WO2017000272A1 - 一种无线系统接入控制方法及装置 - Google Patents

一种无线系统接入控制方法及装置 Download PDF

Info

Publication number
WO2017000272A1
WO2017000272A1 PCT/CN2015/083027 CN2015083027W WO2017000272A1 WO 2017000272 A1 WO2017000272 A1 WO 2017000272A1 CN 2015083027 W CN2015083027 W CN 2015083027W WO 2017000272 A1 WO2017000272 A1 WO 2017000272A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
message
authentication code
code
data
Prior art date
Application number
PCT/CN2015/083027
Other languages
English (en)
French (fr)
Inventor
罗正华
谢汉雄
徐燕
张颖哲
张晶晶
Original Assignee
海能达通信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 海能达通信股份有限公司 filed Critical 海能达通信股份有限公司
Priority to US15/738,326 priority Critical patent/US10869198B2/en
Priority to CN201580000297.4A priority patent/CN105519028B/zh
Priority to EP15896803.2A priority patent/EP3319267B1/en
Priority to PCT/CN2015/083027 priority patent/WO2017000272A1/zh
Publication of WO2017000272A1 publication Critical patent/WO2017000272A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L1/00—Arrangements for detecting or preventing errors in the information received
    • H04L1/004—Arrangements for detecting or preventing errors in the information received by using forward error control
    • H04L1/0056—Systems characterized by the type of code used
    • H04L1/0061—Error detection codes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/08—Error detection or correction by redundancy in data representation, e.g. by using checking codes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a wireless system access control method and apparatus.
  • the trunking communication system implements access control mainly by verifying the validity of the terminal, so as to avoid the problem that illegal terminals occupy resources and affect normal communication between terminals.
  • the specific implementation process of the access control method includes: the system sends challenge information to the terminal under preset conditions; after receiving the challenge information, the terminal first calculates an authentication code according to an authentication algorithm agreed with the system, and then the authentication code The weight code is sent to the system; and the system first calculates the authentication code according to the agreed authentication algorithm, and then determines whether the received authentication code is the same as the authentication code calculated by itself, and if so, the system determines that the terminal is legal, otherwise, The system determines that the terminal is illegal.
  • the system will perform the above-mentioned legality verification on the terminal only when the terminal just enters the network or under the preset conditions of the terminal carrying a specific service. Once the terminal is verified to be legal, the system records the terminal ID and Legal situation.
  • the prior art does not give a related access control scheme in both the through mode and the repeater mode.
  • the active authentication mode of the system requires multiple interactions between the system and the terminal side, resulting in a relatively large air interface overhead.
  • the system may be permanent or in a segment.
  • the terminal is legally recorded in the time. Under this mechanism, the illegal terminal sets the same ID as the legal terminal to illegally occupy resources and affect communication.
  • the present invention provides a wireless system access control method and apparatus.
  • the method actively sends an authentication code to trigger the receiver to perform real-time verification on the legitimacy of the sender.
  • the method can realize real-time authentication by means of the terminal actively initiating the authentication, so as to ensure that the illegal terminal consumes resources in any communication mode. Improve the security of communication between terminals.
  • a radio access control method which is applied to a sender terminal side, and the method includes:
  • the terminal When transmitting the control type data, the terminal generates an authentication code according to a protocol reserved by the receiver; the terminal combines the control type data, the authentication code, and the corresponding CRC check code into a message; the terminal sends the message to the receiver. Sending the message, so that the receiver can perform CRC check on the received message first. After the verification is passed, the authentication code is generated according to the reserved protocol, and the generated authentication code and the received authentication code are compared. The same, if yes, the received control class data is parsed, and if not, the received control class data is discarded.
  • a method for wireless system access control is provided, which is applied to a receiver, and the method includes:
  • the message carries control data, an authentication code, and a corresponding CRC check code; performing CRC check on the message; after the verification is passed, generating an authentication code according to a protocol reserved with the sender And comparing whether the generated authentication code and the authentication code in the received message are the same, if yes, parsing the control class data in the received message, and if not, discarding the received control class data.
  • a wireless access control apparatus for a sender terminal, the apparatus comprising:
  • the authentication code generating unit is configured to generate an authentication code according to a protocol reserved by the receiver when transmitting the control type data
  • the message generating unit is configured to combine the control class data, the authentication code and the corresponding CRC check code into a message sending unit, configured to send the message to the receiver, so that the receiver can perform CRC check on the received message first, and then generate an authentication code according to the reserved protocol, and compare and generate the generated message. Whether the authentication code and the received authentication code are the same, if yes, parsing the received control class data, and if not, discarding the received control class data.
  • a device for access control of a wireless system which is applied to a terminal side of a receiver, and the device includes:
  • the message receiving unit is configured to receive a message sent by the sender, where the message carries control data, an authentication code, and a corresponding CRC check code; a CRC check unit is configured to perform CRC check on the message; Afterwards, the authentication code generating unit and the authentication unit are triggered; the authentication code generating unit is configured to generate an authentication code according to a protocol reserved by the sender; and the authentication unit is configured to compare the generated authentication code with the received message. Whether the authentication code is the same, if yes, parsing the control class data in the received message, and if not, discarding the received control class data.
  • an apparatus for wireless system access control comprising at least one processor, at least one network interface or other communication interface, a memory, and at least one communication bus; the memory for storing a program instruction, the processor being configured to perform the following steps according to the program instruction:
  • the authentication code is generated according to the protocol reserved by the receiver; the control class data, the authentication code and the corresponding CRC check code are combined into a message; the message is sent to the receiver to enable the receiver to enable the receiver to First, the received message is CRC checked. After the verification is passed, the authentication code is generated according to the reserved protocol, and the generated authentication code is compared with the received authentication code. If yes, the received message is received. The control class data is parsed, and if not, the received control class data is discarded.
  • an apparatus for wireless system access control comprising at least one processor, at least one network interface or other communication interface, a memory, and at least one communication bus; the memory for storing a program instruction, the processor being configured to perform the following steps according to the program instruction:
  • the message carries control data, an authentication code, and a corresponding CRC check code; performing CRC check on the message; after the verification is passed, generating an authentication code according to a protocol reserved with the sender And comparing whether the generated authentication code and the authentication code in the received message are the same, if yes, parsing the control class data in the received message, and if not, discarding the received control class data.
  • the terminal when transmitting the control type data, the terminal first generates an authentication code according to a protocol reserved with the receiver; and then combines the control type data, the authentication code, and the corresponding CRC check code into a message; The receiver sends the message, so that the receiver can perform CRC check on the received message first. After the verification is passed, the authentication code is generated according to the reserved protocol, and the generated authentication code and the received authentication are compared. Whether the codes are the same, if yes, parsing the received control class data, and if not, discarding the received control class data. The terminal actively sends the authentication code to implement the real-time authentication for the terminal to perform the communication service.
  • the illegal terminal only has the same ID as the legal terminal, but cannot know that the terminal actively initiates the authentication mechanism, and cannot The invention can prevent the illegal user from occupying resources and ensure the security of the communication.
  • the terminal since the terminal sends the authentication code while transmitting the control type information, the entire authentication process is The control class message processing is compatible, eliminating the need for separate signaling and overhead.
  • FIG. 1 is a first flowchart of a method for controlling radio access of a sender terminal according to the present invention
  • FIG. 2 is a second flowchart of a method for controlling radio access of a sender terminal according to the present invention
  • FIG. 3 is a schematic diagram of data transformation and message composition provided by the present invention.
  • FIG. 4 is a flowchart of a method for controlling radio access of a receiver terminal according to the present invention.
  • FIG. 5 is a first structural diagram of a radio access control apparatus of a sender terminal according to the present invention.
  • FIG. 6 is a second structural diagram of a radio access control apparatus of a sender terminal according to the present invention.
  • FIG. 7 is a structural diagram of a radio access control apparatus of a receiver terminal according to the present invention.
  • FIG. 8 is a schematic diagram showing the hardware configuration of a radio access control apparatus of a sender terminal according to the present invention.
  • Fig. 9 is a block diagram showing the hardware configuration of a radio access control apparatus of a receiver terminal of the present invention.
  • FIG. 1 is a first flowchart of a method for controlling a radio access of a sender of a terminal according to the present invention.
  • the method is applied to a sender terminal, and the method can be applied to a transit mode, a pass-through mode, and a cluster mode, as shown in FIG.
  • the method can include:
  • the terminal here refers to any device with a sending function in the private network, such as a walkie-talkie.
  • the control class data here is the data carried in the control message of the prior art.
  • the control class message generally includes two parts: data and CRC (Cyclic Redundancy Check), and the data generally includes the source ID and the destination ID.
  • Information such as the service identifier, when the terminal initiates any communication service, it needs to send a control class message first, so that the receiver performs CRC verification on the control type message, and the subsequent service data is processed correspondingly after the verification is passed.
  • the present invention utilizes this CRC verification mechanism to carry an authentication code when transmitting a control type message to implement real-time verification of the legitimacy of the sender terminal.
  • the private network communication system supports three communication modes: a transit mode, a through mode, and a cluster mode.
  • the following describes the three communication modes and the specific conditions of implementing the embodiments in the three communication modes.
  • the sender terminal communicates with the receiver terminal through the base station.
  • the solution of the present invention is implemented, and the receiver involved in this step may be a base station of the system or a receiver terminal.
  • the sender terminal In the transit mode, the sender terminal needs to communicate with the receiver terminal through the relay function of the relay station.
  • the receiving party involved in this step may be a relay station or a receiver terminal.
  • the sender terminal and the receiver terminal directly communicate, and the solution of the present invention is implemented in this mode, and the receiver involved in this step can only be the receiver terminal.
  • This step can be implemented in the following four ways:
  • the terminal when transmitting the control type data, the terminal generates an authentication code according to the data set in the protocol reserved with the receiver.
  • the sender and the receiver need to agree on the protocol in advance, and set the data as the authentication code in the protocol, so that the sender only needs to directly use the data set in the protocol as the authentication code.
  • the terminal when transmitting the control type data, the terminal performs operation on the control type data to generate an authentication code according to the authentication algorithm and the authentication key set in the protocol reserved by the receiver.
  • the sending and receiving parties need to pre-agreed the authentication algorithm, the authentication key, and which data to operate, and use the operation result as the authentication code.
  • the authentication key Not transmitted through the air interface. For example, in the protocol, it is agreed to perform calculation on all control type data, or may be performed on control type data of a specific bit.
  • the terminal when transmitting the control type data, performs an operation on the received authentication random number to generate an authentication code according to the authentication algorithm and the authentication key set in the protocol reserved by the receiver;
  • the weight random number is an authentication random number broadcast by the base station or the relay station according to a preset rule.
  • the sender and the receiver need to pre-agreed the authentication algorithm, the authentication key, and perform operations according to the authentication random number, and use the operation result as the authentication code.
  • the sender and the receiver need to receive in real time.
  • the authentication random number broadcast by the base station or the relay station according to a certain rule.
  • the terminal when transmitting the control type data, the terminal performs the operation on the received authentication random number and the control type data according to the authentication algorithm and the authentication key set in the protocol reserved by the receiver to generate an authentication.
  • the authentication random number is an authentication random number broadcast by the base station or the relay station according to a preset rule.
  • the sender and the receiver need to pre-agreed the authentication algorithm, the authentication key, and perform operations according to the authentication random number and the data in the message, and use the operation result as the authentication code, and at the same time, the sender and the The receiver needs to receive the authentication random broadcast of the base station or the relay station according to a certain law in real time. number.
  • the terminal combines control class data, an authentication code, and a corresponding CRC check code into a message.
  • the present invention proposes the following two implementation manners on how to encrypt the authentication code into the control class message.
  • the terminal stores the authentication code by occupying the control data bit in the message, and generates a CRC check code according to the control class data and/or the authentication code, and controls the class data, the authentication code, and the CRC check.
  • the codes are combined into a message.
  • the terminal In the first mode, the terminal only generates one message, which can be understood as carrying the authentication code in the original control class message, so as to implement the authentication mechanism in the CRC check mechanism.
  • the terminal In the second mode, the terminal generates a CRC check code of the control type data according to the control type data, combines the CRC check code of the control type data and the control type data into a message, and generates a CRC check of the authentication code according to the authentication code. The code combines the CRC of the authentication code and the authentication code into a message.
  • the terminal In the second mode, the terminal generates two messages, one is a traditional control type message, and the other is a message carrying an authentication code.
  • the message carrying the authentication code can be placed. It is sent before the control class message, or it can be sent after it.
  • the terminal stores the authentication code by occupying the preset bit in the source ID and the destination ID of the message, and generates a CRC check code according to the control class data and/or the authentication code, and the control class data, The authentication code and the CRC check code are combined into a message.
  • the specific method (1) is illustrated.
  • the source ID and the destination ID are respectively set to 24 bits.
  • the inventor found that the general private network communication carries a maximum of several thousand to 10,000 terminals, and in most cases only hosts hundreds to thousands of terminals, and therefore the inventor
  • the compression source ID and the destination ID occupy the number of bits to make up the idle bit position to store the authentication code.
  • the original 24 bits of the source ID and the destination ID can be compressed into 16 bits, and the 16-bit ID bit can already support 65535. The user can fully meet the communication requirements, and the 16-bit space vacated after compression is used to store the authentication code.
  • 16-bit idle bits are only exemplary. In a specific implementation, specific idle bits can be properly set according to specific application scenarios.
  • the terminal stores the authentication code by occupying the source ID bit in the message, generates a CRC check code according to the control type data and/or the authentication code, and controls the class data, the authentication code and the CRC check.
  • the codes are combined into a message.
  • the terminal stores the authentication code by occupying the preset bit of the data in the message, and generates a CRC check code according to the control type data and/or the authentication code, and the control class data, the authentication code and the CRC are generated.
  • the checksums are combined into a message.
  • the CRC check code is generated according to the control type data and/or the authentication code mentioned in the above three specific manners.
  • the CRC check code may be generated only according to the control type data, or may be based only on the The weight code generates a CRC check code.
  • the most preferred way is to generate a CRC check code according to the control class data and the authentication code.
  • S103 The terminal sends the message to the receiver, so that the receiver can perform CRC check on the received message first, and after the verification is passed, generate an authentication code according to the reserved protocol, and compare the generated authentication code with the receiving. Whether the obtained authentication code is the same, if yes, parsing the received control class data, and if not, discarding the received control class data.
  • the authentication code when the terminal transmits the control type data, the authentication code is generated according to the protocol reserved by the receiver; the terminal combines the control class data, the authentication code, and the corresponding CRC check code.
  • the message is sent by the terminal to the receiver, so that the receiver can perform CRC check on the received message first.
  • the authentication code is generated according to the reserved protocol, and the generated authentication code is compared. Whether the received authentication code is the same, if yes, parsing the received control class data, and if not, discarding the received control class data.
  • the terminal actively sends the authentication code to implement the real-time authentication for the terminal to perform the communication service.
  • the illegal terminal only has the same ID as the legal terminal, but cannot know that the terminal actively initiates the authentication mechanism, and cannot The invention can prevent the illegal user from occupying resources and ensure the security of the communication.
  • the terminal since the terminal sends the authentication code while transmitting the control type information, the entire authentication process is The control class message processing is compatible, eliminating the need for separate signaling and overhead.
  • FIG. 2 is a second flowchart of a method for controlling a radio access of a sender of a terminal according to the present invention.
  • the method is applied to a sender terminal, and the method can be applied to a transit mode, a pass-through mode, and a cluster mode.
  • FIG. 2 and FIG. The difference between 1 is that after the terminal combines the control class data, the authentication code and the corresponding CRC check code into a message, a data transformation process is added, and the data transformed new data and the original data CRC check code are transformed. The message is finally sent to the recipient. This increases the complexity of the entire CRC checksum authentication and further ensures communication security.
  • the method may include:
  • the terminal When transmitting the control type data, the terminal generates an authentication code according to a protocol reserved by the receiver.
  • the terminal combines control class data, an authentication code, and a corresponding CRC check code into a message.
  • S201 and S202 in this embodiment are the same as S101 and S102 in Embodiment 1 above, and may be referred to the corresponding descriptions above, and details are not described herein again.
  • the terminal performs data transformation on the data part in the message according to a conversion algorithm reserved by the receiver, and combines the transformed data with the CRC check code in the message to generate a transformed message.
  • a message can be regarded as being composed of a CRC check portion and a data portion.
  • the rest is the data portion.
  • the terminal If the terminal generates a message according to the first manner mentioned in S102 in Embodiment 1 above, and generates a message including control class data, an authentication code, and a CRC check code, the data portion in the message includes control. Class data and authentication code.
  • the terminal If the terminal generates a message according to the second manner mentioned in S102 in Embodiment 1 above, two messages are generated, the data portion in one message is only an authentication code, and the data portion in the other message is only control data. .
  • the data A is control type data
  • the data B includes control type data and an authentication code
  • the message B and the CRC are combined into a message in the above step 202.
  • data C contains the transformed control class data and the transformed authentication code
  • the CRC remains unchanged.
  • Data C and CRC are combined into a transform message.
  • the transform algorithm herein may be an encryption algorithm or a mathematical algorithm.
  • the transform algorithm and the corresponding inverse transform algorithm are pre-stored on the sender and the receiver, or the mathematical algorithm and the mathematical operation parsing algorithm are stored in advance.
  • the converted data sent by the sender is guaranteed, and the receiver can parse according to the reservation method.
  • control class data and the authentication code in the message may be combined with the CRC check code and/or the transformed random number in the message, and the data is converted according to the reserved transform algorithm by using the transform key reserved by the receiver. Transform processing.
  • the transformed random number is broadcasted by the base station and the relay station according to a preset rule, where the transformed random number may be the same as or different from the above-mentioned authentication random number.
  • the transformation key here may be the same key as the above authentication key, or may be different.
  • S204 The terminal sends the transform message to the receiver, so that the receiver can perform inverse transform on the data part in the received transform message according to the reserved transform algorithm, and then perform CRC check according to the inverse transformed data, and the check succeeds. Then, the authentication code is generated according to the reserved protocol, and the generated authentication code is compared with the received authentication code. If yes, the received control data is parsed, and if not, the received data is discarded. Control class data.
  • the terminal actively performs the real-time authentication for the communication service of the terminal by the terminal actively transmitting the authentication code
  • the illegal terminal only has the same ID as the legal terminal, but cannot know the terminal.
  • the authentication mechanism is initiated, and the authentication code generation and transmission mode cannot be known. Therefore, the present invention can prevent the illegal user from occupying resources and ensure the security of the communication; in addition, since the terminal sends the authentication information while transmitting the authentication information
  • the code makes the entire authentication process compatible with the control class message processing process, without the need for separate signaling and overhead.
  • the data transformation is performed on the data portion except the CRC before the message is sent, which increases the complexity of the CRC check, thereby increasing the complexity of the entire authentication process and further improving the reliability of the authentication.
  • FIG. 4 is a second flowchart of a method for controlling a radio access of a sender of a terminal according to the present invention.
  • the method is applied to a receiver device, and the method can be applied to a transit mode, a pass-through mode, and a cluster mode.
  • the receiving device may be different.
  • the receiving party in the transit mode, the receiving party may be a relay station or a terminal; in the cluster mode, the receiving party may be a base station or a terminal; and in the direct mode, the receiving party It can only be a terminal. Therefore, in this embodiment, the specific execution subject (receiver) is not limited, and the execution subject is determined according to a specific application scenario.
  • the method may include:
  • S401 Receive a message sent by a sender, where the message carries control class data, an authentication code, and a corresponding CRC check code.
  • the implementation of the embodiment is based on the fact that the sender and the receiver have pre-agreed the protocol, and the protocol and the authentication mechanism of the embodiment are set in the protocol, and the receiver can perform the service under the mechanism.
  • the identity of the sender is authenticated, and if the authentication is passed, it is determined to send The party is legal and continues to process the received data; if the authentication fails, it is determined that the sender is illegal and directly discards the received data, thus preventing the receiver from receiving the call of the illegal terminal and enhancing the security of the communication.
  • the receiver Upon receiving the control class message sent by the sender, the receiver first performs a CRC check.
  • the verification process is specifically as follows:
  • the receiving party generates a CRC check code according to the data in the message according to the protocol reserved by the sender, and determines whether the generated CRC check code is the same as the CRC check code in the message. If yes, the check passes.
  • the rule for generating the CRC check code in the protocol reserved by the receiver and the sender is that the CRC check code is calculated according to the CRC generation algorithm according to the control type data; or, according to the preset fixed data, according to the CRC generation algorithm.
  • control class message specified in the protocol reserved by the sender and the receiver is a change message
  • CRC check on the message is specifically:
  • the data portion of the received transformed message is inverse transformed according to a transform algorithm reserved with the sender, and then the CRC check is performed according to the inverse transformed data.
  • the authentication code is generated according to a protocol reserved with the sender.
  • S404 Compare whether the generated authentication code and the authentication code in the received message are the same. If yes, parse the control class data in the received message, and if not, discard the received control class data.
  • the above CRC check pass does not completely determine the identity of the sender, and further authentication is required.
  • the authentication process here still needs to perform the corresponding steps according to the protocol reserved with the sender, which can be understood as only the legitimate sender.
  • the corresponding control message can be sent according to the reserved protocol, and the illegal sender does not know the content of the reserved protocol, so the receiver can perform corresponding checksum authentication through the reserved protocol to identify the illegal.
  • the sender then decides whether to perform subsequent parsing on the received data.
  • the processing of the receiver may include the following forms:
  • the authentication random number is broadcast by the base station or the relay station according to a preset rule. Authentication random number; or,
  • the authentication random number is a base station or a relay station according to the base station or the relay station.
  • the receiver when receiving the control type message sent by the sender, the receiver first performs CRC check on the message according to the protocol reserved by the sender, and when passing the check, further The authentication process of identity legality is performed, and the identity of the sender is guaranteed by double verification, and the receiver is only allowed to receive the call that is truly his own.
  • the invention limits the occupation of resources by the illegal terminal from the perspective of the receiver, and ensures the security of the communication.
  • the receiver performs CRC check and authentication processing as long as it receives the control class message, ensuring real-time effective authentication for all communication services.
  • the authentication process is compatible with the CRC check process, and is no longer needed. Additional signaling overhead saves on authentication costs.
  • FIG. 5 is a first structural diagram of a radio access control apparatus of a sender terminal according to the present invention.
  • the apparatus shown in FIG. 5 can be applied to a sender terminal.
  • the apparatus may include:
  • the authentication code generating unit 501 is configured to generate an authentication code according to a protocol reserved by the receiver when transmitting the control type data
  • the message generating unit 502 is configured to use the control class data, the authentication code, and the corresponding CRC check code.
  • a message synthesizing message 503, configured to send the message to the receiver, so that the receiver can perform CRC check on the received message first, and then generate an authentication code according to the reserved protocol, and then Comparing the generated authentication code with the received authentication code, if yes, parsing the received control class data, and if not, discarding the received control class data.
  • the authentication code generating unit includes: an authentication code first generating subunit, configured to generate an authentication code according to data set in a protocol reserved by the receiver when transmitting the control type data; or, an authentication code a second generation subunit, configured to: when the control type data is sent, perform operation on the control type data to generate an authentication code according to an authentication algorithm and an authentication key set in a protocol reserved by the receiver; or, the authentication The third generation sub-unit is configured to perform an operation on the received authentication random number to generate an authentication code according to an authentication algorithm and an authentication key set in a protocol reserved by the receiver when transmitting the control type data.
  • the authentication random number is an authentication random number broadcast by the base station or the relay station according to a preset rule; or the fourth generation sub-unit of the authentication code is used in the agreement with the receiver when transmitting the control type data.
  • the set authentication algorithm and the authentication key perform operations on the received authentication random number and the control type data to generate an authentication code; the authentication random number is an authentication random number broadcast by the base station or the relay station according to a preset rule. number.
  • the message generating unit comprises:
  • the message first generating sub-unit is configured to store the authentication code by occupying the control data bit in the message, generate a CRC check code according to the control class data and/or the authentication code, and control the class data, the authentication code, and The CRC check code is combined into a message; or the message second generation subunit is configured to generate a CRC check code of the control class data according to the control class data, and combine the CRC check code of the control class data and the control class data into a message. And generating a CRC check code of the authentication code according to the authentication code, and combining the CRC check code of the authentication code and the authentication code into a message.
  • the message first generating sub-unit is specifically configured to store the authentication code by occupying the source ID and the preset bit in the destination ID, and generate a CRC check code according to the control class data and/or the authentication code. Combining control class data, authentication code, and CRC check code into a message; or,
  • the message first generating sub-unit is specifically configured to store the authentication code by occupying the bit of the source ID in the message, generate a CRC check code according to the control class data and/or the authentication code, and control the class data, The authentication code and the CRC check code are combined into a message; or,
  • the message first generating sub-unit is configured to store the authentication code by occupying a preset bit of the data in the message, and generate a CRC check code according to the control class data and/or the authentication code, and the control class is The data, the authentication code and the CRC check code are combined into a message.
  • FIG. 6 is a second structural diagram of a radio access control apparatus of a sender terminal according to the present invention.
  • the apparatus shown in FIG. 6 adds a transform unit to the apparatus of FIG. 5, and the apparatus specifically includes:
  • the authentication code generating unit 601 is configured to generate an authentication code according to a protocol reserved by the receiver when transmitting the control type data.
  • the message generating unit 602 is configured to combine the control class data, the authentication code, and the corresponding CRC check code into a message.
  • the transforming unit 603 is configured to perform data transformation on the data part in the message generated by the message unit according to a conversion algorithm reserved by the receiver, and combine the transformed data and the CRC check code in the message to generate a transformed message.
  • the message sending unit 604 is configured to send a transform message to the receiver, so that the receiver can perform inverse transform on the data part in the received transform message according to the reserved transform algorithm, and perform CRC check according to the inverse transformed data. After the verification is passed, the authentication code is generated according to the reserved protocol, and the generated authentication code is compared with the received authentication code. If yes, the received control data is parsed, if not, discarded. Control class data received.
  • FIG. 7 is a structural diagram of a radio access control apparatus of a receiver terminal according to the present invention. As shown in FIG. 7, the apparatus may include:
  • the message receiving unit 701 is configured to receive a message sent by the sender, where the message carries control class data, an authentication code, and a corresponding CRC check code.
  • the CRC check unit 702 is configured to perform CRC check on the message; after the verification is passed, the authentication code generating unit and the authentication unit are triggered;
  • the authentication code generating unit 703 is configured to generate an authentication code according to a protocol reserved by the sender;
  • the authenticating unit 704 is configured to compare whether the generated authentication code and the authentication code in the received message are the same. If yes, parse the control class data in the received message, and if not, discard the received control. Class data.
  • the CRC check unit is specifically configured to generate a CRC check code according to the data in the message according to a protocol reserved by the sender, and determine whether the generated CRC check code is the same as the CRC check code in the message, if Yes, the verification passed.
  • the authentication code generating unit includes:
  • the first generation sub-unit of the authentication code is configured to generate an authentication code according to the data set in the protocol reserved by the sender;
  • the second generation sub-unit of the authentication code is configured to perform operation on the control type data to generate an authentication code according to an authentication algorithm and an authentication key set in a protocol reserved by the sender;
  • the third generation sub-unit of the authentication code is configured to perform an operation on the received authentication random number to generate an authentication code according to the authentication algorithm and the authentication key set in the protocol reserved by the sender; the authentication randomization The number is an authentication random number broadcast by the base station or the relay station according to a preset rule; or
  • the fourth generation sub-unit of the authentication code is configured to perform an operation on the received authentication random number and the control type data to generate an authentication code according to the authentication algorithm and the authentication key set in the protocol reserved by the sender;
  • the authentication random number is an authentication random number broadcast by the base station or the relay station according to a preset rule.
  • the terminal receives the message sent by the sender as a transform message
  • the CRC check unit is specifically configured to: according to a transformation algorithm reserved by the sender, the received change The data part of the message is inversely transformed, and then the CRC is checked according to the inverse transformed data.
  • the terminal actively performs the real-time authentication for the communication service of the terminal by the terminal actively transmitting the authentication code
  • the illegal terminal only has the same ID as the legal terminal, but cannot know the terminal.
  • the authentication mechanism is initiated, and the authentication code generation and transmission mode cannot be known. Therefore, the present invention can prevent the illegal user from occupying resources and ensure the security of the communication; in addition, since the terminal sends the authentication information while transmitting the authentication information
  • the code makes the entire authentication process compatible with the control class message processing process, without the need for separate signaling and overhead.
  • the data transformation is performed on the data portion except the CRC before the message is sent, which increases the complexity of the CRC check, thereby increasing the complexity of the entire authentication process and further improving the reliability of the authentication.
  • the embodiment of the present invention further provides a hardware configuration of a wireless terminal control device of a sender terminal and a receiver.
  • the wireless terminal control device of the sender terminal and the receiver has the same hardware configuration, and may include at least one processor (for example, a CPU), at least one network interface or other communication interface, a memory, and at least one communication bus for implementing the devices. Communication between the connections.
  • the processor is for executing an executable module, such as a computer program, stored in the memory.
  • the memory may include a high speed random access memory (RAM), and may also include a non-volatile memory such as at least one disk memory.
  • the communication connection between the system gateway and at least one other network element is implemented by at least one network interface (which may be wired or wireless), and an Internet, a wide area network, a local network, a metropolitan area network, etc. may be used.
  • program instructions are stored in a memory of a wireless access control device of a sender terminal, and the program instructions may be executed by a processor, wherein the program instructions may include an authentication code generating unit and a message generating unit. And the message sending unit may also include a transforming unit.
  • the program instructions may include an authentication code generating unit and a message generating unit.
  • the message sending unit may also include a transforming unit.
  • program instructions are stored in a memory of a wireless access control device of a receiver, and the program instructions may be executed by a processor, where the program instructions may include a message receiving unit 701, a CRC check unit 702, The authentication code generating unit 703 and the authenticating unit 704, the specific implementation of each unit can be referred to the corresponding unit disclosed in FIG. 7, and details are not described herein again.
  • the terminal device not only has a transmitting function but also a receiving function, so the terminal device can simultaneously have the devices described in FIG. 8 and FIG. 9 above, and of course, only some transmitting functions or receiving are implemented.
  • the functional terminal device can be provided with the above-described device of Fig. 8 or Fig. 9 alone.
  • the present invention is applicable to a wide variety of general purpose or special purpose computing system environments or configurations.
  • the invention may be described in the general context of computer-executable instructions executed by a computer, such as a program module.
  • program modules include routines, programs, objects, components, data structures, and the like that perform particular tasks or implement particular abstract data types.
  • the invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network.
  • program modules can be located in both local and remote computer storage media including storage devices.
  • relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply such entities or operations. There is any such actual relationship or order between them.
  • the term “comprises” or “comprises” or “comprises” or any other variations thereof is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device that comprises a plurality of elements includes not only those elements but also Other elements, or elements that are inherent to such a process, method, item, or device. An element that is defined by the phrase “comprising a " does not exclude the presence of additional equivalent elements in the process, method, item, or device that comprises the element.
  • the device embodiment since it basically corresponds to the method embodiment, reference may be made to the partial description of the method embodiment.
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment. Those of ordinary skill in the art can understand and implement without any creative effort.

Abstract

本发明提供了一种无线接入控制方法及装置，应用于发送方终端的方法包括：终端在发送控制类数据时，按照与接收方预约的协议生成鉴权码；终端将控制类数据、鉴权码以及对应的CRC校验码组合成消息；终端向接收方发送该消息，以使接收方能够先对接收到的消息进行CRC校验，校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。因此本发明通过终端主动发起鉴权的方式，可以实现实时鉴权，以保证在任何通信模式下，避免非法终端占用资源的问题，提高了终端间通信的安全性。

Description

一种无线系统接入控制方法及装置 技术领域
本发明涉及通信技术领域，更具体地说，涉及一种无线系统接入控制方法及装置。
背景技术
集群通信系统在集群模式下主要通过对终端合法性的验证方式来实现接入控制，以避免非法终端占用资源、影响终端间的正常通信等问题。
该接入控制方法的具体实现过程包括：系统在预设的条件下向终端发送挑战信息；终端接收到该挑战信息后，先按照与系统约定的鉴权算法计算鉴权码，再将该鉴权码发送给系统；而系统先会按照约定的鉴权算法计算鉴权码，再判断接收到的鉴权码与自己计算的鉴权码是否相同，如果是，系统确定该终端合法，否则，系统确定该终端不合法。
一般情况下，系统仅会在终端刚入网时，或在终端承载特定的业务等预设的条件下，才会对终端进行上述合法性验证，一旦终端被验证合法时，系统会记录终端ID以及合法情况。另外，现有技术在直通模式和中转台模式下均没有给出相关的接入控制方案。
发明人发现现有技术存在如下问题：
现有技术这种系统主动鉴权的方式需要系统和终端侧的多次交互，造成比较多的空口开销；另外，在现有技术中，在终端被验证合法后，系统会永久性或在一段时间内记录该终端为合法，在这种机制下，非法终端会通过设置与合法终端同样的ID，以进行非法占有资源，影响通信。
发明内容
本发明为了解决上述技术问题，提供一种无线系统接入控制方法及装置，该方法通过终端发送方在发起业务时，主动发送鉴权码，以触发接收方对发送方的合法性进行实时鉴权，只有在鉴权通过时，才会进行相应的数据处理；该方法通过终端主动发起鉴权的方式，可以实现实时鉴权，以保证在任何通信模式下，避免非法终端占用资源的问题，提高了终端间通信的安全性。
在本发明第一方面，提供了一种无线接入控制方法，应用于发送方终端侧，该方法包括：
终端在发送控制类数据时，按照与接收方预约的协议生成鉴权码；终端将控制类数据、鉴权码以及对应的CRC校验码组合成消息；终端向接收方发 送该消息，以使接收方能够先对接收到的消息进行CRC校验，校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
在本发明第二方面，提供了一种无线系统接入控制的方法，应用于接收方，该方法包括：
接收发送方发送的消息，该消息携带有控制类数据、鉴权码和对应的CRC校验码；对该消息进行CRC校验；校验通过后，按照与发送方预约的协议生成鉴权码；对比生成的鉴权码和接收到的消息中的鉴权码是否相同，如果是，对接收到消息中的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
在本发明第三方面，提供了一种无线接入控制装置，该装置用于发送方终端，该装置包括：
鉴权码生成单元，用于在发送控制类数据时，按照与接收方预约的协议生成鉴权码；消息生成单元，用于将控制类数据、鉴权码以及对应的CRC校验码组合成消息；消息发送单元，用于向接收方发送该消息，以使接收方能够先对接收到的消息进行CRC校验，校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
在本发明第四方面，提供了一种无线系统接入控制的装置，应用于接收方终端侧，该装置包括：
消息接收单元，用于接收发送方发送的消息，该消息携带有控制类数据、鉴权码和对应的CRC校验码；CRC校验单元，用于对该消息进行CRC校验；校验通过后，触发鉴权码生成单元和鉴权单元；鉴权码生成单元，用于按照与发送方预约的协议生成鉴权码；鉴权单元，用于对比生成的鉴权码和接收到的消息中的鉴权码是否相同，如果是，对接收到消息中的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
在本发明第五方面，提供了一种无线系统接入控制的装置，该装置包括至少一个处理器，至少一个网络接口或者其它通信接口，存储器，和至少一个通信总线；所述存储器用于存储程序指令，所述处理器用于根据所述程序指令执行以下步骤：
在发送控制类数据时，按照与接收方预约的协议生成鉴权码；将控制类数据、鉴权码以及对应的CRC校验码组合成消息；向接收方发送该消息，以使接收方能够先对接收到的消息进行CRC校验，校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
在本发明第六方面，提供了一种无线系统接入控制的装置，该装置包括至少一个处理器，至少一个网络接口或者其它通信接口，存储器，和至少一个通信总线；所述存储器用于存储程序指令，所述处理器用于根据所述程序指令执行以下步骤：
接收发送方发送的消息，该消息携带有控制类数据、鉴权码和对应的CRC校验码；对该消息进行CRC校验；校验通过后，按照与发送方预约的协议生成鉴权码；对比生成的鉴权码和接收到的消息中的鉴权码是否相同，如果是，对接收到消息中的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
与现有技术相比，本发明的技术方案具备以下有益效果：
在本发明中，由终端在发送控制类数据时，先按照与接收方预约的协议生成鉴权码；再将控制类数据、鉴权码以及对应的CRC校验码组合成消息；最后，向接收方发送该消息，以使接收方能够先对接收到的消息进行CRC校验，校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。这种由终端主动发送鉴权码的方式，实现对终端进行通信业务的同时执行实时鉴权，非法终端仅拥有与合法终端相同的ID，却无法得知由终端主动发起鉴权机制，也无法得知鉴权码的生成以及发送方式，因此本发明能够防止非法用户占用资源，保证通信的安全性；另外，由于终端是在发送控制类信息的同时发送鉴权码，使得整个鉴权过程与控制类消息处理过程相兼容，无需单独的信令和开销。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1是本发明发送方终端的无线接入控制方法的第一流程图；
图2是本发明发送方终端的无线接入控制方法的第二流程图；
图3是本发明提供的数据变换以及消息组成示意图；
图4是本发明接收方终端的无线接入控制方法的流程图；
图5是本发明发送方终端的无线接入控制装置的第一结构图；
图6是本发明发送方终端的无线接入控制装置的第二结构图；
图7是本发明接收方终端的无线接入控制装置的结构图；
图8是本发明发送方终端的无线接入控制装置的硬件构成示意图；
图9是本发明接收方终端的无线接入控制装置的硬件构成示意图。
具体实施方式
为使得本申请的发明目的、特征、优点能够更加的明显和易懂，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述，显然，所描述的实施例仅仅是本申请一部分实施例，而非全部实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
参见图1，图1是本发明终端发送方的无线接入控制方法的第一流程图，该方法应用于发送方终端，该方法可以适用于中转模式、直通模式以及集群模式，如图1所示，该方法可以包括：
S101，终端在发送控制类数据时，按照与接收方预约的协议生成鉴权码。
这里的终端是指专网中任何一种具有发送功能的设备，如对讲机等。这里的控制类数据是现有技术的控制类消息中所携带的数据，控制类消息一般包括数据和CRC(Cyclic Redundancy Check,循环冗余码校验)两部分，数据一般包括源ID、目的ID、业务标识等信息，终端在发起任何通信业务时，均需要先发送控制类消息，以便接收方对这类控制类消息进行CRC验证，验证通过后才对后续业务数据进行相应处理。而本发明就是利用这个CRC验证的机制，在发送控制类消息时携带鉴权码，以实现对发送方终端合法性的实时验证。
专网通信系统支持中转模式、直通模式以及集群模式三种通信模式，下面对这三种通信模式以及在这三种通信模式下实现本实施例的具体情况进行说明。
在集群通信模式下，发送方终端通过基站与接收方终端实现通信。在该 模式下实现本发明的方案，本步骤涉及的接收方可以是系统的基站，也可以是接收方终端。
在中转模式下，发送方终端需要通过中转台的中转功能与接收方终端实现通信。在该模式下实现本发明的方案，则本步骤涉及的接收方可以是中转台，也可以是接收方终端。
在直通模式下，发送方终端和接收方终端直接进行通信，在该模式下实现本发明的方案，则本步骤涉及的接收方只能是接收方终端。
本步骤在具体实现时，可以按照以下四种方式来实现：
第一种方式，终端在发送控制类数据时，按照与接收方预约的协议中设定的数据生成鉴权码。
在第一种方式中，发送方和接收方需要预先约定好协议，在协议中设定作为鉴权码的数据，这样，发送方只需要将协议中设定的数据直接作为鉴权码。
第二种方式，终端在发送控制类数据时，按照与接收方预约的协议中设定的鉴权算法和鉴权密钥，对控制类数据进行运算生成鉴权码。
在第二种方式中，发送发和接收方需要预先约定鉴权算法、鉴权密钥以及对哪些数据进行运算，将运算结果作为鉴权码，为了保证协议内容的安全性，鉴权密钥不通过空口传输。例如，在协议中约定对全部控制类数据进行运算，也可以是对特定比特位的控制类数据进行运算等。
第三种方式，终端在发送控制类数据时，按照与接收方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数。
在第三种方式中，发送方和接收方需要预先约定鉴权算法、鉴权密钥以及根据鉴权随机数进行运算，将运算结果作为鉴权码，同时，发送方和接收方需要实时接收基站或中转台按照一定规律广播的鉴权随机数。
第四种方式，终端在发送控制类数据时，按照与接收方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数和控制类数据进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数。
在第四种方式中，发送方和接收方需要预先约定鉴权算法、鉴权密钥以及根据鉴权随机数和消息中的数据进行运算，将运算结果作为鉴权码，同时，发送方和接收方需要实时接收基站或中转台按照一定规律广播的鉴权随机 数。
S102，终端将控制类数据、鉴权码以及对应的CRC校验码组合成消息。
本发明关于如何将鉴权码兼容到控制类消息的发送机制提出了以下两种实现方式。
第一种方式，终端通过占用消息中控制类数据比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息。
在第一种方式中，终端仅生成一个消息，该消息可以理解为在原有的控制类消息中携带鉴权码，以实现在CRC校验机制中实现鉴权机制。第二种方式，终端根据控制类数据生成控制类数据的CRC校验码，将控制类数据和控制类数据的CRC校验码组合成消息，并根据鉴权码生成鉴权码的CRC校验码，将鉴权码和鉴权码的CRC校验码组合成消息。
在第二种方式中，终端生成了两个消息，一个是传统的控制类消息，另一个是携带鉴权码的消息，在终端发送这两个消息时，可以将携带鉴权码的消息放在控制类消息之前发送，也可以放在其之后发送。
关于上述第一种方式，在具体实现时，又有以下三种具体实现方式，包括：
具体方式(1)：终端通过占用消息中源ID和目的ID中预设的比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息。对具体方式(1)进行举例说明。
由于现有技术中考虑到不断增长的终端数量，对控制类消息中数据包含的源ID和目的ID占用的比特数量有明确限制，源ID和目的ID分别设置为24比特。发明人通过分析专网通信的实际应用场景发现，一般的专网通信中，最多承载几千至一万多的终端，而大部分情况下仅承载几百至几千的终端，因此，发明人提出压缩源ID和目的ID占用比特数量，以腾出空闲比特位置来存放鉴权码。例如：为了既满足实际用户数量的需求，又能很好的实现本发明，可以将原有的源ID和目的ID的各自的24比特压缩为16比特，16比特的ID位已经可以支持65535个用户，完全可以满足通信需求，而压缩之后腾出的16比特的空间，用于存放鉴权码。
当然，上文的16比特的空闲比特位仅是示例性的，在具体实现时可以根据具体应用场景对具体空闲比特位进行合理设置。
具体方式(2)：终端通过占用消息中源ID比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息。
具体方式(3)：终端通过占用消息中数据的预设比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息。
上述三种具体方式中提及到的根据控制类数据和/或鉴权码生成CRC校验码，在具体实现时，可以是仅根据控制类数据生成CRC校验码，也可以是仅根据鉴权码生成CRC校验码，当然最优选的方式是根据控制类数据和鉴权码生成CRC校验码。
S103，终端向接收方发送该消息，以使接收方能够先对接收到的消息进行CRC校验，校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
通过上述实施例可以看出，在本发明中通过终端在发送控制类数据时，按照与接收方预约的协议生成鉴权码；终端将控制类数据、鉴权码以及对应的CRC校验码组合成消息；终端向接收方发送该消息，以使接收方能够先对接收到的消息进行CRC校验，校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。这种由终端主动发送鉴权码的方式，实现对终端进行通信业务的同时执行实时鉴权，非法终端仅拥有与合法终端相同的ID，却无法得知由终端主动发起鉴权机制，也无法得知鉴权码的生成以及发送方式，因此本发明能够防止非法用户占用资源，保证通信的安全性；另外，由于终端是在发送控制类信息的同时发送鉴权码，使得整个鉴权过程与控制类消息处理过程相兼容，无需单独的信令和开销。
参见图2，图2是本发明终端发送方的无线接入控制方法的第二流程图，该方法应用于发送方终端，该方法可以适用于中转模式、直通模式以及集群模式，图2与图1的区别在于：终端将控制类数据、鉴权码以及对应的CRC校验码组合成消息之后，增加一个数据变换的处理，将数据变换后的新数据和原数据的CRC校验码组成变换消息，最后再将该变换消息发送给接收方。这样增加了整个CRC校验和鉴权的复杂度，更近一步保证通信安全性。
如图2所示，该方法可以包括：
S201，终端在发送控制类数据时，按照与接收方预约的协议生成鉴权码。
S202，终端将控制类数据、鉴权码以及对应的CRC校验码组合成消息。
本实施例中S201和S202与上文实施例1中S101和S102相同，可以参照上文对应的描述，此处不再赘述。
S203，终端按照与接收方预约的变换算法，对该消息中的数据部分进行数据变换，将变换后的数据和该消息中的CRC校验码进行组合生成变换消息。
需要说明的是，一个消息可以看作是由CRC校验部分和数据部分组成，则在消息中，除了CRC校验码部分之外，其余部分都是数据部分。在上述S202组合成消息之后，按照S203先对其消息中的数据部分进行数据变换，然后将变换后的数据和该消息中的CRC校验码重新组合成变换消息。
如果终端按照上述实施例1中的S102中提到的第一种方式生成消息，生成一个消息，该消息包括控制类数据、鉴权码和CRC校验码，则该消息中的数据部分包括控制类数据和鉴权码。
如果终端按照上述实施例1中的S102提到的第二种方式生成消息，则生成两个消息，一个消息中的数据部分仅是鉴权码，另一个消息中的数据部分仅是控制类数据。
下面仅以按照第一种方式生成一个携带鉴权码的消息为例，通过图3对S203的具体实现作举例说明。
如图3中的数据变换以及消息组成示意图，在该图中，数据A为控制类数据，数据B包括控制类数据和鉴权码，数据B和CRC组合成的消息为上述步骤202中的消息，再经过数据变换后成为数据C，而数据C就包含变换后的控制类数据和变换后的鉴权码，而CRC保持不变。数据C和CRC组合成变换消息。
这里的变换算法可以是加密算法、也可以是数学运算法则等，在发送方和接收方均预先储存了变换算法以及对应的反变换算法，或者预先储存了数学运算法则以及数学运算解析算法，以保证发送方发送的变换后的数据，接收方能够按照预约的方法进行解析。
在具体实现时，可以对该消息中的控制类数据和鉴权码，结合消息中的CRC校验码和/或变换随机数，采用与接收方预约的变换密钥按照预约的变换算法进行数据变换处理。
这里的变换随机数是基站和中转台按照预设的规律广播的，这里的变换随机数可以与上述鉴权随机数相同，也可以不相同。这里的变换密钥可以与上文的鉴权密钥采用相同的密钥，也可以不相同。
S204，终端向接收方发送该变换消息，以使接收方能够先按照预约的变换算法对接收到的变换消息中的数据部分进行逆变换，再根据逆变换的数据进行CRC校验，校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
通过上述实施例可以看出，本发明由终端主动发送鉴权码的方式，实现对终端进行通信业务的同时执行实时鉴权，非法终端仅拥有与合法终端相同的ID，却无法得知由终端主动发起鉴权机制，也无法得知鉴权码的生成以及发送方式，因此本发明能够防止非法用户占用资源，保证通信的安全性；另外，由于终端是在发送控制类信息的同时发送鉴权码，使得整个鉴权过程与控制类消息处理过程相兼容，无需单独的信令和开销。另外，在发送消息之前对除CRC之外的数据部分进行了数据变换，增加了CRC校验的复杂度，从而增加了整个鉴权过程的复杂度，进一步提高鉴权的可靠性。
上文从发送方终端的角度描述了本发明的技术方案，下面从接收方的角度描述本发明的技术方案。
参见图4，图4是本发明终端发送方的无线接入控制方法的第二流程图，该方法应用于接收方设备，该方法可以适用于中转模式、直通模式以及集群模式，由于在不同的通信模式下，接收方设备可能不同，如上文描述的，在中转模式下，接收方可以是中转台或者终端；在集群模式下，接收方可以是基站或终端；而在直通模式下，接收方只能是终端。因此在本实施例并不限制具体的执行主体(接收方)，根据具体的应用场景来确定执行主体。如图4所示，该方法可以包括：
S401，接收发送方发送的消息，该消息携带有控制类数据、鉴权码和对应的CRC校验码。
S402，对该消息进行CRC校验；校验通过时，进入S403和S404。
首先简单说明一下，本实施例的实现基础是，发送方与接收方已预先约定了协议，协议中设定了本实施例的传输机制和鉴权机制，在该机制下接收方可以在执行业务时，对发送方的身份进行鉴权，如果鉴权通过，确定发送 方为合法，继续处理已接收的数据；如果鉴权不通过，确定发送方不合法，直接抛弃接收到的数据，这样就能够避免接收方接收非法终端的呼叫，加强了通信的安全性。
在接收到发送方发送的控制类消息时，接收方首先要进行CRC校验，这个校验过程具体为：
接收方按照与发送方预约的协议，根据该消息中的数据生成CRC校验码，判断生成的CRC校验码与该消息中的CRC校验码是否相同，如果是，校验通过。
例如，接收方和发送方预约的协议中设定CRC校验码的生成规则为根据控制类数据按照CRC生成算法计算得到CRC校验码；或，为根据预设的固定数据按照CRC生成算法计算得到CRC校验码；发送方和接收方双方都按照预约好的规则生成CRC校验码，这样，当接收方接收到发送方发送的消息时，先按照预约好的规则生成CRC校验码，然后再对比发送方发送的CRC校验码，如果这两个CRC校验码相同，可以确定该发送方通过CRC校验，后续还需要进行身份合法性鉴权。
如果发送方和接收方预约的协议中规定发送的控制类消息为变换消息，则所述对该消息进行CRC校验具体为：
按照与发送方预约的变换算法对接收到的变换消息中的数据部分进行逆变换，再根据逆变换的数据进行CRC校验。
S403，校验通过时，按照与发送方预约的协议生成鉴权码；
S404，对比生成的鉴权码和接收到的消息中的鉴权码是否相同，如果是，对接收到消息中的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
上述CRC校验通过并不能完全确定发送方的身份合法，还需要进一步地进行身份鉴权，这里的鉴权过程仍旧需要按照与发送方预约的协议执行相应步骤，可以理解为只有合法的发送方才能按照预约的协议执行相应的处理发送对应的控制类消息，而非法的发送方由于并不知道预约的协议内容，从而接收方可以通过预约的协议进行相应的校验和鉴权，识别出非法的发送方，进而决定是否对接收到的数据进行后续解析处理。
关于上述按照与发送方预约的协议生成鉴权码，与上文描述的发送方的处理相对应的，接收方的处理过程可以包括以下几种形式：
按照与发送方预约的协议中设定的数据生成鉴权码；或，
按照与发送方预约的协议中设定的鉴权算法和鉴权密钥，对控制类数据进行运算生成鉴权码；或，
按照与发送方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数；或，
按照与发送方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数和控制类数据进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数。
通过上述实施例可以看出，本发明由接收方在接收到发送方发送的控制类消息时，先按照与发送方预约的协议对该消息进行CRC校验，当通过校验时，再进一步地执行身份合法性的鉴权处理，通过双重验证保证发送方身份合法，保证接收方只接收真正属于自己的呼叫。本发明从接收方的角度限制了非法终端占用资源，保证通信的安全性。另外，接收方只要接收到控制类消息就进行CRC校验和鉴权处理，保证对所有通信业务进行实时有效的鉴权，另外，鉴权处理过程兼容在CRC校验处理过程中，不再需要额外的信令开销，节省了鉴权成本。
上文对本发明的提供的方法进行解释说明，下面对本发明提供的装置进行解释说明。
参见图5，图5是本发明发送方终端的无线接入控制装置的第一结构图，图5所示的装置可以适用于发送方终端，如图5所示，该装置可以包括：
鉴权码生成单元501，用于在发送控制类数据时，按照与接收方预约的协议生成鉴权码；消息生成单元502，用于将控制类数据、鉴权码以及对应的CRC校验码组合成消息；消息发送单元503，用于向接收方发送该消息，以使接收方能够先对接收到的消息进行CRC校验，校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
优选的，鉴权码生成单元包括：鉴权码第一生成子单元，用于在发送控制类数据时，按照与接收方预约的协议中设定的数据生成鉴权码；或，鉴权码第二生成子单元，用于在发送控制类数据时，按照与接收方预约的协议中设定的鉴权算法和鉴权密钥，对控制类数据进行运算生成鉴权码；或，鉴权 码第三生成子单元，用于在发送控制类数据时，按照与接收方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数；或，鉴权码第四生成子单元，用于在发送控制类数据时，按照与接收方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数和控制类数据进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数。
优选的，消息生成单元包括：
消息第一生成子单元，用于通过占用消息中控制类数据比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息；或，消息第二生成子单元，用于根据控制类数据生成控制类数据的CRC校验码，将控制类数据和控制类数据的CRC校验码组合成消息，并根据鉴权码生成鉴权码的CRC校验码，将鉴权码和鉴权码的CRC校验码组合成消息。
优选的，消息第一生成子单元，具体用于通过占用消息中源ID和目的ID中预设的比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息；或，
优选的，消息第一生成子单元，具体用于通过占用消息中源ID的比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息；或，
优选的，消息第一生成子单元，具体用于通过占用消息中数据的预设的比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息。
参见图6，图6是本发明发送方终端的无线接入控制装置的第二结构图，图6所示的装置在图5的基础上增加了变换单元，该装置具体包括：
鉴权码生成单元601，用于在发送控制类数据时，按照与接收方预约的协议生成鉴权码。
消息生成单元602，用于将控制类数据、鉴权码以及对应的CRC校验码组合成消息。
变换单元603，用于按照与接收方预约的变换算法，对消息单元生成的消息中的数据部分进行数据变换，将变换后的数据和该消息中的CRC校验码进行组合生成变换消息。
消息发送单元604，用于向接收方发送变换消息，以使接收方能够先按照预约的变换算法对接收到的变换消息中的数据部分进行逆变换，再根据逆变换的数据进行CRC校验，校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
参见图7，图7是本发明接收方终端的无线接入控制装置的结构图，如图7所示，该装置可以包括：
消息接收单元701，用于接收发送方发送的消息，该消息携带有控制类数据、鉴权码和对应的CRC校验码；
CRC校验单元702，用于对该消息进行CRC校验；校验通过后，触发鉴权码生成单元和鉴权单元；
鉴权码生成单元703，用于按照与发送方预约的协议生成鉴权码；
鉴权单元704，用于对比生成的鉴权码和接收到的消息中的鉴权码是否相同，如果是，对接收到消息中的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
优选的，CRC校验单元具体用于按照与发送方预约的协议，根据该消息中的数据生成CRC校验码，判断生成的CRC校验码与该消息中的CRC校验码是否相同，如果是，校验通过。
优选的，所述鉴权码生成单元包括：
鉴权码第一生成子单元，用于按照与发送方预约的协议中设定的数据生成鉴权码；或，
鉴权码第二生成子单元，用于按照与发送方预约的协议中设定的鉴权算法和鉴权密钥，对控制类数据进行运算生成鉴权码；或，
鉴权码第三生成子单元，用于按照与发送方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数；或，
鉴权码第四生成子单元，用于按照与发送方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数和控制类数据进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数。
优选的，当终端接收发送方发送的消息为变换消息时，
所述CRC校验单元具体用于按照与发送方预约的变换算法对接收到的变 换消息中的数据部分进行逆变换，再根据逆变换的数据进行CRC校验。
通过上述实施例可以看出，本发明由终端主动发送鉴权码的方式，实现对终端进行通信业务的同时执行实时鉴权，非法终端仅拥有与合法终端相同的ID，却无法得知由终端主动发起鉴权机制，也无法得知鉴权码的生成以及发送方式，因此本发明能够防止非法用户占用资源，保证通信的安全性；另外，由于终端是在发送控制类信息的同时发送鉴权码，使得整个鉴权过程与控制类消息处理过程相兼容，无需单独的信令和开销。另外，在发送消息之前对除CRC之外的数据部分进行了数据变换，增加了CRC校验的复杂度，从而增加了整个鉴权过程的复杂度，进一步提高鉴权的可靠性。
进一步地，本发明实施例还提供了发送方终端、接收方的无线接入控制装置的硬件构成。发送方终端、接收方的无线接入控制装置的硬件构成相同，可包括至少一个处理器(例如CPU)，至少一个网络接口或者其他通信接口，存储器，和至少一个通信总线，用于实现这些装置之间的连接通信。处理器用于执行存储器中存储的可执行模块，例如计算机程序。存储器可能包含高速随机存取存储器(RAM：Random Access Memory)，也可能还包括非不稳定的存储器(non-volatile memory)，例如至少一个磁盘存储器。通过至少一个网络接口(可以是有线或者无线)实现该系统网关与至少一个其他网元之间的通信连接，可以使用互联网，广域网，本地网，城域网等。
参见图8，在一些实施方式中，发送方终端的无线接入控制装置的存储器中存储了程序指令，程序指令可以被处理器执行，其中，程序指令可包括鉴权码生成单元、消息生成单元以及消息发送单元，还可以包括变换单元，各单元的具体实现可参见图5和图6所揭示的相应单元，这里不再赘述。
参见图9，在一些实施方式中，接收方的无线接入控制装置的存储器中存储了程序指令，程序指令可以被处理器执行，其中程序指令可包括消息接收单元701、CRC校验单元702、鉴权码生成单元703以及鉴权单元704，各单元的具体实现可参见图7所揭示的相应单元，这里不再赘述。
需要说明的是，在实际应用中，终端设备不仅具备发送功能，还具有接收功能，因此终端设备可以同时具备上述图8和图9所述的装置，当然，在某些仅实现发送功能或接收功能的终端设备可以单独具备上述图8或图9的装置。
可以理解的是，本发明可用于众多通用或专用的计算系统环境或配置中。例如：个人计算机、服务器计算机、手持设备或便携式设备、平板型设备、多处理器系统、基于微处理器的系统、机顶盒、可编程的消费电子设备、网络PC、小型计算机、大型计算机、包括以上任何系统或设备的分布式计算环境等等。本发明可以在由计算机执行的计算机可执行指令的一般上下文中描述，例如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本发明，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
对于装置实施例而言，由于其基本对应于方法实施例，所以相关之处参见方法实施例的部分说明即可。以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
以上所述仅是本发明的具体实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (18)

  1. 一种无线接入控制方法，其特征在于，应用于发送方终端侧，该方法包括：
    终端在发送控制类数据时，按照与接收方预约的协议生成鉴权码；
    终端将控制类数据、鉴权码以及对应的CRC校验码组合成消息；
    终端向接收方发送该消息，以使接收方能够先对接收到的消息进行CRC校验，校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
  2. 根据权利要求1所述的方法，其特征在于，终端在发送控制类数据时，按照与接收方预约的协议生成鉴权码，包括：
    终端在发送控制类数据时，按照与接收方预约的协议中设定的数据生成鉴权码；或，
    终端在发送控制类数据时，按照与接收方预约的协议中设定的鉴权算法和鉴权密钥，对控制类数据进行运算生成鉴权码；或，
    终端在发送控制类数据时，按照与接收方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数；或，
    终端在发送控制类数据时，按照与接收方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数和控制类数据进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数。
  3. 根据权利要求1所述的方法，其特征在于，终端将控制类数据、鉴权码以及对应的CRC校验码组合成消息，包括：
    终端通过占用消息中控制类数据比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息；或，
    终端根据控制类数据生成控制类数据的CRC校验码，将控制类数据和控制类数据的CRC校验码组合成消息，并根据鉴权码生成鉴权码的CRC校验码，将鉴权码和鉴权码的CRC校验码组合成消息。
  4. 根据权利要求3所述的方法，其特征在于，终端通过占用消息中控制类数据比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校 验码，将控制类数据、鉴权码和CRC校验码组合成消息，包括：
    终端通过占用消息中源ID和目的ID中预设的比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息；或，
    终端通过占用消息中源ID比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息；或，
    终端通过占用消息中数据的预设比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息。
  5. 根据权利要求1所述的方法，其特征在于，终端将控制类数据、鉴权码以及对应的CRC校验码组合成消息之后，所述方法还包括：
    终端按照与接收方预约的变换算法，对该消息中的数据部分进行数据变换，将变换后的数据和该消息中的CRC校验码进行组合生成变换消息；
    则向接收方发送该消息，具体为：
    向接收方发送变换消息，以使接收方能够先按照预约的变换算法对接收到的变换消息中的数据部分进行逆变换，再根据逆变换的数据进行CRC校验，校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
  6. 一种无线系统接入控制的方法，其特征在于，应用于接收方，该方法包括：
    接收发送方发送的消息，该消息携带有控制类数据、鉴权码和对应的CRC校验码；
    对该消息进行CRC校验；校验通过后，按照与发送方预约的协议生成鉴权码；
    对比生成的鉴权码和接收到的消息中的鉴权码是否相同，如果是，对接收到消息中的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
  7. 根据权利要求6所述的方法，其特征在于，对该消息进行CRC校验，包括：
    按照与发送方预约的协议，根据该消息中的数据生成CRC校验码，判断 生成的CRC校验码与该消息中的CRC校验码是否相同，如果是，校验通过。
  8. 根据权利要求6所述的方法，其特征在于，按照与发送方预约的协议生成鉴权码，包括：
    按照与发送方预约的协议中设定的数据生成鉴权码；或，
    按照与发送方预约的协议中设定的鉴权算法和鉴权密钥，对控制类数据进行运算生成鉴权码；或，
    按照与发送方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数；或，
    按照与发送方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数和控制类数据进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数。
  9. 根据权利要求6所述的方法，其特征在于，当接收发送方发送的消息为变换消息时，所述对该消息进行CRC校验具体为：
    按照与发送方预约的变换算法对接收到的变换消息中的数据部分进行逆变换，再根据逆变换的数据进行CRC校验。
  10. 一种无线接入控制装置，其特征在于，该装置用于发送方终端，该装置包括：
    鉴权码生成单元，用于在发送控制类数据时，按照与接收方预约的协议生成鉴权码；
    消息生成单元，用于将控制类数据、鉴权码以及对应的CRC校验码组合成消息；
    消息发送单元，用于向接收方发送该消息，以使接收方能够先对接收到的消息进行CRC校验，校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
  11. 根据权利要求10所述的装置，其特征在于，鉴权码生成单元包括：
    鉴权码第一生成子单元，用于在发送控制类数据时，按照与接收方预约的协议中设定的数据生成鉴权码；或，
    鉴权码第二生成子单元，用于在发送控制类数据时，按照与接收方预约的协议中设定的鉴权算法和鉴权密钥，对控制类数据进行运算生成鉴权码； 或，
    鉴权码第三生成子单元，用于在发送控制类数据时，按照与接收方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数；或，
    鉴权码第四生成子单元，用于在发送控制类数据时，按照与接收方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数和控制类数据进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数。
  12. 根据权利要求10所述的装置，其特征在于，消息生成单元包括：
    消息第一生成子单元，用于通过占用消息中控制类数据比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息；或，
    消息第二生成子单元，用于根据控制类数据生成控制类数据的CRC校验码，将控制类数据和控制类数据的CRC校验码组合成消息，并根据鉴权码生成鉴权码的CRC校验码，将鉴权码和鉴权码的CRC校验码组合成消息。
  13. 根据权利要求12所述的装置，其特征在于，
    消息第一生成子单元，具体用于通过占用消息中源ID和目的ID中预设的比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息；或，
    消息第一生成子单元，具体用于通过占用消息中源ID的比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息；或，
    消息第一生成子单元，具体用于通过占用消息中数据的预设的比特位的方式存放鉴权码，根据控制类数据和/或鉴权码生成CRC校验码，将控制类数据、鉴权码和CRC校验码组合成消息。
  14. 根据权利要求10所述的装置，其特征在于，所述装置还包括：
    变换单元，用于按照与接收方预约的变换算法，对消息单元生成的消息中的数据部分进行数据变换，将变换后的数据和该消息中的CRC校验码进行组合生成变换消息；
    则所述消息发送单元具体用于向接收方发送变换消息，以使接收方能够先按照预约的变换算法对接收到的变换消息中的数据部分进行逆变换，再根 据逆变换的数据进行CRC校验，校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
  15. 一种无线系统接入控制的装置，其特征在于，应用于接收方终端侧，该装置包括：
    消息接收单元，用于接收发送方发送的消息，该消息携带有控制类数据、鉴权码和对应的CRC校验码；
    CRC校验单元，用于对该消息进行CRC校验；校验通过后，触发鉴权码生成单元；
    鉴权码生成单元，用于按照与发送方预约的协议生成鉴权码；
    鉴权单元，用于对比生成的鉴权码和接收到的消息中的鉴权码是否相同，如果是，对接收到消息中的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
  16. 根据权利要求15所述的装置，其特征在于，所述鉴权码生成单元包括：
    鉴权码第一生成子单元，用于按照与发送方预约的协议中设定的数据生成鉴权码；或，
    鉴权码第二生成子单元，用于按照与发送方预约的协议中设定的鉴权算法和鉴权密钥，对控制类数据进行运算生成鉴权码；或，
    鉴权码第三生成子单元，用于按照与发送方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数；或，
    鉴权码第四生成子单元，用于按照与发送方预约的协议中设定的鉴权算法和鉴权密钥，对接收到的鉴权随机数和控制类数据进行运算生成鉴权码；该鉴权随机数是基站或中转台按照预设规律广播的鉴权随机数。
  17. 一种无线系统接入控制的装置，其特征在于，包括至少一个处理器，至少一个网络接口或者其它通信接口，存储器，和至少一个通信总线；所述存储器用于存储程序指令，所述处理器用于根据所述程序指令执行以下步骤：
    在发送控制类数据时，按照与接收方预约的协议生成鉴权码；
    将控制类数据、鉴权码以及对应的CRC校验码组合成消息；
    向接收方发送该消息，以使接收方能够先对接收到的消息进行CRC校验， 校验通过后，再按照预约的协议生成鉴权码，并对比生成的鉴权码和接收到的鉴权码是否相同，如果是，对接收到的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
  18. 一种无线系统接入控制的装置，其特征在于，包括至少一个处理器，至少一个网络接口或者其它通信接口，存储器，和至少一个通信总线；所述存储器用于存储程序指令，所述处理器用于根据所述程序指令执行以下步骤：
    接收发送方发送的消息，该消息携带有控制类数据、鉴权码和对应的CRC校验码；
    对该消息进行CRC校验；校验通过后，按照与发送方预约的协议生成鉴权码；
    对比生成的鉴权码和接收到的消息中的鉴权码是否相同，如果是，对接收到消息中的控制类数据进行解析处理，如果否，丢弃接收到的控制类数据。
PCT/CN2015/083027 2015-07-01 2015-07-01 一种无线系统接入控制方法及装置 WO2017000272A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
US15/738,326 US10869198B2 (en) 2015-07-01 2015-07-01 Wireless system access control method and device
CN201580000297.4A CN105519028B (zh) 2015-07-01 2015-07-01 一种无线系统接入控制方法及装置
EP15896803.2A EP3319267B1 (en) 2015-07-01 2015-07-01 Wireless system access control method and device
PCT/CN2015/083027 WO2017000272A1 (zh) 2015-07-01 2015-07-01 一种无线系统接入控制方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2015/083027 WO2017000272A1 (zh) 2015-07-01 2015-07-01 一种无线系统接入控制方法及装置

Publications (1)

Publication Number Publication Date
WO2017000272A1 true WO2017000272A1 (zh) 2017-01-05

Family

ID=55725062

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/083027 WO2017000272A1 (zh) 2015-07-01 2015-07-01 一种无线系统接入控制方法及装置

Country Status (4)

Country Link
US (1) US10869198B2 (zh)
EP (1) EP3319267B1 (zh)
CN (1) CN105519028B (zh)
WO (1) WO2017000272A1 (zh)

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106131835A (zh) * 2016-07-08 2016-11-16 深圳市中兴物联科技股份有限公司 一种终端数据交换方法及系统
CN108923892B (zh) * 2018-06-20 2021-01-19 南京中感微电子有限公司 一种蓝牙接收方法、蓝牙接收机及蓝牙音频设备
CN109064379B (zh) * 2018-07-25 2023-06-06 成都亚信网络安全产业技术研究院有限公司 一种数字水印的标注方法及检验方法和装置
CN110798431A (zh) * 2018-08-03 2020-02-14 杭州海康威视数字技术股份有限公司 一种安全参数交互方法、装置、设备及系统
CN110726809A (zh) * 2019-10-19 2020-01-24 北京工业大学 高可靠性可燃气体状态监测及报警设备设计方法
CN111314915B (zh) * 2020-02-10 2023-04-18 沈阳理工大学 一种适用于无线通信系统的高清鉴权方法
CN113346989B (zh) * 2020-03-02 2023-02-07 北京新能源汽车股份有限公司 一种外部设备接入认证方法、装置、网关及电动汽车
CN113395392B (zh) * 2021-06-11 2022-08-05 哈尔滨海能达科技有限公司 一种呼叫接入控制的方法、系统、同播系统及终端
CN115694599A (zh) * 2021-07-31 2023-02-03 华为技术有限公司 一种传输方法、系统及相关装置
CN114124401B (zh) * 2021-11-02 2023-11-17 佛吉亚歌乐电子(丰城)有限公司 一种数据鉴权方法、装置、设备及存储介质
CN114662073B (zh) * 2022-05-23 2022-08-19 深圳市中科创激光技术有限公司 用于led系统的验证方法、装置、计算机设备与介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1467943A (zh) * 2002-07-10 2004-01-14 ����ͨѶ�ɷ����޹�˾ 实现双向鉴权的码分多址系统和方法
CN101068196A (zh) * 2006-05-01 2007-11-07 中兴通讯股份有限公司 一种蓝牙手机接入蓝牙网关的业务接入控制方法
WO2013102003A1 (en) * 2011-12-30 2013-07-04 Vasco Data Security, Inc. A strong authentication token with visual output of pki signatures
CN103929748A (zh) * 2014-04-30 2014-07-16 普联技术有限公司 一种物联网无线终端及其配置方法和无线网络接入点

Family Cites Families (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5349642A (en) * 1992-11-03 1994-09-20 Novell, Inc. Method and apparatus for authentication of client server communication
US5481610A (en) * 1994-02-28 1996-01-02 Ericsson Inc. Digital radio transceiver with encrypted key storage
CN100401814C (zh) 2003-04-10 2008-07-09 中兴通讯股份有限公司 一种phs移动通信pim卡鉴权数据的保护方法
DE502004007554D1 (de) 2004-06-23 2008-08-21 Message Wireless Information S Verfahren und Vorrichtungen zur Verbreitung einer Nachricht über ein Broadcast-Netz
US7716720B1 (en) * 2005-06-17 2010-05-11 Rockwell Collins, Inc. System for providing secure and trusted computing environments
EP1748615A1 (en) * 2005-07-27 2007-01-31 Sun Microsystems France S.A. Method and system for providing public key encryption security in insecure networks
US20070050622A1 (en) * 2005-09-01 2007-03-01 Rager Kent D Method, system and apparatus for prevention of flash IC replacement hacking attack
US8627092B2 (en) * 2006-03-22 2014-01-07 Lg Electronics Inc. Asymmetric cryptography for wireless systems
US7995994B2 (en) * 2006-09-22 2011-08-09 Kineto Wireless, Inc. Method and apparatus for preventing theft of service in a communication system
KR101365603B1 (ko) * 2006-12-04 2014-02-20 삼성전자주식회사 조건부 인증 코드 삽입 방법 및 그 장치, 인증을 통한조건부 데이터 사용 방법 및 그 장치
US20090262683A1 (en) * 2008-04-18 2009-10-22 Amit Khetawat Method and Apparatus for Setup and Release of User Equipment Context Identifiers in a Home Node B System
US8576785B2 (en) * 2008-12-19 2013-11-05 Robert Bosch Gmbh Method of wireless communication using authentication information
US8516232B2 (en) * 2009-06-30 2013-08-20 Sandisk Technologies Inc. Method and memory device for performing an operation on data
US8260261B2 (en) 2009-08-31 2012-09-04 Qualcomm Incorporated Securing pairing verification of devices with minimal user interfaces
DE102009051383A1 (de) 2009-10-30 2011-05-12 Siemens Aktiengesellschaft Verfahren und Vorrichtung zum sicheren Übertragen von Daten
US8881294B2 (en) * 2011-02-18 2014-11-04 Honeywell International Inc. Methods and systems for securely uploading files onto aircraft
KR101312293B1 (ko) * 2011-10-31 2013-09-27 삼성에스디에스 주식회사 Ｉｃ 칩 및 이에 대한 데이터 검증 방법
CN104185178A (zh) 2013-05-22 2014-12-03 中国人民解放军总参谋部第六十一研究所 一种对移动终端鉴权的方法及装置
WO2015143248A1 (en) * 2014-03-19 2015-09-24 Ebay Inc. Managing multiple beacons with a network-connected primary beacon

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1467943A (zh) * 2002-07-10 2004-01-14 ����ͨѶ�ɷ����޹�˾ 实现双向鉴权的码分多址系统和方法
CN101068196A (zh) * 2006-05-01 2007-11-07 中兴通讯股份有限公司 一种蓝牙手机接入蓝牙网关的业务接入控制方法
WO2013102003A1 (en) * 2011-12-30 2013-07-04 Vasco Data Security, Inc. A strong authentication token with visual output of pki signatures
CN103929748A (zh) * 2014-04-30 2014-07-16 普联技术有限公司 一种物联网无线终端及其配置方法和无线网络接入点

Also Published As

Publication number Publication date
EP3319267B1 (en) 2019-05-08
EP3319267A1 (en) 2018-05-09
CN105519028A (zh) 2016-04-20
US20180184292A1 (en) 2018-06-28
CN105519028B (zh) 2019-05-28
EP3319267A4 (en) 2018-05-09
US10869198B2 (en) 2020-12-15

Similar Documents

Publication Publication Date Title
WO2017000272A1 (zh) 一种无线系统接入控制方法及装置
US10638321B2 (en) Wireless network connection method and apparatus, and storage medium
CN109246053B (zh) 一种数据通信方法、装置、设备和存储介质
US10965772B2 (en) Interface invocation method and apparatus for hybrid cloud
CN109923830B (zh) 用于配置无线网络接入设备的系统和方法
US10681540B2 (en) Communication network system, transmission node, reception node, and message checking method
TW201706900A (zh) 終端的認證處理、認證方法及裝置、系統
US9292670B2 (en) Systems and methods for generating and authenticating one time dynamic password based on context information
EP3175597B1 (en) Apparatus and method for sharing a hardware security module interface in a collaborative network
US8527762B2 (en) Method for realizing an authentication center and an authentication system thereof
CN103166931A (zh) 一种安全传输数据方法，装置和系统
CN104158816A (zh) 认证方法、装置和服务器
CN107517194B (zh) 一种内容分发网络的回源认证方法和装置
CN106304264B (zh) 一种无线网络接入方法及装置
WO2018205148A1 (zh) 一种数据包校验方法及设备
WO2022111187A1 (zh) 终端认证方法、装置、计算机设备及存储介质
US20150009916A1 (en) Pairing of devices through separate networks
Huang et al. A token-based user authentication mechanism for data exchange in RESTful API
CN104580553A (zh) 网络地址转换设备的识别方法和装置
WO2008131696A1 (fr) Procédé, station de base, station de relais et système de communication de relais pour implémenter une authentification de message
WO2014180431A1 (zh) 一种网管安全认证方法、装置、系统及计算机存储介质
CN112118568B (zh) 一种设备身份鉴权的方法及设备
WO2014194818A1 (zh) 一种用于发现设备的用户的方法和用户设备
CN111586017A (zh) 通信用户认证的方法和装置
CN113132323B (zh) 一种通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15896803

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2015896803

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 15738326

Country of ref document: US