证结果执行MTC分组通信的相关业务。
  9. 根据权利要求8所述的方法，该方法还包括，在完成网络实体与MTC分组成员双向认证后，在完成双向认证的MTC分组中添加新的MTC分组成员。
  10. 根据权利要求9所述的方法，其中，所述添加新的MTC分组成员包括：
    网络实体建立新的MTC分组成员与MTC分组之间的关联关系，即网络 实体建立新的MTC成员与MTC分组之间的对应关系；
    将所述MTC分组标识、所述MTC分组标识对应的MTC分组密钥及MTC分组标识对应的分组认证结果发送到新的MTC分组成员；
    其中，所述MTC分组标识、MTC分组标识对应的MTC分组密钥及MTC分组标识对应的分组认证结果通过GBA-push过程或MBMS方式发送。
  11. 根据权利要求10所述的方法，该方法还包括：
    在完成网络实体与MTC分组成员双向认证后，删除所述完成双向认证的MTC分组中的MTC分组成员。
  12. 根据权利要求11所述的方法，其中，所述删除完成双向认证的MTC分组中的MTC分组成员包括：
    所述网络实体删除所述MTC分组成员与完成双向认证的MTC分组之间的关联关系并更新；
    根据MTC分组成员与MTC分组关联的更新更新MTC分组标识对应的MTC分组密钥；
    将MTC分组标识及MTC分组标识对应的更新的MTC分组密钥分发到与MTC分组关联的MTC分组成员；
    其中，所述MTC分组标识及MTC分组标识对应的更新的MTC分组密钥通过GBA-push过程或MBMS的方式分发。
  13. 根据权利要求1、2、6或7所述的方法，该方法还包括：
    在完成网络实体与MTC分组成员双向认证后，根据预先设定的触发条件，重新建立所述MTC分组与所述MTC分组成员之间的关联关系。
  14. 一种实现分组认证的方法，包括：
    网络实体向与机器类通信MTC分组建立关联的MTC分组成员中的一个发送MTC分组的分组认证请求信息；
    网络实体与接收到分组认证请求信息的MTC分组成员进行双向认证。
  15. 根据权利要求14所述的方法，该方法之前还包括：
    所述网络实体预先创建所述MTC分组，建立创建的MTC分组与MTC 分组成员之间的关联关系。
  16. 根据权利要求15所述的方法，还包括：
    所述建立创建的MTC分组与MTC分组成员之间的关联关系后，在所述网络实体向MTC分组成员中的一个发送MTC分组的分组认证请求信息之前，
    所述网络实体向所有MTC分组成员发送MTC分组标识及对应的MTC分组密钥。
  17. 根据权利要求16所述的方法，还包括：
    所述网络实体向所有MTC分组成员发送MTC分组标识及对应的MTC分组密钥后，在所述网络实体向MTC分组成员中的一个发送MTC分组的分组认证请求信息之前，所述网络实体在所述MTC分组中添加新的MTC分组成员，或删除所述MTC分组中的MTC分组成员。
  18. 根据权利要求14所述的方法，该方法还包括：
    在完成与MTC分组成员双向认证后，所述网络实体将认证结果发送到与所述MTC分组关联的其他MTC分组成员。
  19. 根据权利要求14所述的方法，该方法还包括：
    在完成与MTC分组成员双向认证后，所述网络实体在完成双向认证的MTC分组中添加新的MTC分组成员，或删除完成双向认证的MTC分组中的MTC分组成员。
  20. 根据权利要求14所述的方法，该方法还包括：
    在完成与MTC分组成员双向认证后，所述网络实体根据预先设定的触发条件，重新建立所述MTC分组与MTC分组成员之间的关联关系。
  21. 一种实现分组认证的方法，包括：
    机器类通信MTC分组成员接收到来自网络实体的分组认证请求信息；
    MTC分组成员根据分组认证请求信息中的MTC分组标识，以及该MTC分组的MTC分组密钥进行与网络实体的双向认证。
  22. 根据权利要求21所述的方法，该方法之前还包括：
    所述MTC分组成员接收到来自所述网络实体的MTC分组标识及MTC分组标识对应的MTC分组密钥，保存接收到的MTC分组标识和MTC分组密钥。
  23. 一种实现分组认证的系统，包括：网络实体及一个或一个以上MTC分组成员；其中，
    网络实体包括认证请求单元，
    认证请求单元，设置为向与MTC分组建立关联的MTC分组成员中的一个发送MTC分组的分组认证请求信息；
    MTC分组成员包括认证单元，设置为根据分组认证请求信息中的MTC分组标识，以及所述MTC分组对应的MTC分组密钥进行MTC分组成员与网络实体的双向认证。
  24. 根据权利要求23所述的系统，所述网络实体还包括创建单元、关联单元；其中，
    创建单元，设置为预先创建MTC分组；
    关联单元，设置为建立创建的MTC分组与MTC分组成员之间的关联关系。
  25. 根据权利要求23或24所述的系统，所述创建单元是设置为通过如下方式实现建立创建的MTC分组：
    创建包含有MTC分组标识及与MTC分组标识相对应的MTC分组密钥的分组。
  26. 根据权利要求23或24所述的系统，所述关联单元是设置为：
    发送所述MTC分组标识及MTC分组标识对应的MTC分组密钥到与MTC分组建立关联的所有MTC分组成员；
    所述MTC分组成员还包括保存单元，设置为保存MTC分组标识和MTC分组密钥。
  27. 根据权利要求26所述的系统，所述网络实体还包括：
    添加单元，设置为发送MTC分组标识、MTC分组密钥到与MTC分组 建立关联的所有MTC分组成员后，在所述进行双向认证之前，在所述MTC分组中添加新的MTC分组成员；
    或者，删除单元，设置为发送MTC分组标识、MTC分组密钥到与MTC分组建立关联的所有MTC分组成员后，在所述进行双向认证之前，删除所述MTC分组中的MTC分组成员。
  28. 根据权利要求23或24所述的系统，所述网络实体还包括认证结果发送单元，设置为完成互认证后，将MTC分组标识对应的认证结果，发送到与MTC分组关联的其他MTC分组成员；
    MTC分组成员还包括接收单元，设置为：
    接收到所述认证结果后，基于所述认证结果执行MTC分组通信的相关业务。
  29. 根据权利要求23所述的系统，所述网络实体还包括添加单元，设置为在完成与MTC分组成员双向认证后，在完成双向认证的MTC分组中添加新的MTC分组成员；
    或者，所述网络实体还包括删除单元，设置为在完成与MTC分组成员双向认证后，删除完成双向认证的MTC分组中的MTC分组成员。
  30. 根据权利要求23所述的系统，所述网络实体还包括重建单元，设置为在完成与MTC分组成员双向认证后，根据预先设定的触发条件，重新建立分组关联关系。
  31. 一种网络实体，包括：
    认证请求单元，设置为向与MTC分组建立关联的MTC分组成员中的一个发送MTC分组的分组认证请求信息；与接收到分组认证请求信息的MTC分组成员进行双向认证。
  32. 根据权利要求34所述的网络实体，还包括：
    创建单元，设置为预先创建MTC分组；
    关联单元，设置为建立创建的MTC分组与MTC分组成员之间的关联关系。
  33. 根据权利要求31所述的网络实体，还包括：
    认证结果发送单元，设置为完成互认证后，将MTC分组标识对应的认证结果，发送到与MTC分组关联的其他MTC分组成员。
  34. 根据权利要求31所述的网络实体，还包括：
    添加单元，设置为在完成与MTC分组成员双向认证后，在完成双向认证的MTC分组中添加新的MTC分组成员；
    或者，删除单元，设置为在完成与MTC分组成员双向认证后，删除完成双向认证的MTC分组中的MTC分组成员。
  35. 根据权利要求31所述的网络实体，还包括：
    重建单元，设置为在完成与MTC分组成员双向认证后，根据预先设定的触发条件，重新建立分组关联关系。
  36. 一种机器类通信MTC分组成员，包括：
    认证单元，设置为接收到来自网络实体的分组认证请求信息，根据分组认证请求信息中的MTC分组标识，以及所述MTC分组对应的MTC分组密钥进行MTC分组成员与网络实体的双向认证。
  37. 根据权利要求36所述的MTC分组成员，还包括：
    保存单元，设置为保存接收到的来自所述网络实体的MTC分组标识和MTC分组密钥。
  38. 根据权利要求36所述的MTC分组成员，还包括：
    接收单元，设置为接收到来自所述网络实体的认证结果后，基于所述认证结果执行MTC分组通信的相关业务。
  39. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求14～22任意一项所述的方法。
PCT/CN2016/073650 2015-03-12 2016-02-05 一种实现分组认证的方法及系统 WO2016141794A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510108508.8 2015-03-12
CN201510108508.8A CN106034027A (zh) 2015-03-12 2015-03-12 一种实现分组认证的方法及系统

Publications (1)

Publication Number Publication Date
WO2016141794A1 true WO2016141794A1 (zh) 2016-09-15

Family

ID=56879962

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/073650 WO2016141794A1 (zh) 2015-03-12 2016-02-05 一种实现分组认证的方法及系统

Country Status (2)

Country Link
CN (1) CN106034027A (zh)
WO (1) WO2016141794A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111886884B (zh) * 2018-03-09 2023-03-24 上海诺基亚贝尔股份有限公司 用于通信中的认证的方法、设备和计算机可读介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102469458A (zh) * 2010-11-19 2012-05-23 中兴通讯股份有限公司 一种m2m通信中的组认证方法和系统
CN102480727A (zh) * 2010-11-30 2012-05-30 中兴通讯股份有限公司 机器与机器通信中的组认证方法及系统
US20130315389A1 (en) * 2010-12-08 2013-11-28 Lg Electronics Inc. Traffic encryption key management for machine to machine multicast group
CN103688563A (zh) * 2011-05-26 2014-03-26 诺基亚公司 执行组认证和密钥协商过程

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102088668B (zh) * 2011-03-10 2013-09-25 西安电子科技大学 基于群组的机器类型通信设备的认证方法
CN102137397B (zh) * 2011-03-10 2014-04-02 西安电子科技大学 机器类型通信中基于共享群密钥的认证方法
CN102843233B (zh) * 2011-06-21 2017-05-31 中兴通讯股份有限公司 一种机器到机器通信中组认证的方法和系统
CN103596167B (zh) * 2013-10-25 2016-06-29 西安电子科技大学 基于代理的机器类型通信认证和密钥协商方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102469458A (zh) * 2010-11-19 2012-05-23 中兴通讯股份有限公司 一种m2m通信中的组认证方法和系统
CN102480727A (zh) * 2010-11-30 2012-05-30 中兴通讯股份有限公司 机器与机器通信中的组认证方法及系统
US20130315389A1 (en) * 2010-12-08 2013-11-28 Lg Electronics Inc. Traffic encryption key management for machine to machine multicast group
CN103688563A (zh) * 2011-05-26 2014-03-26 诺基亚公司 执行组认证和密钥协商过程

Also Published As

Publication number Publication date
CN106034027A (zh) 2016-10-19

Similar Documents

Publication Publication Date Title
WO2020147760A1 (zh) 一种局域网通信方法、装置及系统
US8275355B2 (en) Method for roaming user to establish security association with visited network application server
KR20070014162A (ko) 장치 그룹화 및 그룹화 된 장치들 사이 상호작용을구현하는 방법
CA2552917C (en) A method of obtaining the user identification for the network application entity
US8914867B2 (en) Method and apparatus for redirecting data traffic
CN111338906B (zh) 终端设备、边缘节点及基于区块链的应用监管方法和系统
AU2018265334A1 (en) Selection of IP version
US9525848B2 (en) Domain trusted video network
WO2014183260A1 (zh) 漫游场景下的数据业务处理方法、装置和系统
US20170215026A1 (en) Method for processing request message in wireless communication system and apparatus therefor
CN109691062A (zh) 管理任务关键数据（MC Data）通信系统中的短数据服务（SDS）的方法
CN105472597B (zh) 应用的注册方法及装置
WO2021051922A1 (zh) 一种群组传输数据的方法、终端及计算机可读存储介质
KR20200063087A (ko) M2m 시스템에서 메시지 반복 전송 방법 및 장치
JP2015503304A (ja) アクセス方法、モビリティ管理デバイス、およびユーザ機器
JP6476319B2 (ja) 移動無線通信ネットワークに移動端末の接続を確立するための方法、及び無線アクセスネットワーク構成要素
JP2019186922A (ja) 接続機器の自動的アクティベーションおよびオンボード
WO2013067744A1 (zh) 一种终端组的服务网关选择方法及系统
WO2016141794A1 (zh) 一种实现分组认证的方法及系统
US20150181503A1 (en) Temporary access to wireless networks
US20080130577A1 (en) Wireless multicasting service method using relayed transmission scheme
US20090059840A1 (en) Wireless communication system and method for managing service flow identifier in the same
WO2016101429A1 (zh) 一种mtc分组管理方法、装置及系统，网络实体
EP3903449B1 (en) Enhanced pfcp association procedure for session restoration
CN106487776B (zh) 一种保护机器类通信设备的方法、网络实体及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16761021

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16761021

Country of ref document: EP

Kind code of ref document: A1