WO2016173074A1 - 基于终端的通信方法、通信终端及通信系统 - Google Patents

基于终端的通信方法、通信终端及通信系统 Download PDF

Info

Publication number
WO2016173074A1
WO2016173074A1 PCT/CN2015/080397 CN2015080397W WO2016173074A1 WO 2016173074 A1 WO2016173074 A1 WO 2016173074A1 CN 2015080397 W CN2015080397 W CN 2015080397W WO 2016173074 A1 WO2016173074 A1 WO 2016173074A1
Authority
WO
WIPO (PCT)
Prior art keywords
base station
communication terminal
communication
terminal
security isolation
Prior art date
Application number
PCT/CN2015/080397
Other languages
English (en)
French (fr)
Inventor
张云飞
朱亚军
雷艺学
钟焰涛
Original Assignee
宇龙计算机通信科技(深圳)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 宇龙计算机通信科技(深圳)有限公司 filed Critical 宇龙计算机通信科技(深圳)有限公司
Publication of WO2016173074A1 publication Critical patent/WO2016173074A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/042—Public Land Mobile systems, e.g. cellular systems
    • H04W84/045—Public Land Mobile systems, e.g. cellular systems using private Base Stations, e.g. femto Base Stations, home Node B
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices
    • H04W88/04—Terminal devices adapted for relaying to or from another terminal or user

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a terminal-based communication method, a communication terminal, and a communication system.
  • the personalized and diverse applications provided by the mobile Internet have greatly enriched people's lives.
  • the security of communication devices has become a problem to be considered.
  • mobile terminals such as smart phones adopting intelligent operating systems and various applications are being developed and utilized, it is inevitable that they will be infected by computer viruses from the Internet and cyber attacks, resulting in business interruption and leakage of user private information. .
  • the second communication terminal here may be a terminal with limited capabilities, such as a low-cost IoT terminal or other device. If a terminal based-small cell (T-SC) base station based on a smart phone terminal is constructed, communication security issues must be considered.
  • T-SC terminal based-small cell
  • the T-SC base station is built on a smart phone, and the T-SC base station device itself is also insecure.
  • the traditional base station equipment is located in the network domain of the operator, such as the macro base station, adopts the security mechanism of the network domain and the physical security mechanism (forbidden to enter the base station configuration area illegally) to ensure security, or is located in the area where the user deploys, such as the home base station HNB. /HeNB, but through the security authentication and authentication of the security gateway SeGW, a secure IPSec tunnel is established with the associated core network (CN) network element to ensure the security of the base station, so that the base station can be completed.
  • CN core network
  • the function includes saving the Context Information in the connected state of the user equipment (User Equipment, UE), and performing the Control Plane (CP) and user plane of the Access Stratum (AS). (User Plane, UP) export of security keys to support the establishment and switching of radio bearers. These factors are not directly available to the T-SC base station equipment.
  • the T-SC base station needs to maintain the bearer information of the accessed UE.
  • the information itself must be secured. Otherwise, the leakage of this information is likely to cause the user to be impersonated, resulting in incorrect authorization or even billing. Therefore, the dual-system smart phone terminal needs to support the function of the T-SC base station, and an independent security protection mechanism needs to be designed for the information of the T-SC base station supporting the cell function.
  • the invention provides a terminal-based communication method with a security protection mechanism, so as to improve the security of communication information while improving the carrying capacity and capacity of the traditional communication network.
  • the present invention also provides a communication terminal, wherein the first communication terminal establishes a communication connection with the communication base station or/and the core network by using the terminal-based communication method, and enables the second communication terminal to communicate with the communication terminal through the first communication terminal.
  • the data exchange between the base station or/and the core network can effectively improve the carrying capacity and capacity of the traditional communication network, and ensure the security of the communication information.
  • the present invention also provides a communication system, wherein the first communication terminal establishes a communication connection with the communication base station or/and the core network by using the terminal-based communication method, and causes the second communication terminal to communicate with the communication terminal through the first communication terminal.
  • the data exchange between the base station or/and the core network can effectively improve the carrying capacity and capacity of the traditional communication network, and ensure the security of the communication information.
  • a terminal-based communication method includes the following steps:
  • the first communication terminal establishes a communication connection with the communication base station or/and the core network to form a terminal based-small cell (T-SC) base station;
  • T-SC terminal based-small cell
  • the second communication terminal performs data interaction with the communication base station or/and the core network through a security isolation module of the T-SC base station.
  • the security isolation module is disposed in a physical memory of the first communication terminal, or the security isolation module is independent of the first communication terminal, and is established with the communication terminal through a wired interface or a wireless interface.
  • the data stored in the secure isolation module cannot be invoked by an application or application programming interface that is unrelated to communication with the T-SC base station.
  • the security isolation module includes a first security isolation area and a second security isolation area, where the first security isolation area is used to save and maintain parameter information of the first terminal when the T-SC base station is running.
  • the second security isolation area is configured to save and maintain an aggregated data stream formed when the second communication terminal performs data interaction with the communication base station or/and the core network by using the T-SC base station.
  • the first communication terminal includes a first working mode and a second working mode, where the first working mode is a default working mode when the first communication terminal is running as a normal communication terminal, and the second working mode is the first working mode.
  • the communication terminal functions as a working mode when the T-SC base station is in operation, and the second working mode is compatible with the first working mode.
  • the security isolation module further includes a third security isolation area, where the third security isolation area is used to save and maintain the first communication terminal in the second working mode with the communication base station or/and core The native data stream formed by the network for data interaction.
  • the step of the second communication terminal performing data interaction with the communication base station or/and the core network by using the security isolation module of the T-SC base station is specifically: the T-SC base station receives the second communication terminal Transmitting the first data and storing in the second security isolation zone, and according to the second communication end The identification information of the end marks the first data, and sends the marked first data to the communication base station or/and the core network.
  • the step of performing data interaction between the second communication terminal and the communication base station or/and the core network by using the security isolation module of the T-SC base station further includes: the T-SC base station receiving the communication base station or The second data sent by the core network is stored in the second security isolation area, and the target terminal that receives the second data is determined according to the marking information of the second data and the identification information of the second communication terminal. And transmitting the second data to the target terminal
  • the method further includes: the T-SC base station transmitting broadcast information to the second communication terminal in the radiation range thereof, to indicate that the T-SC base station has the base station function, And transmitting the synchronization signal and system information to enable the second communication terminal to access the T-SC base station. .
  • the T-SC base station when receiving the access request of the second communication terminal, further includes the steps of: authenticating the identity of the second communication terminal to determine whether the second communication terminal has the right to access The T-SC base station.
  • the terminal-based communication method further includes: after the second communication terminal disconnects from the T-SC base station, the first communication terminal turns off the T-SC base station function, and switches back to the first working mode.
  • the communication method further includes: the second communication terminal performs data interaction with a third communication terminal by using the security isolation module of the T-SC base station.
  • a communication terminal comprising:
  • connection establishing module configured to establish a communication connection between the communication terminal and the communication base station or/and the core network to form a terminal based-small cell (T-SC) base station;
  • a base station module configured to provide a communication service to the second communication terminal, where the second communication terminal performs data interaction with the communication base station or/and the core network by using the T-SC base station;
  • a security isolation module configured to store an aggregated data stream formed by the second communication terminal through data interaction between the T-SC base station and the communication base station or/and a core network, and the communication terminal as the T-SC Parameter information when the base station is running.
  • the communication terminal includes a first working mode and a second working mode, where the first working mode is an operating mode when the communication terminal operates as a normal communication terminal, and the second working mode is that the communication terminal is The working mode when the T-SC base station is running, and the second working mode is compatible with the The first working mode is described.
  • the base station module is disposed in the communication terminal or is independent of the communication terminal, and establishes a connection with the communication terminal through a wired interface or a wireless interface.
  • the communication terminal further includes an authentication module, configured to authenticate an identity of the second communication terminal when receiving an access request of the second communication terminal, to determine whether the second communication terminal has rights Accessing the T-SC base station.
  • the communication terminal further includes a storage module, the security isolation module is disposed in the storage module or the base station module, and the security isolation module includes a first security isolation zone, a second security isolation zone, and a third a security isolation zone, where the first security isolation zone is used to save and maintain parameter information required for operation of the T-SC base station, and the second security isolation zone is used to save and maintain the second communication terminal a converged data stream formed by data interaction between the T-SC base station and the communication base station or/and a core network, where the third security isolation area is used for saving and maintaining the communication terminal operating in the second working mode. Native data stream.
  • the second security isolation area is further configured to save and maintain an aggregated data stream formed when the second communication terminal performs data interaction with the third communication terminal by using the T-SC base station.
  • a communication system includes a communication base station, a core network, a communication terminal, a first communication terminal, a second communication terminal, and a third communication terminal, and communication between the first communication terminal and the communication base station or/and a core network Connecting, forming a terminal based-small cell (T-SC) base station, the second communication terminal communicating with the communication base station, the core network or/the third communication by the T-SC base station The terminal performs data interaction.
  • T-SC terminal based-small cell
  • the terminal-based communication method of the present invention allocates a plurality of independent security isolation zones in the physical memory of the first communication terminal to save and maintain parameter information and aggregate data flows required for the operation of the T-SC base station. And a native data stream to ensure communication security of the second communication terminal accessing the T-SC base station.
  • FIG. 1 is a flow chart showing a terminal-based communication method according to a preferred embodiment of the present invention.
  • FIG. 2 is a schematic structural diagram of a communication terminal according to a preferred embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of another embodiment of a communication terminal provided by the present invention.
  • FIG. 4 is a block diagram showing the structure of a communication system in accordance with a preferred embodiment of the present invention.
  • a preferred embodiment of the present invention provides a terminal-based communication method, including the following steps:
  • Step S1 providing a first communication terminal that integrates a small cell base station function and has a first working mode and a second working mode, where the first communication terminal establishes a communication connection with the communication base station or/and the core network, A terminal based-small cell (T-SC) base station is formed.
  • the first working mode is a default working mode when the first communications terminal operates as a normal communications terminal
  • the second working mode is a working mode when the first communications terminal operates as a T-SC base station.
  • the second working mode is compatible with the first working mode, that is, the first communications terminal can operate as a normal communication terminal in addition to being operable as a T-SC base station in the second working mode.
  • the first communication terminal is in the first working mode by default.
  • Step S2 The T-SC base station receives an access request of the second communication terminal, and establishes a communication connection with the second communication terminal.
  • Step S3 The second communication terminal performs data interaction with the communication base station or/and the core network through a security isolation module of the T-SC base station.
  • the T-SC base station before receiving the access request of the second communication terminal, further includes the step of: the T-SC base station transmitting broadcast information to the second communication terminal in its radiation range to indicate that the T-SC base station has the broadcast information
  • the base station functions and enables the second communication terminal to access the T-SC base station by transmitting a synchronization signal, system information, and the like. It can be understood that the T-SC base station sends broadcast information or synchronizes.
  • the period and time-frequency locations of other signals, such as signals, system information, etc., may be predefined.
  • step S2 before the T-SC base station establishes a communication connection with the second communication terminal, the method further includes the steps of: switching the working mode of the first communication terminal to a second working mode, in the second working mode And the first communication terminal uses only the security isolation module to perform data interaction with the second terminal, the communication base station, or/and the core network.
  • the security isolation module is disposed in a physical memory of the first communication terminal, or the security isolation module is independent of the first communication terminal, and establishes a connection with the communication terminal through a wired interface or a wireless interface.
  • the security isolation module is configured to save and maintain parameter information, a converged data stream, and a native data stream required for the T-SC base station to operate.
  • the security isolation module includes a first security isolation zone, a second security isolation zone, and a third security isolation zone.
  • the first security isolation zone is used to save and maintain parameter information required for the T-SC base station to operate.
  • the second security quarantine is used to save and maintain the aggregated data stream.
  • the third secure quarantine is used to save and maintain the native data stream.
  • the memory capacities of the first security isolation zone, the second security isolation zone, and the third security isolation zone may be set to be the same or different.
  • the parameter information, the aggregated data stream and the original data stream required for the operation of the T-SC base station are stored in the security isolation zone, and can be prevented from being applied by any application (Application, App) or other application unrelated to the operation of the T-SC base station.
  • Application Programming Interface API calls and accesses. It can be understood that if the operation of the T-SC base station accepts the configuration from the operator core network entity, its configuration information should also be saved in the security isolation module.
  • the T-SC base station when receiving the access request of the second communication terminal, further includes the steps of: authenticating the identity of the second communication terminal to determine whether the second communication terminal has Access to the T-SC base station.
  • authenticating the identity of the second communication terminal to determine whether the second communication terminal has Access to the T-SC base station.
  • step S3 when the second communication terminal performs data interaction with the communication base station or/and the core network through the T-SC base station, the first communication terminal itself and the communication base station or/and the core network There is also data interaction.
  • the second communication terminal forms an aggregated data stream by data interaction between the T-SC base station and the communication base station or/and a core network; the first communication terminal itself and the communication base station or/and a core network The interaction between the data forms a native data stream.
  • step S3 the step of the second communication terminal performing data interaction with the communication base station or/and the core network by using the T-SC base station is specifically: the T-SC base station receives the second communication terminal to send The first data is stored in the second security isolation zone, and the first data is marked according to the identification information of the second communication terminal, and the marked first data is sent to the communication a base station or/and a core network; the T-SC base station receives the second data sent by the communication base station or/and the core network and stores the second data in the second security isolation zone, and according to the marking information of the second data, The identification information of the second communication terminal determines a target terminal that receives the second data, and sends the second data to the target terminal.
  • step S3 the step of the second communication terminal performing data interaction with the communication base station or/and the core network by using the T-SC base station further includes: the T-SC base station according to the first communication terminal and the The identification information of the second communication terminal determines the type of the accessed data stream, and performs data interaction with the communication base station or/and the core network according to different data stream types.
  • the data stream accessing the T-SC base station is an aggregated data stream
  • the aggregated data stream is stored in the second security isolation zone to prevent it from being used by any application or other device unrelated to the operation of the T-SC base station.
  • the native data stream is stored in the third isolation zone, and passes through the first communication terminal and the communication base station or/and the core network. Data interaction between them.
  • step S3 after the second communication terminal leaves the radiation range of the T-SC base station, the method further includes: after the second communication terminal disconnects from the T-SC base station, the first communication terminal is closed.
  • the T-SC base station functions and switches back to the first mode of operation.
  • the terminal-based communication method may further include: the second communication terminal performs data interaction with a third communication terminal by using the security isolation module of the T-SC base station.
  • the second security isolation area is further configured to save and maintain an aggregated data stream formed when the second communication terminal performs data interaction with the third communication terminal by using the T-SC base station.
  • the second communication terminal and the third communication terminal may be ordinary communication terminals, such as mobile communication terminals such as mobile phones and tablet computers, or terminals with limited capabilities, such as low-cost IoT terminals.
  • the terminal-based communication method by allocating multiple independents in physical memory of the first communication terminal a security isolation zone to preserve and maintain parameter information, aggregated data streams, and native data streams required for operation of the T-SC base station, thereby effectively preventing the parameter information and the aggregated data stream from being connected to any T-SC base station Running an unrelated App or other API call and access ensures communication security for the second communication terminal accessing the T-SC base station.
  • a preferred embodiment of the present invention further provides a communication terminal 100, which includes a connection establishing module 10 for establishing a communication connection with a communication base station or/and a core network to form a terminal-based micro cell.
  • a terminal base-small cell (T-SC) base station module 20 configured to provide a communication service to a second communication terminal, for the second communication terminal to pass the T-SC base station and the communication base station or And interacting with the core network;
  • the security isolation module 30 is configured to store the aggregated data stream and the data formed by the second communication terminal when the T-SC base station performs data interaction with the communication base station or/and the core network.
  • the communication terminal is used as parameter information when the T-SC base station is in operation. It can be understood that the base station module 20 can be disposed in the communication terminal 100, or can be set independently of the communication terminal 100, and can establish a connection with the communication terminal 100 through a wired interface or a wireless interface.
  • the communication terminal 100 has a first working mode and a second working mode, where the first working mode is an operating mode when the communication terminal operates as a normal communication terminal, and the second working mode is the communication terminal as a T-SC
  • the communication terminal is in the first working mode by default.
  • the security isolation module 30 is disposed in the physical memory of the communication terminal 100, and includes a first security isolation zone 31, a second security isolation zone 33, and a third security isolation zone 35.
  • the first security isolation area 31 is configured to save and maintain parameter information required for the T-SC base station to operate.
  • the second security isolation area 33 is configured to save and maintain an aggregated data stream formed by the second communication terminal by data interaction between the T-SC base station and the communication base station or/and a core network.
  • the third security isolation area 35 is used to save and maintain the native data stream in which the communication terminal 100 operates in the second mode of operation. When the communication terminal 100 is operating in the second working mode, the communication terminal 100 uses only the first safety isolation area 31, the second safety isolation area 33, and the third safety isolation area 35 to ensure the second working mode.
  • the communication security of the second communication terminal accessing the T-SC base station is performed. It can be understood that the security isolation module 30 can also be disposed in the base station module 20, when the base station module 20 is set independently of the communication terminal 100. The security isolation module 30 and the base station module 20 establish a connection with the communication terminal 100 through a wired interface or a wireless interface.
  • the communication terminal 100 further includes an authentication module 40, configured to authenticate an identity of the second communication terminal when receiving an access request of the second communication terminal, to determine whether the second communication terminal has rights Accessing the T-SC base station.
  • an authentication module 40 configured to authenticate an identity of the second communication terminal when receiving an access request of the second communication terminal, to determine whether the second communication terminal has rights Accessing the T-SC base station.
  • the communication terminal 100 further includes a switching module 50 for switching the working mode of the communication terminal 100.
  • the switching module 50 switches the working mode of the communication terminal 100 to a second working mode, and in the second working mode, the The communication terminal 100 uses only the security isolation module to perform data interaction with the second terminal, the communication base station, or/and the core network.
  • the second communication terminal can also perform data interaction with a third communication terminal by using the security isolation module 30 of the T-SC base station.
  • the second security isolation area 33 is further configured to save and maintain an aggregated data stream formed when the second communication terminal performs data interaction with the third communication terminal by using the T-SC base station.
  • the second communication terminal and the third communication terminal may be ordinary communication terminals, such as mobile communication terminals such as mobile phones and tablet computers, or terminals with limited capabilities, such as low-cost IoT terminals.
  • the implementation manner of the communication terminal 100 in the embodiment of the present invention may be specifically referred to the implementation manner of the first communication terminal in the foregoing method embodiment, and details are not described herein again.
  • FIG. 3 is a schematic structural diagram of a communication terminal 100 according to another embodiment of the present invention.
  • the communication terminal 100 can include at least one processor 101, such as a CPU, at least one communication bus 102, a user interface 103, a base station module 104, at least one communication interface 105, a memory 106, and a display 107.
  • the communication bus 102 is used to implement connection communication between these components.
  • the user interface 103 can include a mouse, a keyboard, or a display screen.
  • the optional user interface 103 can also include a standard wired interface and a wireless interface.
  • the base station module 104 is configured to establish a communication connection with the communication base station or/and the core network to form a terminal based-small cell (T-SC) base station.
  • the communication interface 105 can optionally include a standard wired interface (such as a data line interface, a network line interface, etc.), and a wireless interface (such as a WI-FI interface, a Bluetooth interface, and a near field communication interface).
  • Memory 106 may be a high speed RAM memory or a non-volatile memory such as at least one disk memory.
  • the memory 106 can optionally also be at least one storage device located remotely from the aforementioned processor 101. As shown in FIG.
  • the memory 106 as a computer storage medium may include an operating system, a network communication module, a security isolation module, and a user interface module.
  • the operating system is used to cooperate with the operations of the various components of the communication terminal 100.
  • the network communication module may include a connection establishment module, an authentication module, and a handover module in the embodiment shown in FIG. 2.
  • the safety isolation module is equivalent to the safety isolation module of the embodiment shown in FIG. 2.
  • the user interface module is for saving and maintaining user data of the communication terminal 100.
  • the base station module 104 is further configured to enable a second communication terminal to perform with the communication base station, the core network, or/and a third communication terminal by using the T-SC base station. Data interaction. It can be understood that the base station module 104 described in this embodiment should have the same function and structure as the base station module 20 in the embodiment shown in FIG. 2. Similarly, the base station module 104 can be disposed in the communication terminal 100, or can be set independently of the communication terminal 100, and can establish a connection with the communication terminal 100 through a wired interface or a wireless interface.
  • the security isolation module is configured to save and maintain parameter information, a converged data stream, and a native data stream required for the T-SC base station to operate, so as to prevent it from being used by any application unrelated to the operation of the T-SC base station (Application, App) or other application programming interface (API) calls and accesses. It can be understood that the security isolation module can also be disposed in the base station module 104. When the base station module 104 is set independently of the communication terminal 100, the security isolation module and the base station module 104 pass through a wired interface or a wireless interface. A connection is established with the communication terminal 100.
  • the communication terminal 100 described in this embodiment may be a mobile phone, a tablet computer, a notebook computer, a palmtop computer, a mobile internet device (MID), a wearable device (such as a smart watch, a smart bracelet, a pedometer, etc.). Or other devices in the terminal device where the instant messaging application client can be installed.
  • the second communication terminal and the third communication terminal may be ordinary communication terminals, such as mobile communication terminals such as mobile phones and tablet computers, or terminals with limited capabilities, such as low-cost Internet of Things terminals.
  • a preferred embodiment of the present invention further provides a communication system 500 including a first communication terminal 100, a communication base station 200, a core network 300, a second communication terminal 401, and a Three communication terminals 403.
  • the first communication terminal 100 integrates a small cell base station function and has a first working mode and a second working mode.
  • the first communication terminal 100 establishes a communication connection with the communication base station 200 or/and the core network 300 to form a terminal based-small cell (T-SC) base station.
  • the second communication terminal 401 performs data interaction with the communication base station 200, the core network 300, or/and the third communication terminal 403 through the T-SC base station.
  • the first working mode is an operating mode when the first communication terminal operates as a normal communication terminal
  • the second working mode is a working mode when the first communication terminal operates as a T-SC base station
  • the working mode is compatible with the first working mode, that is, the first communication terminal can operate as a general communication terminal in addition to being able to operate as a T-SC base station in the second working mode.
  • the first communication terminal is in the first working mode by default.
  • the first security isolation area 31, the second security isolation area 33, and the third security isolation area 35 are preset in a physical memory of the first communication terminal 100.
  • the first security isolation area 31 is configured to save and maintain parameter information required for the T-SC base station to operate.
  • the second security isolation area 33 is configured to save and maintain data between the T-SC base station and the communication base station 200, the core network 300, or/and the third communication terminal 403 by the second communication terminal 401. An aggregated data stream formed by interaction.
  • the third security isolation area 35 is configured to save and maintain the native data stream in which the first communication terminal 100 operates in the second working mode. It can be understood that the first security isolation zone 31, the second security isolation zone 33, and the third security isolation zone 35 can also be disposed independently of the first communication terminal 100, and through the wired interface or the wireless interface with the first The communication terminal establishes a connection.
  • a physical storage area of the first communication terminal 100 further includes an additional storage area 37 for storing and maintaining the operating system and network communication in the embodiment shown in FIG. Module and user interface module. It can be understood that the physical memory of the first communication terminal 100 of the embodiment is equivalent to the memory 106 of the embodiment shown in FIG.
  • the second communication terminal 401 and the third communication terminal 403 When the second communication terminal 401 and the third communication terminal 403 are located within the radiation range of the T-SC base station, the second communication terminal 401 and the third communication terminal 403 establish a communication connection with the T-SC base station.
  • the second communication terminal 401 interacts with the communication base station 200, the core network 300, or/and the third communication terminal 403 via the T-SC base station.
  • the second communication terminal 401 and the third communication terminal 403 may be ordinary communication terminals, such as mobile communication terminals such as mobile phones and tablet computers, or terminals with limited capabilities, such as low-cost IoT terminals.
  • the T-SC base station transmits broadcast information to the second communication terminal 401 and the third communication terminal 403 within its radiation range to indicate that it has the function of the base station; or the T-SC base station performs the operation of the traditional communication base station, and transmits the synchronization. Signals, system information, and the like, such that the second communication terminal 401 and the third communication terminal 403 can access the T-SC base station. It can be understood that the period and time-frequency position of the T-SC base station transmitting other information such as broadcast information or synchronization signal, system information, etc. may be predefined.
  • the T-SC base station When receiving the access request of the third communication terminal 403 by the second communication terminal 401, the T-SC base station authenticates the identity of the second communication terminal 401 and the third communication terminal 403 to determine the The second communication terminal 401 of the second communication terminal 401 has the right to access the T-SC base station.
  • the first communication terminal 100 switches its operation mode to the second operation mode.
  • the first communication terminal 100 uses only the first security isolation zone 31, the second security isolation zone 33, and the third security isolation zone 35 to ensure The communication of the second communication terminal accessing the T-SC base station is secure in the second mode of operation.
  • the communication terminal 100 forms a T-SC base station by integrating the base station module 20 for the second communication terminal 401 to pass the T-SC base station with the communication base station 200, the core network 300 or/and the third
  • the communication terminal 403 performs data interaction and allocates a plurality of independent security isolation zones in the physical memory of the first communication terminal to save and maintain the parameter information and aggregation required by the first communication terminal 100 to operate as a T-SC base station.
  • a data stream and a native data stream to prevent the ring parameter information, the aggregate data stream, and the native data stream from being called and accessed by any App or other API unrelated to the operation of the T-SC base station, thereby effectively ensuring access to the T-SC
  • the communication of the second communication terminal of the base station is secure.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明提供一种基于终端的通信方法，包括：第一通信终端与通信基站或/和核心网建立通信连接，以构成基于终端的微小区(terminal based-small cell，T-SC)基站；所述T-SC基站接收第二通信终端的接入请求，并与所述第二通信终端建立通信连接；所述第二通信终端通过所述T-SC基站的一安全隔离模块与所述通信基站或/和核心网进行数据交互。本发明还提供一种通信终端及通信系统。所述基于终端的通信方法可以确保接入所述T-SC基站的第二通信终端的通信安全。

Description

基于终端的通信方法、通信终端及通信系统
本申请要求于2015年04月30日提交中国专利局，申请号为201510219206.8、发明名称为“基于终端的通信方法、通信终端及通信系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信技术领域，尤其涉及一种基于终端的通信方法、通信终端及通信系统。
背景技术
移动互联网所提供的个性化、多样化的应用，极大地丰富了人们的生活。与之同时，通信设备的安全性也成为了一个需要考虑的问题。尤其是随着智能手机等移动终端采用智能操作系统并且各种各样的应用不断被开发和利用，难免会受到来自互联网的计算机病毒的感染和网络攻击，造成业务的中断和用户私密信息的泄漏。
另一方面，随着移动终端数目的不断增多以及业务需求的多样化，为了进一步的提高传统网络的承载能力与容量，基站的小型化和网络节点的密集化已经成为必然的选择。目前，已经存在把基站功能集成到智能手机等移动终端上作为一种灵活地为第二通信终端提供小区方式接入的方案。这里的第二通信终端，可能是能力受限的终端，如低成本的物联网终端或者其他设备。如果构建基于智能手机终端的微小区(terminal based-small cell，T-SC)基站，必须要考虑通信的安全问题。因为这种方案中，T-SC基站构建在智能手机上，T-SC基站设备本身也是不安全的。传统的基站设备要么位于运营商的网络域，如宏基站，采用网络域的安全机制以及物理安全机制(禁止非法进入基站配置区域)来保证安全，要么虽然位于用户部署的区域，如家庭基站HNB/HeNB，但是要通过安全网关SeGW的安全认证和鉴权，与相关的核心网(Core Network，CN)网元之间建立安全的IPSec隧道来保证基站的安全，以便能够完成基站 的功能，包括保存所接入用户设备(User Equipment，UE)连接状态下的承载信息(Context Information)，并进行接入层(Access Stratum，AS)的控制面(Control Plane，CP)和用户面(User Plane，UP)安全密钥的导出，以支持无线承载的建立和切换等操作。以上这些因素对T-SC基站设备来说都是不直接具备的。
在目前的智能手机设计中，部分已经实现了“双系统”的功能，可以把手机系统分成“安全区”和“非安全区”，通过这种安全隔离技术来降低了“安全区”的数据受到攻击的风险。但如何利用这种双系统的智能手机终端来提供T-SC基站功能，尚未被研究和公开。且现有技术中的双系统安全手机技术，无法直接应用用于T-SC基站功能的构建，因为该技术本身仅仅考虑了用户的应用需求，而T-SC基站汇聚接入的流量本身可能不是智能手机自身的业务，而是其他所连接UE的业务。这些汇聚的UE业务如何进行安全保证和隔离，尚未被解决。另一方面，T-SC基站一旦支持了小区功能，就需要维护所接入UE的承载信息，这些信息本身必须是有安全保证的。否则，泄漏了这些信息很可能导致用户被冒名顶替，从而产生错误的授权甚至计费。因此，双系统的智能手机终端要支持T-SC基站的功能，还需针对T-SC基站支持小区功能的信息设计独立的安全保护机制。
发明内容
本发明提供一种具有安全保护机制的基于终端的通信方法，以在提升传统通信网络的承载能力与容量的同时，更好地保证通信信息的安全。
另，本发明还提供一种通信终端，第一通信终端采用所述基于终端的通信方法与通信基站或/和核心网建立通信连接，并使第二通信终端通过第一通信终端与所述通信基站或/和核心网进行数据交互，能够有效提升传统通信网络的承载能力与容量，并保证通信信息的安全。
另，本发明还提供一种通信系统，第一通信终端采用所述基于终端的通信方法与通信基站或/和核心网建立通信连接，并使第二通信终端通过第一通信终端与所述通信基站或/和核心网进行数据交互，能够有效提升传统通信网络的承载能力与容量，并保证通信信息的安全。
一种基于终端的通信方法，包括如下步骤：
第一通信终端与通信基站或/和核心网建立通信连接，以构成基于终端的微小区(terminal based-small cell，T-SC)基站；
所述T-SC基站接收第二通信终端的接入请求，并与所述第二通信终端建立通信连接；
所述第二通信终端通过所述T-SC基站的一安全隔离模块与所述通信基站或/和核心网进行数据交互。
其中，所述安全隔离模块设置于所述第一通信终端的一物理内存中，或者所述安全隔离模块独立于所述第一通信终端设置，并通过有线接口或无线接口与所述通信终端建立连接，所述安全隔离模块内存储的数据无法被与T-SC基站通信无关的应用程序或应用程序编程接口调用。
其中，所述安全隔离模块包括第一安全隔离区和第二安全隔离区，所述第一安全隔离区用于保存和维护所述第一终端作为所述T-SC基站运行时的参数信息，所述第二安全隔离区用于保存和维护所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网进行数据交互时形成的汇聚数据流。
其中，所述第一通信终端包括第一工作模式和第二工作模式，所述第一工作模式为第一通信终端作为普通通信终端运行时的默认工作模式，所述第二工作模式为第一通信终端作为T-SC基站运行时的工作模式，且所述第二工作模式兼容所述第一工作模式。
其中，所述安全隔离模块还包括第三安全隔离区，所述第三安全隔离区用于保存和维护所述第一通信终端在所述第二工作模式下与所述通信基站或/和核心网进行数据交互时形成的原生数据流。
其中，所述T-SC基站与所述第二通信终端建立通信连接之前还包括步骤：切换所述第一通信终端的工作模式为第二工作模式，在所述第二工作模式下，所述第一通信终端仅使用所述安全隔离模块与所述第二终端、通信基站或/和核心网进行数据交互。
其中，所述第二通信终端通过所述T-SC基站的安全隔离模块与所述通信基站或/和核心网进行数据交互的步骤具体为：所述T-SC基站接收所述第二通信终端发送的第一数据并存储于所述第二安全隔离区，并根据所述第二通信终 端的标识信息对所述第一数据进行标记，并将标记后的所述第一数据发送至所述通信基站或/和核心网。
其中，所述第二通信终端通过所述T-SC基站的安全隔离模块与所述通信基站或/和核心网进行数据交互的步骤还包括：所述T-SC基站接收所述通信基站或/和核心网发送的第二数据并存储于所述第二安全隔离区，并根据所述第二数据的标记信息和所述第二通信终端的标识信息确定接收所述第二数据的目标终端，并将所述第二数据发送至所述目标终端
其中，所述T-SC基站接收第二通信终端的接入请求之前，还包括步骤：所述T-SC基站向其辐射范围内的第二通信终端发送广播信息，以说明自身具备基站功能，并通过发送同步信号和系统信息，以使得所述第二通信终端接入所述T-SC基站。。
其中，所述T-SC基站在接收第二通信终端的接入请求时，还包括步骤：对所述第二通信终端的身份进行鉴权，以确定所述第二通信终端是否有权限接入所述T-SC基站。
其中，所述基于终端的通信方法还包括：所述第二通信终端断开与该T-SC基站的连接后，第一通信终端关闭T-SC基站功能，并切换回第一工作模式。
其中，所述通信方法还包括：所述第二通信终端通过所述T-SC基站的所述安全隔离模块与一第三通信终端进行数据交互。
一种通信终端，包括：
连接建立模块，用于建立所述通信终端与通信基站或/和核心网之间的通信连接，以构成基于终端的微小区(terminal based-small cell，T-SC)基站；
基站模块，用于向第二通信终端提供通信服务，以供所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网进行数据交互；
安全隔离模块，用于存储所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网进行数据交互时形成的汇聚数据流及所述通信终端作为所述T-SC基站运行时的参数信息。
其中，所述通信终端包括第一工作模式和第二工作模式，所述第一工作模式为所述通信终端作为普通通信终端运行时的工作模式，所述第二工作模式为所述通信终端作为T-SC基站运行时的工作模式，且所述第二工作模式兼容所 述第一工作模式。
其中，所述基站模块设置于所述通信终端内或独立于所述通信终端设置，并通过有线接口或无线接口与所述通信终端建立连接。
其中，所述通信终端还包括鉴权模块，用于在接收第二通信终端的接入请求时，对所述第二通信终端的身份进行鉴权，以确定所述第二通信终端是否有权限接入所述T-SC基站。
其中，所述通信终端还包括存储模块，所述安全隔离模块设置于所述存储模块内或所述基站模块内，所述安全隔离模块包括第一安全隔离区、第二安全隔离区和第三安全隔离区，所述第一安全隔离区用于保存和维护所述T-SC基站运行时所需的参数信息，所述第二安全隔离区用于保存和维护所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网之间的数据交互形成的汇聚数据流，所述第三安全隔离区用于保存和维护所述通信终端工作于第二工作模式下的原生数据流。
其中，所述第二安全隔离区还用于保存和维护所述第二通信终端通过所述T-SC基站与一第三通信终端进行数据交互时形成的汇聚数据流。
一种通信系统，包括通信基站、核心网、通信终端、第一通信终端、第二通信终端和第三通信终端，所述第一通信终端与所述通信基站或/和核心网之间的通信连接，构成基于终端的微小区(terminal based-small cell，T-SC)基站，所述第二通信终端通过所述T-SC基站与所述通信基站、核心网或/和所述第三通信终端进行数据交互。
本发明所述基于终端的通信方法，通过在第一通信终端的物理内存中分配多个独立的安全隔离区，以保存和维护所述T-SC基站运行时所需的参数信息、汇聚数据流及原生数据流，从而确保接入所述T-SC基站的第二通信终端的通信安全。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付 出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明较佳实施例的基于终端的通信方法的流程示意图。
图2是本发明较佳实施例的通信终端的结构示意图。
图3是本发明提供的通信终端的另一实施例的结构示意图。
图4是本发明较佳实施例的通信系统的结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
请参阅图1，本发明较佳实施例提供一种基于终端的通信方法，其包括如下步骤：
步骤S1：提供一集成微小区(small cell)基站功能并具有第一工作模式和第二工作模式的第一通信终端，所述第一通信终端与通信基站或/和核心网建立通信连接，以构成基于终端的微小区(terminal based-small cell，T-SC)基站。其中，所述第一工作模式为所述第一通信终端作为普通通信终端运行时的默认工作模式，所述第二工作模式为所述第一通信终端作为T-SC基站运行时的工作模式，且所述第二工作模式兼容所述第一工作模式，即所述第一通信终端在第二工作模式下，除了可以作为T-SC基站运行外，也可作为普通通信终端运行。在本实施例中，第一通信终端默认处于第一工作模式。
步骤S2：所述T-SC基站接收第二通信终端的接入请求，并与所述第二通信终端建立通信连接。
步骤S3：所述第二通信终端通过所述T-SC基站的一安全隔离模块与所述通信基站或/和核心网进行数据交互。
在步骤S2中，所述T-SC基站接收第二通信终端的接入请求之前，还包括步骤：所述T-SC基站向其辐射范围内的第二通信终端发送广播信息，以说明自身具备基站功能，并通过发送同步信号、系统信息等，从而使得第二通信终端可以接入该T-SC基站。可以理解，所述T-SC基站发送广播信息或同步 信号、系统信息等其他信号的周期和时频位置可以是预先定义的。
在步骤S2中，所述T-SC基站与所述第二通信终端建立通信连接之前还包括步骤：切换所述第一通信终端的工作模式为第二工作模式，在所述第二工作模式下，所述第一通信终端仅使用所述安全隔离模块与所述第二终端、通信基站或/和核心网进行数据交互。
所述安全隔离模块设置于所述第一通信终端的一物理内存中，或者所述安全隔离模块独立于所述第一通信终端设置，并通过有线接口或无线接口与所述通信终端建立连接。所述安全隔离模块用以保存和维护所述T-SC基站运行时所需的参数信息、汇聚数据流和原生数据流。在本实施例中，所述安全隔离模块包括第一安全隔离区、第二安全隔离区和第三安全隔离区。该第一安全隔离区用于保存和维护所述T-SC基站运行时所需的参数信息。该第二安全隔离区用于保存和维护所述汇聚数据流。该第三安全隔离区用于保存和维护所述原生数据流。在本实施例中，所述将所述第一安全隔离区、第二安全隔离区和第三安全隔离区的内存容量可以被设置为相同或者不同。T-SC基站运行时所需的参数信息、汇聚数据流和原生数据流存储于所述安全隔离区，可以防止其被任何与T-SC基站运行无关的应用程序(Application，App)或者其他应用程序编程接口(Application Programming Interface，API)调用和访问。可以理解，如果T-SC基站的运行是接受了来自运营商核心网络实体的配置，那么其配置信息也应该保存在所述安全隔离模块内。
在步骤S2中，所述T-SC基站在接收第二通信终端的接入请求时，还包括步骤：对所述第二通信终端的身份进行鉴权，以确定所述第二通信终端是否有权限接入所述T-SC基站。通过在接入前对第二通信终端进行身份鉴权，以判断发起接入请求的第二通信终端是否有权限接入，可以防止非法终端的接入，提高通信的安全性与保密性。
在步骤S3中，所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网进行数据交互时，第一通信终端本身与所述通信基站或/和核心网之间也存在数据交互。其中，所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网之间的数据交互形成汇聚数据流；第一通信终端本身与所述通信基站或/和核心网之间的数据交互形成原生数据流。
在步骤S3中，所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网进行数据交互的步骤具体为：所述T-SC基站接收所述第二通信终端发送的第一数据并存储于所述第二安全隔离区，并根据所述第二通信终端的标识信息对所述第一数据进行标记，并将标记后的所述第一数据发送至所述通信基站或/和核心网；所述T-SC基站接收所述通信基站或/和核心网发送的第二数据并存储于所述第二安全隔离区，并根据所述第二数据的标记信息和所述第二通信终端的标识信息确定接收所述第二数据的目标终端，并将所述第二数据发送至所述目标终端。
在步骤S3中，所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网进行数据交互的步骤还包括：所述T-SC基站根据第一通信终端和所述第二通信终端的标识信息，判断接入的数据流类型，并根据不同的数据流类型分别与所述通信基站或/和核心网进行数据交互。当接入该T-SC基站的数据流为汇聚数据流时，所述汇聚数据流被存储至所述第二安全隔离区内，以防止其被任何与T-SC基站运行无关的App或者其他API调用和访问，并最终在数据无线接入层面或更高的汇聚层面被汇聚后与所述通信基站或/和核心网进行交互，也可经由所述T-SC基站转发到另一个与该T-SC基站连接的第二通信终端。当接入该T-SC基站的数据流为原生数据流时，所述原生数据流通被存储至所述第三隔离区内，并过第一通信终端与所述通信基站或/和核心网之间进行数据交互。
在步骤S3中，当所述第二通信终端离开所述T-SC基站的辐射范围后，还包括：所述第二通信终端断开与该T-SC基站的连接后，第一通信终端关闭T-SC基站功能，并切换回第一工作模式。
可以理解，所述基于终端的通信方法还可包括：所述第二通信终端通过所述T-SC基站的所述安全隔离模块与一第三通信终端进行数据交互。所述第二安全隔离区还用于保存和维护所述第二通信终端通过所述T-SC基站与所述第三通信终端进行数据交互时形成的汇聚数据流。其中，所述第二通信终端与所述第三通信终端可以是普通通信终端，如手机、平板电脑等移动通信终端，或能力受限的终端，如低成本的物联网终端。
所述基于终端的通信方法，通过在第一通信终端的物理内存中分配多个独 立的安全隔离区，以保存和维护所述T-SC基站运行时所需的参数信息、汇聚数据流及原生数据流，从而有效防止所述参数信息和汇聚数据流被任何与T-SC基站运行无关的App或者其他API调用和访问，确保接入所述T-SC基站的第二通信终端的通信安全。
请参阅图2，本发明较佳实施例还提供一种通信终端100，该通信终端100包括连接建立模块10，用于与通信基站或/和核心网建立通信连接，以构成基于终端的微小区(terminal based-small cell，T-SC)基站；基站模块20，用于向一第二通信终端提供通信服务，以供所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网进行数据交互；安全隔离模块30，用于存储所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网进行数据交互时形成的汇聚数据流及所述通信终端作为所述T-SC基站运行时的参数信息。可以理解，该基站模块20可以设置于通信终端100内，也可独立于通信终端100设置，并可以通过有线接口或无线接口与通信终端100建立连接。
所述通信终端100具有第一工作模式和第二工作模式，所述第一工作模式为该通信终端作为普通通信终端运行时的工作模式，所述第二工作模式为该通信终端作为T-SC基站运行时的工作模式，且所述第二工作模式兼容所述第一工作模式，即该通信终端在第二工作模式下，除了可以作为T-SC基站运行外，也可作为普通通信终端运行。在本实施例中，该通信终端默认处于第一工作模式。
所述安全隔离模块30设置于该通信终端100的物理内存中，包括第一安全隔离区31、第二安全隔离区33和第三安全隔离区35。该第一安全隔离区31用于保存和维护所述T-SC基站运行时所需的参数信息。该第二安全隔离区33用于保存和维护所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网之间的数据交互形成的汇聚数据流。该第三安全隔离区35用于保存和维护该通信终端100工作于第二工作模式下的原生数据流。当该通信终端100工作于第二工作模式下时，该通信终端100仅使用所述第一安全隔离区31、第二安全隔离区33及第三安全隔离区35，以保证在第二工作模式下接入所述T-SC基站的第二通信终端的通信安全。可以理解，所述安全隔离模块30还可设置于所述基站模块20内，当所述基站模块20独立于所述通信终端100设置 时，所述安全隔离模块30及基站模块20通过有线接口或无线接口与所述通信终端100建立连接。
所述通信终端100还包括鉴权模块40，用于在接收第二通信终端的接入请求时，对所述第二通信终端的身份进行鉴权，以确定所述第二通信终端是否有权限接入所述T-SC基站。通过在接入前对第二通信终端进行身份鉴权，以判断发起接入请求的第二通信终端是否有权限接入，可以防止非法终端的接入，提高通信的安全性与保密性。
所述通信终端100还包括切换模块50，用于切换该通信终端100的工作模式。所述T-SC基站与所述第二通信终端401建立通信连接之前，由该切换模块50切换所述通信终端100的工作模式为第二工作模式，在所述第二工作模式下，所述通信终端100仅使用所述安全隔离模块与所述第二终端、通信基站或/和核心网进行数据交互。
可以理解，所述第二通信终端还可通过所述T-SC基站的所述安全隔离模块30与一第三通信终端进行数据交互。所述第二安全隔离区33还用于保存和维护所述第二通信终端通过所述T-SC基站与所述第三通信终端进行数据交互时形成的汇聚数据流。其中，所述第二通信终端与所述第三通信终端可以是普通通信终端，如手机、平板电脑等移动通信终端，或能力受限的终端，如低成本的物联网终端。
需要说明的是，本发明实施例中的通信终端100的实施方式可以具体参考上述方法实施例中的第一通信终端的实施方式，这里不再赘述。
请参阅图3，图3所示为本发明另一实施例的通信终端100的结构示意图。该通信终端100可以包括：至少一个处理器101，例如CPU，至少一个通信总线102，用户接口103，基站模块104，至少一个通信接口105，存储器106，以及显示屏(Display)107。其中，通信总线102用于实现这些组件之间的连接通信。其中，用户接口103可以包括鼠标、键盘或显示屏，可选用户接口103还可以包括标准的有线接口、无线接口。基站模块104用于与通信基站或/和核心网建立通信连接，以构成基于终端的微小区(terminal based-small cell，T-SC)基站。通信接口105可选的可以包括标准的有线接口(如数据线接口、网线接口等)、无线接口(如WI-FI接口、蓝牙接口、近场通讯接口)。存储器 106可以是高速RAM存储器，也可以是非不稳定的存储器(non-volatile memory)，例如至少一个磁盘存储器。存储器106可选的还可以是至少一个位于远离前述处理器101的存储装置。如图3所示，作为一种计算机存储介质的存储器106中可以包括操作系统、网络通信模块、安全隔离模块以及用户接口模块。其中，所述操作系统用于协同该通信终端100各个组成部分的运行。该网络通信模块可包括如图2所示实施例中的连接建立模块、鉴权模块及切换模块。该安全隔离模块与图2所示实施例中的安全隔离模块等同。该用户接口模块用于保存和维护该通信终端100的用户数据。
在图3所示的通信终端100中，所述基站模块104还用于使一第二通信终端可以通过所述T-SC基站与所述通信基站、核心网或/和一第三通信终端进行数据交互。可以理解，本实施例所述的基站模块104与图2所示实施例中的基站模块20应具有相同的功能和结构。同样，所述基站模块104可以设置于所述通信终端100内，也可独立于通信终端100设置，并可以通过有线接口或无线接口与该通信终端100建立连接。
所述安全隔离模块用以保存和维护所述T-SC基站运行时所需的参数信息、汇聚数据流和原生数据流，以防止其被任何与T-SC基站运行无关的应用程序(Application，App)或者其他应用程序编程接口(Application Programming Interface，API)调用和访问。可以理解，所述安全隔离模块还可设置于所述基站模块104内，当所述基站模块104独立于所述通信终端100设置时，所述安全隔离模块及基站模块104通过有线接口或无线接口与所述通信终端100建立连接。
本实施例所描述的通信终端100可以为手机、平板电脑、笔记本电脑、掌上电脑、移动互联网设备(MID，mobile internet device)、可穿戴设备(例如智能手表、智能手环、计步器等)或其他可安装部署即时通信应用客户端的终端设备中的装置。所述第二通信终端与所述第三通信终端可以是普通通信终端，如手机、平板电脑等移动通信终端，或能力受限的终端，如低成本的物联网终端。
请参阅图4，本发明较佳实施例还提供一种通信系统500，该通信系统500包括第一通信终端100、通信基站200、核心网300、第二通信终端401和第 三通信终端403。其中，所述第一通信终端100集成微小区(small cell)基站功能并具有第一工作模式和第二工作模式。所述第一通信终端100与所述通信基站200或/和核心网300建立通信连接，构成基于终端的微小区(terminal based-small cell，T-SC)基站。所述第二通信终端401通过所述T-SC基站与所述通信基站200、核心网300或/和所述第三通信终端403进行数据交互。其中，所述第一工作模式为第一通信终端作为普通通信终端运行时的工作模式，所述第二工作模式为第一通信终端作为T-SC基站运行时的工作模式，且所述第二工作模式兼容所述第一工作模式，即第一通信终端在第二工作模式下，除了可以作为T-SC基站运行外，也可作为普通通信终端运行。在本实施例中，第一通信终端默认处于第一工作模式。
所述第一通信终端100的一物理内存中预设第一安全隔离区31、第二安全隔离区33和第三安全隔离区35。该第一安全隔离区31用于保存和维护所述T-SC基站运行时所需的参数信息。该第二安全隔离区33用于保存和维护所述第二通信终端401通过所述T-SC基站与所述通信基站200、核心网300或/和所述第三通信终端403之间的数据交互形成的汇聚数据流。该第三安全隔离区35用于保存和维护该第一通信终端100工作于第二工作模式下的原生数据流。可以理解，所述第一安全隔离区31、第二安全隔离区33和第三安全隔离区35还可独立于所述第一通信终端100设置，并通过有线接口或无线接口与所述第一通信终端建立连接。
在本实施例中，所述第一通信终端100的一物理内存中还包括一其他存储区域37，所述其他存储区域37用于保存和维护图3所示实施例中的操作系统、网络通信模块及用户接口模块。可以理解，本实施例的所述第一通信终端100的物理内存与图3所示实施例中所述存储器106等同。
所述第二通信终端401及第三通信终端403位于该T-SC基站的辐射范围之内时，所述第二通信终端401及第三通信终端403与所述T-SC基站建立通信连接，所述第二通信终端401通过所述T-SC基站与所述通信基站200、核心网进300或/和所述第三通信终端403行数据交互。所述第二通信终端401及第三通信终端403可以是普通通信终端，如手机、平板电脑等移动通信终端，或能力受限的终端，如低成本的物联网终端。
所述T-SC基站向其辐射范围内的第二通信终端401及第三通信终端403发送广播信息，以说明自身具备基站功能；或所述T-SC基站执行传统通信基站的操作，发送同步信号、系统信息等，从而使得所述第二通信终端401及第三通信终端403可以接入该T-SC基站。可以理解，所述T-SC基站发送广播信息或同步信号、系统信息等其他信号的周期和时频位置可以是预先定义的。
所述T-SC基站在接收所述第二通信终端401第三通信终端403的接入请求时，对所述第二通信终端401第三通信终端403的身份进行鉴权，以确定所述第二通信终端401第三通信终端403是否有权限接入所述T-SC基站。当所述第二通信终端401第三通信终端403具备接入所述T-SC基站的权限时，第一通信终端100切换其工作模式为第二工作模式。并当该第一通信终端100工作于第二工作模式下时，该第一通信终端100仅使用所述第一安全隔离区31、第二安全隔离区33及第三安全隔离区35，以保证在第二工作模式下接入所述T-SC基站的第二通信终端的通信安全。
所述通信终端100通过集成该基站模块20，构成T-SC基站，以供所述第二通信终端401通过该T-SC基站与所述通信基站200、核心网300或/和所述第三通信终端403进行数据交互，并通过在第一通信终端的物理内存中分配多个独立的安全隔离区，以保存和维护第一通信终端100作为T-SC基站运行时所需的参数信息、汇聚数据流和原生数据流，以防止所述环参数信息、汇聚数据流和原生数据流被任何与T-SC基站运行无关的App或者其他API调用和访问，从而有效确保接入所述T-SC基站的第二通信终端的通信安全。
以上所揭露的仅为本发明一种较佳实施例而已，当然不能以此来限定本发明之权利范围，本领域普通技术人员可以理解实现上述实施例的全部或部分流程，并依本发明权利要求所作的等同变化，仍属于发明所涵盖的范围。

Claims (19)

  1. 一种基于终端的通信方法，其特征在于，所述通信方法包括如下步骤：
    第一通信终端与通信基站或/和核心网建立通信连接，以构成基于终端的微小区(terminal based-small cell，T-SC)基站；
    所述T-SC基站接收第二通信终端的接入请求，并与所述第二通信终端建立通信连接；
    所述第二通信终端通过所述T-SC基站的一安全隔离模块与所述通信基站或/和核心网进行数据交互。
  2. 如权利要求1所述的基于终端的通信方法，其特征在于，所述安全隔离模块设置于所述第一通信终端的一物理内存中，或者所述安全隔离模块独立于所述第一通信终端设置，并通过有线接口或无线接口与所述通信终端建立连接，所述安全隔离模块内存储的数据无法被与T-SC基站通信无关的应用程序或应用程序编程接口调用。
  3. 如权利要求2所述的基于终端的通信方法，其特征在于，所述安全隔离模块包括第一安全隔离区和第二安全隔离区，所述第一安全隔离区用于保存和维护所述第一终端作为所述T-SC基站运行时的参数信息，所述第二安全隔离区用于保存和维护所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网进行数据交互时形成的汇聚数据流。
  4. 如权利要求3所述的基于终端的通信方法，其特征在于，所述第一通信终端包括第一工作模式和第二工作模式，所述第一工作模式为第一通信终端作为普通通信终端运行时的默认工作模式，所述第二工作模式为第一通信终端作为T-SC基站运行时的工作模式，且所述第二工作模式兼容所述第一工作模式。
  5. 如权利要求4所述的基于终端的通信方法，其特征在于，所述安全隔离模块还包括第三安全隔离区，所述第三安全隔离区用于保存和维护所述第一通信终端在所述第二工作模式下与所述通信基站或/和核心网进行数据交互时形成的原生数据流。
  6. 如权利要求5所述的基于终端的通信方法，其特征在于，所述T-SC 基站与所述第二通信终端建立通信连接之前还包括步骤：切换所述第一通信终端的工作模式为第二工作模式，在所述第二工作模式下，所述第一通信终端仅使用所述安全隔离模块与所述第二终端、通信基站或/和核心网进行数据交互。
  7. 如权利要求5所述的基于终端的通信方法，其特征在于，所述第二通信终端通过所述T-SC基站的安全隔离模块与所述通信基站或/和核心网进行数据交互的步骤具体为：所述T-SC基站接收所述第二通信终端发送的第一数据并存储于所述第二安全隔离区，并根据所述第二通信终端的标识信息对所述第一数据进行标记，并将标记后的所述第一数据发送至所述通信基站或/和核心网。
  8. 如权利要求7所述的基于终端的通信方法，其特征在于，所述第二通信终端通过所述T-SC基站的安全隔离模块与所述通信基站或/和核心网进行数据交互的步骤还包括：所述T-SC基站接收所述通信基站或/和核心网发送的第二数据并存储于所述第二安全隔离区，并根据所述第二数据的标记信息和所述第二通信终端的标识信息确定接收所述第二数据的目标终端，并将所述第二数据发送至所述目标终端。
  9. 如权利要求1所述的基于终端的通信方法，其特征在于，所述T-SC基站接收第二通信终端的接入请求之前，还包括步骤：所述T-SC基站向其辐射范围内的第二通信终端发送广播信息，以说明自身具备基站功能，并通过发送同步信号和系统信息，以使得所述第二通信终端接入所述T-SC基站。
  10. 如权利要求1所述的基于终端的通信方法，其特征在于，所述T-SC基站在接收第二通信终端的接入请求时，还包括步骤：对所述第二通信终端的身份进行鉴权，以确定所述第二通信终端是否有权限接入所述T-SC基站。
  11. 如权利要求5所述的基于终端的通信方法，其特征在于，所述基于终端的通信方法还包括：所述第二通信终端断开与所述T-SC基站的连接后，所述通信终端关闭T-SC基站功能，并切换回第一工作模式。
  12. 如权利要求1所述的基于终端的通信方法，其特征在于，所述通信方法还包括：所述第二通信终端通过所述T-SC基站的所述安全隔离模块与一第三通信终端进行数据交互。
  13. 一种通信终端，其特征在于，所述通信终端包括：
    连接建立模块，用于建立所述通信终端与通信基站或/和核心网之间的通信连接，以构成基于终端的微小区(terminal based-small cell，T-SC)基站；
    基站模块，用于向第二通信终端提供通信服务，以供所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网进行数据交互；
    安全隔离模块，用于保存和维护所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网进行数据交互时形成的汇聚数据流及所述通信终端作为所述T-SC基站运行时的参数信息。
  14. 如权利要求13所述的通信终端，其特征在于，所述通信终端包括第一工作模式和第二工作模式，所述第一工作模式为所述通信终端作为普通通信终端运行时的工作模式，所述第二工作模式为所述通信终端作为T-SC基站运行时的工作模式，且所述第二工作模式兼容所述第一工作模式。
  15. 如权利要求13所述的通信终端，其特征在于，所述通信终端还包括鉴权模块，用于在接收第二通信终端的接入请求时，对所述第二通信终端的身份进行鉴权，以确定所述第二通信终端是否有权限接入所述T-SC基站。
  16. 如权利要求13所述的通信终端，其特征在于，所述基站模块设置于所述通信终端内或独立于所述通信终端设置，通过有线接口或无线接口与所述通信终端建立连接。
  17. 如权利要求16所述的通信终端，其特征在于，所述通信终端还包括存储模块，所述安全隔离模块设置于所述存储模块内或所述基站模块内，所述安全隔离模块包括第一安全隔离区、第二安全隔离区和第三安全隔离区，所述第一安全隔离区用于保存和维护所述T-SC基站运行时所需的参数信息，所述第二安全隔离区用于保存和维护所述第二通信终端通过所述T-SC基站与所述通信基站或/和核心网之间的数据交互形成的汇聚数据流，所述第三安全隔离区用于保存和维护所述通信终端工作于第二工作模式下的原生数据流。
  18. 如权利要求17所述的通信终端，其特征在于，所述第二安全隔离区还用于保存和维护所述第二通信终端通过所述T-SC基站与一第三通信终端进行数据交互时形成的汇聚数据流。
  19. 一种通信系统，包括通信基站、核心网、第一通信终端、第二通信终端和第三通信终端，其特征在于，所述第一通信终端为如权利要求13-18任意 一项所述的通信终端，所述第一通信终端与所述通信基站或/和核心网之间的通信连接，构成基于终端的微小区(terminal based-small cell，T-SC)基站，所述第二通信终端通过所述T-SC基站与所述通信基站、核心网或/和所述第三通信终端进行数据交互。
PCT/CN2015/080397 2015-04-30 2015-05-29 基于终端的通信方法、通信终端及通信系统 WO2016173074A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510219206.8A CN105578469B (zh) 2015-04-30 2015-04-30 基于终端的通信方法、通信终端及通信系统
CN201510219206.8 2015-04-30

Publications (1)

Publication Number Publication Date
WO2016173074A1 true WO2016173074A1 (zh) 2016-11-03

Family

ID=55888025

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/080397 WO2016173074A1 (zh) 2015-04-30 2015-05-29 基于终端的通信方法、通信终端及通信系统

Country Status (2)

Country Link
CN (1) CN105578469B (zh)
WO (1) WO2016173074A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106686532B (zh) * 2017-01-05 2021-12-21 宇龙计算机通信科技(深圳)有限公司 通信方法、系统及终端化基站及所提供的终端化小区

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101971654A (zh) * 2008-03-11 2011-02-09 日本电气株式会社 网络访问控制
CN102480713A (zh) * 2010-11-25 2012-05-30 中国移动通信集团河南有限公司 一种汇聚节点与移动通信网络间的通信方法、系统及装置
CN102550057A (zh) * 2009-11-03 2012-07-04 上海贝尔股份有限公司 一种汇聚来自机器终端设备的多个业务数据的方法和设备
CN103262632A (zh) * 2010-06-04 2013-08-21 得克萨斯系统大学评议会 无线通信方法、系统和计算机程序产品
CN104159240A (zh) * 2014-08-15 2014-11-19 宇龙计算机通信科技(深圳)有限公司 基于终端的通信方法和终端

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8201240B2 (en) * 2005-09-16 2012-06-12 Nokia Corporation Simple scalable and configurable secure boot for trusted mobile phones
CN104168361A (zh) * 2014-08-29 2014-11-26 宇龙计算机通信科技(深圳)有限公司 通话方法、通话装置、服务器和通话系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101971654A (zh) * 2008-03-11 2011-02-09 日本电气株式会社 网络访问控制
CN102550057A (zh) * 2009-11-03 2012-07-04 上海贝尔股份有限公司 一种汇聚来自机器终端设备的多个业务数据的方法和设备
CN103262632A (zh) * 2010-06-04 2013-08-21 得克萨斯系统大学评议会 无线通信方法、系统和计算机程序产品
CN102480713A (zh) * 2010-11-25 2012-05-30 中国移动通信集团河南有限公司 一种汇聚节点与移动通信网络间的通信方法、系统及装置
CN104159240A (zh) * 2014-08-15 2014-11-19 宇龙计算机通信科技(深圳)有限公司 基于终端的通信方法和终端

Also Published As

Publication number Publication date
CN105578469A (zh) 2016-05-11
CN105578469B (zh) 2018-04-10

Similar Documents

Publication Publication Date Title
US10516540B2 (en) Management of profiles in an embedded universal integrated circuit card (eUICC)
EP3972347A1 (en) User plane function selection for isolated network slice
JP6901009B2 (ja) ネットワークスライス選択のためのプライバシー考慮
KR101727873B1 (ko) 피어 기반 인증
US20200178070A1 (en) Provisioning electronic subscriber identity modules to mobile wireless devices
US20180288614A1 (en) WiFi PROTECTED ACCESS 2 (WPA2) PASS-THROUGH VIRTUALIZATION PARTITION
US20120184242A1 (en) Methods and Systems for Enhancing Wireless Coverage
EP2846586B1 (en) A method of accessing a network securely from a personal device, a corporate server and an access point
EP2234438B1 (en) Wireless personal area network accessing method
US20110296501A1 (en) Connecting Devices to an Existing Secure Wireless Network
US11121871B2 (en) Secured key exchange for wireless local area network (WLAN) zero configuration
JP7506799B2 (ja) プロトコルデータユニットセッションの確立
WO2010015174A1 (zh) 一种适合无线个域网的接入方法
KR102381038B1 (ko) 피제어 장치의 보안 인증 기법
EP3764259A1 (en) Systems and methods for secure endpoint connection and communication
WO2023143411A1 (zh) 设备鉴权方法、装置及通信设备
WO2016173074A1 (zh) 基于终端的通信方法、通信终端及通信系统
US20210243599A1 (en) User authentication method through bluetooth device and device therefor
WO2021031054A1 (zh) 通信方法及装置
Nguyen et al. An SDN‐based connectivity control system for Wi‐Fi devices
CN108668278A (zh) 一种基于终端的通信方法
US11503017B2 (en) EHN venue-specific application provisioning
KR20190050242A (ko) 동글의 동작 방법, 동글 및 네트워크 장치의 동작 방법
WO2024067619A1 (zh) 通信方法和通信装置
KR20140055675A (ko) 이동통신망에서 지리 정보를 이용한 무선랜 선인증 방법 및 장치

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15890453

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 19.04.2018)

122 Ep: pct application non-entry in european phase

Ref document number: 15890453

Country of ref document: EP

Kind code of ref document: A1