WO2016180145A1 - 一种无线网络鉴权方法及核心网网元、接入网网元、终端 - Google Patents

一种无线网络鉴权方法及核心网网元、接入网网元、终端 Download PDF

Info

Publication number
WO2016180145A1
WO2016180145A1 PCT/CN2016/079200 CN2016079200W WO2016180145A1 WO 2016180145 A1 WO2016180145 A1 WO 2016180145A1 CN 2016079200 W CN2016079200 W CN 2016079200W WO 2016180145 A1 WO2016180145 A1 WO 2016180145A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
user equipment
network element
access network
nas security
Prior art date
Application number
PCT/CN2016/079200
Other languages
English (en)
French (fr)
Inventor
戴谦
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016180145A1 publication Critical patent/WO2016180145A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/062—Pre-authentication

Definitions

  • This document relates to the field of wireless network authentication technologies, and in particular, to a wireless network authentication method, a core network element, an access network element, and a terminal.
  • the LTE (Long Term Evolution) system of the related art adopts an EPC (Evolved Packet Core) network architecture, and the process of establishing a connection between the UE (user equipment) and the network side needs to complete the connection establishment of the air interface, and The connection of the core network is established, and the control plane signaling that requires interaction is very much.
  • EPC Evolved Packet Core
  • the terminal sends an attach request to the eNB, and the eNB sends the terminal attach request to the MME;
  • the MME performs an authentication process, and the MME acquires an intermediate authentication vector of the terminal from the HSS;
  • the MME sends part of the authentication information in the intermediate authentication vector to the UE;
  • the UE calculates an authentication expectation value according to the received authentication information, and sends the expected value to the MME;
  • the MME determines whether the authentication is successful according to the expected value sent by the UE
  • the MME sends a NAS security mode command to the UE to establish NAS security
  • the UE verifies the mobile phone security capability sent by the MME, generates a NAS Security Key based on the security algorithm, and returns a NAS Security Mode Complete message to the MME.
  • the entire attach process process typically takes more than a hundred milliseconds.
  • the technical problem to be solved by the present invention is to provide a wireless network authentication method, a core network element, an access network element, and a terminal, so as to reduce the delay of end-to-end wireless communication.
  • the present invention provides a wireless network authentication method, including:
  • the authentication and security control information is sent to the network element of the access network, and the network element of the access network is instructed to perform authentication on the pre-selected user equipment or the NAS security establishment process according to the authentication and security control information.
  • the authentication and security control information includes a combination of one or more of the following:
  • the access network element may perform an authorization to authenticate the user equipment
  • the access network element may perform a license for establishing a NAS security of the user equipment
  • the access network element may perform an authorization time range for authenticating the user equipment
  • the access network element may perform an authorization time range for establishing a NAS security of the user equipment
  • the access network element may perform pre-selected user equipment information established by authentication or NAS security;
  • the authentication information corresponding to the preselected user equipment used by the access network element for performing authentication
  • the access network element is used to perform NAS security establishment information corresponding to the pre-selected user equipment established by the NAS security.
  • the foregoing method is further characterized in that: the NAS security establishment information corresponding to the preselected user equipment used by the access network element to perform NAS security establishment is obtained by:
  • the NAS security establishment information includes selection information of the NAS encryption algorithm and the NAS integrity protection algorithm, or includes permission to authorize the eNB to select the NAS encryption algorithm and the NAS integrity protection algorithm.
  • the NAS security establishment information only contains NAS security mode commands.
  • the foregoing method has the following features: before the sending the authentication and security control information to the access network element, the method further includes:
  • the access network element may be authorized to perform authentication on the user equipment or the NAS security establishment process:
  • the frequency of the same user equipment entering the range of the access network element exceeds the second preset threshold.
  • the foregoing method has the following features: before the sending the authentication and security control information to the access network element, the method further includes:
  • the access network element satisfies at least one of the following conditions:
  • the frequency of the same user equipment entering the range of the access network element exceeds the second preset threshold.
  • the time that the pre-selected user equipment resides in the network element range of the access network exceeds the first preset threshold, where the time is a continuous camp time or an accumulated camp time, or enters the access network.
  • the frequency of the network element range exceeds the second preset threshold.
  • the user equipment is a delay sensitive user equipment, or
  • the user equipment runs a delay sensitive service.
  • the authentication context information includes whether the user equipment authentication is performed.
  • the success information and the authentication value included in the authentication response reported by the user equipment, the context information of the NAS security establishment includes: NAS security mode completion information reported by the user equipment or NAS security mode rejection information.
  • the access network element After the access network element completes the authentication of the user equipment or the NAS security establishment process, the user equipment that has completed the authentication or the NAS security establishment is re-authenticated or re-established by the NAS.
  • the list of access network elements supporting the authentication or NAS security establishment process is sent to the pre-selected user equipment.
  • the updated authentication and security control information is periodically obtained from the home subscriber server.
  • the authentication and security control information includes:
  • Deactivating the access network element may perform an authentication permission for the user equipment
  • Deactivating the access network element can perform the license for NAS security establishment of the user equipment.
  • the present invention also provides a core network, which includes:
  • the sending module is configured to send the authentication and security control information to the network element of the access network, and instruct the network element of the access network to perform authentication on the pre-selected user equipment or the NAS security establishment process according to the authentication and security control information.
  • the authentication and security control information includes one or more of the following combinations:
  • the access network element may perform an authorization to authenticate the user equipment
  • the access network element may perform a license for establishing a NAS security of the user equipment
  • the access network element may perform an authorization time range for authenticating the user equipment
  • the access network element may perform an authorization time range for establishing a NAS security of the user equipment
  • the access network element may perform pre-selected user equipment information established by authentication or NAS security;
  • the authentication information corresponding to the preselected user equipment used by the access network element for performing authentication
  • the access network element is used to perform NAS security establishment information corresponding to the pre-selected user equipment established by the NAS security, and the NAS security establishment information includes selection information about the NAS encryption algorithm and the NAS integrity protection algorithm, or includes the authorized eNB to the NAS.
  • the encryption algorithm and the NAS integrity protection algorithm make the selection permission, or the NAS security establishment information only contains the NAS security mode command.
  • the above core network also has the following features:
  • the statistics module is configured to collect statistics on the dwell time of the user equipment in each access network network element and the frequency of the user equipment entering each access network network element, or receive the user of each access network to count the users in the range.
  • the statistic result of the dwell time of the device and the entry frequency of the user equipment entering the coverage area; or receiving the time of each user equipment to count the time of the network element that resides in each access network and entering the network element range of each access network Statistical results of frequency;
  • a determining module configured to determine, according to the statistical result, that the access network element can be authorized to perform authentication on the user equipment or the NAS security establishment process by using at least one of the following conditions: the user equipment resides in the access The time of the network element range exceeds the first preset threshold, where the time is the continuous camp time or the accumulated camp time; the frequency of the same user equipment entering the access network element range If the second preset threshold is exceeded, the time that the preselected user equipment resides in the network element range of the access network exceeds the first preset threshold, where the time is a continuous camp time or a cumulative camp time. Or the frequency of entering the network element range of the access network exceeds the second preset threshold.
  • the above core network also has the following features:
  • the receiving module is configured to receive the identifier information of the access network element reported by the access network element or the user equipment, where the access network element meets at least one of the following conditions: the user equipment resides in the The time range of the network element of the access network exceeds the first preset threshold, where the time is the continuous camp time or the accumulated camp time; the frequency of the same user equipment entering the network element range of the access network exceeds the second pre- Setting a threshold, the time that the pre-selected user equipment resides in the network element range of the access network exceeds the first preset threshold, where the time is a continuous camp time or an accumulated camp time, or enters the The frequency of the network element range of the access network exceeds the second preset threshold.
  • the above core network also has the following features:
  • an obtaining module configured to obtain, from the home subscriber server, a fixed authentication key, a permanent key, or an intermediate authentication vector corresponding to the pre-selected user equipment, as the authentication information.
  • the above core network also has the following features:
  • a receiving module configured to receive authentication context information corresponding to the user equipment established by the access network element or NAS security establishment, or context information established by the NAS security, where the authentication context information includes The information about whether the user equipment is successfully authenticated and the authentication value included in the authentication response reported by the user equipment, the context information of the NAS security establishment includes: the NAS security mode completion information reported by the user equipment or the NAS security mode. Reject information.
  • the above core network also has the following features:
  • the processing module is configured to perform re-authentication or NAS security on the user equipment that has been authenticated or NAS security established through the NAS message after the access network element completes the authentication of the user equipment or the NAS security establishment process. reconstruction.
  • the above core network also has the following features:
  • a sending module configured to: after the network element that authorizes the access network performs authentication on the user equipment or the NAS security establishment process, send, to the pre-selection, a list of access network elements supporting the authentication or NAS security establishment process User equipment.
  • the present invention also provides a wireless network authentication method, including:
  • the access network element receives the authentication and security control information
  • the authentication and security control information includes a combination of one or more of the following:
  • the access network element may perform an authorization to authenticate the user equipment
  • the access network element may perform a license for establishing a NAS security of the user equipment
  • the access network element may perform an authorization time range for authenticating the user equipment
  • the access network element may perform an authorization time range for establishing a NAS security of the user equipment
  • the access network element may perform pre-selected user equipment information established by authentication or NAS security;
  • the authentication information corresponding to the preselected user equipment used by the access network element for performing authentication
  • the access network element is used to perform NAS security establishment information corresponding to the pre-selected user equipment established by the NAS security.
  • the authentication and security control information includes one or two of the following:
  • Deactivating the access network element may perform an authentication permission for the user equipment
  • Deactivating the access network element can perform the license for NAS security establishment of the user equipment.
  • the authentication information is a fixed authentication key, a permanent key or an intermediate authentication vector corresponding to the pre-selected user equipment.
  • the foregoing method further has the following feature: before the access network element receives the authentication and security control information, the method further includes:
  • the residence time of the user equipment exceeds the first preset threshold, the residence time is continuous The timeout or the accumulated dwell time, and/or, if the frequency of the access of the same user equipment to the network element of the access network exceeds the second preset threshold, the statistics result and/or the identifier of the access network element are reported. .
  • the access network element sends the identifier of the licensable access network element to the pre-selected user equipment by using a broadcast message or dedicated signaling.
  • the foregoing method has the following features: the performing the authentication on the pre-selected user equipment according to the authentication and security control information, including:
  • the access network element generates an authentication vector according to the authentication and security control information
  • the foregoing method further has the following feature: after receiving the authentication response fed back by the pre-selected user equipment, and performing authentication according to the authentication vector and the authentication response, the method further includes:
  • the authentication context information is reported, and the authentication context information includes information about whether the user equipment is authenticated successfully and an authentication value included in the authentication response reported by the user equipment.
  • the access network element generates an authentication vector according to the authentication and security control information, including:
  • the access network element generates a corresponding intermediate authentication vector according to a fixed key or a permanent key corresponding to the preset user in the authentication information in the authentication and security control information; or
  • the access network element receives the intermediate authentication vector corresponding to the preset user in the authentication information in the authentication and security control information.
  • the access network element performs a NAS security establishment process on the pre-selected user equipment according to the authentication and security control information, including:
  • the network element of the access network selects a NAS security algorithm and a NAS integrity protection algorithm, and generates a NAS security key and a NAS integrity protection key corresponding to the preselected user equipment according to the access network element; or
  • the access network element receives the NAS security algorithm and the NAS integrity protection algorithm, and generates the NAS security key and the NAS integrity protection key corresponding to the pre-selected user equipment.
  • the access network element performs a NAS security establishment process for the pre-selected user equipment according to the authentication and security control information, and further includes:
  • the access network element constructs a NAS security mode command according to the NAS security key and the NAS integrity protection key, and sends the NAS security mode command to the pre-selected user equipment;
  • the access network element receives the NAS security mode completion signaling fed back by the preselected user equipment.
  • the foregoing method has the following features: after the access network element performs the NAS security establishment process on the pre-selected user equipment according to the authentication and security control information, the method includes:
  • the access network element reports the context information of the NAS security establishment, and the context information of the NAS security establishment includes: the NAS security key and the NAS integrity protection key generated by the access network element, and the The NAS security algorithm selected by the network element and the identifier of the NAS integrity protection algorithm.
  • an access network element which includes:
  • a receiving module configured to receive, by the access network element, authentication and security control information
  • an execution module configured to perform an authentication on the pre-selected user equipment or a NAS security establishment process according to the authentication and security control information.
  • the foregoing access network element further has the following features:
  • the statistics module is configured to count the dwell time of the user equipment in the range of the network element of the access network and the entry frequency of the user equipment that enters the coverage of the network element of the access network, if the resident time of the user equipment exceeds the first pre- The threshold is set, the dwell time is a continuous dwell time or a cumulative dwell time, and/or, if the frequency of the same user equipment entering the coverage of the access network element exceeds the second preset threshold, the statistics are reported. The result and/or the identity of the access network element.
  • the foregoing access network element further has the following features:
  • a sending module configured to send, by using a broadcast message or dedicated signaling, an identifier of the licensable access network element to the pre-selected user equipment.
  • the access network element has the following features:
  • the performing module performing authentication on the pre-selected user equipment according to the authentication and security control information, includes: the access network element generating an authentication vector according to the authentication and security control information;
  • the pre-selected user equipment sends an authentication request, carries the authentication vector, receives an authentication response fed back by the pre-selected user equipment, and performs authentication according to the authentication vector and the authentication response.
  • the access network element has the following features:
  • the generating module according to the authentication and security control information, generates an authentication vector, including: a fixed key or a permanent key corresponding to a preset user in the authentication information in the authentication and security control information, Generating a corresponding intermediate authentication vector; or receiving an intermediate authentication vector corresponding to the preset user in the authentication information in the authentication and security control information.
  • the access network element has the following features:
  • the executing module performs a NAS security establishment process on the pre-selected user equipment according to the authentication and security control information, including: selecting a NAS security algorithm and a NAS integrity protection algorithm, and generating a NAS security corresponding to the pre-selected user equipment according to the The key and the NAS integrity protection key are received; or the NAS security algorithm and the NAS integrity protection algorithm are received, and the NAS security key and the NAS integrity protection key corresponding to the pre-selected user equipment are generated accordingly.
  • the access network element has the following features:
  • the performing module, performing the NAS security establishment process on the preselected user equipment according to the authentication and security control information further includes: constructing a NAS security mode command according to the NAS security key and the NAS integrity protection key, and sending the The NAS security mode command is sent to the pre-selected user equipment; and the NAS security mode completion signaling fed back by the pre-selected user equipment is received.
  • the access network element has the following features:
  • the execution module after performing the NAS security establishment process on the pre-selected user equipment according to the authentication and security control information, includes: reporting context information of the NAS security establishment, where the context information of the NAS security establishment includes: The NAS security key and the NAS integrity protection key generated by the network element, the NAS security algorithm selected by the access network element and the identifier of the NAS integrity protection algorithm.
  • the present invention also provides a wireless network authentication method, including:
  • the user equipment When the user equipment needs to complete the authentication or the NAS establishes the security process with the network side, the user equipment performs an authentication or NAS security establishment process with the access network element authorized to perform the authentication or NAS security establishment.
  • the foregoing method further has the following features: the user equipment and the access network element that is authorized to perform the authentication or the NAS security establishment to perform the authentication or the NAS security establishment process, and the method further includes:
  • the user equipment counts the time of the network element that resides in each access network and the frequency of entering the network element of each access network, and if it finds that it resides in the network element range of the access network, the time exceeds the first pre- If the threshold is set or the frequency of the network element of the access network exceeds the second preset threshold, the identifier of the receiving network element or the corresponding statistical result is reported to the core network.
  • the foregoing method further has the following features: before the user equipment is authenticated or the NAS security establishment process is performed by the access network element authorized to perform the authentication or the NAS security, the method includes:
  • the user equipment receives a list of access network elements supporting authentication or NAS security establishment.
  • the foregoing method further has the following features: after the user equipment is authenticated or the NAS security establishment process is performed by an access network element that is authorized to perform authentication or NAS security establishment, the method further includes:
  • the user equipment sends NAS security mode completion signaling to the access network element, and the NAS security mode completion signaling uses the NAS security key and the NAS integrity protection key calculated by the user equipment for encryption and integrity protection. .
  • the present invention further provides a user equipment, including:
  • the processing module is configured to perform an authentication or NAS security establishment process with the access network element authorized to perform the authentication or the NAS security when the user equipment needs to complete the authentication or the NAS establishes the security process.
  • the foregoing user equipment further has the following features:
  • the statistics module is configured to count the time of the network element that resides in each access network and the frequency of entering the network element of each access network, and if it is found to be in the range of the network element of the access network, the time exceeds the first If the preset threshold or the frequency of the access to the network element of the access network exceeds the second preset threshold, the identifier of the receiving network element or the corresponding statistical result is reported to the core network.
  • the foregoing user equipment further has the following features:
  • the receiving module is configured to receive a list of access network elements supporting authentication or NAS security establishment.
  • the foregoing user equipment further has the following features:
  • a sending module configured to send NAS security mode completion signaling to the access network element, where the NAS security mode completion signaling uses the NAS security key and the NAS integrity protection key calculated by the user equipment for encryption and integrity. protection.
  • the wireless network authentication method and the core network element, the access network element, and the terminal provided by the technical solution of the present invention can effectively reduce the delay of the end-to-end wireless communication.
  • Embodiment 1 is a flowchart of Embodiment 1 of the present invention.
  • Embodiment 2 is a flowchart of Embodiment 2 of the present invention.
  • Embodiment 4 of the present invention is a flowchart of Embodiment 4 of the present invention.
  • FIG. 4 is a schematic diagram of a core network according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of an access network element according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of a user equipment according to an embodiment of the present invention.
  • the eNB (evolved base station) is loaded with an authentication vector generator and a secret key derivation function KDF, so that the eNB has the authentication vector computing capability and the key generation capability. As shown in Figure 1, the following steps are included:
  • Step 201 Select an eNB that meets the authorization condition and a pre-selected UE, and the feasible selection methods and rules include:
  • the time may be continuous or cumulative; the UE may serve as a preselected UE, and the eNB may consider that the authorization condition is met;
  • the UE may serve as a preselected UE, and the eNB may consider that the authorization condition is met;
  • the user equipment is a delay sensitive UE, or
  • the user equipment runs a delay sensitive service.
  • the subject of performing statistics may be MME, eNB, UE, and the respective methods are:
  • the MME collects statistics on the camping time of the UE in each eNB and the frequency of the UE entering each eNB range, and selects an eNB that has one of the foregoing conditions, the preset threshold 1 and the preset threshold 2 Can be preset by the MME;
  • Each eNB automatically counts the stagnation time of the UE in its own range and the entry frequency of the UE that enters its own coverage.
  • the eNB reports its own ID to the MME, and the optional eNB can also The statistic result is reported to the MME;
  • the preset threshold 1 and the preset threshold 2 may be preset by the MME, and the eNB may acquire the preset threshold 1 and the preset threshold 2 from the MME;
  • Each UE acquires the preset threshold 1 and the preset threshold 2 from the MME, and the UE self-counts the time of camping on each eNB and the frequency of entering each eNB, when the UE finds that it resides in an eNB range. If the time exceeds the preset threshold, or the frequency of the eNB exceeds the preset threshold, the UE considers that the eNB is eligible for authentication or NAS security, and the UE reports the ID of the eNB to the MME. Optionally, the UE may also correspond to the eNB. The result is reported to the MME;
  • the MME After determining the eNB and the pre-selected UE that can authorize the authentication and the NAS security establishment, the MME sends the eNB ID to the pre-selected UE, so that the UE knows that the eNB can initiate authentication and NAS security establishment in the eNB range;
  • the pre-selected user equipment may also be informed by the authorized access network element via a broadcast message or dedicated signaling.
  • Step 202 The MME requests the HSS (Home Subscriber Server, the home subscriber server) to obtain the authentication information in the HSS corresponding to the qualified pre-selected UE, and specifically includes: the permanent key K corresponding to the target UE; the HSS sends the information to the MME. .
  • HSS Home Subscriber Server, the home subscriber server
  • Step 203 The MME sends the authentication and security control information to the eNB that meets the authorization condition, where the MME includes:
  • the eNB may perform an authorization to authenticate the user equipment
  • the eNB may perform a license for establishing a NAS security of the user equipment
  • the eNB may perform an authorization time range for authenticating the user equipment; the item information is optional, and after the MME counts the active time of the eNB, the authorization time range may be configured according to the active time thereof;
  • the eNB may perform an authorization time range for NAS security establishment of the user equipment
  • the eNB may perform pre-selected user equipment information established by authentication or NAS security; the information is used by the eNB to identify which UEs are pre-selected user equipments;
  • the authentication information corresponding to the preselected user equipment used by the eNB to perform authentication
  • the eNB determines from the above information that it can perform authentication or NAS security establishment on the UE.
  • Step 204 When the pre-selected UE initiates an attach procedure or an RRC (Radio Resource Control) connection procedure in the range of an authorized eNB, the UE may know, according to the previously obtained list of authorized eNBs, in the range of such eNBs. The authentication or NAS security establishment may be initiated to the eNB.
  • RRC Radio Resource Control
  • Step 205 The pre-selected UE initiates an attach request to the eNB.
  • the eNB forwards the attach request to the MME at the same time, so that the MME knows the attach action of the UE.
  • Step 206 The eNB generates an authentication vector according to the content of the authentication and security control information, where the authentication information corresponding to the pre-selected user equipment in the content of the authentication and security control information includes the fixed key K corresponding to the UE, and the eNB generates a random Based on these input parameters, the eNB uses the authentication vector generator to generate an authentication vector.
  • the definitions of the authentication vector generator and the authentication vector still adopt the method defined by the relevant LTE protocol.
  • Step 207 The eNB sends an authentication request to the UE, and includes an authentication vector.
  • Step 208 The UE generates an authentication value and an intermediate key according to the received authentication vector and its own fixed key K according to the relevant protocol manner.
  • Step 209 The UE feeds back an authentication response to the eNB, and includes an authentication value.
  • the eNB compares the authentication vector generated by the eNB with the authentication response content fed back by the UE. If the LTE protocol complies with the authentication control relationship specified by the LTE protocol, the authentication succeeds, otherwise the authentication fails.
  • Step 211 The eNB sends the authentication result to the MME. If the authentication succeeds, the eNB continues to perform NAS security establishment. If the authentication fails, the MME may reject the attachment of the UE, or the MME may re-authenticate the UE. (ie, according to the authentication method of the relevant LTE protocol, does not pass the authorized eNB).
  • Step 212 The eNB performs NAS security establishment with the UE, and the eNB selects a NAS security algorithm and a NAS integrity protection algorithm, and the eNB generates a NAS security key and a NAS integrity protection key according to the intermediate key generated by the eNB.
  • Step 213 The eNB sends the NAS security mode command to the UE, and the content definition of the command is the same as the NAS security mode command of the related LTE protocol.
  • the eNB sends the NAS security establishment context information to the MME, where the content includes the NAS security secret generated by the eNB.
  • Step 214 The UE calculates the NAS security algorithm key and the NAS integrity protection algorithm key according to the NAS security mode command sent by the eNB, and the NAS security establishment is completed.
  • the UE sends NAS security mode completion signaling to the eNB, and the signaling uses the NAS security key and the NAS integrity protection key calculated by the UE for encryption and integrity protection; the eNB forwards the signaling to the MME.
  • the authentication and the NAS security establishment function are authorized to the eNB, the signaling interaction between the eNB and the MME and the MME and the HSS is cancelled in the entire authentication and NAS security establishment process initiated by the UE, which greatly simplifies. The entire authentication process, which greatly reduces the connection establishment delay.
  • the 3GPP EPC architecture is used to load the secret key derivation function KDF for the eNB, so that the eNB has the key generation capability. As shown in Figure 2, the following steps are included:
  • Step 301 Counting the eNB that meets the authorization condition and the pre-selected UE, and the applicable statistical methods and rules may refer to Embodiment 1, and are not repeated here.
  • Step 302 The MME requests the HSS to obtain the authentication information in the HSS corresponding to the pre-selected UE that meets the condition, and specifically includes: an intermediate authentication vector corresponding to the target UE; and the HSS sends the authentication information to the MME.
  • Step 303 The MME sends the authentication and security control information to the eNB that meets the authorization condition, where the MME includes:
  • the eNB may perform an authorization to authenticate the user equipment
  • the eNB may perform a license for establishing a NAS security of the user equipment
  • the eNB may perform an authorization time range for authenticating the user equipment; the item information is optional, and after the MME counts the active time of the eNB, the authorization time range may be configured according to the active time thereof;
  • the eNB may perform an authorization time range for NAS security establishment of the user equipment
  • the eNB may perform pre-selected user equipment information established by authentication or NAS security; the information is used by the eNB to identify which UEs are pre-selected user equipments;
  • the authentication information corresponding to the preselected user equipment used by the eNB to perform authentication
  • the eNB determines from the above information that it can perform authentication or NAS security establishment on the UE.
  • the authentication information includes the intermediate authentication vector, and the NAS security establishment information includes the MME.
  • the ID of the selected NAS security algorithm and the NAS integrity protection algorithm includes the MME.
  • Step 304 When the pre-selected UE initiates an attach procedure within a certain authorized eNB, or an RRC connection procedure; the UE may notify the eNB of the authorized eNB list notified by the previous MME, and may initiate authentication or NAS to the eNB within the scope of the eNB. Established safely.
  • Step 305 The pre-selected UE initiates an attach request to the eNB.
  • the eNB forwards the attach request to the MME at the same time, so that the MME knows the attach action of the UE.
  • Step 306 The eNB sends an authentication request to the UE, and includes an intermediate authentication vector.
  • Step 307 The UE generates an authentication value and an intermediate key according to the received intermediate authentication vector according to a related protocol manner.
  • Step 308 The UE feeds back the authentication response to the eNB, and includes an authentication value.
  • Step 309 The eNB compares the intermediate authentication vector with the content of the authentication response fed back by the UE. If the authentication relationship is met in the LTE protocol, the authentication succeeds, otherwise the authentication fails.
  • Step 310 The eNB sends the authentication result to the MME. If the authentication succeeds, the eNB continues to perform NAS security establishment. If the authentication fails, the MME may reject the attachment of the UE, or the MME may re-authenticate the UE. (ie, according to the authentication method of the relevant LTE protocol, does not pass the authorized eNB).
  • Step 311 The eNB performs NAS security establishment with the UE, and the eNB generates a NAS security key and a NAS integrity protection key according to the NAS security algorithm and the ID of the NAS integrity protection algorithm and the intermediate key sent by the MME.
  • the MME uses the generated NAS security key and the NAS integrity protection key to form a subsequent NAS security mode command.
  • Step 312 The eNB sends a NAS security mode command to the UE, where the content definition of the command is the same as the NAS security mode command of the related LTE protocol, and the eNB sends the context of the NAS security establishment to the MME, and the content of the NAS security established context
  • the NAS security key and the NAS integrity protection key generated by the eNB, the NAS security algorithm selected by the MME, and the ID of the NAS integrity protection algorithm are included to implement the NAS security connection between the subsequent MME and the UE.
  • Step 313 The UE calculates the NAS security algorithm key and the NAS integrity protection algorithm key according to the NAS security mode command sent by the eNB, and the NAS security establishment is completed.
  • the UE sends NAS security mode completion signaling to the eNB, and the signaling uses the NAS security key and the NAS integrity protection key calculated by the UE for encryption and integrity protection; the eNB forwards the signaling to the MME.
  • Embodiment 2 describes a process. Further, the authentication information and the NAS security establishment information in the authentication and security control information received by the eNB in the step 303 are always valid, and can be used to perform the comparison on the corresponding pre-selected UE multiple times.
  • the security and NAS security establishment, the MME can periodically obtain updated authentication information and NAS security establishment information from the HSS to update the authentication information and NAS security establishment information saved by the eNB, which can further improve security.
  • Embodiment 3 adopts the same procedure as that of Embodiment 2, and the difference is:
  • the authentication information and the NAS security establishment information in the authentication and security control information received by the eNB in step 303 may remain valid until being updated or de-authorized by the MME.
  • the authentication information and the NAS security establishment information in the authentication and security control information received by the eNB in step 303 are valid only once, and the MME acquires the UE from the HSS in advance before the next authentication start of the preselected UE.
  • the intermediate authentication vector, the MME updates the selection of the NAS encryption and integrity protection algorithm to form a new authentication and NAS security establishment information to the eNB; the eNB uses the updated authentication in the next authentication of the UE.
  • Embodiment 3 Compared with Embodiment 2, Embodiment 3 has the same delay reduction performance, and although the signaling overhead is increased, the security is improved.
  • the eNB does not have the secret key derivation function KDF and does not have the key generation capability. As shown in Figure 3, the following steps are included:
  • Step 401 Counting the eNB that meets the authorization condition and the pre-selected UE, and the applicable statistical methods and rules may refer to Embodiment 1, and are not repeated here;
  • Step 402 The MME requests the HSS to obtain the authentication information in the HSS corresponding to the pre-selected UE that meets the condition, and specifically includes: an intermediate authentication vector corresponding to the target UE; the HSS sends the authentication information to the MME;
  • Step 403 The MME generates the NAS security key and the NAS integrity protection key in advance, and the MME generates the NAS security mode command by using the generated NAS security key and the NAS integrity protection key, and the format content of the NAS security mode command and related LTE The agreement is defined the same.
  • Step 404 The MME sends the authentication and security control information to the eNB that meets the authorization condition, where the MME includes:
  • the eNB may perform an authorization to authenticate the user equipment
  • the eNB may perform a license for establishing a NAS security of the user equipment
  • the eNB may perform an authorization time range for authenticating the user equipment; the item information is optional, and after the MME counts the active time of the eNB, the authorization time range may be configured according to the active time thereof;
  • the eNB may perform an authorization time range for NAS security establishment of the user equipment
  • the eNB may perform pre-selected user equipment information established by authentication or NAS security; the information is used by the eNB to identify which UEs are pre-selected user equipments;
  • the authentication information corresponding to the pre-selected user equipment used by the eNB including the intermediate authentication vector AUTN (Authentication Token) corresponding to the pre-selected UE obtained by the MME, and the RAND (Random Number) And XRES (Expected Response);
  • AUTN Authentication Token
  • RAND Random Number
  • XRES Extended Response
  • the eNB is configured to perform NAS security establishment information corresponding to the pre-selected user equipment of the NAS security establishment, where the NAS security establishment information is a NAS security mode command previously generated by the MME;
  • the eNB determines from the above information that it can perform authentication or NAS security establishment on the UE.
  • Step 405 When the preselected UE initiates an attach procedure or an RRC connection procedure within a certain authorized eNB range, the UE may notify the eNB to initiate authentication or NAS in the range of the eNB according to the list of authorized eNBs notified by the MME. Security establishment;
  • Step 406 The pre-selected UE initiates an attach request to the eNB.
  • the eNB forwards the attach request to the MME at the same time, so that the MME understands the attach action of the UE.
  • Step 407 The eNB sends an authentication request to the UE, and includes an intermediate authentication vector.
  • Step 408 The UE according to the relevant protocol manner, according to the received intermediate authentication vector and its own Fixed key, generating authentication value and intermediate key;
  • Step 409 The UE feeds back an authentication response to the eNB, and includes an authentication value.
  • Step 410 The eNB compares the intermediate authentication vector with the content of the authentication response fed back by the UE. If the authentication relationship is met in the LTE protocol, the authentication succeeds, otherwise the authentication fails.
  • Step 411 The eNB sends the authentication result to the MME. If the authentication succeeds, the eNB continues to perform the NAS security establishment. If the authentication fails, the MME may reject the attachment of the UE, or the MME may re-authenticate the UE. (ie, according to the authentication method of the relevant LTE protocol, does not pass the authorized eNB);
  • Step 412 The eNB performs the NAS security establishment with the UE, and the eNB sends the MME sends a NAS security mode command to the UE; the content definition of the command is the same as the NAS security mode command of the related LTE protocol.
  • Step 413 The UE calculates the NAS security algorithm key and the NAS integrity protection algorithm key according to the NAS security mode command sent by the eNB, and the NAS security establishment is completed.
  • the UE sends NAS security mode completion signaling to the eNB, and the signaling uses the NAS security key and the NAS integrity protection key calculated by the UE for encryption and integrity protection; the eNB forwards the signaling to the MME.
  • the embodiment 4 cancels the eNB's authentication vector generation capability and key generation capability, and has the same delay reduction performance, further improving security.
  • the MME may update the pre-selected UE list of each eNB through the authentication and security control information, or cancel the authentication authorization or NAS security establishment authorization of an eNB at any time; usually such update behavior and cancellation
  • the authorization behavior needs to be based on the judgment of the statistical results of the eNB and the pre-selected UE.
  • the type of the access network element includes, in addition to the eNB, a small cell, a home base station, and other access network element types compatible with the EPC architecture.
  • FIG. 4 is a schematic diagram of a core network according to an embodiment of the present invention. As shown in FIG. 4, the core network in this embodiment includes:
  • the sending module is configured to send the authentication and security control information to the access network element, and instruct the access network element to perform an authentication on the pre-selected user equipment or a NAS security establishment process according to the authentication and security control information.
  • the authentication and security control information includes a combination of one or more of the following:
  • the access network element may perform an authorization to authenticate the user equipment
  • the access network element may perform a license for establishing a NAS security of the user equipment
  • the access network element may perform an authorization time range for authenticating the user equipment
  • the access network element may perform an authorization time range for establishing a NAS security of the user equipment
  • the access network element may perform pre-selected user equipment information established by authentication or NAS security;
  • the access network element may perform authentication information corresponding to the pre-selected user equipment of the authentication
  • the access network element may perform NAS security establishment information corresponding to the pre-selected user equipment established by the NAS security, where the NAS security establishment information includes selection information of the NAS encryption algorithm and the NAS integrity protection algorithm, or includes the authorized eNB to encrypt the NAS.
  • the algorithm and the NAS integrity protection algorithm make the selection permission, or the NAS security establishment information only contains the NAS security mode command.
  • the statistics module may be configured to: perform statistics on the dwell time of the user equipment in each access network network element and the frequency at which the user equipment enters each access network network element; or receive each access network element to self-statistically The statistic result of the stagnation time of the user equipment and the access frequency of the user equipment entering the coverage area; or receiving the time of each user equipment to count the time of the network element that resides in each access network and entering each access network element Statistical results of the range of frequencies;
  • the determining module may be configured to: according to the statistical result, determine that the access network element may be authorized to perform authentication on the user equipment or the NAS security establishment process by satisfying at least one of the following conditions: the user equipment resides in the The time range of the network element of the access network exceeds the first preset threshold, where the time is the continuous camp time or the accumulated camp time; the frequency of the same user equipment entering the network element range of the access network exceeds the second preset. a threshold, the time that the preselected user equipment resides in the network element range of the access network exceeds the first preset threshold, where the time is a continuous camp time or an accumulated camp time, or enters the connection The frequency of the network element range of the network exceeds the second preset threshold.
  • the core network may further include:
  • the receiving module may be configured to: receive the identifier information of the access network element reported by the access network element or the user equipment, where the access network element meets at least one of the following conditions: the user equipment resides The time in the range of the network element of the access network exceeds a first preset threshold, where the time is a continuous camp time or a cumulative camp time; the frequency of the same user equipment entering the network element range of the access network exceeds After the second preset threshold, the time that the preselected user equipment resides in the network element range of the access network exceeds the first preset threshold, where the time is a continuous camp time or an accumulated camp time. Or the frequency of entering the network element range of the access network exceeds the second preset threshold.
  • the core network may further include:
  • the obtaining module may be configured to: obtain, from the home subscriber server, a fixed authentication key, a permanent key, or an intermediate authentication vector corresponding to the pre-selected user equipment, as the authentication information.
  • the core network may further include:
  • the receiving module may be configured to: receive the authentication information completed by the access network element or the authentication context information corresponding to the user equipment established by the NAS security or the context information established by the NAS security, where the authentication context information includes The information about whether the authentication of the user equipment is successful and the authentication value included in the authentication response reported by the user equipment, the context information of the NAS security establishment includes: NAS security mode completion information reported by the user equipment or NAS Security mode rejects information.
  • the core network may further include:
  • the processing module may be configured to: after the access network element completes the authentication of the user equipment or the NAS security establishment process, re-authenticize or re-establish the user equipment that has been authenticated or NAS security established through the NAS message. NAS security reconstruction.
  • the core network may further include:
  • the sending module may be configured to: after determining that the access network element is authorized to perform authentication on the user equipment or the NAS security establishment process, send the list of access network elements supporting the authentication or NAS security establishment process to the Pre-select user equipment.
  • FIG. 5 is a schematic diagram of an access network element according to an embodiment of the present invention. As shown in FIG. 5, the access network element of this embodiment includes:
  • the receiving module is configured to: the access network element receives the authentication and security control information;
  • the execution module is configured to perform an authentication of the pre-selected user equipment or a NAS security establishment process according to the authentication and security control information.
  • the access network element may further include:
  • the statistics module can be configured to: count the dwell time of the user equipment in the range of the access network element And the entry frequency of the user equipment that enters the coverage of the network element of the access network. If the residence time of the user equipment exceeds the first preset threshold, the residence time is a continuous residence time or a cumulative residence time. And/or, if the frequency of the access of the same user equipment to the network element of the access network exceeds the second preset threshold, the statistics result and/or the identifier of the network element of the access network are reported.
  • the access network element may further include:
  • the sending module may be configured to: send the identifier of the licensable access network element to the pre-selected user equipment by using a broadcast message or dedicated signaling.
  • the performing module after performing the authentication on the pre-selected user equipment according to the authentication and security control information, may include: the access network element generating the information according to the authentication and security control information An authentication vector is sent to the pre-selected user equipment, and the authentication vector is carried; the authentication response fed back by the pre-selected user equipment is received, and the authentication is performed according to the authentication vector and the authentication response.
  • the executing module when generating the authentication vector according to the authentication and security control information, may include: corresponding to a preset user in the authentication information in the authentication and security control information.
  • the fixed key or the permanent key generates a corresponding intermediate authentication vector; or receives an intermediate authentication vector corresponding to the preset user in the authentication information in the authentication and security control information.
  • the performing module, performing the NAS security establishment process on the pre-selected user equipment according to the authentication and security control information may include: selecting a NAS security algorithm and a NAS integrity protection algorithm, and generating according to the The NAS security key and the NAS integrity protection key corresponding to the preselected user equipment; or receiving the NAS security algorithm and the NAS integrity protection algorithm, and generating the NAS security key and the NAS integrity corresponding to the preselected user equipment accordingly Protect the key.
  • the performing module when performing the NAS security establishment process on the pre-selected user equipment according to the authentication and security control information, may further include: performing, according to the NAS security key and the NAS integrity protection key Constructing a NAS security mode command, sending the NAS security mode command to the pre-selected user equipment, and receiving NAS security mode completion signaling fed back by the pre-selected user equipment.
  • the performing module after performing the NAS security establishment process on the pre-selected user equipment according to the authentication and security control information, may include: reporting the NAS security establishment Context information, the NAS security established context information includes: a NAS security key and a NAS integrity protection key generated by the access network element, and a NAS security algorithm and a NAS selected by the access network element The identity of the integrity protection algorithm.
  • FIG. 6 is a schematic diagram of a user equipment according to an embodiment of the present invention. As shown in FIG. 6, the user equipment in this embodiment includes:
  • the processing module may be configured to: when the user equipment needs to complete the authentication with the network side or establish a security process by the NAS, perform an authentication or NAS security establishment process with the access network element authorized to perform the authentication or NAS security establishment.
  • the user equipment may further include:
  • the statistics module can be configured to: count the time of the network element that resides in each access network and the frequency of entering the network element of each access network, and if it is found that it stays in the range of the access network element exceeds If the first preset threshold or the frequency of the network element in the access network exceeds the second preset threshold, the identifier of the receiving network element or the corresponding statistical result is reported to the core network.
  • the user equipment may further include:
  • the receiving module may be configured to: receive a list of access network elements that support authentication or NAS security establishment.
  • the user equipment may further include:
  • the sending module may be configured to: send a NAS security mode completion signaling to the access network element, where the NAS security mode completion signaling uses the NAS security key and the NAS integrity protection key calculated by the user equipment to perform encryption. Integrity protection.
  • the embodiment of the invention further discloses a computer program, comprising program instructions, when the program instruction is executed by the access network element, so that the access network element can perform any of the above wireless network authentication methods.
  • the embodiment of the invention also discloses a carrier carrying the computer program.
  • the embodiment of the invention also discloses a computer program, including program instructions, when the program instruction When executed by the core network, the core network can perform any of the above wireless network authentication methods.
  • the embodiment of the invention also discloses a carrier carrying the computer program.
  • the embodiment of the invention further discloses a computer program, comprising program instructions, when the program instruction is executed by the user equipment, so that the user equipment can perform any of the above wireless network authentication methods.
  • the embodiment of the invention also discloses a carrier carrying the computer program.
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve. Thus, the invention is not limited to any specific combination of hardware and software.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • each device/function module/functional unit in the above embodiment When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • Wireless network authentication method and core network element and access network provided by technical solution of the present invention
  • the meta and terminal can effectively reduce the delay of end-to-end wireless communication. Therefore, the present invention has strong industrial applicability.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种无线网络鉴权方法及核心网网元、接入网网元、终端，该方法包括：向接入网网元发送鉴权与安全控制信息，指示所述接入网网元根据所述鉴权与安全控制信息执行对预选用户设备的鉴权或者NAS安全建立过程。通过本发明技术方案可以有效降低端到端无线通信的时延。

Description

一种无线网络鉴权方法及核心网网元、接入网网元、终端 技术领域
本文涉及无线网络鉴权技术领域，特别是涉及一种无线网络鉴权方法及核心网网元、接入网网元、终端。
背景技术
相关技术的LTE(Long Term Evolution，长期演进)系统采用EPC(Evolved Packet Core，演进的分组核心)网络架构，UE(用户设备)在和网络侧建立连接的过程需要完成空中接口的连接建立、与核心网的连接建立，其中需要交互的控制面信令非常多，以3GPP(The 3rd Generation Partnership Project，第三代合作伙伴计划)LTE的附着流程为例，。
相关技术EPC系统的附着过程包含：
-注册到EPS网络(注册到MME，移动性管理实体)
-建立EPS承载(用于传输用户数据)
其中注册到EPS网络的过程进一步细分为：
-终端发附着请求到eNB，eNB将该终端附着请求发给MME；
-MME执行鉴权过程，MME从HSS获取所述终端的中间鉴权向量；
-MME将所述中间鉴权向量中的部分鉴权信息发给UE；
-UE根据收到的鉴权信息计算鉴权期望值，并将该期望值发给MME；
-MME根据UE发来的期望值，确定其是否鉴权成功；
-若鉴权成功，MME向UE发NAS安全模式命令，以建立NAS安全；
-UE验证MME发送的手机安全能力，并基于安全算法生成NAS Security Key，向MME返回NAS Security Mode Complete消息。
整个附着流程过程的耗时通常在一百多毫秒。
当UE数量较多的情况下，由于硬件处理时延的影响，耗时可能会更长。
相关技术的无线通信业务的种类不断增长，其中产生了很多对端到端时延有严格要求的业务，例如在线游戏，车联网，虚拟现实等，对端到端时延的要求通常在数十毫秒甚至更小，而相关技术的LTE系统的时延指标还无法很好的支持这些类型的业务。
发明内容
本发明要解决的技术问题是提供一种无线网络鉴权方法及核心网网元、接入网网元、终端，以降低端到端无线通信的时延。
为了解决上述技术问题，采用如下技术方案：
本发明提供了一种无线网络鉴权方法，包括：
向接入网网元发送鉴权与安全控制信息，指示所述接入网网元根据所述鉴权与安全控制信息执行对预选用户设备的鉴权或者NAS安全建立过程。
进一步地，上述方法还具有下面特点：所述鉴权与安全控制信息包括下述之一或多项的组合：
接入网网元可执行对用户设备的鉴权的授权许可；
接入网网元可执行对用户设备的NAS安全建立的授权许可；
接入网网元可执行对用户设备的鉴权的授权时间范围；
接入网网元可执行对用户设备的NAS安全建立的授权时间范围；
接入网网元可执行鉴权或者NAS安全建立的预选用户设备信息；
接入网网元用于执行鉴权的预选用户设备所对应的鉴权信息；
接入网网元用于执行NAS安全建立的预选用户设备所对应的NAS安全建立信息。
进一步地，上述方法还具有下面特点：所述接入网网元用于执行NAS安全建立的预选用户设备所对应的NAS安全建立信息是通过以下方式获取的：
从归属用户服务器获取所述预选用户设备所对应的NAS安全的中间密钥，或者
周期地从归属用户服务器获取所述预选用户设备所对应的NAS安全的 中间密钥。
进一步地，上述方法还具有下面特点：
所述NAS安全建立信息包括对NAS加密算法和NAS完整性保护算法的选择信息，或者包括授权eNB对NAS加密算法和NAS完整性保护算法进行选择的许可。
进一步地，上述方法还具有下面特点：
所述NAS安全建立信息只包含NAS安全模式命令。
进一步地，上述方法还具有下面特点：所述发送鉴权与安全控制信息给接入网网元之前，还包括：
对各个接入网网元内的用户设备的驻留时间以及用户设备进入各个接入网网元的频率进行统计；或者接收各个接入网网元自行统计自己范围内的用户设备的驻留时间以及进入自己覆盖范围的用户设备的进入频率的统计结果；或者接收各个用户设备统计自己驻留在每个接入网网元的时间以及进入每个接入网网元范围的频率的统计结果；
根据所述统计结果以至少满足以下一个条件来确定可授权所述接入网网元执行对用户设备的鉴权或者NAS安全建立过程：
有用户设备驻留在所述接入网网元范围的时间超过第一预设门限，所述时间为连续的驻留时间或累积的驻留时间；
同一用户设备进入所述接入网网元范围的频率超过第二预设门限。
进一步地，上述方法还具有下面特点：所述发送鉴权与安全控制信息给接入网网元之前，还包括：
接收到所述接入网网元或用户设备上报的所述接入网网元的标识信息，所述接入网网元满足以下至少一个条件：
有用户设备驻留在所述接入网网元范围的时间超过第一预设门限，所述时间为连续的驻留时间或累积的驻留时间；
同一用户设备进入所述接入网网元范围的频率超过第二预设门限。
进一步地，上述方法还具有下面特点：
所述预选用户设备驻留在所述接入网网元范围的时间超过所述第一预设门限，所述时间为连续的驻留时间或累积的驻留时间，或者进入所述接入网网元范围的频率超过所述第二预设门限。
进一步地，上述方法还具有下面特点：
所述用户设备属于时延敏感的用户设备，或者
所述用户设备运行时延敏感的业务。
进一步地，上述方法还具有下面特点：还包括：
从归属用户服务器获取所述预选用户设备对应的固定鉴权秘钥、永久秘钥或中间鉴权向量，作为鉴权信息。
进一步地，上述方法还具有下面特点：还包括：
接收所述接入网网元完成的鉴权或者NAS安全建立的所述用户设备所对应的鉴权上下文信息或NAS安全建立的上下文信息，所述鉴权上下文信息包括所述用户设备鉴权是否成功的信息和所述用户设备上报的鉴权响应所包含的鉴权值，所述NAS安全建立的上下文信息包括：所述用户设备上报的NAS安全模式完成信息或者NAS安全模式拒绝信息。
进一步地，上述方法还具有下面特点：还包括：
在所述接入网网元完成对用户设备的鉴权或者NAS安全建立过程后，通过NAS消息对已完成鉴权或者NAS安全建立的用户设备进行再次鉴权或再次NAS安全重建。
进一步地，上述方法还具有下面特点：还包括：
确定授权所述接入网网元执行对用户设备的鉴权或者NAS安全建立过程后，将支持鉴权或者NAS安全建立过程的接入网网元的列表发送给所述预选用户设备。
进一步地，上述方法还具有下面特点：还包括：
周期地从归属用户服务器上获取更新的鉴权与安全控制信息。
进一步地，上述方法还具有下面特点：所述鉴权与安全控制信息包括：
取消接入网网元可执行对用户设备的鉴权许可；
取消接入网网元可执行用户设备的NAS安全建立的许可。
为了解决上述问题，本发明还提供了一种核心网，其中，包括：
发送模块，用于向接入网网元发送鉴权与安全控制信息，指示所述接入网网元根据所述鉴权与安全控制信息执行对预选用户设备的鉴权或者NAS安全建立过程。
进一步地，上述核心网还具有下面特点：所述鉴权与安全控制信息包括下述之一或多项的组合：
接入网网元可执行对用户设备的鉴权的授权许可；
接入网网元可执行对用户设备的NAS安全建立的授权许可；
接入网网元可执行对用户设备的鉴权的授权时间范围；
接入网网元可执行对用户设备的NAS安全建立的授权时间范围；
接入网网元可执行鉴权或者NAS安全建立的预选用户设备信息；
接入网网元用于执行鉴权的预选用户设备所对应的鉴权信息；
接入网网元用于执行NAS安全建立的预选用户设备所对应的NAS安全建立信息，所述NAS安全建立信息包括对NAS加密算法和NAS完整性保护算法的选择信息，或者包括授权eNB对NAS加密算法和NAS完整性保护算法进行选择的许可，或者所述NAS安全建立信息只包含NAS安全模式命令。
进一步地，上述核心网还具有下面特点：还包括：
统计模块，用于对各个接入网网元内的用户设备的驻留时间以及用户设备进入各个接入网网元的频率进行统计；或者接收各个接入网网元自行统计自己范围内的用户设备的驻留时间以及进入自己覆盖范围的用户设备的进入频率的统计结果；或者接收各个用户设备统计自己驻留在每个接入网网元的时间以及进入每个接入网网元范围的频率的统计结果；
确定模块，用于根据所述统计结果以至少满足以下一个条件来确定可授权所述接入网网元执行对用户设备的鉴权或者NAS安全建立过程：有用户设备驻留在所述接入网网元范围的时间超过第一预设门限，所述时间为连续的驻留时间或累积的驻留时间；同一用户设备进入所述接入网网元范围的频率 超过第二预设门限，所述预选用户设备驻留在所述接入网网元范围的时间超过所述第一预设门限，所述时间为连续的驻留时间或累积的驻留时间，或者进入所述接入网网元范围的频率超过所述第二预设门限。
进一步地，上述核心网还具有下面特点：还包括：
接收模块，用于接收到所述接入网网元或用户设备上报的所述接入网网元的标识信息，所述接入网网元满足以下至少一个条件：有用户设备驻留在所述接入网网元范围的时间超过第一预设门限，所述时间为连续的驻留时间或累积的驻留时间；同一用户设备进入所述接入网网元范围的频率超过第二预设门限，所述预选用户设备驻留在所述接入网网元范围的时间超过所述第一预设门限，所述时间为连续的驻留时间或累积的驻留时间，或者进入所述接入网网元范围的频率超过所述第二预设门限。
进一步地，上述核心网还具有下面特点：还包括：
获取模块，用于从归属用户服务器获取所述预选用户设备对应的固定鉴权秘钥、永久秘钥或中间鉴权向量，作为鉴权信息。
进一步地，上述核心网还具有下面特点：还包括：
接收模块，用于接收所述接入网网元完成的鉴权或者NAS安全建立的所述用户设备所对应的鉴权上下文信息或NAS安全建立的上下文信息，所述鉴权上下文信息包括所述用户设备鉴权是否成功的信息和所述用户设备上报的鉴权响应所包含的鉴权值，所述NAS安全建立的上下文信息包括：所述用户设备上报的NAS安全模式完成信息或者NAS安全模式拒绝信息。
进一步地，上述核心网还具有下面特点：还包括：
处理模块，用于在所述接入网网元完成对用户设备的鉴权或者NAS安全建立过程后，通过NAS消息对已完成鉴权或者NAS安全建立的用户设备进行再次鉴权或再次NAS安全重建。
进一步地，上述核心网还具有下面特点：还包括：
发送模块，用于确定授权所述接入网网元执行对用户设备的鉴权或者NAS安全建立过程后，将支持鉴权或者NAS安全建立过程的接入网网元的列表发送给所述预选用户设备。
为了解决上述问题，本发明还提供了一种无线网络鉴权方法，包括：
接入网网元接收鉴权与安全控制信息；
根据所述鉴权与安全控制信息执行对预选用户设备的鉴权或者NAS安全建立过程。
进一步地，上述方法还具有下面特点：所述鉴权与安全控制信息包括下述之一或多项的组合：
接入网网元可执行对用户设备的鉴权的授权许可；
接入网网元可执行对用户设备的NAS安全建立的授权许可；
接入网网元可执行对用户设备的鉴权的授权时间范围；
接入网网元可执行对用户设备的NAS安全建立的授权时间范围；
接入网网元可执行鉴权或者NAS安全建立的预选用户设备信息；
接入网网元用于执行鉴权的预选用户设备所对应的鉴权信息；
接入网网元用于执行NAS安全建立的预选用户设备所对应的NAS安全建立信息。
进一步地，上述方法还具有下面特点：所述鉴权与安全控制信息包括以下的一种或两种：
取消接入网网元可执行对用户设备的鉴权许可；
取消接入网网元可执行用户设备的NAS安全建立的许可。
进一步地，上述方法还具有下面特点：
所述鉴权信息为所述预选用户设备对应的固定鉴权秘钥、永久秘钥或中间鉴权向量。
进一步地，上述方法还具有下面特点：所述接入网网元接收鉴权与安全控制信息之前，还包括：
统计本接入网网元范围内的用户设备的驻留时间以及进入本接入网网元覆盖范围的用户设备的进入频率；
若有用户设备的驻留时间超过第一预设门限，所述驻留时间为连续的驻 留时间或累计的驻留时间，和/或，若同一用户设备进入本接入网网元覆盖范围的频率超过第二预设门限，则上报统计结果和/或本接入网网元的标识。
进一步地，上述方法还具有下面特点：还包括：
所述接入网网元通过广播消息或者专用信令将可授权的接入网网元的标识发送给所述预选用户设备。
进一步地，上述方法还具有下面特点：所述根据所述鉴权与安全控制信息执行对预选用户设备的鉴权，包括：
所述接入网网元根据所述鉴权与安全控制信息生成鉴权向量；
向所述预选用户设备发送鉴权要求，携带所述鉴权向量；
接收所述预选用户设备反馈的鉴权响应，根据所述鉴权向量和所述鉴权响应进行鉴权。
进一步地，上述方法还具有下面特点：所述接收所述预选用户设备反馈的鉴权响应，根据所述鉴权向量和所述鉴权响应进行鉴权之后，还包括：
上报鉴权上下文信息，所述鉴权上下文信息包括所述用户设备鉴权是否成功的信息和所述用户设备上报的鉴权响应所包含的鉴权值。
进一步地，上述方法还具有下面特点：所述接入网网元根据所述鉴权与安全控制信息生成鉴权向量，包括：
所述接入网网元根据所述鉴权与安全控制信息中的鉴权信息中的预设用户所对应的固定密钥或者永久密钥，生成对应的中间鉴权向量；或者，
所述接入网网元接收所述鉴权与安全控制信息中的鉴权信息中的预设用户所对应的中间鉴权向量。
进一步地，上述方法还具有下面特点：所述接入网网元根据所述鉴权与安全控制信息执行对预选用户设备的NAS安全建立过程，包括：
所述接入网网元选择NAS安全算法和NAS完整性保护算法，并据此生成所述预选用户设备对应的NAS安全密钥和NAS完整性保护密钥；或者，
所述接入网网元接收NAS安全算法和NAS完整性保护算法，并据此生成所述预选用户设备对应的NAS安全密钥和NAS完整性保护密钥。
进一步地，上述方法还具有下面特点：所述接入网网元根据所述鉴权与安全控制信息执行对预选用户设备的NAS安全建立过程，还包括：
所述接入网网元根据所述NAS安全密钥和NAS完整性保护密钥构造NAS安全模式命令，发送所述NAS安全模式命令给所述预选用户设备；
所述接入网网元接收所述预选用户设备反馈的NAS安全模式完成信令。
进一步地，上述方法还具有下面特点：所述接入网网元根据所述鉴权与安全控制信息执行对预选用户设备的NAS安全建立过程之后，包括：
所述接入网网元上报NAS安全建立的上下文信息，所述NAS安全建立的上下文信息中包含：所述接入网网元生成的NAS安全密钥和NAS完整性保护密钥，所述接入网网元选择的NAS安全算法和NAS完整性保护算法的标识。
为了解决上述问题，本发明还提供了一种接入网网元，其中，包括：
接收模块，用于接入网网元接收鉴权与安全控制信息；
执行模块，用于根据所述鉴权与安全控制信息执行对预选用户设备的鉴权或者NAS安全建立过程。
进一步地，上述接入网网元还具有下面特点：还包括：
统计模块，用于统计本接入网网元范围内的用户设备的驻留时间以及进入本接入网网元覆盖范围的用户设备的进入频率，若有用户设备的驻留时间超过第一预设门限，所述驻留时间为连续的驻留时间或累计的驻留时间，和/或，若同一用户设备进入本接入网网元覆盖范围的频率超过第二预设门限，则上报统计结果和/或本接入网网元的标识。
进一步地，上述接入网网元还具有下面特点：还包括：
发送模块，用于通过广播消息或者专用信令将可授权的接入网网元的标识发送给所述预选用户设备。
进一步地，上述接入网网元还具有下面特点：
所述执行模块，根据所述鉴权与安全控制信息执行对预选用户设备的鉴权包括：所述接入网网元根据所述鉴权与安全控制信息生成鉴权向量；向所 述预选用户设备发送鉴权要求，携带所述鉴权向量；接收所述预选用户设备反馈的鉴权响应，根据所述鉴权向量和所述鉴权响应进行鉴权。
进一步地，上述接入网网元还具有下面特点：
所述执行模块，根据所述鉴权与安全控制信息生成鉴权向量包括：根据所述鉴权与安全控制信息中的鉴权信息中的预设用户所对应的固定密钥或者永久密钥，生成对应的中间鉴权向量；或者接收所述鉴权与安全控制信息中的鉴权信息中的预设用户所对应的中间鉴权向量。
进一步地，上述接入网网元还具有下面特点：
所述执行模块，根据所述鉴权与安全控制信息执行对预选用户设备的NAS安全建立过程包括：选择NAS安全算法和NAS完整性保护算法，并据此生成所述预选用户设备对应的NAS安全密钥和NAS完整性保护密钥；或者接收NAS安全算法和NAS完整性保护算法，并据此生成所述预选用户设备对应的NAS安全密钥和NAS完整性保护密钥。
进一步地，上述接入网网元还具有下面特点：
所述执行模块，根据所述鉴权与安全控制信息执行对预选用户设备的NAS安全建立过程还包括：根据所述NAS安全密钥和NAS完整性保护密钥构造NAS安全模式命令，发送所述NAS安全模式命令给所述预选用户设备；接收所述预选用户设备反馈的NAS安全模式完成信令。
进一步地，上述接入网网元还具有下面特点：
所述执行模块，根据所述鉴权与安全控制信息执行对预选用户设备的NAS安全建立过程之后，包括：上报NAS安全建立的上下文信息，所述NAS安全建立的上下文信息中包含：所述接入网网元生成的NAS安全密钥和NAS完整性保护密钥，所述接入网网元选择的NAS安全算法和NAS完整性保护算法的标识。
为了解决上述问题，本发明还提供了一种无线网络鉴权方法，包括：
当用户设备需要和网络侧完成鉴权或NAS建立安全过程时，所述用户设备与被授权可执行鉴权或NAS安全建立的接入网网元进行鉴权或NAS安全建立过程。
进一步地，上述方法还具有下面特点：所述用户设备与被授权可执行鉴权或NAS安全建立的接入网网元进行鉴权或NAS安全建立过程的过程中，还包括：
所述用户设备统计其驻留在每个接入网网元的时间以及进入每个接入网网元范围的频率，若发现其驻留在一接入网网元范围的时间超过第一预设门限或者其进入一接入网网元范围的频率超过第二预设门限，则将该接收网网元的标识或对应的统计结果上报给核心网。
进一步地，上述方法还具有下面特点：所述用户设备与被授权可执行鉴权或NAS安全建立的接入网网元进行鉴权或NAS安全建立过程之前，包括：
所述用户设备接收支持鉴权或者NAS安全建立的接入网网元的列表。
进一步地，上述方法还具有下面特点：所述用户设备与被授权可执行鉴权或NAS安全建立的接入网网元进行鉴权或NAS安全建立过程之后，还包括：
所述用户设备向接入网网元发送NAS安全模式完成信令，所述NAS安全模式完成信令使用所述用户设备算出的NAS安全密钥和NAS完整性保护密钥进行加密和完整性保护。
为了解决上述问题，本发明还提供了一种用户设备，其中，包括：
处理模块，用于当用户设备需要和网络侧完成鉴权或NAS建立安全过程时，与被授权可执行鉴权或NAS安全建立的接入网网元进行鉴权或NAS安全建立过程。
进一步地，上述用户设备还具有下面特点：还包括：
统计模块，用于统计其驻留在每个接入网网元的时间以及进入每个接入网网元范围的频率，若发现其驻留在一接入网网元范围的时间超过第一预设门限或者其进入一接入网网元范围的频率超过第二预设门限，则将该接收网网元的标识或对应的统计结果上报给核心网。
进一步地，上述用户设备还具有下面特点：还包括：
接收模块，用于接收支持鉴权或者NAS安全建立的接入网网元的列表。
进一步地，上述用户设备还具有下面特点：还包括：
发送模块，用于向接入网网元发送NAS安全模式完成信令，所述NAS安全模式完成信令使用所述用户设备算出的NAS安全密钥和NAS完整性保护密钥进行加密和完整性保护。
综上，本发明技术方案提供的一种无线网络鉴权方法及核心网网元、接入网网元、终端，能够有效了降低端到端无线通信的时延。
附图概述
附图用来提供对本发明的进一步理解，并且构成说明书的一部分，与本发明的实施例一起用于解释本发明，并不构成对本发明的限制。在附图中：
图1为本发明实施例1的流程图；
图2为本发明实施例2的流程图；
图3为本发明实施例4的流程图；
图4为本发明实施例的核心网的示意图；
图5为本发明实施例的接入网网元的示意图；
图6为本发明实施例的用户设备的示意图。
本发明的较佳实施方式
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
以下将结合附图及实施例来详细说明本发明的实施方式，借此对本发明如何应用技术手段来解决技术问题，并达成技术效果的实现过程能充分理解并据以实施。
首先，如果不冲突，本发明实施例以及实施例中的各个特征可以相互结合，均在本发明的保护范围之内。另外，在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或 描述的步骤。
实施例1：
以3GPP EPC架构结合LTE接入网为例，为eNB(演进的基站)加载鉴权向量生成器以及秘钥派生函数KDF，使得eNB具备鉴权向量计算能力以及秘钥生成能力。如图1所示，包括以下步骤：
步骤201、选择符合授权条件的eNB以及预选UE，可行的选择方法和规则包括：
有UE驻留在某个eNB范围的时间超过预设门限一，所述时间可以是连续的，也可以是累积的；则该UE可作为预选UE，该eNB可认为符合授权条件；
同一UE进入某个eNB范围的频率超过预设门限二,则该UE可作为预选UE，该eNB可认为符合授权条件；
所述用户设备属于时延敏感的UE，或
所述用户设备运行时延敏感的业务。
实行统计的主体可以是MME、eNB、UE，分别的方法是：
若统计主体是MME，则MME自行对各个eNB内的UE的驻留时间以及UE进入各个eNB范围的频率进行统计，选择出上述条件之一的eNB，所述预设门限一和预设门限二可由MME预先设定；
各个eNB自行统计自己范围内的UE的驻留时间以及进入自己覆盖范围的UE的进入频率，当判断自己符合条件后，所述eNB将自己的ID上报给MME，可选的eNB也可将所述统计结果上报给MME；所述预设门限一和预设门限二可由MME预先设定，eNB可从MME获取所述预设门限一和预设门限二；
各个UE从MME获取所述预设门限一和预设门限二，UE自行统计自己驻留在每个eNB的时间以及进入每个eNB范围的频率，当UE发现自己驻留在某个eNB范围的时间超过预设门限一或者自己进入某个eNB范围的频率超过预设门限二，则UE认为该eNB符合可被授权执行鉴权或NAS安全的条件，UE将所述eNB的ID上报给MME，可选的，UE也可将所述eNB对应的统 计结果上报给MME；
MME在确定了可授权鉴权与NAS安全建立的eNB以及预选UE后，将可授权的eNB ID发送给所述预选UE，以便UE知道在这些eNB范围可以向eNB发起鉴权和NAS安全建立；
或者也可由被授权的接入网网元通过广播消息或者专用信令告知所述预选用户设备。
步骤202、MME向HSS(Home Subscriber Server，归属用户服务器)索要符合条件的预选UE对应的HSS内的鉴权信息，具体包括：目标UE对应的永久密钥K；HSS将所述信息发送给MME。
步骤203、MME向符合授权条件的eNB发送鉴权与安全控制信息，其中包括：
eNB可以执行对用户设备的鉴权的授权许可；
eNB可以执行对用户设备的NAS安全建立的授权许可；
eNB可以执行对用户设备的鉴权的授权时间范围；该项信息是可选项，用于当MME统计过所述eNB的活跃时间后，可根据其活跃时间来配置授权时间范围；
eNB可以执行对用户设备的NAS安全建立的授权时间范围；
eNB可以执行鉴权或者NAS安全建立的预选用户设备信息；该信息用于eNB识别哪些UE是预选用户设备；
eNB用于执行鉴权的预选用户设备所对应的鉴权信息；
eNB根据上述信息确定自己可对所述UE执行鉴权或NAS安全建立。
步骤204、当预选UE在某个被授权的eNB范围内发起附着过程，或者RRC(Radio Resource Control，无线资源控制协议)连接过程；UE根据之前获得的被授权eNB列表可知，在这类eNB范围内可向eNB发起鉴权或NAS安全建立。
步骤205、预选UE向eNB发起附着请求，可选的，eNB将该附着请求同时转发给MME，让MME了解到所述UE的附着动作。
步骤206、eNB根据鉴权与安全控制信息内容生成鉴权向量，鉴权与安全控制信息内容中的预选用户设备所对应的鉴权信息中包含该UE对应的固定密钥K，eNB自行生成随机数RAND和序列数SQN，基于这些输入参数，eNB使用鉴权向量生成器生成鉴权向量，鉴权向量生成器和鉴权向量的定义仍采用相关LTE协议定义的方法。
步骤207、eNB向UE发送鉴权要求，内含鉴权向量。
步骤208、UE按照相关协议方式，根据收到的鉴权向量以及自身的固定密钥K，生成鉴权值以及中间密钥。
步骤209、UE反馈鉴权响应给eNB，内含鉴权值。
步骤210、eNB对比自己生成的鉴权向量和UE反馈的鉴权响应内容，若符合LTE协议规定的鉴权对照关系，则鉴权成功，否则鉴权失败。
步骤211、eNB将鉴权结果发送给MME，若鉴权成功，则eNB继续执行NAS安全建立，若鉴权失败，则MME可以拒绝该UE的附着，也可以由MME重新对该UE进行鉴权(即按照相关LTE协议的鉴权方式，不通过授权的eNB)。
步骤212、eNB执行和所述UE的NAS安全建立，eNB选择NAS安全算法和NAS完整性保护算法，eNB根据自己之前生成的中间密钥，生成NAS安全密钥和NAS完整性保护密钥。
步骤213、eNB将NAS安全模式命令发送给UE，该命令的内容定义和相关LTE协议的NAS安全模式命令相同；同时eNB将NAS安全建立的上下文信息发送给MME，内容包含eNB生成的NAS安全密钥和NAS完整性保护密钥，eNB选择的NAS安全算法和NAS完整性保护算法的ID，以实现后续MME和UE之间的NAS安全对接。
步骤214、UE根据eNB发送的NAS安全模式命令计算出NAS安全算法密钥和NAS完整性保护算法密钥，到此NAS安全建立完成。
UE向eNB发送NAS安全模式完成信令，该信令使用UE算出的NAS安全密钥和NAS完整性保护密钥进行加密和完整性保护；eNB将给信令转发MME。
在本实施例中，由于鉴权和NAS安全建立功能被授权给eNB，在UE发起的整个鉴权和NAS安全建立过程中取消了eNB和MME以及MME和HSS之间的信令交互，大大简化了整个鉴权过程，从而大幅的减少了连接建立延迟。
实施例2：
以3GPP EPC架构结合LTE接入网为例，为eNB加载秘钥派生函数KDF，使得eNB具备秘钥生成能力。如图2所示，包括以下步骤：
步骤301、统计符合授权条件的eNB以及预选UE，可行的统计方法和规则可参考实施例1，这里不再重复。
步骤302、MME向HSS索要符合条件的预选UE对应的HSS内的鉴权信息，具体包括：目标UE对应的中间鉴权向量；HSS将所述鉴权信息发送给MME。
步骤303、MME向符合授权条件的eNB发送鉴权与安全控制信息，其中包括：
eNB可以执行对用户设备的鉴权的授权许可；
eNB可以执行对用户设备的NAS安全建立的授权许可；
eNB可以执行对用户设备的鉴权的授权时间范围；该项信息是可选项，用于当MME统计过所述eNB的活跃时间后，可根据其活跃时间来配置授权时间范围；
eNB可以执行对用户设备的NAS安全建立的授权时间范围；
eNB可以执行鉴权或者NAS安全建立的预选用户设备信息；该信息用于eNB识别哪些UE是预选用户设备；
eNB用于执行鉴权的预选用户设备所对应的鉴权信息；
eNB用于执行NAS安全建立的预选用户设备所对应的NAS安全建立信息；
eNB根据上述信息确定自己可对所述UE执行鉴权或NAS安全建立。
其中，鉴权信息包括所述中间鉴权向量，NAS安全建立信息包括MME 选择的NAS安全算法和NAS完整性保护算法对应的ID。
步骤304、当预选UE在某个被授权的eNB范围内发起附着过程，或者RRC连接过程；UE根据之前MME告知的被授权eNB列表可知，在这类eNB范围内可向eNB发起鉴权或NAS安全建立。
步骤305、预选UE向eNB发起附着请求，可选的，eNB将该附着请求同时转发给MME，让MME了解到所述UE的附着动作。
步骤306、eNB向UE发送鉴权要求，内含中间鉴权向量。
步骤307、UE按照相关协议方式，根据收到的中间鉴权向量生成鉴权值以及中间密钥。
步骤308、UE反馈鉴权响应给eNB，内含鉴权值。
步骤309、eNB对比中间鉴权向量和UE反馈的鉴权响应内容，若符合LTE协议规定的鉴权对照关系，则鉴权成功，否则鉴权失败。
步骤310、eNB将鉴权结果发送给MME，若鉴权成功，则eNB继续执行NAS安全建立，若鉴权失败，则MME可以拒绝该UE的附着，也可以由MME重新对该UE进行鉴权(即按照相关LTE协议的鉴权方式，不通过授权的eNB)。
步骤311、eNB执行和所述UE的NAS安全建立，eNB根据MME发送的NAS安全算法和NAS完整性保护算法的ID，以及中间密钥，生成NAS安全密钥和NAS完整性保护密钥。
MME用生成的NAS安全密钥和NAS完整性保护密钥来构成后续的NAS安全模式命令。
步骤312、eNB将NAS安全模式命令发送给UE，该命令的内容定义和相关LTE协议的NAS安全模式命令相同；同时eNB将NAS安全建立的上下文发送给MME，所述NAS安全建立的上下文的内容包含eNB生成的NAS安全密钥和NAS完整性保护密钥，MME选择的NAS安全算法和NAS完整性保护算法的ID，以实现后续MME和UE之间的NAS安全对接。
步骤313、UE根据eNB发送的NAS安全模式命令计算出NAS安全算法密钥和NAS完整性保护算法密钥，到此NAS安全建立完成。
UE向eNB发送NAS安全模式完成信令，该信令使用UE算出的NAS安全密钥和NAS完整性保护密钥进行加密和完整性保护；eNB将给信令转发MME。
实施例2描述的是一个流程，进一步的，步骤303中eNB收到的鉴权与安全控制信息中的鉴权信息和NAS安全建立信息一直有效，可以用于多次对对应的预选UE进行鉴权和NAS安全建立，MME可周期性从HSS获取更新的鉴权信息和NAS安全建立信息，以对eNB保存的鉴权信息和NAS安全建立信息进行更新，可进一步提高安全性。
实施例3
实施例3采用和实施例2相同的流程，其区别之处是：
实施例2中，步骤303中eNB收到的鉴权与安全控制信息中的鉴权信息和NAS安全建立信息可以一直有效，直到被MME更新或者取消授权。
实施例3中，步骤303中eNB收到的鉴权与安全控制信息中的鉴权信息和NAS安全建立信息仅有效一次，在预选UE的下一次鉴权开始前，MME提前从HSS获取该UE的中间鉴权向量，MME更新对NAS加密和完整性保护算法的选择，以构成新的鉴权与NAS安全建立信息发送给eNB；eNB在UE的下一次鉴权中使用该更新过的鉴权信息与NAS安全建立信息对UE鉴权和建立NAS安全。
相对于实施例2，实施例3具有相同的延时降低性能，虽然增加了信令开销，但提高了安全性。
实施例4.
以3GPP EPC架构结合LTE接入网为例，与之前实施例不同的是，eNB没有秘钥派生函数KDF，不具备秘钥生成能力。如图3所示，包括以下步骤：
步骤401、统计符合授权条件的eNB以及预选UE，可行的统计方法和规则可参考实施例1，这里不再重复；
步骤402、MME向HSS索要符合条件的预选UE对应的HSS内的鉴权信息，具体包括：目标UE对应的中间鉴权向量；HSS将所述鉴权信息发送给MME；
步骤403、MME提前生成NAS安全密钥和NAS完整性保护密钥，MME用生成的NAS安全密钥和NAS完整性保护密钥来生成NAS安全模式命令，NAS安全模式命令的格式内容与相关LTE协议定义的相同。
步骤404、MME向符合授权条件的eNB发送鉴权与安全控制信息，其中包括：
eNB可以执行对用户设备的鉴权的授权许可；
eNB可以执行对用户设备的NAS安全建立的授权许可；
eNB可以执行对用户设备的鉴权的授权时间范围；该项信息是可选项，用于当MME统计过所述eNB的活跃时间后，可根据其活跃时间来配置授权时间范围；
eNB可以执行对用户设备的NAS安全建立的授权时间范围；
eNB可以执行鉴权或者NAS安全建立的预选用户设备信息；该信息用于eNB识别哪些UE是预选用户设备；
eNB用于执行鉴权的预选用户设备所对应的鉴权信息，包括MME获取的预选UE对应的中间鉴权向量AUTN(Authentication Token，鉴权令牌)、RAND(Random Number，鉴权随机数)以及XRES(Expected Response，预期回应)；
eNB用于执行NAS安全建立的预选用户设备所对应的NAS安全建立信息，所述NAS安全建立信息即MME之前生成的NAS安全模式命令；
eNB根据上述信息确定自己可对所述UE执行鉴权或NAS安全建立。
步骤405、当预选UE在某个被授权的eNB范围内发起附着过程，或者RRC连接过程；UE根据之前MME告知的被授权eNB列表可知，在这类eNB范围内可向eNB发起鉴权或NAS安全建立；
步骤406、预选UE向eNB发起附着请求，可选的，eNB将该附着请求同时转发给MME，让MME了解到所述UE的附着动作
步骤407、eNB向UE发送鉴权要求，内含中间鉴权向量；
步骤408、UE按照相关协议方式，根据收到的中间鉴权向量以及自身的 固定密钥，生成鉴权值以及中间密钥；
步骤409、UE反馈鉴权响应给eNB，内含鉴权值；
步骤410、eNB对比中间鉴权向量和UE反馈的鉴权响应内容，若符合LTE协议规定的鉴权对照关系，则鉴权成功，否则鉴权失败；
步骤411、eNB将鉴权结果发送给MME，若鉴权成功，则eNB继续执行NAS安全建立，若鉴权失败，则MME可以拒绝该UE的附着，也可以由MME重新对该UE进行鉴权(即按照相关LTE协议的鉴权方式，不通过授权的eNB)；
步骤412、eNB执行和所述UE的NAS安全建立，eNB将MME发送NAS安全模式命令发送给UE；该命令的内容定义和相关LTE协议的NAS安全模式命令相同；
步骤413、UE根据eNB发送的NAS安全模式命令计算出NAS安全算法密钥和NAS完整性保护算法密钥，到此NAS安全建立完成。UE向eNB发送NAS安全模式完成信令，该信令使用UE算出的NAS安全密钥和NAS完整性保护密钥进行加密和完整性保护；eNB将给信令转发MME。
相对于之前的实施例1，2，3，实施例4取消了eNB的鉴权向量生成能力和密钥生成能力，具有相同的延时降低性能，进一步提高了安全性。
以上所有实施例中，MME可通过鉴权与安全控制信息随时更新各个eNB的预选UE名单，也可以随时取消某个eNB的鉴权授权许可或NAS安全建立授权许可；通常这种更新行为和取消授权行为需基于对eNB和预选UE的统计结果的判断。
在以上所有实施例中，接入网网元的类型除了eNB之外，也包括small cell，家庭基站，以及兼容EPC架构的其他接入网网元类型。
图4为本发明实施例的核心网的示意图，如图4所示，本实施例的核心网包括：
发送模块，可用于发送鉴权与安全控制信息给接入网网元，指示所述接入网网元根据所述鉴权与安全控制信息执行对预选用户设备的鉴权或者NAS安全建立过程。
其中，所述鉴权与安全控制信息包括下述之一或多项的组合：
接入网网元可执行对用户设备的鉴权的授权许可；
接入网网元可执行对用户设备的NAS安全建立的授权许可；
接入网网元可执行对用户设备的鉴权的授权时间范围；
接入网网元可执行对用户设备的NAS安全建立的授权时间范围；
接入网网元可执行鉴权或者NAS安全建立的预选用户设备信息；
接入网网元可执行鉴权的预选用户设备所对应的鉴权信息；
接入网网元可执行NAS安全建立的预选用户设备所对应的NAS安全建立信息，所述NAS安全建立信息包括对NAS加密算法和NAS完整性保护算法的选择信息，或者包括授权eNB对NAS加密算法和NAS完整性保护算法进行选择的许可，或者所述NAS安全建立信息只包含NAS安全模式命令。
统计模块，可设置成：对各个接入网网元内的用户设备的驻留时间以及用户设备进入各个接入网网元的频率进行统计；或者接收各个接入网网元自行统计自己范围内的用户设备的驻留时间以及进入自己覆盖范围的用户设备的进入频率的统计结果；或者接收各个用户设备统计自己驻留在每个接入网网元的时间以及进入每个接入网网元范围的频率的统计结果；
确定模块，可设置成：根据所述统计结果以至少满足以下一个条件来确定可授权所述接入网网元执行对用户设备的鉴权或者NAS安全建立过程：有用户设备驻留在所述接入网网元范围的时间超过第一预设门限，所述时间为连续的驻留时间或累积的驻留时间；同一用户设备进入所述接入网网元范围的频率超过第二预设门限，所述预选用户设备驻留在所述接入网网元范围的时间超过所述第一预设门限，所述时间为连续的驻留时间或累积的驻留时间，或者进入所述接入网网元范围的频率超过所述第二预设门限。
在一可选实施例中，所述核心网还可以包括：
接收模块，可设置成：接收到所述接入网网元或用户设备上报的所述接入网网元的标识信息，所述接入网网元满足以下至少一个条件：有用户设备驻留在所述接入网网元范围的时间超过第一预设门限，所述时间为连续的驻留时间或累积的驻留时间；同一用户设备进入所述接入网网元范围的频率超 过第二预设门限，所述预选用户设备驻留在所述接入网网元范围的时间超过所述第一预设门限，所述时间为连续的驻留时间或累积的驻留时间，或者进入所述接入网网元范围的频率超过所述第二预设门限。
在一可选实施例中，所述核心网还可以包括：
获取模块，可设置成：从归属用户服务器获取所述预选用户设备对应的固定鉴权秘钥、永久秘钥或中间鉴权向量，作为鉴权信息。
在一可选实施例中，所述核心网还可以包括：
接收模块，可设置成：接收所述接入网网元完成的鉴权或者NAS安全建立的所述用户设备所对应的鉴权上下文信息或NAS安全建立的上下文信息，所述鉴权上下文信息包括所述用户设备鉴权是否成功的信息和所述用户设备上报的鉴权响应所包含的鉴权值，所述NAS安全建立的上下文信息包括：所述用户设备上报的NAS安全模式完成信息或者NAS安全模式拒绝信息。
在一可选实施例中，所述核心网还可以包括：
处理模块，可设置成：在所述接入网网元完成对用户设备的鉴权或者NAS安全建立过程后，通过NAS消息对已完成鉴权或者NAS安全建立的用户设备进行再次鉴权或再次NAS安全重建。
在一可选实施例中，所述核心网还可以包括：
发送模块，可设置成：确定授权所述接入网网元执行对用户设备的鉴权或者NAS安全建立过程后，将支持鉴权或者NAS安全建立过程的接入网网元的列表发送给所述预选用户设备。
图5为本发明实施例的接入网网元的示意图，如图5所示，本实施例的接入网网元包括：
接收模块，设置成：接入网网元接收鉴权与安全控制信息；
执行模块，设置成：根据所述鉴权与安全控制信息执行对预选用户设备的鉴权或者NAS安全建立过程。
在一可选实施例中，所述接入网网元还可以包括：
统计模块，可设置成：统计本接入网网元范围内的用户设备的驻留时间 以及进入本接入网网元覆盖范围的用户设备的进入频率，若有用户设备的驻留时间超过第一预设门限，所述驻留时间为连续的驻留时间或累计的驻留时间，和/或，若同一用户设备进入本接入网网元覆盖范围的频率超过第二预设门限，则上报统计结果和/或本接入网网元的标识。
在一可选实施例中，所述接入网网元还可以包括：
发送模块，可设置成：通过广播消息或者专用信令将可授权的接入网网元的标识发送给所述预选用户设备。
在一可选实施例中，所述执行模块，根据所述鉴权与安全控制信息执行对预选用户设备的鉴权可以包括：所述接入网网元根据所述鉴权与安全控制信息生成鉴权向量；向所述预选用户设备发送鉴权要求，携带所述鉴权向量；接收所述预选用户设备反馈的鉴权响应，根据所述鉴权向量和所述鉴权响应进行鉴权。
在一可选实施例中，所述执行模块，根据所述鉴权与安全控制信息生成鉴权向量可以包括：根据所述鉴权与安全控制信息中的鉴权信息中的预设用户所对应的固定密钥或者永久密钥，生成对应的中间鉴权向量；或者接收所述鉴权与安全控制信息中的鉴权信息中的预设用户所对应的中间鉴权向量。
在一可选实施例中，所述执行模块，根据所述鉴权与安全控制信息执行对预选用户设备的NAS安全建立过程可以包括：选择NAS安全算法和NAS完整性保护算法，并据此生成所述预选用户设备对应的NAS安全密钥和NAS完整性保护密钥；或者接收NAS安全算法和NAS完整性保护算法，并据此生成所述预选用户设备对应的NAS安全密钥和NAS完整性保护密钥。
在一可选实施例中，所述执行模块，根据所述鉴权与安全控制信息执行对预选用户设备的NAS安全建立过程还可以包括：根据所述NAS安全密钥和NAS完整性保护密钥构造NAS安全模式命令，发送所述NAS安全模式命令给所述预选用户设备；接收所述预选用户设备反馈的NAS安全模式完成信令。
在一可选实施例中，所述执行模块，根据所述鉴权与安全控制信息执行对预选用户设备的NAS安全建立过程之后，可以包括：上报NAS安全建立 的上下文信息，所述NAS安全建立的上下文信息中包含：所述接入网网元生成的NAS安全密钥和NAS完整性保护密钥，所述接入网网元选择的NAS安全算法和NAS完整性保护算法的标识。
图6为本发明实施例的用户设备的示意图，如图6所示，本实施例的用户设备包括：
处理模块，可设置成：当用户设备需要和网络侧完成鉴权或NAS建立安全过程时，与被授权可执行鉴权或NAS安全建立的接入网网元进行鉴权或NAS安全建立过程。
在一可选实施例中，所述用户设备还可以包括：
统计模块，可设置成：统计其驻留在每个接入网网元的时间以及进入每个接入网网元范围的频率，若发现其驻留在一接入网网元范围的时间超过第一预设门限或者其进入一接入网网元范围的频率超过第二预设门限，则将该接收网网元的标识或对应的统计结果上报给核心网。
在一可选实施例中，所述用户设备还可以包括：
接收模块，可设置成：接收支持鉴权或者NAS安全建立的接入网网元的列表。
在一可选实施例中，所述用户设备还可以包括：
发送模块，可设置成：向接入网网元发送NAS安全模式完成信令，所述NAS安全模式完成信令使用所述用户设备算出的NAS安全密钥和NAS完整性保护密钥进行加密和完整性保护。
本发明实施例还公开了一种计算机程序，包括程序指令，当该程序指令被接入网网元执行时，使得该接入网网元可执行上述任意的无线网络鉴权方法。
本发明实施例还公开了一种载有所述的计算机程序的载体。
本发明实施例还公开了一种计算机程序，包括程序指令，当该程序指令 被核心网执行时，使得该核心网可执行上述任意的无线网络鉴权方法。
本发明实施例还公开了一种载有所述的计算机程序的载体。
本发明实施例还公开了一种计算机程序，包括程序指令，当该程序指令被用户设备执行时，使得该用户设备可执行上述任意的无线网络鉴权方法。
本发明实施例还公开了一种载有所述的计算机程序的载体。
在阅读并理解了附图和详细描述后，可以明白其他方面。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
上述实施例中的各装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的各装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以权利要求所述的保护范围为准。
工业实用性
本发明技术方案提供的一种无线网络鉴权方法及核心网网元、接入网网 元、终端，能够有效了降低端到端无线通信的时延。因此本发明具有很强的工业实用性。

Claims (50)

  1. 一种无线网络鉴权方法，包括：
    核心网网元向接入网网元发送鉴权信息与安全控制信息，指示所述接入网网元根据所述鉴权信息与安全控制信息执行对预选用户设备的鉴权或者NAS安全建立过程。
  2. 如权利要求1所述的无线网络鉴权方法，其中，所述鉴权信息与安全控制信息包括下述之一或多项的组合：
    接入网网元可执行对用户设备的鉴权的授权许可；
    接入网网元可执行对用户设备的NAS安全建立的授权许可；
    接入网网元可执行对用户设备的鉴权的授权时间范围；
    接入网网元可执行对用户设备的NAS安全建立的授权时间范围；
    接入网网元可执行鉴权或者NAS安全建立的预选用户设备信息；
    接入网网元用于执行鉴权的预选用户设备所对应的鉴权信息；
    接入网网元用于执行NAS安全建立的预选用户设备所对应的NAS安全建立信息。
  3. 如权利要求2所述的无线网络鉴权方法，其中：所述接入网网元执行NAS安全建立的预选用户设备所对应的NAS安全建立信息是由所述核心网网元通过以下方式获取的：
    从归属用户服务器获取所述预选用户设备所对应的NAS安全的中间密钥；或者
    周期地从归属用户服务器获取所述预选用户设备所对应的NAS安全的中间密钥。
  4. 如权利要求3所述的无线网络鉴权方法，其中：
    所述NAS安全建立信息包括对NAS加密算法和NAS完整性保护算法的选择信息，或者包括授权eNB对NAS加密算法和NAS完整性保护算法进行选择的许可。
  5. 如权利要求3所述的无线网络鉴权方法，其中：
    所述NAS安全建立信息只包含NAS安全模式命令。
  6. 如权利要求1所述的无线网络鉴权方法，其中，所述向接入网网元发送鉴权与安全控制信息的步骤之前，该方法还包括：
    对每个接入网网元内的用户设备的驻留时间以及用户设备进入各个接入网网元的频率进行统计；或者接收每个接入网网元自行统计自己范围内的用户设备的驻留时间以及进入自己覆盖范围的用户设备的进入频率的统计结果；或者接收每个用户设备统计自己驻留在每个接入网网元的时间以及进入每个接入网网元范围的频率的统计结果；
    根据所述统计结果，当所述接入网网元满足以下条件中的至少一个时，确定可授权所述接入网网元执行对用户设备的鉴权或者NAS安全建立过程：
    有用户设备驻留在所述接入网网元范围的时间超过第一预设门限，所述时间为连续的驻留时间或累积的驻留时间；
    同一用户设备进入所述接入网网元范围的频率超过第二预设门限。
  7. 如权利要求1所述的无线网络鉴权方法，其中，所述向接入网网元发送鉴权与安全控制信息的步骤之前，该方法还包括：
    接收到所述接入网网元或用户设备上报的所述接入网网元的标识信息，被上报标识信息的接入网网元为可授权执行对用户设备的鉴权或者NAS安全建立过程的接入网网元；
    其中，被上报标识信息的接入网网元满足以下条件中的至少一个：
    有用户设备驻留在所述接入网网元范围的时间超过第一预设门限，所述时间为连续的驻留时间或累积的驻留时间；
    同一用户设备进入所述接入网网元范围的频率超过第二预设门限。
  8. 如权利要求6或7所述的无线网络鉴权方法，其中
    所述用户设备属于时延敏感的用户设备，或者
    所述用户设备运行时延敏感的业务。
  9. 如权利要求1-7中任一项所述的无线网络鉴权方法，该方法还包括：
    所述核心网网元从归属用户服务器获取所述预选用户设备对应的固定鉴 权秘钥、永久秘钥或中间鉴权向量，作为所述鉴权信息。
  10. 如权利要求1所述的无线网络鉴权方法，所述指示所述接入网网元根据所述鉴权与安全控制信息执行对预选用户设备的鉴权或者NAS安全建立过程的步骤之后，该方法还包括：
    接收所述接入网网元完成的鉴权或者NAS安全建立的所述用户设备所对应的鉴权上下文信息或NAS安全建立的上下文信息；
    其中，所述鉴权上下文信息包括所述用户设备鉴权是否成功的信息和所述用户设备上报的鉴权响应所包含的鉴权值，所述NAS安全建立的上下文信息包括：所述用户设备上报的NAS安全模式完成信息或者NAS安全模式拒绝信息。
  11. 如权利要求1所述的无线网络鉴权方法，该方法还包括：
    所述核心网网元在所述接入网网元完成对用户设备的鉴权或者NAS安全建立过程后，通过NAS消息对已完成鉴权或者NAS安全建立的用户设备进行再次鉴权或再次NAS安全重建。
  12. 如权利要求6或7所述的无线网络鉴权方法，该方法还包括：
    确定授权所述接入网网元执行对用户设备的鉴权或者NAS安全建立过程后，将支持鉴权或者NAS安全建立过程的接入网网元的列表发送给所述预选用户设备。
  13. 如权利要求1-7及10-12中任一项所述的无线网络鉴权方法，该方法还包括：
    周期地从归属用户服务器上获取更新的鉴权与安全控制信息。
  14. 如权利要求1-7及10-12中任一项所述的无线网络鉴权方法，其中，所述鉴权与安全控制信息包括：
    取消接入网网元可执行对用户设备的鉴权许可；
    取消接入网网元可执行用户设备的NAS安全建立的许可。
  15. 一种核心网，包括发送模块，其中
    所述发送模块设置成：向接入网网元发送鉴权信息与安全控制信息，指 示所述接入网网元根据所述鉴权信息与安全控制信息执行对预选用户设备的鉴权或者NAS安全建立过程。
  16. 如权利要求15所述的核心网，其中，所述鉴权信息与安全控制信息包括下述之一或多项的组合：
    接入网网元可执行对用户设备的鉴权的授权许可；
    接入网网元可执行对用户设备的NAS安全建立的授权许可；
    接入网网元可执行对用户设备的鉴权的授权时间范围；
    接入网网元可执行对用户设备的NAS安全建立的授权时间范围；
    接入网网元可执行鉴权或者NAS安全建立的预选用户设备信息；
    接入网网元用于执行鉴权的预选用户设备所对应的鉴权信息；
    接入网网元用于执行NAS安全建立的预选用户设备所对应的NAS安全建立信息，其中，所述NAS安全建立信息包括对NAS加密算法和NAS完整性保护算法的选择信息，或者包括授权eNB对NAS加密算法和NAS完整性保护算法进行选择的许可，或者所述NAS安全建立信息只包含NAS安全模式命令。
  17. 如权利要求15所述的核心网，该核心网还包括统计模块和确定模块，其中
    所述统计模块设置成：对每个接入网网元内的用户设备的驻留时间以及用户设备进入每个接入网网元的频率进行统计；或者接收每个接入网网元自行统计自己范围内的用户设备的驻留时间以及进入自己覆盖范围的用户设备的进入频率的统计结果；或者接收每个用户设备统计自己驻留在每个接入网网元的时间以及进入每个接入网网元范围的频率的统计结果；
    所述确定模块设置成：根据所述统计结果，当所述接入网网元满足以下条件中的至少一个时，确定可授权所述接入网网元执行对用户设备的鉴权或者NAS安全建立过程：有用户设备驻留在所述接入网网元范围的时间超过第一预设门限，所述时间为连续的驻留时间或累积的驻留时间；同一用户设备进入所述接入网网元范围的频率超过第二预设门限，所述预选用户设备驻留在所述接入网网元范围的时间超过所述第一预设门限，所述时间为连续的驻 留时间或累积的驻留时间，或者进入所述接入网网元范围的频率超过所述第二预设门限。
  18. 如权利要求15所述的核心网，该核心网还包括接收模块，其中
    所述接收模块设置成：接收到所述接入网网元或用户设备上报的所述接入网网元的标识信息，被上报标识信息的接入网网元为可授权执行对用户设备的鉴权或者NAS安全建立过程的接入网网元；
    其中，被上报标识信息的接入网网元满足以下条件中的至少一个：有用户设备驻留在所述接入网网元范围的时间超过第一预设门限，所述时间为连续的驻留时间或累积的驻留时间；同一用户设备进入所述接入网网元范围的频率超过第二预设门限，所述预选用户设备驻留在所述接入网网元范围的时间超过所述第一预设门限，所述时间为连续的驻留时间或累积的驻留时间，或者进入所述接入网网元范围的频率超过所述第二预设门限。
  19. 如权利要求15-18任一项所述的核心网，该核心网还包括获取模块，其中
    所述获取模块设置成：从归属用户服务器获取所述预选用户设备对应的固定鉴权秘钥、永久秘钥或中间鉴权向量，作为所述鉴权信息。
  20. 如权利要求15所述的核心网，该核心网还包括接收模块，其中
    所述接收模块设置成：接收所述接入网网元完成的鉴权或者NAS安全建立的所述用户设备所对应的鉴权上下文信息或NAS安全建立的上下文信息；
    其中，所述鉴权上下文信息包括所述用户设备鉴权是否成功的信息和所述用户设备上报的鉴权响应所包含的鉴权值，所述NAS安全建立的上下文信息包括：所述用户设备上报的NAS安全模式完成信息或者NAS安全模式拒绝信息。
  21. 如权利要求15所述的核心网，该核心网还包括处理模块，其中
    所述处理模块设置成：在所述接入网网元完成对用户设备的鉴权或者NAS安全建立过程后，通过NAS消息对已完成鉴权或者NAS安全建立的用户设备进行再次鉴权或再次NAS安全重建。
  22. 如权利要求17或18所述的核心网，该核心网还包括发送模块，其 中
    所述发送模块设置成：确定授权所述接入网网元执行对用户设备的鉴权或者NAS安全建立过程后，将支持鉴权或者NAS安全建立过程的接入网网元的列表发送给所述预选用户设备。
  23. 一种无线网络鉴权方法，包括：
    接入网网元接收鉴权信息与安全控制信息；
    所述接入网网元根据所述鉴权信息与安全控制信息执行对预选用户设备的鉴权或者NAS安全建立过程。
  24. 如权利要求23所述的无线网络鉴权方法，其中，所述鉴权信息与安全控制信息包括下述之一或多项的组合：
    接入网网元可执行对用户设备的鉴权的授权许可；
    接入网网元可执行对用户设备的NAS安全建立的授权许可；
    接入网网元可执行对用户设备的鉴权的授权时间范围；
    接入网网元可执行对用户设备的NAS安全建立的授权时间范围；
    接入网网元可执行鉴权或者NAS安全建立的预选用户设备信息；
    接入网网元用于执行鉴权的预选用户设备所对应的鉴权信息；
    接入网网元用于执行NAS安全建立的预选用户设备所对应的NAS安全建立信息。
  25. 如权利要求24所述的无线网络鉴权方法，其中：所述鉴权信息与安全控制信息包括以下的一种或两种：
    取消接入网网元可执行对用户设备的鉴权许可；
    取消接入网网元可执行用户设备的NAS安全建立的许可。
  26. 如权利要求24所述的无线网络鉴权方法，其中：
    所述鉴权信息为所述预选用户设备对应的固定鉴权秘钥、永久秘钥或中间鉴权向量。
  27. 如权利要求24所述的无线网络鉴权方法，其中：所述接入网网元接 收鉴权与安全控制信息的步骤之前，该方法还包括：
    统计本接入网网元范围内的用户设备的驻留时间以及进入本接入网网元覆盖范围的用户设备的进入频率；
    若有用户设备的驻留时间超过第一预设门限，所述驻留时间为连续的驻留时间或累计的驻留时间，和/或，若同一用户设备进入本接入网网元覆盖范围的频率超过第二预设门限，则上报统计结果和/或本接入网网元的标识，以便核心网将满足所述统计结果的接入网网元确定为可授权执行对用户设备的鉴权或者NAS安全建立过程的接入网网元，或者将接收到的标识对应的接入网网元确定为可授权执行对用户设备的鉴权或者NAS安全建立过程的接入网网元。
  28. 如权利要求27所述的无线网络鉴权方法，该方法还包括：
    所述接入网网元通过广播消息或者专用信令将可授权执行对用户设备的鉴权或者NAS安全建立过程的接入网网元的标识发送给所述预选用户设备。
  29. 如权利要求24所述的无线网络鉴权方法，其中：所述根据所述鉴权与安全控制信息执行对预选用户设备的鉴权的步骤包括：
    所述接入网网元根据所述鉴权与安全控制信息生成鉴权向量；
    向所述预选用户设备发送鉴权要求，携带所述鉴权向量；
    接收所述预选用户设备反馈的鉴权响应，根据所述鉴权向量和所述鉴权响应进行鉴权。
  30. 如权利要求29所述的无线网络鉴权方法，其中，所述接收所述预选用户设备反馈的鉴权响应，根据所述鉴权向量和所述鉴权响应进行鉴权的步骤之后，该方法还包括：
    向核心网上报鉴权上下文信息，所述鉴权上下文信息包括所述用户设备鉴权是否成功的信息和所述用户设备上报的鉴权响应所包含的鉴权值。
  31. 如权利要求29或30所述的无线网络鉴权方法，其中，所述接入网网元根据所述鉴权与安全控制信息生成鉴权向量的步骤包括：
    所述接入网网元根据所述鉴权与安全控制信息中的鉴权信息中的预设用户所对应的固定密钥或者永久密钥，生成对应的中间鉴权向量；或者，
    所述接入网网元接收所述鉴权与安全控制信息中的鉴权信息中的预设用户所对应的中间鉴权向量。
  32. 如权利要求24所述的无线网络鉴权方法，其中，所述接入网网元根据所述鉴权与安全控制信息执行对预选用户设备的NAS安全建立过程的步骤包括：
    所述接入网网元选择NAS安全算法和NAS完整性保护算法，并据此生成所述预选用户设备对应的NAS安全密钥和NAS完整性保护密钥；或者，
    所述接入网网元接收NAS安全算法和NAS完整性保护算法，并据此生成所述预选用户设备对应的NAS安全密钥和NAS完整性保护密钥。
  33. 如权利要求32所述的无线网络鉴权方法，其中，所述接入网网元根据所述鉴权与安全控制信息执行对预选用户设备的NAS安全建立过程的步骤还包括：
    所述接入网网元根据所述NAS安全密钥和NAS完整性保护密钥构造NAS安全模式命令，发送所述NAS安全模式命令给所述预选用户设备；
    所述接入网网元接收所述预选用户设备反馈的NAS安全模式完成信令。
  34. 如权利要求24-30、32、33中的任一项所述的无线网络鉴权方法，其中：所述接入网网元根据所述鉴权与安全控制信息执行对预选用户设备的NAS安全建立过程的步骤之后，包括：
    所述接入网网元向核心网上报NAS安全建立的上下文信息；
    其中，所述NAS安全建立的上下文信息中包含：所述接入网网元生成的NAS安全密钥和NAS完整性保护密钥，所述接入网网元选择的NAS安全算法和NAS完整性保护算法的标识。
  35. 一种接入网网元，包括接收模块和执行模块，其中
    所述接收模块设置成：接收鉴权信息与安全控制信息；
    所述执行模块设置成：根据所述鉴权信息与安全控制信息执行对预选用户设备的鉴权或者NAS安全建立过程。
  36. 如权利要求35所述的接入网网元，该接入网网元还包括统计模块， 其中
    所述统计模块设置成：统计本接入网网元范围内的用户设备的驻留时间以及进入本接入网网元覆盖范围的用户设备的进入频率，若有用户设备的驻留时间超过第一预设门限，所述驻留时间为连续的驻留时间或累计的驻留时间，和/或，若同一用户设备进入本接入网网元覆盖范围的频率超过第二预设门限，则上报统计结果和/或本接入网网元的标识，以便核心网将满足所述统计结果的接入网网元确定为可授权执行对用户设备的鉴权或者NAS安全建立过程的接入网网元，或者将接收到的标识对应的接入网网元确定为可授权执行对用户设备的鉴权或者NAS安全建立过程的接入网网元。
  37. 如权利要求36所述的接入网网元，该接入网网元还包括发送模块，其中
    所述发送模块设置成：通过广播消息或者专用信令将可授权执行对用户设备的鉴权或者NAS安全建立过程的接入网网元的标识发送给所述预选用户设备。
  38. 如权利要求35所述的接入网网元，其中
    所述执行模块设置成按照如下方式根据所述鉴权信息与安全控制信息执行对预选用户设备的鉴权：
    根据所述鉴权信息与安全控制信息生成鉴权向量；
    向所述预选用户设备发送鉴权要求，携带所述鉴权向量；
    接收所述预选用户设备反馈的鉴权响应，根据所述鉴权向量和所述鉴权响应进行鉴权。
  39. 如权利要求38所述的接入网网元，其中，
    所述执行模块设置成按照如下方式根据所述鉴权信息与安全控制信息生成鉴权向量：
    根据所述鉴权信息与安全控制信息中的鉴权信息中的预设用户所对应的固定密钥或者永久密钥，生成对应的中间鉴权向量；或者，
    接收所述鉴权信息与安全控制信息中的鉴权信息中的预设用户所对应的中间鉴权向量。
  40. 如权利要求35所述的接入网网元，其中，
    所述执行模块设置成按照如下方式根据所述鉴权与安全控制信息执行对预选用户设备的NAS安全建立过程：
    选择NAS安全算法和NAS完整性保护算法，并据此生成所述预选用户设备对应的NAS安全密钥和NAS完整性保护密钥；或者，
    接收NAS安全算法和NAS完整性保护算法，并据此生成所述预选用户设备对应的NAS安全密钥和NAS完整性保护密钥。
  41. 如权利要求40所述的接入网网元，其中，
    所述执行模块设置成按照如下方式根据所述鉴权信息与安全控制信息执行对预选用户设备的NAS安全建立过程：
    根据所述NAS安全密钥和NAS完整性保护密钥构造NAS安全模式命令，发送所述NAS安全模式命令给所述预选用户设备；
    接收所述预选用户设备反馈的NAS安全模式完成信令。
  42. 如权利要求35-41中任一项所述的接入网网元，其中，
    所述执行模块还设置成：根据所述鉴权信息与安全控制信息执行对预选用户设备的NAS安全建立过程之后，上报NAS安全建立的上下文信息；
    其中，所述NAS安全建立的上下文信息中包含：所述接入网网元生成的NAS安全密钥和NAS完整性保护密钥，所述接入网网元选择的NAS安全算法和NAS完整性保护算法的标识。
  43. 一种无线网络鉴权方法，包括：
    当用户设备需要和网络侧完成鉴权或NAS建立安全过程时，所述用户设备与被授权可执行鉴权或NAS安全建立的接入网网元进行鉴权或NAS安全建立过程。
  44. 如权利要求43所述的无线网络鉴权方法，其中：所述用户设备与被授权可执行鉴权或NAS安全建立的接入网网元进行鉴权或NAS安全建立过程的步骤包括：
    所述用户设备统计其驻留在每个接入网网元的时间以及进入每个接入网 网元范围的频率，若发现其驻留在一接入网网元范围的时间超过第一预设门限或者其进入一接入网网元范围的频率超过第二预设门限，则将该接收网网元的标识或对应的统计结果上报给核心网，以便核心网将满足所述统计结果的接入网网元确定为可授权执行对用户设备的鉴权或者NAS安全建立过程的接入网网元。
  45. 如权利要求43所述的无线网络鉴权方法，其中：所述用户设备与被授权可执行鉴权或NAS安全建立的接入网网元进行鉴权或NAS安全建立过程的步骤之前，该方法包括：
    所述用户设备接收被授权可执行鉴权或者NAS安全建立的接入网网元的列表。
  46. 如权利要求43-45任一项所述的无线网络鉴权方法，其中，所述用户设备与被授权可执行鉴权或NAS安全建立的接入网网元进行鉴权或NAS安全建立过程的步骤之后，该方法还包括：
    所述用户设备向接入网网元发送NAS安全模式完成信令，所述NAS安全模式完成信令使用所述用户设备算出的NAS安全密钥和NAS完整性保护密钥进行加密和完整性保护。
  47. 一种用户设备，包括处理模块，其中
    所述处理模块设置成：当用户设备需要和网络侧完成鉴权或NAS建立安全过程时，与被授权可执行鉴权或NAS安全建立的接入网网元进行鉴权或NAS安全建立过程。
  48. 如权利要求47所述的用户设备，该用户设备还包括统计模块，其中
    所述统计模块设置成：统计其驻留在每个接入网网元的时间以及进入每个接入网网元范围的频率，若发现其驻留在一接入网网元范围的时间超过第一预设门限或者其进入一接入网网元范围的频率超过第二预设门限，则将该接收网网元的标识或对应的统计结果上报给核心网，以便核心网将满足所述统计结果的接入网网元确定为可授权执行对用户设备的鉴权或者NAS安全建立过程的接入网网元。
  49. 如权利要求47所述的用户设备，该用户设备还包括接收模块，其中
    所述接收模块设置成：接收被授权可执行鉴权或者NAS安全建立的接入网网元的列表。
  50. 如权利要求47-49任一项所述的用户设备，该用户设备还包括发送模块，其中
    所述发送模块设置成：向接入网网元发送NAS安全模式完成信令，所述NAS安全模式完成信令使用所述用户设备算出的NAS安全密钥和NAS完整性保护密钥进行加密和完整性保护。
PCT/CN2016/079200 2015-09-10 2016-04-13 一种无线网络鉴权方法及核心网网元、接入网网元、终端 WO2016180145A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510574963.7A CN106535182A (zh) 2015-09-10 2015-09-10 一种无线网络鉴权方法及核心网网元、接入网网元、终端
CN201510574963.7 2015-09-10

Publications (1)

Publication Number Publication Date
WO2016180145A1 true WO2016180145A1 (zh) 2016-11-17

Family

ID=57248557

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/079200 WO2016180145A1 (zh) 2015-09-10 2016-04-13 一种无线网络鉴权方法及核心网网元、接入网网元、终端

Country Status (2)

Country Link
CN (1) CN106535182A (zh)
WO (1) WO2016180145A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110351725B (zh) * 2018-04-08 2022-08-09 华为技术有限公司 通信方法和装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101594607A (zh) * 2008-05-27 2009-12-02 华为技术有限公司 分组数据网络网关信息的维护方法、系统及设备
CN101640886A (zh) * 2008-07-29 2010-02-03 上海华为技术有限公司 鉴权方法、重认证方法和通信装置
US20130267203A1 (en) * 2012-04-05 2013-10-10 Zu Qiang Sending plmn id at a shared wifi access
WO2013181847A1 (zh) * 2012-06-08 2013-12-12 华为技术有限公司 一种无线局域网接入鉴权方法、设备及系统
CN103945379A (zh) * 2013-01-23 2014-07-23 上海贝尔股份有限公司 一种在接入网中实现接入认证和数据通信的方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103313239B (zh) * 2012-03-06 2018-05-11 中兴通讯股份有限公司 一种用户设备接入融合核心网的方法及系统
TWI531257B (zh) * 2013-07-16 2016-04-21 財團法人資訊工業策進會 無線通訊系統及其認證方法
CN103596176B (zh) * 2013-10-18 2016-10-12 北京北方烽火科技有限公司 基于演进分组系统的小规模核心网的鉴权方法及装置
CN104661217A (zh) * 2015-02-09 2015-05-27 哈尔滨工业大学深圳研究生院 基于td-lte网络的鉴权和密钥衍生方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101594607A (zh) * 2008-05-27 2009-12-02 华为技术有限公司 分组数据网络网关信息的维护方法、系统及设备
CN101640886A (zh) * 2008-07-29 2010-02-03 上海华为技术有限公司 鉴权方法、重认证方法和通信装置
US20130267203A1 (en) * 2012-04-05 2013-10-10 Zu Qiang Sending plmn id at a shared wifi access
WO2013181847A1 (zh) * 2012-06-08 2013-12-12 华为技术有限公司 一种无线局域网接入鉴权方法、设备及系统
CN103945379A (zh) * 2013-01-23 2014-07-23 上海贝尔股份有限公司 一种在接入网中实现接入认证和数据通信的方法

Also Published As

Publication number Publication date
CN106535182A (zh) 2017-03-22

Similar Documents

Publication Publication Date Title
US11178584B2 (en) Access method, device and system for user equipment (UE)
EP2549785B1 (en) Method and network side entity for authenticating communication devices
JP6632713B2 (ja) 直接通信キーの確立のための方法および装置
JP2022502908A (ja) Ｎａｓメッセージのセキュリティ保護のためのシステム及び方法
CN102318386B (zh) 向网络的基于服务的认证
US9516501B2 (en) Authentication in a communications system
US20120039472A1 (en) Method and device for establishing a security mechanism for an air interface link
CN106507348B (zh) 一种lte系统中ue接入核心网epc的方法和装置
WO2012174959A1 (zh) 一种机器到机器通信中组认证的方法、系统及网关
CN109788474A (zh) 一种消息保护的方法及装置
US10897707B2 (en) Methods and apparatus for direct communication key establishment
WO2011131052A1 (zh) 机器对机器的通信系统中基于组的认证方法及系统
US20190274039A1 (en) Communication system, network apparatus, authentication method, communication terminal, and security apparatus
JP5888715B2 (ja) モバイル端末のハンドオーバを実行する方法及びシステム、並びに無線セルラ通信ネットワークにおいて用いるように意図されたモバイル端末
CN110383868A (zh) 无线通信系统中的非活动状态安全支持
CN113498057A (zh) 通信系统、方法及装置
JP2023080266A (ja) モビリティ管理ノード、ユーザ機器、及びこれらの方法
US20220360985A1 (en) Ue rejection handling when onboarding a network based on default ue credentials
WO2016180145A1 (zh) 一种无线网络鉴权方法及核心网网元、接入网网元、终端
WO2022237778A1 (zh) 异常检测的方法、通信装置及通信系统
JP7131721B2 (ja) Ａｍｆノード及びその方法
US11576232B2 (en) Method for establishing a connection of a mobile terminal to a mobile radio communication network and communication network device
WO2021026927A1 (zh) 通信方法和相关设备
US20180343559A1 (en) Method and device for obtaining user equipment identifier, and method and device for sending user equipment identifier
EP4203392B1 (en) Authentication support for an electronic device to connect to a telecommunications network

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16791995

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16791995

Country of ref document: EP

Kind code of ref document: A1