WO2017024449A1 - 终端接入3gpp网络的处理方法及装置 - Google Patents

终端接入3gpp网络的处理方法及装置 Download PDF

Info

Publication number
WO2017024449A1
WO2017024449A1 PCT/CN2015/086390 CN2015086390W WO2017024449A1 WO 2017024449 A1 WO2017024449 A1 WO 2017024449A1 CN 2015086390 W CN2015086390 W CN 2015086390W WO 2017024449 A1 WO2017024449 A1 WO 2017024449A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
terminal
authentication
3gpp network
message
Prior art date
Application number
PCT/CN2015/086390
Other languages
English (en)
French (fr)
Inventor
李�赫
于游洋
陈璟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19179058.3A priority Critical patent/EP3614741B1/en
Priority to KR1020187005375A priority patent/KR102084580B1/ko
Priority to CN201580053514.6A priority patent/CN107079377B/zh
Priority to RU2018108140A priority patent/RU2682849C1/ru
Priority to CN202010073023.0A priority patent/CN111064756B/zh
Priority to PCT/CN2015/086390 priority patent/WO2017024449A1/zh
Priority to EP15900648.5A priority patent/EP3324681B1/en
Publication of WO2017024449A1 publication Critical patent/WO2017024449A1/zh
Priority to US15/890,936 priority patent/US10278073B2/en
Priority to US16/357,950 priority patent/US10681546B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/04—Registration at HLR or HSS [Home Subscriber Server]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
    • H04W8/24—Transfer of terminal data

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method and an apparatus for processing a terminal to access a 3GPP (The 3rd Generation Partnership Project) network.
  • 3GPP The 3rd Generation Partnership Project
  • 3GPP mainly develops global applicable technical specifications and technical reports for third-generation mobile communication systems.
  • a network based on the 3GPP framework may be referred to as a 3GPP network, for example, a mobile communication network based on the 3GPP framework.
  • the 3GPP network can provide a basis for communication between mobile terminals, and has the advantages of wide signal coverage and high mobile performance, but the data transmission rate is low.
  • a 3GPP network for example, WLAN (Wireless Local Area Networks) can provide hotspot coverage and has a high data transmission rate, but has low mobility. Therefore, if a 3GPP network is combined with a non-3GPP (non-3GPP) network, the user experience can be improved, and the network construction cost and the wireless resource requirement can be reduced.
  • the UE User Equipment
  • the core network device determines whether the UE has access to the 3GPP network. If the core network device finds that the UE does not have access. , the unauthorised access message is generated and sent to the UE, but the UE will continue to try to access the 3GPP network. If there are 500,000 users trying to access the 3GPP network, it is assumed that 400,000 users will be unable to access because they do not have permission. That is, HSS will send no access to these 400,000 users, and this 400,000 Users will continue to try to access the 3GPP network, causing the core network equipment to be overburdened.
  • a method and a device for processing a terminal to access a 3GPP network are provided, so as to solve the problem that the core network device in the prior art is overburdened.
  • the present invention provides a method for processing a terminal to access a 3GPP network, including:
  • the terminal sends an access request message to the core network device of the 3GPP network, the access request message is used to request access to the 3GPP network, and the access request message includes identity information of the terminal;
  • the terminal performs authentication on the sending the core network device according to the authentication information
  • the network access policy is executed to reduce the number of the access request messages sent by the terminal to the core network device.
  • the authentication information includes a first message digest, where the first message digest is used to enable the terminal to be in the core network device Home subscriber server HSS for authentication;
  • the terminal authenticates the core network device according to the authentication information, including:
  • the authentication information includes an authentication vector set, where the authentication vector set includes a first parameter and a message authentication code MAC, where a parameter is used to generate a desired message authentication code X-MAC;
  • the terminal authenticates the core network device according to the authentication information, including:
  • the X-MAC is the same as the MAC, it is determined that the HSS authentication is successful; or if the X-MAC is not the same as the MAC, it is determined that the HSS authentication fails.
  • the authentication information includes certificate information and signature information of an evolved packet data domain gateway ePDG;
  • the terminal authenticates the core network device according to the authentication information, including:
  • the authentication information further includes an authentication vector set, where the authentication vector set includes a first parameter and MAC, the first parameter is used to generate an X-MAC;
  • the terminal authenticates the core network device according to the authentication information, and further includes:
  • the X-MAC is the same as the MAC, determining that the HSS authentication is successful; or, if If the X-MAC is different from the MAC, it is determined that the HSS authentication fails.
  • a fifth possible implementation manner after the terminal successfully authenticates the core network device, performing a corresponding network access policy, including:
  • the terminal stops attempting to access the 3GPP network until the state of the terminal meets the first preset condition, and re-attempts to access the 3GPP network;
  • the first preset condition includes at least one of the following: the terminal replaces the customer identification module SIM card, reboots, the terminal attempts to access the 3GPP network fails to exceed the first preset duration, and the terminal reselects the non-3GPP The internet.
  • the access request message further includes an access point name APN information, where the APN information is used to represent the location The non-3GPP network used by the terminal application, where the core network device includes an ePDG;
  • the terminal stops trying to access the 3GPP network until the state of the terminal meets the first preset condition, and re-attempts to access the 3GPP network, including:
  • the terminal stops attempting to access the 3GPP network until the state of the terminal satisfies at least one of the following: replacing the SIM card, rebooting, attempting to access the 3GPP network After the failure exceeds the first preset duration, retrying to access the 3GPP network through the non-3GPP network corresponding to the APN information; or
  • the ePDG belongs to the visited public land mobile network VPLMN, after the terminal reselects the non-3GPP network, it attempts to access the 3GPP network through the reselected non-3GPP network.
  • the core network device does not include the ePDG, and the first preset condition includes the terminal attempting The first preset duration is exceeded after the failure to access the 3GPP network.
  • the method further includes:
  • the terminal fails to authenticate the core network device, the terminal attempts to re-access the 3GPP network;
  • the access to the 3GPP network is re-attempted.
  • a second aspect provides a processing method for a terminal to access a 3GPP network, including:
  • the core network device determines that the terminal does not have the right to access the 3GPP network according to the identity information of the terminal, sending an unauthorized access message to the terminal, where the unauthorized access message includes the The authentication information of the core network device, where the authentication information is used by the terminal to authenticate the core network device.
  • the authentication information includes certificate information and signature information of the ePDG, or
  • the authentication information includes certificate information and signature information of the ePDG, and an authentication vector set, where the authentication vector set includes a first parameter and a message authentication code MAC;
  • the authentication information includes a first message digest, and the first message digest is performed by the HSS according to a preset algorithm, a failure message code carried by the unauthorised access message, and The identity information of the terminal is generated, or the authentication information includes the set of authentication vectors.
  • a terminal including:
  • a transmitter configured to send an access request message to a core network device of a 3GPP network plan 3GPP network, where the access request message is used to request access to the 3GPP network, where the access request message includes the terminal Identity information;
  • a receiver configured to receive an unprivileged access message sent by the core network device, where the unprivileged access message is used to indicate that the terminal does not have access to the 3GPP network;
  • a processor configured to perform authentication on the sending the core network device according to the authentication information, and after authenticating the core network device, perform a corresponding network access policy to reduce the terminal to the The number of access request messages sent by the core network device.
  • the authentication information includes a first message digest, where the first message digest is used to enable the terminal to be in the core network device Home subscriber server HSS for authentication;
  • the processor is specifically configured to:
  • the first message digest is the same as the second message digest, determining that the HSS authentication is successful; Or, if the first message digest is different from the second message digest, determining that the HSS authentication fails.
  • the authentication information includes an authentication vector set, where the authentication vector set includes a first parameter and a message authentication code MAC, where a parameter is used to generate a desired message authentication code X-MAC;
  • the processor is specifically configured to:
  • the X-MAC is the same as the MAC, it is determined that the HSS authentication is successful; or if the X-MAC is not the same as the MAC, it is determined that the HSS authentication fails.
  • the authentication information includes the certificate information and the signature information of the evolved packet data domain gateway ePDG;
  • the processor is specifically configured to:
  • the authentication information further includes an authentication vector set, where the authentication vector set includes a first parameter and MAC, the first parameter is used to generate an X-MAC;
  • the processor is further configured to:
  • the X-MAC is the same as the MAC, it is determined that the HSS authentication is successful; or if the X-MAC is not the same as the MAC, it is determined that the HSS authentication fails.
  • the processor when the processor performs the corresponding network access policy after successfully authenticating the core network device, the processor is specifically configured to:
  • the first preset condition includes at least one of the following: the terminal replaces the customer identification module SIM card, reboots, the terminal attempts to access the 3GPP network fails to exceed the first preset duration, and the terminal reselects the non-3GPP The internet.
  • the access request message further includes an access point name APN information, where the APN information is used to represent a non-3GPP network used by the terminal, and the core network device includes an ePDG;
  • the processor stops attempting to access the 3GPP network until the state of the terminal meets the first preset condition, and when re-attempting to access the 3GPP network, specifically:
  • the ePDG belongs to the home public land mobile network HPLMN, stop trying to access the 3GPP network until the state of the terminal satisfies at least one of the following: replacing the SIM card, rebooting, attempting to access the 3GPP network, failing to exceed Re-attempting to access the 3GPP network through a non-3GPP network corresponding to the APN information; or
  • the ePDG belongs to the visited public land mobile network VPLMN, after reselecting the non-3GPP network, an attempt is made to access the 3GPP network through the reselected non-3GPP network.
  • the core network device does not include the ePDG, and the first preset condition includes the terminal attempting The first preset duration is exceeded after the failure to access the 3GPP network.
  • the processor is further configured to:
  • the access to the 3GPP network is re-attempted.
  • a core network device including:
  • a receiver configured to receive an access request message sent by the terminal, where the access request message includes at least identity information of the terminal;
  • a processor configured to send, when the terminal does not have the right to access the 3GPP network, according to the identity information of the terminal, send an unprivileged access message to the terminal by using a communication interface, where the unauthorized access message is sent.
  • the authentication information of the core network device is used, and the authentication information is used to enable the terminal to authenticate the core network device.
  • the authentication information includes certificate information and signature information of the ePDG. ,or,
  • the authentication information includes certificate information and signature information of the ePDG, and an authentication vector set, where the authentication vector set includes a first parameter and a message authentication code MAC;
  • the authentication information includes a first message digest, and the first message digest is performed by the HSS according to a preset algorithm, a failure message code carried by the unauthorised access message, and The identity information of the terminal is generated, or the authentication information includes the set of authentication vectors.
  • the terminal sends an access request message to the core network device in the 3GPP network, and the core network device determines that the terminal does not have the right to access the 3GPP network.
  • the user does not have access to the message, and the unauthorised access message includes the authentication information of the core network device.
  • the terminal authenticates the core network device according to the authentication information of the core network device. If the terminal successfully authenticates the core network device, that is, after determining that the source of the unauthorized access message is legal, the network access policy is executed to reduce the network access policy.
  • the number of access request messages is sent to the core network device, thereby reducing the burden on the core network device, and further, the access efficiency of the 3GPP network can be improved.
  • FIG. 1 is a schematic diagram of a core network frame of a 3GPP network in the prior art
  • FIG. 2 is a flowchart of a processing method for a terminal to access a 3GPP network according to an embodiment of the present invention
  • FIG. 3 is a flowchart of a method for processing a terminal accessing a 3GPP network according to an embodiment of the present invention
  • FIG. 4 is a flowchart of a processing method for a terminal to access a 3GPP network according to an embodiment of the present invention
  • FIG. 5 is a flowchart of a method for processing a terminal accessing a 3GPP network according to an embodiment of the present invention
  • FIG. 6 is a flowchart of a method for processing a terminal accessing a 3GPP network according to an embodiment of the present invention
  • FIG. 7 is a block diagram of a terminal according to an embodiment of the present invention.
  • FIG. 8 is a block diagram of a processing apparatus for a terminal to access a 3GPP network according to an embodiment of the present invention.
  • FIG. 9 is a block diagram of a core network device according to an embodiment of the present invention.
  • FIG. 10 is a block diagram of another apparatus for processing a terminal to access a 3GPP network according to an embodiment of the present invention.
  • FIG. 1 is a schematic diagram of a core network device, which mainly includes an HSS (Home Subscriber Server, The home subscriber server, the ePDG (elevated Packet Data Gateway), the AAA (Authentication, Authorization, and Accounting Server, Authentication Authority and Account) server, wherein the HSS is used to determine whether the UE has the right to access 3GPP network.
  • HSS Home Subscriber Server, The home subscriber server, the ePDG (elevated Packet Data Gateway), the AAA (Authentication, Authorization, and Accounting Server, Authentication Authority and Account) server, wherein the HSS is used to determine whether the UE has the right to access 3GPP network.
  • the trusted non-3GPP network access and the non-trusted non-3GPP network access are supported.
  • the WLAN deployed by the operator is trusted.
  • the 3GPP network, and the WLAN in a bookstore is a non-trusted non-3GPP network.
  • the UE In an application scenario that is accessed through a non-trusted non-3GPP network, the UE needs to access the core network through the ePDG. Therefore, in this application scenario, the core network device includes the ePDG, the AAA server, and the HSS; In the application scenario, the UE can access the core network without using the ePDG. Therefore, in the application scenario, the core network device includes the AAA server and the HSS. In the application scenario where the UE directly accesses the 3GPP network, the UE can directly connect. In the application scenario, the core network device includes at least the HSS.
  • FIG. 2 a flowchart of a method for processing a UE to access a 3GPP network according to an embodiment of the present invention is shown. As shown in FIG. 2, the method is applied to a UE, for example, a mobile phone. The method can include the following steps:
  • the UE sends an access request message to a core network device of the 3GPP network.
  • the access request message includes identity information of the UE.
  • the identity information of the UE is used to uniquely characterize the UE, for example, may be an IMSI (International Mobile Subscriber Identification Number) of the UE.
  • IMSI International Mobile Subscriber Identification Number
  • the access request message may further include an APN (Access Point Name) information, where the APN information is used to represent information of the non-3GPP network requested by the UE, for example, , WLAN ID (Identification).
  • APN Access Point Name
  • the UE receives an unprivileged access message sent by the core network device, where the unprivileged access message includes the authentication information of the core network device.
  • the unauthorised access message further includes a failure message code, which is used to indicate the type of the UE that the UE does not have access to the 3GPP network, for example, arrears of downtime, access to the network without permission, and the like.
  • the core network device informs the UE that the UE does not have access to the specific information of the 3GPP through the message.
  • the core network devices are different, and the corresponding authentication information is different.
  • the authentication information may include the authentication information of the ePDG, that is, the certificate information and the sign of the ePDG. Name information; or,
  • the authentication information of the core network device may include the authentication information of the ePDG and the authentication information of the HSS, where the authentication information of the HSS includes an authentication vector set generated when the HSS determines that the UE does not have access to the 3GPP network, where the authentication is performed.
  • the vector set includes a failure message code, a first parameter, and a MAC (Message Authentication Code).
  • the core network device does not include the ePDG, and the authentication information includes a first message digest, where the first message digest is performed by the HSS according to a preset algorithm, the failure message code, and the UE Identity information is generated; or, the authentication information includes the set of authentication vectors.
  • the UE authenticates the core network device according to the authentication information.
  • the UE receives the unauthorised access message from the core network device, and authenticates the core network device by using the authentication information of the core network device included in the unauthorised access message, and determines whether the core network device is legal, that is, has no right. Whether the source of the access message is legal.
  • the UE successfully authenticates the core network device that is, determines that the source of the unauthorized access message is legal, try to connect to the 3GPP network according to the corresponding network access policy, reduce the number of requests for the connected network, and further reduce the core network device to process the access request.
  • the number of messages reduces the burden on the core network devices.
  • the processing method of the terminal accessing the 3GPP network provided by the embodiment, the UE sends an access request message to the core network device in the 3GPP network, and the core network device determines that the UE does not have the right to access the 3GPP network, and sends the access to the UE without permission.
  • the message, the unauthorised access message includes authentication information of the core network device.
  • the UE authenticates the core network device according to the authentication information of the core network device. If the UE successfully authenticates the core network device, that is, determines that the source of the unauthorized access message is legal, the network access policy is executed to reduce the network access policy.
  • the number of access request messages is sent to the core network device, thereby reducing the burden on the core network device, and further, the access efficiency of the 3GPP network can be improved.
  • FIG. 3 a flowchart of a method for processing another UE to access a 3GPP network according to an embodiment of the present invention is shown.
  • the method is applied to a core network device.
  • the method may include the following steps:
  • the core network device receives an access request message sent by the UE, where the access request message includes identity information of the UE.
  • the access request message sent by the UE further includes the APN information
  • the HSS obtains the authority information of the UE according to the identity information of the UE, for example, whether the device is in arrears, etc., and determines the UE. Whether to have access to the 3GPP network; then, determine whether the UE has the right to use the non-3GPP network corresponding to the APN information.
  • the UE has the right to use the non-3GPP network corresponding to the APN information, and The UE has the right to access the 3GPP network, and then determines that the UE can pass the non-3GPP network corresponding to the APN information; otherwise, if either of the two is not satisfied, it is determined that the UE does not have access to the 3GPP network.
  • the core network devices When the core network devices are different, the corresponding authentication information is different, as described above, and will not be described here.
  • the HSS determines that the UE does not have access to the 3GPP network, the HSS sends an unprivileged access message to the AAA server, and the AAA server then accesses the AAA server.
  • the message is sent to the ePDG, and the ePDG adds its own authentication information to the unprivileged access message and sends it to the UE.
  • the HSS determines that the UE does not have access to the 3GPP network, an unauthorised access message is generated, and the authentication information of the HSS may be obtained. Join the unprivileged access message and send it to the UE.
  • the UE authenticates the core network device according to the authentication information of the core network device, and after authenticating the core network device, performs a corresponding network access policy to reduce the number of access request messages sent to the core network device, thereby reducing The burden of the core network equipment.
  • the processing method of the UE accessing the 3GPP network provided by the embodiment, the core network device determining, according to the identity information of the UE, whether the UE has the right to access the 3GPP network, and if it is determined that the UE does not have the permission, generating an unauthorized access message,
  • the right access message carries the authentication information of the core network device.
  • the UE authenticates the core network device according to the authentication information of the core network device. If the UE successfully authenticates the core network device, that is, after determining that the source of the unauthorized access message is legal, the UE performs the corresponding network access policy to reduce the The core network device sends the number of access request messages, thereby reducing the burden on the core network device, and further improving the access efficiency of the 3GPP network.
  • FIG. 4 a flowchart of a method for processing a terminal to access a 3GPP network according to an embodiment of the present invention is shown, where the method is applied to an application scenario in which a UE accesses a 3GPP network through a non-trusted non-3GPP network, for example, the UE passes The non-trusted WLAN accesses the 3GPP network.
  • the method may include the following steps:
  • the UE sends an access request message to the ePDG.
  • the access request message includes identity information of the UE and APN information.
  • the APN information characterizes the non-trusted non-3GPP network that the UE applies for.
  • the UE and the ePDG before the UE sends an access request message to the ePDG, the UE and the ePDG perform IKEv2_SA_INIT signaling interaction, negotiate an encryption algorithm, use a random number for encryption, and exchange D-H data of the generated key.
  • the UE sends an access request message to the ePDG, where the access request message is used to request access to the 3GPP network.
  • the ePDG forwards the access request message to the AAA server.
  • the AAA server sends the access request message to the HSS.
  • the HSS determines, according to the identity information of the UE and the APN information, whether the UE has the right to access the 3GPP network. If the UE does not have the right to access the 3GPP network, perform S350.
  • the HSS obtains the authority information of the UE according to the identity information of the UE, for example, whether the arrears are down, etc., and determines whether the UE has the right to access the 3GPP network. Then, it is determined whether the UE has the right to use the non-3GPP network corresponding to the APN information. If the UE has the right to use the non-3GPP network corresponding to the APN information, and the UE has the right to access the 3GPP network, it is determined that the UE can pass the non-3GPP network corresponding to the APN information; otherwise, if any one of the two is not satisfied, it is determined that the UE has no right. Access to the 3GPP network.
  • the HSS generates a failure message code, and sends the failure message code to the AAA server.
  • the HSS determines that the UE does not have access to the 3GPP network
  • the corresponding failure message code is generated and transmitted to the UE through the AAA server and the ePDG.
  • the AAA server sends the failure message code to the ePDG.
  • the ePDG obtains an unprivileged access message according to the failure message code and the authentication information of the ePDG, and sends the unprivileged access message to the UE.
  • the ePDG After receiving the failure message code, the ePDG adds its own authentication information to the failure message code and transmits it to the UE.
  • the authentication information of the ePDG includes a certificate (Certificate) and signature information.
  • the signature information that is, AUTH (authentication, Right) information.
  • S380 The UE authenticates the ePDG according to the authentication information of the ePDG. If the UE successfully authenticates the ePDG, the process proceeds to S390. If the UE fails to authenticate the ePDG, the process proceeds to S3120.
  • the UE verifies the authenticity of the ePDG certificate and the AUTH information.
  • the UE acquires the identity of the ePDG, and obtains the ePDG certificate from the authentication center according to the identity of the ePDG, and then compares the obtained ePDG certificate with the received ePDG. Whether the certificates are the same; AUTH information is used to describe the authentication method and authentication content.
  • the ePDG certificate and the AUTH information are both correct, it is determined that the ePDG is successfully authenticated, that is, the ePDG is determined to be a legal device; if any of the ePDG certificate and the AUTH information is incorrect, it is determined that the ePDG authentication fails, that is, The ePDG is not a legitimate device, that is, the access to the source is not legal.
  • the UE determines whether the ePDG belongs to the HPLMN (Home Public Land Mobile Network) or the VPLMN (Visited Public Land Mobile Network); if the ePDG belongs to the HPLMN, executes S3100; if the ePDG belongs to VPLMN, then execute S3110.
  • HPLMN Home Public Land Mobile Network
  • VPLMN Vehicle Land Mobile Network
  • the UE may determine whether the ePDG is an ePDG deployed by the HPLMN or an ePDG deployed by the VPLMN according to the information in the FQDN (Fully Qualified Domain Name) message of the ePDG.
  • FQDN Full Qualified Domain Name
  • S3100 The UE stops trying to access the 3GPP network from the non-trusted non-3GPP network until the state of the UE meets at least one of the following: replacing a SIM (Subscriber Identity Module) card, rebooting, and timing exceeds the first preset duration .
  • SIM Subscriber Identity Module
  • the UE When the UE attempts to access the 3GPP network, it starts timing, and after the timing reaches the first preset duration, it re-attempts to access the 3GPP network.
  • the current non-trusted non-3GPP network that is, the non-trusted non-3GPP network that the UE applies for, that is, the non-trusted non-3GPP network corresponding to the APN information.
  • S3110 The UE reselects the non-3GPP network and attempts to access the 3GPP network from the reselected non-3GPP network.
  • the non-3GPP network (including trusted non-3GPP and non-trusted non-3GPP) is reselected and attempts to access the 3GPP network through the reselected non-3GPP network.
  • S3120 The UE attempts to re-access the 3GPP network from the current non-trusted non-3GPP network. If the preset number of attempts fails, the second preset time period is re-attempted to access the 3GPP network from the current non-trusted non-3GPP network. .
  • the UE fails to authenticate the ePDG, that is, the UE considers the ePDG to be an illegal device, attempts to access the 3GPP network from the current non-trusted non-3GPP network, and after failing to try the preset number of times, the first timer is started, when the first Before the timer reaches the second preset duration, no longer attempts to access the 3GPP network from the current non-trusted non-3GPP network; if the first timer exceeds the second preset duration, retrying from the current non-trusted non-3GPP network Access to the 3GPP network, and start the first timer again after failing to try the preset number of times.
  • the current non-trusted non-3GPP network refers to a non-3GPP network used by the UE to try to access the 3GPP.
  • the preset number of times and the value of the second preset duration can be freely set by the home operator according to actual needs.
  • the processing method of the terminal accessing the 3GPP network provided by the embodiment is applied to the application scenario of accessing the 3GPP network through the non-trusted non-3GPP network.
  • the failure message code is generated.
  • the failure message code is delivered to the ePDG, and the ePDG obtains the unauthorised access message according to the failure message code and its own authentication information, and sends the message to the UE.
  • the UE determines whether the ePDG is a legal device according to the authentication information of the ePDG.
  • the UE does not retry to access the 3GPP network before the state of the UE meets the corresponding condition, so as to reduce the sending of the access request to the core network device.
  • the number of messages, thereby mitigating The burden on the core network equipment further improves the efficiency of the terminal accessing the 3GPP network.
  • FIG. 5 a flowchart of a method for processing a terminal to access a 3GPP network according to an embodiment of the present invention is shown.
  • the method may be applied to an application scenario in which a UE accesses a 3GPP network through a non-trusted non-3GPP network.
  • the method can include the following steps:
  • the UE sends an access request message to the ePDG.
  • the access request message includes at least the identity information of the UE and the APN information.
  • the APN information characterizes the non-trusted non-3GPP network that the UE applies for.
  • the ePDG forwards the access request message to the AAA server.
  • the AAA server sends an access request message to the HSS.
  • the HSS determines, according to the identity information of the UE and the APN information, whether the UE has the right to access the 3GPP network. If the UE does not have the right to access the 3GPP network, perform S450.
  • the HSS generates a failure message code, and obtains a first message digest according to the preset algorithm, the failure message code, the identity information of the UE, and the APN information.
  • the HSS may input the identity information, the APN information, and the failure message code of the UE into a preset algorithm to obtain a first message digest.
  • the preset algorithm can be an integrity protection algorithm, such as the Hash-256 algorithm.
  • the HSS obtains the first message digest according to the preset algorithm, the identity information of the UE, the APN information and the failure message code, and other information.
  • the HSS obtains an unprivileged access message according to the failure message code and the first message digest, and sends the unauthorised access message to the AAA server.
  • the HSS will generate the first message digest and the failure message code as unprived access messages and deliver them to the UE.
  • the AAA server sends the received unprivileged access message to the ePDG.
  • the ePDG sends the received unprivileged access message to the UE.
  • the UE After receiving the unauthorised access message, the UE obtains the failure message code and the first message digest.
  • the UE obtains a second message digest according to the preset algorithm, the failure message code, the identity information of the UE, and the APN information.
  • the UE generates a second message digest by using the HSS to generate a first message digest.
  • S4110 The UE compares whether the first message digest and the second message digest are the same; if they are the same, executing S4120; if not, executing S4160.
  • S4120 The UE determines that the HSS authentication is successful; that is, the UE determines that the HSS is a legal device.
  • S4130 The UE determines whether the ePDG belongs to the HPLMN or the VPLMN; if the ePDG belongs to the HPLMN, executes S4140; if the ePDG belongs to the VPLMN, executes S4150.
  • the UE After the UE determines that the HSS is a legal device, it needs to determine the network to which the ePDG belongs, as described above, and details are not described herein again.
  • S4140 The UE stops trying to access the 3GPP network from the non-trusted non-3GPP network until the state of the UE meets at least one of the following: the UE replaces the SIM card, restarts, and the timing exceeds the first preset duration.
  • the UE When the UE attempts to access the 3GPP network, it starts timing, and after the timing reaches the first preset duration, it re-attempts to access the 3GPP network.
  • S4150 The UE reselects the non-3GPP network and attempts to access the 3GPP network from the reselected non-3GPP network.
  • the non-3GPP network (including trusted non-3GPP and non-trusted non-3GPP) is reselected and attempts to access the 3GPP network through the reselected non-3GPP network.
  • the S4130 to S4150 are the same as the S390 to S3110 in the embodiment shown in FIG. 4, and details are not described herein again.
  • S4160 The UE attempts to re-access the 3GPP network from the current non-trusted non-3GPP network. If the attempted preset times fail, the UE attempts to access the 3GPP network from the current non-trusted non-3GPP network after the second preset duration.
  • the current non-trusted non-3GPP network that is, the non-trusted non-3GPP network that the UE applies for, that is, the non-trusted non-3GPP network corresponding to the APN information.
  • the UE fails to authenticate the HSS, that is, the HSS is considered to be an illegal device, retrying to access the 3GPP network from the current non-trusted non-3GPP network, and after failing the preset number of times, the first timer is started, when the first Before the timer reaches the second preset duration, no longer attempts to access the 3GPP network from the current non-trusted non-3GPP network; if the first timer exceeds the second preset duration, retrying from the current non-trusted non-3GPP network Access to the 3GPP network, and start the first timer again after failing to try the preset number of times.
  • the preset number of times and the value of the second preset duration may be freely set by the home operator according to actual needs.
  • the processing method of the terminal accessing the 3GPP network provided by this embodiment, after determining that the UE does not have the right to access the 3GPP network, the HSS obtains the first message digest according to the preset algorithm, using the failure message code, the identity information of the UE, and the APN information. And sending the first message digest and the failure message code to the UE as an unprivileged access message.
  • the UE After receiving the unauthorised access message, the UE generates the second message digest by using the same method, and the UE authenticates the HSS by comparing the first message digest with the second message digest; if the HSS authentication succeeds, the UE is not authorized to access.
  • the message implements a corresponding network access policy, which reduces the number of network access requests sent to the core network device, thereby reducing the burden on the core network device and further improving the efficiency of the terminal accessing the 3GPP network.
  • the processing method of the terminal accessing the 3GPP network provided by the embodiment shown in FIG. 5, the HSS directly adds a first message digest for the UE to verify whether the HSS is a legal device, so that the UE does not need to The ePDG performs authentication. Therefore, the method of authenticating the HSS through the message digest can be applied to an application scenario that does not require ePDG, for example, accessing the 3GPP network through a trusted non-3GPP network, or directly accessing the 3GPP network.
  • the method for authenticating the HSS by using the message digest is the same as the related step in FIG. 5 in the application scenario where the ePDG is required, and details are not described herein again.
  • the 3GPP network is no longer attempted to access the 3GPP network before the timing exceeds the first preset duration; when the timing exceeds the first preset duration, the 3GPP network is attempted to access.
  • the UE attempts to access the 3GPP network, it starts timing, and after the timing reaches the first preset duration, it re-attempts to access the 3GPP network.
  • the authentication of the HSS fails, the user attempts to access the 3GPP network. If the number of attempts fails, the timer starts after the preset number of attempts fails, and then attempts to access the 3GPP after the timing reaches the second preset duration.
  • the internet The internet.
  • FIG. 6 a flowchart of a method for processing a terminal to access a 3GPP network according to an embodiment of the present invention is shown.
  • the method may be applied to an application scenario of accessing a 3GPP network through a non-trusted non-3GPP network, as shown in FIG. 6.
  • the method can include the following steps:
  • the UE sends an access request message to the ePDG.
  • the access request message includes at least the identity information of the UE and the APN information.
  • the APN information indicates information of a non-trusted non-3GPP network that the UE applies for.
  • the ePDG forwards the access request message to the AAA server.
  • the AAA server sends an access request message to the HSS.
  • the HSS determines, according to the identity information of the UE and the APN information, whether the UE has the right to access the 3GPP network. If the UE does not have the right to access the 3GPP network, perform S550.
  • the HSS generates an authentication vector set, and carries the failure message code in the authentication vector set.
  • the authentication vector set includes an AMF (Authentication Management Field), a first parameter, and a MAC; the failure message code may be copied into the AMF, and the AMF is used as a carrier for transmitting the failed message code.
  • the first parameter is used to generate an X-MAC (Excepted Message Authentication Code).
  • the AMF is a part of the authentication vector set. There are 16 bits in total. The 0th bit is a separate bit.
  • the authentication parameter used to distinguish the HSS is the UMTS (Universal Mobile Telecommunications System) network. It is also an LTE (Long Term Evolution) network. If it is a UMTS network, the 0th bit is "0"; if it is an LTE network, the 0th bit is "1". Other bits of the AMF can be used to store the failed message code.
  • the first parameter may include a key and a random number, and the UE generates an X-MAC by using a random number and a key; or the first parameter includes at least a random number, and the key may be generated by the UE, and the UE further according to the secret The key and the random number generate an X-MAC.
  • the HSS sends an unprivileged access message to the AAA server, and the unprivileged access message includes the set of authentication vectors.
  • the authentication vector set is deleted, thereby saving storage space in the HSS.
  • the AAA server sends the received unprivileged access message to the ePDG.
  • the ePDG carries its own authentication information in the unauthorised access message and sends the information to the UE.
  • the authentication information of the ePDG includes the certificate and AUTH information of the ePDG.
  • the UE After receiving the unauthorized access message, the UE obtains the authentication information of the ePDG and authenticates the ePDG. If the UE successfully authenticates the ePDG, the S5100 is performed. If the UE fails to authenticate the ePDG, the S5150 is performed.
  • the UE After receiving the unauthorised access message, the UE first authenticates the ePDG. If the ePDG is successfully authenticated, the UE authenticates the HSS. Otherwise, after the ePDG fails to authenticate, the HSS does not need to be authenticated.
  • the UE obtains an X-MAC according to the first parameter, and compares whether the X-MAC and the MAC are the same. If the X-MAC is the same as the MAC, the S5110 is performed. If the X-MAC is different from the MAC, the S5150 is performed.
  • the UE determines that the HSS is a legal device. That is, the UE determines that the unauthorised access message originates from a legitimate device.
  • S5120 The UE determines whether the ePDG belongs to the HPLMN or the VPLMN; if the ePDG belongs to the HPLMN, executes S5130; if the ePDG belongs to the VPLMN, executes S5140.
  • the UE After the UE successfully authenticates the HSS, the UE needs to perform the corresponding network access policy according to the network to which the ePDG belongs.
  • S5130 The UE stops trying to access the 3GPP network from the current non-trusted non-3GPP network until the state of the UE meets at least one of the following: the UE replaces the SIM card, restarts, and the timing exceeds the first preset duration.
  • the UE When the UE attempts to access the 3GPP network, it starts timing, and after the timing reaches the first preset duration, it re-attempts to access the 3GPP network.
  • S5140 The UE reselects the non-3GPP network and attempts to access the 3GPP network from the reselected non-3GPP network.
  • the non-3GPP network (including trusted non-3GPP and non-trusted non-3GPP) is reselected and attempts to access the 3GPP network through the reselected non-3GPP network.
  • the S5120 to S5140 are the same as the S390 to S3110 in the embodiment shown in FIG. Said.
  • S5150 The UE determines that the source authentication of the untrusted access message fails, and attempts to re-access the 3GPP network from the current non-trusted non-3GPP network. If the preset number of attempts fails, after the second preset duration, Attempts to access the 3GPP network from the current non-trusted non-3GPP network.
  • the UE fails to authenticate the ePDG, or if the authentication of the HSS fails, that is, the UE considers that the unauthorised access message originates from the illegal device, retrying to access the 3GPP network from the current non-trusted non-3GPP network, and attempting to preset After the number of times fails, the first timer is started.
  • the network device Before the first timer reaches the second preset duration, no longer attempts to access the 3GPP network from the current non-trusted non-3GPP network; if the first timer exceeds the second pre- After the duration is set, the network device is re-attempted to access the 3GPP network from the current non-trusted non-3GPP network, and after the failure of the preset number of attempts, the first timer is started again.
  • the preset number of times and the value of the second preset duration may be freely set by the home operator according to actual needs.
  • the HSS determines that the UE does not have access to the 3GPP network, generates an authentication vector set, and carries the failure message code in the authentication vector set.
  • the UE determines whether the HSS is a legal device according to the parameter in the authentication vector set. If the HSS is a legal device, the network connection sent to the core network device is reduced according to the corresponding network access policy. The number of incoming requests reduces the burden on the core network device and further improves the efficiency of the terminal accessing the 3GPP network.
  • the method for processing a terminal to access a 3GPP network provided by this embodiment, after the HSS determines that the UE does not have access to the 3GPP network, generates an authentication vector set.
  • the UE can directly use the authentication vector set to authenticate the HSS.
  • the method can be applied to an application scenario that does not require an ePDG, for example, an application scenario in which a trusted non-3GPP network accesses a 3GPP network or directly accesses a 3GPP network.
  • the UE accesses the 3GPP network, or directly accesses the 3GPP network, if the UE successfully authenticates the HSS according to the authentication vector set, the UE does not attempt to connect until the first preset duration is exceeded. Entering the 3GPP network; attempting to access the 3GPP network after the timing exceeds the first preset duration. When the UE attempts to access the 3GPP network, it starts timing, and after the timing reaches the first preset duration, it re-attempts to access the 3GPP network. If the authentication of the HSS fails, the user attempts to access the 3GPP network. If the number of attempts fails, the timer starts after the preset number of attempts fails, and then attempts to access the 3GPP after the timing reaches the second preset duration. The internet.
  • the present invention also provides A terminal embodiment is provided.
  • the terminal includes a transmitter 710, a receiver 720, and a processor 730.
  • the sender 710 is configured to send an access request message to the core network device of the third generation partner plan 3GPP network, where the access request message is used to request access to the 3GPP network, where the access request message includes the The identity information of the terminal.
  • the receiver 720 is configured to receive an unprivileged access message sent by the core network device, where the unprivileged access message is used to indicate that the terminal does not have access to the 3GPP network.
  • the processor 730 is configured to perform authentication on the core network device according to the authentication information, and after authenticating the core network device, perform a corresponding network access policy to reduce the terminal location.
  • the processor 730 is specifically configured to: stop attempting to access the 3GPP network, until when the state of the terminal meets the first preset condition, Re-attempting to access the 3GPP network; the first preset condition includes at least one of the following: the terminal replaces the customer identification module SIM card, reboots, and the terminal fails to exceed the first pre-trial after attempting to access the 3GPP network Given the duration, the terminal reselects the non-3GPP network.
  • the processor 730 is specifically configured to: if the authentication of the core network device fails, try to re-access the 3GPP network; if the attempted preset times fail, the second After the preset duration, the access to the 3GPP network is re-attempted.
  • the terminal provided in this embodiment sends an access request message to the core network device in the 3GPP network through the transmitter, and the core network device determines that the terminal does not have the right to access the 3GPP network, and then sends an unprivileged access message to the terminal.
  • the access message contains authentication information of the core network device. After receiving the unauthorised access message by the receiver, the terminal authenticates the core network device according to the authentication information of the core network device. If the terminal successfully authenticates the core network device, the terminal determines the source of the unauthorized access message. After being legal, the network access policy is executed to reduce the number of access request messages sent to the core network device, thereby reducing the burden on the core network device, and further improving the access efficiency of the 3GPP network.
  • the authentication information received by the terminal includes a first message digest
  • the first message digest is generated by the HSS, and is used to enable the terminal to authenticate the HSS.
  • the embodiment may be applied to the terminal. Accessing the 3GPP network through the non-trusted non-3GPP network, or accessing the 3GPP network through the trusted 3GPP network, or directly accessing the application scenario of the 3GPP network.
  • the processor 730 is configured to perform authentication on the core network device according to the authentication information.
  • the processor 730 is configured to perform authentication on the core network device according to the authentication information.
  • the HSS after determining that the terminal does not have the right to access the 3GPP network, the HSS obtains the first message digest according to the preset algorithm, using the failure message code, the identity information of the terminal, and the APN information, and the first message digest and The failure message code is sent to the terminal as an unprivileged access message.
  • the terminal After receiving the unauthorised access message, the terminal generates the second message digest by using the same method, and the terminal authenticates the HSS by comparing the first message digest with the second message digest; if the HSS authentication succeeds, the terminal is not authorized to access.
  • the message implements a corresponding network access policy, which reduces the number of network access requests sent to the core network device, thereby reducing the burden on the core network device and further improving the efficiency of the terminal accessing the 3GPP network.
  • the authentication vector set is still generated, so that the terminal authenticates the HSS according to the authentication vector set.
  • This embodiment can be applied to an application scenario in which a terminal accesses a 3GPP network through a non-trusted non-3GPP network, or accesses a 3GPP network through a trusted 3GPP network, or directly accesses a 3GPP network.
  • the authentication information includes an authentication vector set, where the authentication vector set includes a first parameter and a message authentication code MAC, and the first parameter is used to generate a desired message authentication code X-MAC;
  • processor 730 When the processor 730 is configured to perform authentication on the core network device according to the authentication information, it is specifically used to:
  • the X-MAC is the same as the MAC, it is determined that the HSS authentication is successful; or if the X-MAC is not the same as the MAC, it is determined that the HSS authentication fails.
  • the HSS after determining that the terminal does not have the right to access the 3GPP network, the HSS generates an authentication vector set and carries the failure message code in the authentication vector set. After receiving the authentication vector set sent by the HSS, the terminal determines whether the HSS is a legal device according to the parameter in the authentication vector set. If the HSS is a legal device, the network connection sent to the core network device is reduced according to the corresponding network access policy. The number of incoming requests reduces the burden on the core network device and further improves the efficiency of the terminal accessing the 3GPP network.
  • the authentication information includes the certificate information and the signature information of the ePDG.
  • the embodiment is applied to the application scenario where the terminal accesses the 3GPP network through the non-trusted non-3GPP network, that is, the core network is applied to the core network.
  • the device includes the application scenario of the ePDG.
  • the processor 730 is configured to authenticate the core network device according to the authentication information, specifically, the processor 730 is configured to:
  • the terminal provided in this embodiment is applied to the application scenario of accessing the 3GPP network through the non-trusted non-3GPP network.
  • the failure message code is generated, and the failure message code is transmitted to the terminal.
  • the ePDG obtains an unprivileged access message according to the failure message code and its own authentication information, and sends the message to the terminal.
  • the terminal determines whether the ePDG is a legal device according to the authentication information of the ePDG. If the ePDG is determined to be a legal device, the terminal does not retry to access the 3GPP network before the state of the terminal meets the corresponding condition, so as to reduce the sending of the access request to the core network device.
  • the number of messages thereby reducing the burden on the core network equipment, and further improving the efficiency of the terminal accessing the 3GPP network.
  • the authentication information further includes an authentication vector set, where the authentication vector set includes a first parameter and a MAC, and the first parameter is used to generate an X-MAC; Applicable to the application scenario where the core network device includes the ePDG.
  • the processor 730 is configured to: when authenticating the core network device according to the authentication information, specifically:
  • certificate information and the signature information of the ePDG are both correct, determining that the ePDG is successfully authenticated; or, if the certificate information or the signature information of the ePDG is incorrect, determining that the ePDG authentication fails;
  • the X-MAC is the same as the MAC, it is determined that the HSS authentication is successful; or if the X-MAC is not the same as the MAC, it is determined that the HSS authentication fails.
  • the terminal accesses the 3GPP network through the non-trusted non-3GPP network.
  • the core network device includes the ePDG, and the access request message sent by the terminal further includes the access point name APN information.
  • the APN information is used to represent a non-3GPP network used by the terminal to apply for;
  • the processor 730 stops attempting to access the 3GPP network until when the state of the terminal meets the first preset condition, when retrying to access the 3GPP network, specifically:
  • the ePDG belongs to the HPLMN, stop trying to access the 3GPP network until the state of the terminal meets at least one of the following: after replacing the SIM card, rebooting, or attempting to access the 3GPP network fails to exceed the first preset duration, retrying to pass the APN
  • the non-3GPP network corresponding to the information accesses the 3GPP network; or
  • the ePDG belongs to the VPLMN, after reselecting the non-3GPP network, an attempt is made to access the 3GPP network through the reselected non-3GPP network.
  • the UE accesses the 3GPP network through the trusted non-3GPP network, or directly accesses the 3GPP network.
  • the core network device does not include the ePDG, and the first preset Conditions include exceeding the first preset duration after attempting to access the 3GPP network.
  • the processor 730 is specifically configured to re-attempt to access the 3GPP network after reselecting the non-3GPP network after the terminal attempts to access the 3GPP network fails for more than the first preset duration.
  • FIG. 8 a block diagram of a processing device for a terminal to access a 3GPP network according to an embodiment of the present invention is shown.
  • the device is applied to a terminal.
  • the device may include: a sending module 810, and a receiving module 820.
  • the sending module 810 is configured to send an access request message to the core network device of the third generation partner plan 3GPP network, where the access request message is used to request access to the 3GPP network, where the access request message includes the The identity information of the terminal.
  • the receiving module 820 is configured to receive an unprivileged access message sent by the core network device, where the unprivileged access message is used to indicate that the terminal does not have access to the 3GPP network.
  • the authentication module 830 is configured to perform authentication on the sending the core network device according to the authentication information.
  • the authentication information includes a first message digest, and the first message digest is generated by the HSS, so that the terminal authenticates the home subscriber server HSS in the core network device.
  • the authentication module 830 is specifically configured to:
  • the authentication information includes an authentication vector set, the authentication vector set includes a first parameter and a message authentication code MAC, and the first parameter is used to generate an X-MAC;
  • the authentication module 830 is specifically configured to:
  • the X-MAC is the same as the MAC, it is determined that the HSS authentication is successful; or if the X-MAC is not the same as the MAC, it is determined that the HSS authentication fails.
  • the authentication information of the core network device includes the certificate information and the signature information of the ePDG, and the authentication module 830 is specifically configured to:
  • the authentication information includes authentication information of the ePDG, and an authentication vector set.
  • the set of authentication vectors includes a first parameter and a MAC, and the first parameter is used to generate an X-MAC;
  • the authentication module 830 is specifically configured to:
  • the certificate information and the signature information of the ePDG are both correct, it is determined that the ePDG is successfully authenticated; or if the certificate information or the signature information of the ePDG is incorrect, it is determined that the ePDG authentication fails.
  • the X-MAC is the same as the MAC, it is determined that the HSS authentication is successful; or if the X-MAC is not the same as the MAC, it is determined that the HSS authentication fails.
  • the execution module 840 is configured to: after the authentication module 830 successfully authenticates the core network device, perform a corresponding network access policy to reduce the number of the access request messages sent by the terminal to the core network device.
  • the execution module 840 is specifically configured to:
  • the first preset condition includes at least one of the following: the terminal replaces the SIM card of the customer identification module, and is restarted. After the terminal attempts to access the 3GPP network, the terminal exceeds the first preset duration, and the terminal reselects the non-3GPP. The internet.
  • the access request message further includes an access point name APN information, where the APN information is used to represent a non-3GPP network used by the terminal to apply, and the core network device includes an ePDG;
  • the execution module 840 is specifically configured to:
  • the ePDG belongs to the HPLMN, stop trying to access the 3GPP network until the state of the terminal satisfies at least one of the following: re-trying after replacing the SIM card, rebooting, or attempting to access the 3GPP network fails for more than the first preset duration Accessing the 3GPP network by using a non-3GPP network corresponding to the APN information;
  • the ePDG belongs to the VPLMN, after reselecting the non-3GPP network, an attempt is made to access the 3GPP network through the reselected non-3GPP network.
  • the core network device does not include the ePDG, that is, the terminal accesses the 3GPP network through the trusted non-3GPP network, or directly accesses the 3GPP network; and the executing module 840 is specifically configured to: when the terminal attempts to access After the 3GPP network fails and exceeds the first preset duration, it re-attempts to access the 3GPP network.
  • the executing module 840 is specifically configured to:
  • the processing device of the terminal accessing the 3GPP network provided by the UE in the embodiment the UE is connected to the core network in the 3GPP network
  • the device sends an access request message, and the core network device determines that the UE does not have the right to access the 3GPP network, and then sends an unprivileged access message to the UE, where the unprivileged access message includes the authentication information of the core network device.
  • the UE authenticates the core network device according to the authentication information of the core network device. If the UE successfully authenticates the core network device, that is, determines that the source of the unauthorized access message is legal, the network access policy is executed to reduce the network access policy.
  • the number of access request messages is sent to the core network device, thereby reducing the burden on the core network device, and further, the access efficiency of the 3GPP network can be improved.
  • the core network device includes a bus 940; and a processor 910, a communication interface 920, and a memory 930 connected to the bus 940. .
  • the communication interface 920 is configured to receive an access request message sent by the terminal, where the access request message includes at least the identity information of the terminal.
  • the memory 930 is configured to store an instruction, and the processor 910 executes the instruction, when determining that the terminal does not have the right to access the 3GPP network according to the identity information of the terminal, sending an unauthorized access message to the terminal through the communication interface 930, where the command is not authorized.
  • the access message includes authentication information of the core network device, and the authentication information is used to enable the terminal to authenticate the core network device.
  • the authentication information includes certificate information and signature information of the ePDG; or, the authentication information includes certificate information and signature information of the ePDG, and an authentication vector set, and the authentication The vector set is generated when the HSS determines that the terminal does not have access to the 3GPP network, and the authentication vector set includes the first parameter and the message authentication code MAC.
  • the core network device does not include the ePDG, and the authentication information includes a first message digest, and the first message digest is failed by the HSS according to a preset algorithm and an unauthorised access message.
  • the message code and the identity information of the terminal are generated; or, the authentication information includes a set of authentication vectors.
  • the process of the terminal authenticating the HSS according to the authentication vector set, and the process of the terminal authenticating the HSS according to the first message digest refer to the corresponding method embodiment.
  • the relevant content no longer repeat here.
  • the core network device determines, according to the identity information of the terminal, whether the terminal has the right to access the 3GPP network, and if it is determined that the terminal does not have the permission, the device generates an unauthorized access message and does not have access to the message. Carry the authentication information of the core network device.
  • the terminal authenticates the core network device according to the authentication information of the core network device. If the terminal successfully authenticates the core network device, that is, after determining that the source of the unauthorized access message is legal, the terminal performs the corresponding network access policy to reduce the
  • the core network device sends the number of access request messages, thereby reducing the burden on the core network device, and further improving the access efficiency of the 3GPP network.
  • FIG. 10 a block diagram of a processing apparatus for a terminal to access a 3GPP network according to an embodiment of the present invention is shown.
  • the device is applied to a core network device.
  • the device may include: a receiving module 1010, a processing module 1020, and a communication module 1030.
  • the receiving module 1010 is configured to receive an access request message sent by the terminal, where the access request message includes at least the identity information of the terminal.
  • the processing module 1020 is configured to: when determining, according to the identity information of the terminal, that the terminal does not have the right to access the 3GPP network, send the unprivileged access message to the terminal by using the communication module 1030, where the unprivileged access message includes the core network device.
  • the authentication information is used to enable the terminal to authenticate the core network device.
  • the authentication information includes certificate information and signature information of the ePDG; or, the authentication information includes certificate information and signature information of the ePDG, and an authentication vector set, and the authentication The vector set is generated when the HSS determines that the terminal does not have access to the 3GPP network, and the authentication vector set includes the first parameter and the message authentication code MAC.
  • the core network device does not include the ePDG, and the authentication information includes a first message digest, and the first message digest is failed by the HSS according to a preset algorithm and an unauthorised access message.
  • the message code and the identity information of the terminal are generated; or, the authentication information includes a set of authentication vectors.
  • the processing device of the terminal accessing the 3GPP network determines, according to the identity information of the terminal, whether the terminal has the right to access the 3GPP network, and if it is determined that the terminal does not have the permission, the device generates an unauthorized access message,
  • the right access message carries the authentication information of the core network device.
  • the terminal authenticates the core network device according to the authentication information of the core network device. If the terminal successfully authenticates the core network device, that is, after determining that the source of the unauthorized access message is legal, the terminal performs the corresponding network access policy to reduce the
  • the core network device sends the number of access request messages, thereby reducing the burden on the core network device, and further improving the access efficiency of the 3GPP network.

Abstract

一种终端接入3GPP网络的处理方法，UE向3GPP网络中的核心网设备发送接入请求消息，核心网设备判断UE没有接入3GPP网络的权限后，向UE发送无权接入消息，该无权接入消息包含核心网设备的鉴权信息。UE根据核心网设备的鉴权信息对该核心网设备进行鉴权，如果UE对核心网设备鉴权成功，即确定无权接入消息的来源合法后，则执行相应的网络接入策略，减少向所述核心网设备发送接入请求消息的数量，从而减轻核心网设备的负担，进而，能够提高3GPP网络的接入效率。

Description

终端接入3GPP网络的处理方法及装置 技术领域
本发明涉及通信技术领域，尤其涉及终端接入3GPP(The 3rd Generation Partnership Project，第三代合作伙伴计划)网络的处理方法及装置。
背景技术
3GPP主要是为第三代移动通信系统制定全球适用技术规范和技术报告。基于3GPP框架的网络均可以称为3GPP网络，例如，基于3GPP框架的移动通信网络。
3GPP网络可以为移动终端之间进行通信提供基础，具有信号覆盖宽广、移动性能较高的优点，但是数据传输速率较低。而非3GPP网络，例如，WLAN(Wireless Local Area Networks，无线局域网)可以提供热点覆盖、具有数据传输速率较高的特点，但是移动性能低。因此，如果将3GPP网络和非3GPP(non-3GPP)网络结合，既能提高用户体验，又能降低网络建设成本和无线资源需求。
UE(User Equipment，用户设备)可以直接接入3GPP网络，也可以通过非3GPP网络接入3GPP网络，核心网设备会判断UE是否有权接入3GPP网络；如果核心网设备发现UE无权接入，则产生无权接入消息并发送给UE，但是，UE仍然会继续尝试接入3GPP网络。如果有50万个用户尝试接入3GPP网络，假设会有40万个用户因为没有权限导致无法接入，也就是说，HSS会对这40万个用户发送无权接入消息，而这40万个用户仍会不停地尝试接入3GPP网，导致核心网设备负担过重。
发明内容
本发明实施例中提供了一种终端接入3GPP网络的处理方法及装置，以解决现有技术中核心网设备负担过重的问题。
为了解决上述技术问题，本发明实施例公开了如下技术方案：
第一方面，本发明提供一种终端接入3GPP网络的处理方法，包括：
终端向第三代合作伙伴计划3GPP网络的核心网设备发送接入请求消息，所述接入请求消息用于请求接入所述3GPP网络，所述接入请求消息包括所述终端的身份信息；
所述终端接收所述核心网设备发送的无权接入消息，所述无权接入消息用于表征 所述终端无权接入所述3GPP网络；
所述终端根据所述鉴权信息对发送所述核心网设备进行鉴权；
当所述终端对所述核心网设备鉴权成功后，执行相应的网络接入策略，以减少所述终端向所述核心网设备发送接入请求消息的数量。
结合第一方面，在第一方面的第一种可能的实现方式中，所述鉴权信息包括第一消息摘要，所述第一消息摘要用于使所述终端对所述核心网设备中的归属用户服务器HSS进行鉴权；
所述终端根据所述鉴权信息对所述核心网设备进行鉴权，包括：
根据预设算法、所述终端的身份信息及所述无权接入消息携带的失败消息码，生成第二消息摘要；
若所述第一消息摘要与所述第二消息摘要相同，则确定对所述HSS鉴权成功；或者，若所述第一消息摘要与所述第二消息摘要不同，则确定对所述HSS鉴权失败。
结合第一方面，在第一方面的第二种可能的实现方式中，所述鉴权信息包括鉴权向量集，所述鉴权向量集包括第一参数和消息鉴权码MAC，所述第一参数用于生成期望消息鉴权码X-MAC；
所述终端根据所述鉴权信息对所述核心网设备进行鉴权，包括：
根据所述第一参数生成所述X-MAC；
若所述X-MAC与所述MAC相同，则确定对所述HSS鉴权成功；或者，若所述X-MAC与所述MAC不相同，则确定对所述HSS鉴权失败。
结合第一方面，在第一方面的第三种可能的实现方式中，所述鉴权信息包括演进的分组数据域网关ePDG的证书信息和签名信息；
所述终端根据所述鉴权信息对所述核心网设备进行鉴权，包括：
若所述ePDG的证书信息和签名信息都正确，则确定对所述ePDG鉴权成功；或者，
若所述ePDG的证书信息或签名信息不正确，则确定对所述ePDG鉴权失败。
结合第一方面的第三种可能的实现方式，在第一方面的第四种可能的实现方式中，所述鉴权信息还包括鉴权向量集，所述鉴权向量集包括第一参数和MAC，所述第一参数用于生成X-MAC；
所述终端根据所述鉴权信息对所述核心网设备进行鉴权，还包括：
当对所述ePDG鉴权成功时，根据所述第一参数生成所述X-MAC；
若所述X-MAC与所述MAC相同，则确定对所述HSS鉴权成功；或者，若所述 X-MAC与所述MAC不相同，则确定对所述HSS鉴权失败。
结合第一方面、第一方面的第一种可能的实现、第二种可能的实现方式、第三种可能的实现方式、第四种可能的实现方式中的至少一种，在第一方面的第五种可能的实现方式中，所述当终端对所述核心网设备鉴权成功后，执行相应的网络接入策略，包括：
所述终端停止尝试接入所述3GPP网络，直到当所述终端的状态满足第一预设条件时，重新尝试接入所述3GPP网路；
所述第一预设条件包括以下至少一种：所述终端更换客户识别模块SIM卡、重新开机、所述终端尝试接入3GPP网络失败后超过第一预设时长、所述终端重新选择非3GPP网络。
结合第一方面的第五种可能的实现方式，在第一方面的第六种可能的实现方式中，所述接入请求消息还包括接入点名称APN信息，所述APN信息用于表征所述终端申请使用的非3GPP网络，所述核心网设备包括ePDG；
所述终端停止尝试接入所述3GPP网络，直到当所述终端的状态满足第一预设条件时，重新尝试接入所述3GPP网路，包括：
若所述ePDG属于归属地公共陆地移动网络HPLMN，则所述终端停止尝试接入所述3GPP网络，直到所述终端的状态满足以下至少一种：更换SIM卡、重新开机、尝试接入3GPP网络失败后超过第一预设时长，重新尝试通过所述APN信息对应的非3GPP网络接入所述3GPP网络；或者，
若所述ePDG属于拜访地公共陆地移动网络VPLMN，则当所述终端重新选择非3GPP网络后，尝试通过重新选择的非3GPP网络接入所述3GPP网络。
结合第一方面的第五种可能的实现方式，在第一方面的第七种可能的实现方式中，所述核心网设备不包括所述ePDG，所述第一预设条件包括所述终端尝试接入3GPP网络失败后超过第一预设时长。
结合第一方面、第一方面的第一种可能的实现、第二种可能的实现方式、第三种可能的实现方式、第四种可能的实现方式、第五种可能的实现方式、第六种可能的实现方式、第七种可能的实现方式中的至少一种，在第一方面的第八种可能的实现方式中，所述方法还包括：
若所述终端对所述核心网设备鉴权失败，则所述终端尝试重新接入所述3GPP网络；
如果尝试预设次数均失败，则在第二预设时长后，重新尝试接入所述3GPP网络。
第二方面，提供一种终端接入3GPP网络的处理方法，包括：
核心网设备接收终端发送的接入请求消息，所述接入请求消息至少包括所述终端的身份信息；
当所述核心网设备根据所述终端的身份信息，确定所述终端没有接入所述3GPP网络的权限时，向所述终端发送无权接入消息，所述无权接入消息包括所述核心网设备的鉴权信息，所述鉴权信息用于所述终端对所述核心网设备进行鉴权。
结合第二方面，在第二方面的第一种可能的实现方式中，
若所述核心网设备包括演进的分组数据域网关ePDG，则所述鉴权信息包括所述ePDG的证书信息和签名信息，或者，
所述鉴权信息包括所述ePDG的证书信息和签名信息，以及鉴权向量集，所述鉴权向量集包括第一参数和消息鉴权码MAC；
或者，
所述核心网设备不包括所述ePDG，则所述鉴权信息包括第一消息摘要，所述第一消息摘要由HSS根据预设算法、所述无权接入消息所携带的失败消息码及所述终端的身份信息生成，或者，所述鉴权信息包括所述鉴权向量集。
第三方面，提供一种终端，包括：
发送器，用于向第三代合作伙伴计划3GPP网络的核心网设备发送接入请求消息，所述接入请求消息用于请求接入所述3GPP网络，所述接入请求消息包括所述终端的身份信息；
接收器，用于接收所述核心网设备发送的无权接入消息，所述无权接入消息用于表征所述终端无权接入所述3GPP网络；
处理器，用于根据所述鉴权信息对发送所述核心网设备进行鉴权，当对所述核心网设备鉴权成功后，执行相应的网络接入策略，以减少所述终端向所述核心网设备发送接入请求消息的数量。
结合第三方面，在第三方面的第一种可能的实现方式中，所述鉴权信息包括第一消息摘要，所述第一消息摘要用于使所述终端对所述核心网设备中的归属用户服务器HSS进行鉴权；
当所述处理器用于根据所述鉴权信息对所述核心网设备进行鉴权时，具体用于：
根据预设算法、所述终端的身份信息及所述无权接入消息携带的失败消息码，生成第二消息摘要；
若所述第一消息摘要与所述第二消息摘要相同，则确定对所述HSS鉴权成功； 或者，若所述第一消息摘要与所述第二消息摘要不同，则确定对所述HSS鉴权失败。
结合第三方面，在第三方面的第二种可能的实现方式中，所述鉴权信息包括鉴权向量集，所述鉴权向量集包括第一参数和消息鉴权码MAC，所述第一参数用于生成期望消息鉴权码X-MAC；
当所述处理器用于根据所述鉴权信息对所述核心网设备进行鉴权时，具体用于：
根据所述第一参数生成所述X-MAC；
若所述X-MAC与所述MAC相同，则确定对所述HSS鉴权成功；或者，若所述X-MAC与所述MAC不相同，则确定对所述HSS鉴权失败。
结合第三方面，在第三方面的第三种可能的实现方式中，所述鉴权信息包括演进的分组数据域网关ePDG的证书信息和签名信息；
当所述处理器用于根据所述鉴权信息对所述核心网设备进行鉴权时，具体用于：
若所述ePDG的证书信息和签名信息都正确，则确定对所述ePDG鉴权成功；或者，
若所述ePDG的证书信息或签名信息不正确，则确定对所述ePDG鉴权失败。
结合第三方面的第三种可能的实现方式，在第三方面的第四种可能的实现方式中，所述鉴权信息还包括鉴权向量集，所述鉴权向量集包括第一参数和MAC，所述第一参数用于生成X-MAC；
所述处理器用于根据所述鉴权信息对所述核心网设备进行鉴权时，进一步用于：
当对所述ePDG鉴权成功时，根据所述第一参数生成所述X-MAC；
若所述X-MAC与所述MAC相同，则确定对所述HSS鉴权成功；或者，若所述X-MAC与所述MAC不相同，则确定对所述HSS鉴权失败。
结合第三方面、第三方面的第一种可能的实现、第二种可能的实现方式、第三种可能的实现方式、第四种可能的实现方式中的至少一种，在第三方面的第五种可能的实现方式中，所述处理器对所述核心网设备鉴权成功后，执行相应的网络接入策略时，具体用于：
停止尝试接入所述3GPP网络，直到当所述终端的状态满足第一预设条件时，重新尝试接入所述3GPP网路；
所述第一预设条件包括以下至少一种：所述终端更换客户识别模块SIM卡、重新开机、所述终端尝试接入3GPP网络失败后超过第一预设时长，所述终端重新选择非3GPP网络。
结合第三方面的第五种可能的实现方式，在第三方面的第六种可能的实现方式 中，所述接入请求消息还包括接入点名称APN信息，所述APN信息用于表征所述终端申请使用的非3GPP网络，所述核心网设备包括ePDG；
所述处理器停止尝试接入所述3GPP网络，直到当所述终端的状态满足第一预设条件时，重新尝试接入所述3GPP网路时，具体用于：
若所述ePDG属于归属地公共陆地移动网络HPLMN，则停止尝试接入所述3GPP网络，直到所述终端的状态满足以下至少一种：更换SIM卡、重新开机、尝试接入3GPP网络失败后超过第一预设时长，重新尝试通过所述APN信息对应的非3GPP网络接入所述3GPP网络；或者，
若所述ePDG属于拜访地公共陆地移动网络VPLMN，则当重新选择非3GPP网络后，尝试通过重新选择的非3GPP网络接入所述3GPP网络。
结合第一方面的第五种可能的实现方式，在第一方面的第七种可能的实现方式中，所述核心网设备不包括所述ePDG，所述第一预设条件包括所述终端尝试接入3GPP网络失败后超过第一预设时长。
结合第一方面、第一方面的第一种可能的实现、第二种可能的实现方式、第三种可能的实现方式、第四种可能的实现方式、第五种可能的实现方式、第六种可能的实现方式、第七种可能的实现方式中的至少一种，在第一方面的第八种可能的实现方式中，所述处理器进一步用于：
若对所述核心网设备鉴权失败，则尝试重新接入所述3GPP网络；
如果尝试预设次数均失败，则在第二预设时长后，重新尝试接入所述3GPP网络。
第四方面，提供一种核心网设备，包括：
接收器，用于接收终端发送的接入请求消息，所述接入请求消息至少包括所述终端的身份信息；
处理器，用于当根据所述终端的身份信息，确定所述终端没有接入所述3GPP网络的权限时，通过通信接口向所述终端发送无权接入消息，所述无权接入消息包括所述核心网设备的鉴权信息，所述鉴权信息用于使所述终端对所述核心网设备进行鉴权。
结合第四方面，在第四方面的第一种可能的实现方式中，若所述核心网设备包括演进的分组数据域网关ePDG，则所述鉴权信息包括所述ePDG的证书信息和签名信息，或者，
所述鉴权信息包括所述ePDG的证书信息和签名信息，以及鉴权向量集，所述鉴权向量集包括第一参数和消息鉴权码MAC；
或者，
所述核心网设备不包括所述ePDG，则所述鉴权信息包括第一消息摘要，所述第一消息摘要由HSS根据预设算法、所述无权接入消息所携带的失败消息码及所述终端的身份信息生成，或者，所述鉴权信息包括所述鉴权向量集。
由以上技术方案可见，本发明实施例提供的终端接入3GPP网络的处理方法，终端向3GPP网络中的核心网设备发送接入请求消息，核心网设备判断终端没有接入3GPP网络的权限后得到无权接入消息，该无权接入消息包含核心网设备的鉴权信息。终端根据核心网设备的鉴权信息对该核心网设备进行鉴权，如果终端对核心网设备鉴权成功，即确定无权接入消息的来源合法后，则执行相应的网络接入策略，减少向所述核心网设备发送接入请求消息的数量，从而减轻核心网设备的负担，进而，能够提高3GPP网络的接入效率。
附图说明
构成本申请的一部分的说明书附图用来提供对本发明的进一步理解，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1为现有技术的一种3GPP网络的核心网架示意图；
图2为本发明实施例一种终端接入3GPP网络的处理方法流程图；
图3为本发明实施例另一种终端接入3GPP网络的处理方法流程图；
图4为本发明实施例一种终端接入3GPP网络的处理方法流程图；
图5为本发明实施例另一种终端接入3GPP网络的处理方法流程图；
图6为本发明实施例另一种终端接入3GPP网络的处理方法流程图；
图7为本发明实施例一种终端的框图；
图8为本发明实施例一种终端接入3GPP网络的处理装置的框图；
图9为本发明实施例一种核心网设备的框图；
图10为本发明实施例另一种终端接入3GPP网络的处理装置的框图。
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，对于本领域普通技术人员而言，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
具体实施方式
在详细介绍本发明的具体实施例之前，首先对核心网设备进行简单说明：
图1是一种核心网的示意图，核心网设备主要包括HSS(Home Subscriber Server， 归属用户服务器)、ePDG(evloved Packet Data Gateway，演进的分组数据域网关)、AAA(Authentication,Authorization,and Accounting Server，鉴权授权和账户)服务器，其中，HSS用于判断UE是否有权接入3GPP网络。在UE通过非3GPP网络接入3GPP网络的应用场景中，从核心网侧看，支持可信非3GPP网络接入和非可信非3GPP网络接入，例如，运营商部署的WLAN是可信非3GPP网络，而一家书店中的WLAN就是非可信非3GPP网络。在通过非可信非3GPP网络接入的应用场景中，UE需要通过ePDG接入核心网，因此，此应用场景中，核心网设备包括ePDG、AAA服务器和HSS；在通过可信非3GPP网络接入的应用场景中，UE不需要ePDG就能接入核心网，因此，此种应用场景中，核心网设备包括AAA服务器和HSS；在UE直接接入3GPP网络的应用场景中，UE可以直接接入HSS，此种应用场景中，核心网设备至少包括HSS。
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所述描述的实施例仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
请参见图2，示出了本发明实施例一种UE接入3GPP网络的处理方法流程图，如图2所示，该方法应用于UE中，例如，手机。该方法可以包括以下步骤：
S110，UE向3GPP网络的核心网设备发送接入请求消息。
接入请求消息包括UE的身份信息。UE的身份信息用于唯一表征UE，例如，可以是UE的IMSI(International Mobile Subscriber Identification Number，国际移动用户识别码)。
在UE通过非3GPP网络接入3GPP网络时，接入请求消息中进一步可以包括APN(Access Point Name，接入点名称)信息，该APN信息用于表征UE请求使用的非3GPP网络的信息，例如，WLAN的ID(Identification，身份标识)。
S120，UE接收核心网设备发送的无权接入消息，无权接入消息包括所述核心网设备的鉴权信息。
无权接入消息中还包括失败消息码，该失败消息码用于表征UE无权接入3GPP网络的类型，例如，欠费停机、无权限接入网络等。核心网设备通过该消息告知UE无权接入3GPP的具体信息。
核心网设备不同，对应的鉴权信息也不相同。在本发明的一个实施例中，核心网设备包括ePDG时，鉴权信息可以包括ePDG的鉴权信息，即ePDG的证书信息和签 名信息；或者，
核心网设备的鉴权信息可以包括ePDG的鉴权信息和HSS的鉴权信息，其中，HSS的鉴权信息包括HSS判定UE无权接入3GPP网络时产生的鉴权向量集，其中，鉴权向量集包括失败消息码、第一参数和MAC(Message Authentication Code，消息鉴权码)。在本发明的另一个实施例中，核心网设备不包括ePDG，则鉴权信息包括第一消息摘要，第一消息摘要由所述HSS根据预设算法、所述失败消息码、所述UE的身份信息生成；或者，所述鉴权信息包括所述鉴权向量集。
S130，UE根据鉴权信息对核心网设备进行鉴权。
UE接收到来自核心网设备的无权接入消息，并利用无权接入消息所包含的核心网设备的鉴权信息对核心网设备进行鉴权，判断该核心网设备是否合法，即无权接入消息的来源是否合法。
S140，当UE对核心网设备鉴权成功后，执行相应的网络接入策略，以减少向核心网设备发送接入请求消息的数量。
如果UE对核心网设备鉴权成功，即确定无权接入消息的来源合法，则根据相应的网络接入策略尝试连接3GPP网络，减少请求连接网络的数量，进而减少核心网设备处理接入请求消息的数量，减轻核心网设备的负担。
本实施例提供的终端接入3GPP网络的处理方法，UE向3GPP网络中的核心网设备发送接入请求消息，核心网设备判断UE没有接入3GPP网络的权限后，向UE发送无权接入消息，该无权接入消息包含核心网设备的鉴权信息。UE根据核心网设备的鉴权信息对该核心网设备进行鉴权，如果UE对核心网设备鉴权成功，即确定无权接入消息的来源合法后，则执行相应的网络接入策略，减少向所述核心网设备发送接入请求消息的数量，从而减轻核心网设备的负担，进而，能够提高3GPP网络的接入效率。
请参见图3，示出了本发明实施例示出的另一种UE接入3GPP网络的处理方法流程图，该方法应用于核心网设备中，如图3所示，该方法可以包括以下步骤：
S210，核心网设备接收UE发送的接入请求消息，接入请求消息包括UE的身份信息。
在UE通过非3GPP网络接入3GPP网络的应用场景中，UE发送的接入请求消息中还包括APN信息，HSS根据UE的身份信息获得UE的权限信息，例如，是否欠费停机等，判断UE是否有权接入3GPP网络；然后，判断该UE是否有权限使用APN信息对应的非3GPP网络。如果UE有权限使用APN信息对应的非3GPP网络，且 UE有权接入3GPP网络，则确定UE可以通过APN信息对应的非3GPP网络；否则，两者任意一项不满足，则确定UE无权接入3GPP网络。
S220，当核心网设备根据UE的身份信息，判定该UE不具有接入3GPP网络的权限时，向该UE发送无权接入消息，无权接入消息包括核心网设备的鉴权信息。
核心网设备不同时，对应的鉴权信息也不相同，前已叙及，此处不再赘述。
在通过非可信非3GPP网络接入3GPP网络的应用场景中，如果HSS判定UE没有接入3GPP网络的权限，HSS将无权接入消息发送给AAA服务器，AAA服务器再将该无权接入消息发送给ePDG，ePDG将自身的鉴权信息加入该无权接入消息中并发送给UE。
在通过可信非3GPP网络接入3GPP网络，或直接接入3GPP网络的应用场景中，如果HSS判定UE没有接入3GPP网络的权限，则产生无权接入消息，可以将HSS的鉴权信息加入无权接入消息中，并发送给UE。UE根据核心网设备的鉴权信息对核心网设备进行鉴权，并对核心网设备鉴权成功后，执行相应的网络接入策略，减少向核心网设备发送接入请求消息的数量，从而减轻核心网设备的负担。
本实施例提供的UE接入3GPP网络的处理方法，核心网设备根据UE的身份信息，判断UE是否具有接入3GPP网络的权限，如果判定UE没有该权限，则产生无权接入消息，无权接入消息中携带核心网设备的鉴权信息。UE根据核心网设备的鉴权信息对核心网设备进行鉴权，如果UE对核心网设备鉴权成功，即确定无权接入消息的来源合法后，则执行相应的网络接入策略，减少向所述核心网设备发送接入请求消息的数量，从而减轻核心网设备的负担，进而，提高3GPP网络的接入效率。
请参见图4，示出了本发明实施例一种终端接入3GPP网络的处理方法流程图，该方法应用于UE通过非可信非3GPP网络接入3GPP网络的应用场景中，例如，UE通过非可信WLAN接入3GPP网络，如图4所示，该方法可以包括以下步骤：
S310，UE向ePDG发送接入请求消息。
本实施例中，接入请求消息包括UE的身份信息和APN信息。APN信息表征UE申请使用的非可信非3GPP网络。
具体实施时，在UE向ePDG发送接入请求消息之前，UE和ePDG之间进行IKEv2_SA_INIT信令交互，协商加密算法，加密用的随机数以及交换生成密钥的D-H数据。
然后，UE向ePDG发送接入请求消息，该接入请求消息用于请求接入3GPP网络。
S320，ePDG向AAA服务器转发该接入请求消息。
S330，AAA服务器将该接入请求消息发送给HSS。
S340，HSS根据UE的身份信息和APN信息判断UE是否具有接入3GPP网络的权限；如果UE没有接入3GPP网络的权限，则执行S350。
HSS根据UE的身份信息获得UE的权限信息，例如，是否欠费停机等，判断UE是否有权接入3GPP网络；然后，判断该UE是否有权限使用APN信息对应的非3GPP网络。如果UE有权限使用APN信息对应的非3GPP网络，且UE有权接入3GPP网络，则确定UE可以通过APN信息对应的非3GPP网络；否则，两者任意一项不满足，则确定UE无权接入3GPP网络。
S350，HSS产生失败消息码，并将该失败消息码发送给AAA服务器服务器。
HSS判定UE无权接入3GPP网络时，产生相应的失败消息码，通过AAA服务器、ePDG传递给UE。
S360，AAA服务器将失败消息码发送给ePDG。
S370，ePDG根据失败消息码及ePDG的鉴权信息，得到无权接入消息，并将该无权接入消息发送给UE。
ePDG接收到失败消息码后，将自身的鉴权信息加入到失败消息码中，传递给UE；ePDG的鉴权信息包括证书(Certificate)和签名信息；其中，签名信息，即AUTH(authentication，鉴权)信息。
S380，UE根据ePDG的鉴权信息对ePDG进行鉴权；如果UE对ePDG鉴权成功，则执行S390；如果UE对ePDG鉴权失败，则执行S3120。
UE验证ePDG的证书和AUTH信息的真实性，具体实施时，UE获取ePDG的身份标识，并根据ePDG的身份标识从认证中心获取ePDG的证书，然后，比较获得的ePDG的证书与接收到的ePDG的证书是否相同；AUTH信息用于描述鉴权方式和鉴权内容。
如果ePDG的证书和AUTH信息均正确，则确定对ePDG鉴权成功，即确定ePDG是合法设备；如果ePDG的证书和AUTH信息中的任一项不正确，则确定对ePDG鉴权失败，即认为ePDG不是合法设备，即，无权接入消息来源不合法。
S390，UE判断ePDG属于HPLMN(Home Public Land Mobile Network，归属地公共陆地移动网络)还是VPLMN(Visited Public Land Mobile Network，拜访地公共陆地移动网络)；如果ePDG属于HPLMN，则执行S3100；如果ePDG属于VPLMN，则执行S3110。
UE可以根据ePDG的FQDN(Fully qualified domain name，完全合格域名)消息中的信息，判断ePDG是HPLMN部署的ePDG，还是VPLMN部署的ePDG。
S3100，UE停止尝试从非可信非3GPP网络接入3GPP网络，直到UE的状态满足以下至少一种：更换SIM(Subscriber Identity Module，客户识别模块)卡、重新开机、计时超过第一预设时长。
当UE尝试接入3GPP网络失败时开始计时，计时达到第一预设时长后，重新尝试接入3GPP网络。
当UE的状态满足上述至少一种时，尝试从当前非可信非3GPP网络接入3GPP网络。
当前非可信非3GPP网络，即UE申请使用的非可信性非3GPP网络，即APN信息对应的非可信非3GPP网络。
S3110，UE重新选择非3GPP网络，并尝试从重新选择的非3GPP网络接入3GPP网络。
如果UE判定ePDG属于VPLMN，则重新选择非3GPP网络(包括可信非3GPP和非可信非3GPP)，并尝试通过重新选择的非3GPP网络接入3GPP网络。
S3120，UE尝试重新从当前非可信非3GPP网络接入3GPP网络，如果尝试预设次数均失败，则在第二预设时长后，再重新尝试从当前非可信非3GPP网络接入3GPP网络。
如果UE对ePDG鉴权失败，即UE认为ePDG是非法设备，则尝试从当前非可信非3GPP网络接入3GPP网络，并且在尝试预设次数均失败后，启动第一定时器，当第一定时器定时达到第二预设时长之前，不再尝试从当前非可信非3GPP网络接入3GPP网络；如果第一定时器超过第二预设时长后，重新尝试从当前非可信非3GPP网络接入3GPP网络，并在尝试预设次数均失败后，再次启动第一定时器。
其中，当前非可信非3GPP网络是指UE当前尝试接入3GPP所使用的非3GPP网络。预设次数和第二预设时长的数值均可以由归属运营商根据实际需求自由设定。
本实施例提供的终端接入3GPP网络的处理方法，应用于通过非可信非3GPP网络接入3GPP网络的应用场景中，当HSS判定UE没有接入3GPP网络的权限时，产生失败消息码，并将失败消息码传递给ePDG，ePDG根据失败消息码和自身的鉴权信息得到无权接入消息，并发送给UE。UE根据ePDG的鉴权信息判定ePDG是否是合法设备，如果判定ePDG是合法设备，则在UE的状态满足相应的条件之前不再重新尝试接入3GPP网络，以便减少向核心网设备发送接入请求消息的数量，从而减轻 核心网设备的负担，进一步提高终端接入3GPP网络的效率。
请参见图5，示出了本发明实施例另一种终端接入3GPP网络的处理方法流程图，该方法可以应用于UE通过非可信非3GPP网络接入3GPP网络的应用场景中，如图5所示，该方法可以包括以下步骤：
S410，UE向ePDG发送接入请求消息。本实施例中，接入请求消息至少包括UE的身份信息和APN信息。APN信息表征UE申请使用的非可信非3GPP网络。
S420，ePDG向AAA服务器转发接入请求消息。
S430，AAA服务器将接入请求消息发送给HSS。
S440，HSS根据UE的身份信息和APN信息判断UE是否具有接入3GPP网络的权限；如果UE没有接入3GPP网络的权限，则执行S450。
S450，HSS产生失败消息码，并根据预设算法、失败消息码、UE的身份信息及APN信息得到第一消息摘要。
在本发明的一个实施例中，HSS可以将UE的身份信息、APN信息和失败消息码输入到预设算法中，得到第一消息摘要。预设算法可以是完整性保护算法，例如，Hash-256算法。
在本发明的其它实施例中，HSS根据预设算法、UE的身份信息、APN信息和失败消息码，以及其它的信息，得到第一消息摘要。
S460，HSS根据失败消息码和第一消息摘要得到无权接入消息，并将该无权接入消息发送给AAA服务器。
HSS将生成的第一消息摘要和失败消息码作为无权接入消息并传递给UE。
S470，AAA服务器将接收到的无权接入消息发送给ePDG。
S480，ePDG将接收到的无权接入消息发送给UE。
S490，UE接收到无权接入消息后，获得失败消息码和第一消息摘要。
S4100，UE根据所述预设算法、失败消息码、UE的身份信息及APN信息得到第二消息摘要。
UE利用HSS生成第一消息摘要的方法生成第二消息摘要。
S4110，UE比较第一消息摘要与第二消息摘要是否相同；如果相同，则执行S4120；如果不相同，则执行S4160。
S4120，UE确定对HSS鉴权成功；即UE确定HSS是合法设备。
S4130，UE判断ePDG属于HPLMN还是VPLMN；如果ePDG属于HPLMN，则执行S4140；如果ePDG属于VPLMN，则执行S4150。
UE确定HSS是合法设备后，需要判断ePDG所属的网络，前已叙及，此处不再赘述。
S4140，UE停止尝试从非可信非3GPP网络接入3GPP网络，直到UE的状态满足以下至少一种：UE更换SIM卡、重新开机、计时超过第一预设时长。
当UE尝试接入3GPP网络失败时开始计时，计时达到第一预设时长后，重新尝试接入3GPP网络。
S4150，UE重新选择非3GPP网络，并尝试从重新选择的非3GPP网络接入3GPP网络。
如果UE判定ePDG属于VPLMN，则重新选择非3GPP网络(包括可信非3GPP和非可信非3GPP)，并尝试通过重新选择的非3GPP网络接入3GPP网络。
其中，S4130至S4150与图4所示实施例中的S390至S3110相同，此处不再赘述。
S4160，UE尝试重新从当前非可信非3GPP网络接入3GPP网络，如果尝试预设次数均失败，则在第二预设时长后，再尝试从当前非可信非3GPP网络接入3GPP网络。
当前非可信非3GPP网络，即UE申请使用的非可信非3GPP网络，也即，所述APN信息对应的非可信非3GPP网络。
如果UE对HSS鉴权失败，即认为HSS是非法设备，则重新尝试从当前非可信非3GPP网络接入3GPP网络，并且在尝试预设次数均失败后，启动第一定时器，当第一定时器定时达到第二预设时长之前，不再尝试从当前非可信非3GPP网络接入3GPP网络；如果第一定时器超过第二预设时长后，重新尝试从当前非可信非3GPP网络接入3GPP网络，并在尝试预设次数均失败后，再次启动第一定时器。
其中，预设次数和第二预设时长的数值均可以由归属运营商根据实际需求自由设定。
本实施例提供的终端接入3GPP网络的处理方法，HSS判定UE没有接入3GPP网络的权限后，根据预设算法，利用失败消息码、UE的身份信息及APN信息，得到第一消息摘要，并将第一消息摘要和失败消息码作为无权接入消息发送给UE。UE接收到无权接入消息后，利用相同的方法产生第二消息摘要，UE通过比较第一消息摘要与第二消息摘要对HSS进行鉴权；如果对HSS鉴权成功，根据无权接入消息执行相应的网络接入策略，减少向核心网设备发送的网络接入请求的数量，从而减轻了核心网设备的负担，进一步提高终端接入3GPP网络的效率。
此外，图5所示实施例提供的终端接入3GPP网络的处理方法，HSS直接在无权接入消息中添加用于使UE验证HSS是否是合法设备的第一消息摘要，使得UE不需要对ePDG进行鉴权，因此，通过消息摘要对HSS进行鉴权的方式可以应用于不需要ePDG的应用场景中，例如，通过可信非3GPP网络接入3GPP网络，或者，直接接入3GPP网络。其中，在需要ePDG的应用场景中，UE通过消息摘要对HSS进行鉴权的方法与图5中的相关步骤相同，此处不再赘述。
如果对HSS鉴权成功，则在计时超过第一预设时长之前，不再尝试接入3GPP网络；当计时超过第一预设时长后，尝试接入3GPP网络。当UE尝试接入3GPP网络失败时开始计时，计时达到第一预设时长后，重新尝试接入3GPP网络。如果对HSS鉴权失败，则尝试接入3GPP网络，如果尝试预设次数均失败，则在预设次数尝试均失败后开始计时，并在计时达到第二预设时长后，再尝试接入3GPP网络。
请参见图6，示出了本发明实施例另一种终端接入3GPP网络的处理方法流程图，该方法可以应用于通过非可信非3GPP网络接入3GPP网络的应用场景中，如图6所示，该方法可以包括以下步骤：
S510，UE向ePDG发送接入请求消息。接入请求消息至少包括UE的身份信息和APN信息。本实施例中，APN信息表示UE申请使用的非可信非3GPP网络的信息。
S520，ePDG向AAA服务器转发接入请求消息。
S530，AAA服务器将接入请求消息发送给HSS。
S540，HSS根据UE的身份信息和APN信息判断UE是否具有接入3GPP网络的权限；如果UE没有接入3GPP网络的权限，则执行S550。
S550，HSS产生鉴权向量集，并将失败消息码携带于所述鉴权向量集中。
在本发明实施例中，鉴权向量集包括AMF(Authentication Management Field，鉴权管理域)、第一参数和MAC；可以将失败消息码复制到AMF中，利用AMF作为传递失败消息码的载体。其中，第一参数用于生成X-MAC(Excepted Message Authentication Code，期望获得的消息鉴权码)
AMF是鉴权向量集中的一部分，一共有16个比特位，第0个比特位是分离比特位，主要用于区分HSS的鉴权参数是使用UMTS(Universal Mobile Telecommunications System，通用移动通信系统)网络还是LTE(Long Term Evolution，长期演进)网络，如果是UMTS网络，则第0个比特位是“0”；如果是LTE网络，则第0个比特位是“1”。可以利用AMF的其它比特位存放失败消息码。
其中，所述第一参数可以包括密钥和随机数，UE利用随机数和密钥生成X-MAC；或者，所述第一参数至少包括随机数，密钥可以由UE生成，UE进而根据密钥和随机数生成X-MAC。
S560，HSS将无权接入消息发送给AAA服务器，无权接入消息包括所述鉴权向量集。
HSS将无权接入消息发送给AAA服务器后，删除所述鉴权向量集，从而节省HSS内的存储空间。
S570，AAA服务器将接收到的无权接入消息发送给ePDG。
S580，ePDG将自身的鉴权信息携带于无权接入消息中，并发送给UE。
ePDG的鉴权信息包括ePDG的证书和AUTH信息。
S590，UE接收到无权接入消息后，获得ePDG的鉴权信息，并对ePDG进行鉴权；如果UE对ePDG鉴权成功，则执行S5100；如果UE对ePDG鉴权失败，则执行S5150。
UE对ePDG鉴权的过程参见图4所示实施例中的相关内容，此处不再赘述。
UE接收到无权接入消息后，首先对ePDG进行鉴权，如果对ePDG鉴权成功后，再对HSS鉴权；否则，对ePDG鉴权失败后，无需对HSS鉴权。
S5100，UE根据第一参数得到X-MAC，并比较X-MAC与MAC是否相同，如果X-MAC与MAC相同，则执行S5110；如果X-MAC与MAC不相同，则执行S5150。
S5110，UE确定HSS是合法设备。即UE确定无权接入消息来源于合法设备。
S5120，UE判断ePDG属于HPLMN还是VPLMN；如果ePDG属于HPLMN，则执行S5130；如果ePDG属于VPLMN，则执行S5140。
UE对HSS鉴权成功后，需要根据ePDG所属的网络执行相应的网络接入策略。
S5130，UE停止尝试从当前非可信非3GPP网络接入3GPP网络，直到UE的状态满足以下至少一种：UE更换SIM卡、重新开机、计时超过第一预设时长。
当UE尝试接入3GPP网络失败时开始计时，计时达到第一预设时长后，重新尝试接入3GPP网络。
S5140，UE重新选择非3GPP网络，并尝试从重新选择的非3GPP网络接入3GPP网络。
如果UE判定ePDG属于VPLMN，则重新选择非3GPP网络(包括可信非3GPP和非可信非3GPP)，并尝试通过重新选择的非3GPP网络接入3GPP网络。
其中，S5120至S5140与图4所示实施例中的S390至S3110相同，此处不再赘 述。
S5150，UE确定对无权接入消息的来源鉴权失败，并尝试重新从当前非可信非3GPP网络接入3GPP网络，如果尝试预设次数均失败，则在第二预设时长后，再尝试从当前非可信非3GPP网络接入3GPP网络。
如果UE对ePDG鉴权失败，或者，对HSS鉴权失败，即UE认为无权接入消息来源于非法设备，则重新尝试从当前非可信非3GPP网络接入3GPP网络，并且在尝试预设次数均失败后，启动第一定时器，当第一定时器定时达到第二预设时长之前，不再尝试从当前非可信非3GPP网络接入3GPP网络；如果第一定时器超过第二预设时长后，重新尝试从当前非可信非3GPP网络接入3GPP网络，并在尝试预设次数均失败后，再次启动第一定时器。
其中，预设次数和第二预设时长的数值均可以由归属运营商根据实际需求自由设定。
本实施例提供的终端接入3GPP网络的处理方法，HSS判定UE没有接入3GPP网络的权限后，产生鉴权向量集，并将失败消息码携带于鉴权向量集中。UE接收到HSS发送的鉴权向量集后，根据鉴权向量集中的参数判断HSS是否是合法设备，如果HSS是合法设备，则根据相应的网络接入策略，减少向核心网设备发送的网络接入请求的数量，从而减轻了核心网设备的负担，进一步能够提高终端接入3GPP网络的效率。
此外，本实施例提供的终端接入3GPP网络的处理方法，HSS判定UE没有权限接入3GPP网络后，产生鉴权向量集。UE可以直接利用鉴权向量集对HSS鉴权，该方法可以应用于不需要ePDG的应用场景中，例如，基于可信非3GPP网络接入3GPP网络，或者，直接接入3GPP网络的应用场景。UE通过鉴权向量集对HSS进行鉴权的过程可以参见图6所示实施例中的相关内容，此处不再赘述。
基于可信非3GPP网络接入3GPP网络，或者，直接接入3GPP网络的应用场景，如果UE根据鉴权向量集对HSS鉴权成功，则在计时超过第一预设时长之前，不再尝试接入3GPP网络；当计时超过第一预设时长后，尝试接入3GPP网络。当UE尝试接入3GPP网络失败时开始计时，计时达到第一预设时长后，重新尝试接入3GPP网络。如果对HSS鉴权失败，则尝试接入3GPP网络，如果尝试预设次数均失败，则在预设次数尝试均失败后开始计时，并在计时达到第二预设时长后，再尝试接入3GPP网络。
相应于上述的应用于终端的终端接入3GPP网络的处理方法实施例，本发明还提 供了终端实施例。
请参见图7，示出了本发明实施例一种终端的框图，如图7所示，该终端包括发送器710、接收器720和处理器730。
发送器710，用于向第三代合作伙伴计划3GPP网络的核心网设备发送接入请求消息，所述接入请求消息用于请求接入所述3GPP网络，所述接入请求消息包括所述终端的身份信息。
接收器720，用于接收所述核心网设备发送的无权接入消息，所述无权接入消息用于表征所述终端无权接入所述3GPP网络。
处理器730，用于根据所述鉴权信息对发送所述核心网设备进行鉴权，当对所述核心网设备鉴权成功后，执行相应的网络接入策略，以减少所述终端向所述核心网设备发送接入请求消息的数量。
在本发明的具体实施例中，如果对核心网设备鉴权成功，则处理器730具体用于：停止尝试接入所述3GPP网络，直到当所述终端的状态满足第一预设条件时，重新尝试接入所述3GPP网路；所述第一预设条件包括以下至少一种：所述终端更换客户识别模块SIM卡，重新开机，所述终端尝试接入3GPP网络失败后超过第一预设时长，所述终端重新选择非3GPP网络。
如果对核心网设备鉴权失败，则处理器730具体用于：若对所述核心网设备鉴权失败，则尝试重新接入所述3GPP网络；如果尝试预设次数均失败，则在第二预设时长后，重新尝试接入所述3GPP网络。
本实施例提供的终端，通过发送器向3GPP网络中的核心网设备发送接入请求消息，核心网设备判断终端没有接入3GPP网络的权限后，向终端发送无权接入消息，该无权接入消息包含核心网设备的鉴权信息。终端通过接收器接收到该无权接入消息后，根据核心网设备的鉴权信息对该核心网设备进行鉴权，如果终端对核心网设备鉴权成功，即确定无权接入消息的来源合法后，则执行相应的网络接入策略，减少向所述核心网设备发送接入请求消息的数量，从而减轻核心网设备的负担，进而，能够提高3GPP网络的接入效率。
在本发明的一个实施例中，终端接收到的鉴权信息包括第一消息摘要，该第一消息摘要由HSS生成，用于使所述终端对HSS进行鉴权，本实施例可以应用于终端通过非可信非3GPP网络接入3GPP网络，或者，通过可信3GPP网络接入3GPP网络，或者，直接接入3GPP网络的应用场景中。
本实施例中，所述处理器730用于根据所述鉴权信息对所述核心网设备进行鉴权 时，具体用于：
根据预设算法、所述终端的身份信息及所述无权接入消息携带的失败消息码，生成第二消息摘要；
若所述第一消息摘要与所述第二消息摘要相同，则确定对所述HSS鉴权成功；或者，若所述第一消息摘要与所述第二消息摘要不同，则确定对所述HSS鉴权失败。
本实施例提供的终端，HSS判定终端没有接入3GPP网络的权限后，根据预设算法，利用失败消息码、终端的身份信息及APN信息，得到第一消息摘要，并将第一消息摘要和失败消息码作为无权接入消息发送给终端。终端接收到无权接入消息后，利用相同的方法产生第二消息摘要，终端通过比较第一消息摘要与第二消息摘要对HSS进行鉴权；如果对HSS鉴权成功，根据无权接入消息执行相应的网络接入策略，减少向核心网设备发送的网络接入请求的数量，从而减轻了核心网设备的负担，进一步提高终端接入3GPP网络的效率。
在本发明的另一个实施例中，HSS对终端鉴权失败后，仍会产生鉴权向量集，使得终端根据该鉴权向量集对HSS鉴权。该实施例可以应用于终端通过非可信非3GPP网络接入3GPP网络，或者，通过可信3GPP网络接入3GPP网络，或者，直接接入3GPP网络的应用场景中。本实施例中，所述鉴权信息包括鉴权向量集，所述鉴权向量集包括第一参数和消息鉴权码MAC，所述第一参数用于生成期望消息鉴权码X-MAC；
当处理器730用于根据所述鉴权信息对所述核心网设备进行鉴权时，具体用于：
根据所述第一参数生成所述X-MAC；
若所述X-MAC与所述MAC相同，则确定对所述HSS鉴权成功；或者，若所述X-MAC与所述MAC不相同，则确定对所述HSS鉴权失败。
本实施例提供的终端，HSS判定终端没有接入3GPP网络的权限后，产生鉴权向量集，并将失败消息码携带于鉴权向量集中。终端接收到HSS发送的鉴权向量集后，根据鉴权向量集中的参数判断HSS是否是合法设备，如果HSS是合法设备，则根据相应的网络接入策略，减少向核心网设备发送的网络接入请求的数量，从而减轻了核心网设备的负担，进一步能够提高终端接入3GPP网络的效率。
在本发明另一个实施例中，所述鉴权信息包括ePDG的证书信息和签名信息；本实施例应用于终端通过非可信非3GPP网络接入3GPP网络的应用场景中，即应用于核心网设备包括ePDG的应用场景中。
当处理器730用于根据鉴权信息对所述核心网设备进行鉴权时，具体用于：
若ePDG的证书信息和签名信息都正确，则确定对所述ePDG鉴权成功；或者，
若ePDG的证书信息或签名信息不正确，则确定对所述ePDG鉴权失败。
本实施例提供的终端，应用于通过非可信非3GPP网络接入3GPP网络的应用场景中，当HSS判定终端没有接入3GPP网络的权限时，产生失败消息码，并将失败消息码传递给ePDG，ePDG根据失败消息码和自身的鉴权信息得到无权接入消息，并发送给终端。终端根据ePDG的鉴权信息判定ePDG是否是合法设备，如果判定ePDG是合法设备，则在终端的状态满足相应的条件之前不再重新尝试接入3GPP网络，以便减少向核心网设备发送接入请求消息的数量，从而减轻核心网设备的负担，进一步提高终端接入3GPP网络的效率。
在本发明的另一个实施例中，所述鉴权信息还包括鉴权向量集，所述鉴权向量集包括第一参数和MAC，所述第一参数用于生成X-MAC；本实施例应用于核心网设备包含ePDG的应用场景中，
处理器730用于根据鉴权信息对核心网设备进行鉴权时具体用于：
若ePDG的证书信息和签名信息都正确，则确定对所述ePDG鉴权成功；或者，若ePDG的证书信息或签名信息不正确，则确定对所述ePDG鉴权失败；
当对所述ePDG鉴权成功时，根据所述第一参数生成所述X-MAC；
若所述X-MAC与所述MAC相同，则确定对所述HSS鉴权成功；或者，若所述X-MAC与所述MAC不相同，则确定对所述HSS鉴权失败。
在本发明的一个应用场景中，终端通过非可信非3GPP网络接入3GPP网络，此种应用场景中，核心网设备包括ePDG，终端发送的接入请求消息还包括接入点名称APN信息，所述APN信息用于表征所述终端申请使用的非3GPP网络；
处理器730停止尝试接入所述3GPP网络，直到当所述终端的状态满足第一预设条件时，重新尝试接入所述3GPP网路时，具体用于：
若ePDG属于HPLMN，则停止尝试接入3GPP网络，直到终端的状态满足以下至少一种：更换SIM卡、重新开机或尝试接入3GPP网络失败后超过第一预设时长，重新尝试通过所述APN信息对应的非3GPP网络接入所述3GPP网络；或者，
若ePDG属于VPLMN，则重新选择非3GPP网络后，尝试通过重新选择的非3GPP网络接入所述3GPP网络。
在本发明的另一个应用场景中，UE通过可信非3GPP网络接入3GPP网络，或者直接接入3GPP网络，此种应用场景下，核心网设备不包括所述ePDG，所述第一预设条件包括尝试接入3GPP网络失败后超过第一预设时长。
处理器730具体用于，当终端尝试接入3GPP网络失败后超过第一预设时长后，重新选择非3GPP网络后，重新尝试接入3GPP网络。
请参见图8，示出了本发明实施例一种终端接入3GPP网络的处理装置的框图，该装置应用于终端中，如图8所示，该装置可以包括：发送模块810、接收模块820、鉴权模块830和执行模块840。
发送模块810，用于向第三代合作伙伴计划3GPP网络的核心网设备发送接入请求消息，所述接入请求消息用于请求接入所述3GPP网络，所述接入请求消息包括所述终端的身份信息。
接收模块820，用于接收所述核心网设备发送的无权接入消息，所述无权接入消息用于表征所述终端无权接入所述3GPP网络.
鉴权模块830，用于根据所述鉴权信息对发送所述核心网设备进行鉴权。
在本发明一个实施例中，鉴权信息包括第一消息摘要，所述第一消息摘要由HSS产生，使所述终端对所述核心网设备中的归属用户服务器HSS进行鉴权；
本实施例中鉴权模块830具体用于：
根据预设算法、所述终端的身份信息及所述无权接入消息携带的失败消息码，生成第二消息摘要；
若所述第一消息摘要与所述第二消息摘要相同，则确定对所述HSS鉴权成功；或者，若所述第一消息摘要与所述第二消息摘要不同，则确定对所述HSS鉴权失败。
在本发明的另一个实施例中，鉴权信息包括鉴权向量集，鉴权向量集包括第一参数和消息鉴权码MAC，第一参数用于生成X-MAC；
本实施例中，鉴权模块830具体用于：
根据所述第一参数生成所述X-MAC；
若所述X-MAC与所述MAC相同，则确定对所述HSS鉴权成功；或者，若所述X-MAC与所述MAC不相同，则确定对所述HSS鉴权失败。
在本发明又一实施例中，核心网设备的鉴权信息包括ePDG的证书信息和签名信息；鉴权模块830具体用于：
若所述ePDG的证书信息和签名信息都正确，则确定对所述ePDG鉴权成功；或者，
若所述ePDG的证书信息或签名信息不正确，则确定对所述ePDG鉴权失败。
在本发明的再一实施例中，鉴权信息包括ePDG的鉴权信息，以及鉴权向量集， 所述鉴权向量集包括第一参数和MAC，所述第一参数用于生成X-MAC；
所述鉴权模块830具体用于：
若所述ePDG的证书信息和签名信息都正确，则确定对所述ePDG鉴权成功；或者，若所述ePDG的证书信息或签名信息不正确，则确定对所述ePDG鉴权失败。
当对所述ePDG鉴权成功时，根据所述第一参数生成所述X-MAC；
若所述X-MAC与所述MAC相同，则确定对所述HSS鉴权成功；或者，若所述X-MAC与所述MAC不相同，则确定对所述HSS鉴权失败。
执行模块840，用于当鉴权模块830对核心网设备鉴权成功后，执行相应的网络接入策略，以减少所述终端向所述核心网设备发送接入请求消息的数量。
在本发明一个实施例中，执行模块840具体用于：
停止尝试接入所述3GPP网络，直到当所述终端的状态满足第一预设条件时，重新尝试接入所述3GPP网路；
所述第一预设条件包括以下至少一种：所述终端更换客户识别模块SIM卡，重新开机，所述终端尝试接入3GPP网络失败后超过第一预设时长，所述终端重新选择非3GPP网络。
在本发明的另一实施例中，接入请求消息还包括接入点名称APN信息，APN信息用于表征所述终端申请使用的非3GPP网络，核心网设备包括ePDG；
执行模块840具体用于：
若所述ePDG属于HPLMN，则停止尝试接入所述3GPP网络，直到终端的状态满足以下至少一种：更换SIM卡、重新开机或尝试接入3GPP网络失败后超过第一预设时长，重新尝试通过所述APN信息对应的非3GPP网络接入所述3GPP网络；
或者，
若所述ePDG属于VPLMN，则当重新选择非3GPP网络后，尝试通过重新选择的非3GPP网络接入所述3GPP网络。
在本发明另一个实施例中，核心网设备不包括所述ePDG，即终端通过可信非3GPP网络接入3GPP网络，或者，直接接入3GPP网络；执行模块840具体用于当终端尝试接入3GPP网络失败后超过第一预设时长之后，重新尝试接入3GPP网络。
当鉴权模块830对核心网设备鉴权失败时，执行模块840具体用于：
尝试重新接入所述3GPP网络，如果尝试预设次数均失败，则在第二预设时长后，重新尝试接入所述3GPP网络。
本实施例提供的终端接入3GPP网络的处理装置，UE向3GPP网络中的核心网 设备发送接入请求消息，核心网设备判断UE没有接入3GPP网络的权限后，向UE发送无权接入消息，该无权接入消息包含核心网设备的鉴权信息。UE根据核心网设备的鉴权信息对该核心网设备进行鉴权，如果UE对核心网设备鉴权成功，即确定无权接入消息的来源合法后，则执行相应的网络接入策略，减少向所述核心网设备发送接入请求消息的数量，从而减轻核心网设备的负担，进而，能够提高3GPP网络的接入效率。
请参见图9，示出了本发明实施例一种核心网设备的框图，如图10所示，该核心网设备包括总线940；以及连接到总线940的处理器910、通信接口920和存储器930。
其中，通信接口920用于接收终端发送的接入请求消息，所述接入请求消息至少包括所述终端的身份信息。存储器930用于存储指令；处理器910执行该指令用于当根据终端的身份信息，确定终端没有接入3GPP网络的权限时，通过通信接口930向终端发送无权接入消息，所述无权接入消息包括所述核心网设备的鉴权信息，所述鉴权信息用于使所述终端对所述核心网设备进行鉴权。
在本发明一个实施例中，如果核心网设备包括ePDG，则鉴权信息包括ePDG的证书信息和签名信息；或者，鉴权信息包括ePDG的证书信息和签名信息，以及鉴权向量集，鉴权向量集由HSS判定终端无权接入3GPP网络时产生，且鉴权向量集包括第一参数和消息鉴权码MAC。
在本发明另一个实施例中，核心网设备不包括ePDG，则所述鉴权信息包括第一消息摘要，所述第一消息摘要由HSS根据预设算法、无权接入消息所携带的失败消息码及终端的身份信息生成；或者，鉴权信息包括鉴权向量集。
对于终端根据ePDG的鉴权信息对ePDG鉴权的过程，终端根据鉴权向量集对HSS鉴权的过程，以及，终端根据第一消息摘要对HSS鉴权的过程，请参见对应方法实施例中的相关内容，此处不再赘述。
本实施例提供的核心网设备，核心网设备根据终端的身份信息，判断终端是否具有接入3GPP网络的权限，如果判定终端没有该权限，则产生无权接入消息，无权接入消息中携带核心网设备的鉴权信息。终端根据核心网设备的鉴权信息对核心网设备进行鉴权，如果终端对核心网设备鉴权成功，即确定无权接入消息的来源合法后，则执行相应的网络接入策略，减少向核心网设备发送接入请求消息的数量，从而减轻核心网设备的负担，进而，提高3GPP网络的接入效率。
请参见图10，示出了本发明实施例一种终端接入3GPP网络的处理装置的框图， 该装置应用于核心网设备中，如图10所示，该装置可以包括：接收模块1010、处理模块1020和通信模块1030。
接收模块1010，用于接收终端发送的接入请求消息，所述接入请求消息至少包括所述终端的身份信息。
处理模块1020，用于当根据终端的身份信息，确定终端没有接入3GPP网络的权限时，通过通信模块1030向终端发送无权接入消息，所述无权接入消息包括所述核心网设备的鉴权信息，所述鉴权信息用于使所述终端对所述核心网设备进行鉴权。
在本发明一个实施例中，如果核心网设备包括ePDG，则鉴权信息包括ePDG的证书信息和签名信息；或者，鉴权信息包括ePDG的证书信息和签名信息，以及鉴权向量集，鉴权向量集由HSS判定终端无权接入3GPP网络时产生，且鉴权向量集包括第一参数和消息鉴权码MAC。
在本发明另一个实施例中，核心网设备不包括ePDG，则所述鉴权信息包括第一消息摘要，所述第一消息摘要由HSS根据预设算法、无权接入消息所携带的失败消息码及终端的身份信息生成；或者，鉴权信息包括鉴权向量集。
本实施例提供的终端接入3GPP网络的处理装置，核心网设备根据终端的身份信息，判断终端是否具有接入3GPP网络的权限，如果判定终端没有该权限，则产生无权接入消息，无权接入消息中携带核心网设备的鉴权信息。终端根据核心网设备的鉴权信息对核心网设备进行鉴权，如果终端对核心网设备鉴权成功，即确定无权接入消息的来源合法后，则执行相应的网络接入策略，减少向核心网设备发送接入请求消息的数量，从而减轻核心网设备的负担，进而，提高3GPP网络的接入效率。
以上所述仅是本发明的具体实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (22)

  1. 一种终端接入3GPP网络的处理方法，其特征在于，包括：
    终端向第三代合作伙伴计划3GPP网络的核心网设备发送接入请求消息，所述接入请求消息用于请求接入所述3GPP网络，所述接入请求消息包括所述终端的身份信息；
    所述终端接收所述核心网设备发送的无权接入消息，所述无权接入消息用于表征所述终端无权接入所述3GPP网络；
    所述终端根据所述鉴权信息对发送所述核心网设备进行鉴权；
    当所述终端对所述核心网设备鉴权成功后，执行相应的网络接入策略，以减少所述终端向所述核心网设备发送接入请求消息的数量。
  2. 根据权利要求1所述的方法，其特征在于，所述鉴权信息包括第一消息摘要，所述第一消息摘要用于使所述终端对所述核心网设备中的归属用户服务器HSS进行鉴权；
    所述终端根据所述鉴权信息对所述核心网设备进行鉴权，包括：
    根据预设算法、所述终端的身份信息及所述无权接入消息携带的失败消息码，生成第二消息摘要；
    若所述第一消息摘要与所述第二消息摘要相同，则确定对所述HSS鉴权成功；或者，若所述第一消息摘要与所述第二消息摘要不同，则确定对所述HSS鉴权失败。
  3. 根据权利要求1所述的方法，其特征在于，所述鉴权信息包括鉴权向量集，所述鉴权向量集包括第一参数和消息鉴权码MAC，所述第一参数用于生成期望消息鉴权码X-MAC；
    所述终端根据所述鉴权信息对所述核心网设备进行鉴权，包括：
    根据所述第一参数生成所述X-MAC；
    若所述X-MAC与所述MAC相同，则确定对所述HSS鉴权成功；或者，若所述X-MAC与所述MAC不相同，则确定对所述HSS鉴权失败。
  4. 根据权利要求1所述的方法，其特征在于，所述鉴权信息包括演进的分组数据域网关ePDG的证书信息和签名信息；
    所述终端根据所述鉴权信息对所述核心网设备进行鉴权，包括：
    若所述ePDG的证书信息和签名信息都正确，则确定对所述ePDG鉴权成功；或者，
    若所述ePDG的证书信息或签名信息不正确，则确定对所述ePDG鉴权失败。
  5. 根据权利要求4所述的方法，其特征在于，所述鉴权信息还包括鉴权向量集，所述鉴权向量集包括第一参数和MAC，所述第一参数用于生成X-MAC；
    所述终端根据所述鉴权信息对所述核心网设备进行鉴权，还包括：
    当对所述ePDG鉴权成功时，根据所述第一参数生成所述X-MAC；
    若所述X-MAC与所述MAC相同，则确定对所述HSS鉴权成功；或者，若所述X-MAC与所述MAC不相同，则确定对所述HSS鉴权失败。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，所述当终端对所述核心网设备鉴权成功后，执行相应的网络接入策略，包括：
    所述终端停止尝试接入所述3GPP网络，直到当所述终端的状态满足第一预设条件时，重新尝试接入所述3GPP网路；
    所述第一预设条件包括以下至少一种：所述终端更换客户识别模块SIM卡、重新开机、所述终端尝试接入3GPP网络失败后超过第一预设时长、所述终端重新选择非3GPP网络。
  7. 根据权利要求6所述的方法，其特征在于，所述接入请求消息还包括接入点名称APN信息，所述APN信息用于表征所述终端申请使用的非3GPP网络，所述核心网设备包括ePDG；
    所述终端停止尝试接入所述3GPP网络，直到当所述终端的状态满足第一预设条件时，重新尝试接入所述3GPP网路，包括：
    若所述ePDG属于归属地公共陆地移动网络HPLMN，则所述终端停止尝试接入所述3GPP网络，直到所述终端的状态满足以下至少一种：更换SIM卡、重新开机、尝试接入3GPP网络失败后超过第一预设时长，重新尝试通过所述APN信息对应的非3GPP网络接入所述3GPP网络；或者，
    若所述ePDG属于拜访地公共陆地移动网络VPLMN，则当所述终端重新选择非3GPP网络后，尝试通过重新选择的非3GPP网络接入所述3GPP网络。
  8. 根据权利要求6所述的方法，其特征在于，所述核心网设备不包括所述ePDG，所述第一预设条件包括所述终端尝试接入3GPP网络失败后超过第一预设时长。
  9. 根据权利要求1至8任意一项所述的方法，其特征在于，所述方法还包括：
    若所述终端对所述核心网设备鉴权失败，则所述终端尝试重新接入所述3GPP网络；
    如果尝试预设次数均失败，则在第二预设时长后，重新尝试接入所述3GPP网络。
  10. 一种终端接入3GPP网络的处理方法，其特征在于，包括：
    核心网设备接收终端发送的接入请求消息，所述接入请求消息至少包括所述终端的身份信息；
    当所述核心网设备根据所述终端的身份信息，确定所述终端没有接入第三代合作伙伴计划3GPP网络的权限时，向所述终端发送无权接入消息，所述无权接入消息包括所述核心网设备的鉴权信息，所述鉴权信息用于所述终端对所述核心网设备进行鉴权。
  11. 根据权利要求10所述的方法，其特征在于：
    若所述核心网设备包括演进的分组数据域网关ePDG，则所述鉴权信息包括所述ePDG的证书信息和签名信息，或者，
    所述鉴权信息包括所述ePDG的证书信息和签名信息，以及鉴权向量集，所述鉴权向量集包括第一参数和消息鉴权码MAC；
    或者，
    所述核心网设备不包括所述ePDG，则所述鉴权信息包括第一消息摘要，所述第一消息摘要由归属用户服务器HSS根据预设算法、所述无权接入消息所携带的失败消息码及所述终端的身份信息生成，或者，所述鉴权信息包括所述鉴权向量集。
  12. 一种终端，其特征在于，包括：
    发送器，用于向第三代合作伙伴计划3GPP网络的核心网设备发送接入请求消息，所述接入请求消息用于请求接入所述3GPP网络，所述接入请求消息包括所述终端的身份信息；
    接收器，用于接收所述核心网设备发送的无权接入消息，所述无权接入消息用于表征所述终端无权接入所述3GPP网络；
    处理器，用于根据所述鉴权信息对发送所述核心网设备进行鉴权，当对所述核心网设备鉴权成功后，执行相应的网络接入策略，以减少所述终端向所述核心网设备发送接入请求消息的数量。
  13. 根据权利要求12所述的终端，其特征在于，所述鉴权信息包括第一消息摘要，所述第一消息摘要用于使所述终端对所述核心网设备中的归属用户服务器HSS进行鉴权；
    当所述处理器用于根据所述鉴权信息对所述核心网设备进行鉴权时，具体用于：
    根据预设算法、所述终端的身份信息及所述无权接入消息携带的失败消息码，生成第二消息摘要；
    若所述第一消息摘要与所述第二消息摘要相同，则确定对所述HSS鉴权成功；或者，若所述第一消息摘要与所述第二消息摘要不同，则确定对所述HSS鉴权失败。
  14. 根据权利要求12所述的终端，其特征在于，所述鉴权信息包括鉴权向量集，所述鉴权向量集包括第一参数和消息鉴权码MAC，所述第一参数用于生成期望消息鉴权码X-MAC；
    当所述处理器用于根据所述鉴权信息对所述核心网设备进行鉴权时，具体用于：
    根据所述第一参数生成所述X-MAC；
    若所述X-MAC与所述MAC相同，则确定对所述HSS鉴权成功；或者，若所述X-MAC与所述MAC不相同，则确定对所述HSS鉴权失败。
  15. 根据权利要求12所述的终端，其特征在于，所述鉴权信息包括演进的分组数据域网关ePDG的证书信息和签名信息；
    当所述处理器用于根据所述鉴权信息对所述核心网设备进行鉴权时，具体用于：
    若所述ePDG的证书信息和签名信息都正确，则确定对所述ePDG鉴权成功；或者，
    若所述ePDG的证书信息或签名信息不正确，则确定对所述ePDG鉴权失败。
  16. 根据权利要求15所述的终端，其特征在于，所述鉴权信息还包括鉴权向量集，所述鉴权向量集包括第一参数和MAC，所述第一参数用于生成X-MAC；
    所述处理器用于根据所述鉴权信息对所述核心网设备进行鉴权时，进一步用于：
    当对所述ePDG鉴权成功时，根据所述第一参数生成所述X-MAC；
    若所述X-MAC与所述MAC相同，则确定对所述HSS鉴权成功；或者，若所述X-MAC与所述MAC不相同，则确定对所述HSS鉴权失败。
  17. 根据权利要求12至16任一项所述的终端，其特征在于，所述处理器对所述核心网设备鉴权成功后，执行相应的网络接入策略时，具体用于：
    停止尝试接入所述3GPP网络，直到当所述终端的状态满足第一预设条件时，重新尝试接入所述3GPP网路；
    所述第一预设条件包括以下至少一种：所述终端更换客户识别模块SIM卡、重新开机、所述终端尝试接入3GPP网络失败后超过第一预设时长，所述终端重新选择非3GPP网络。
  18. 根据权利要求17所述的终端，其特征在于，所述接入请求消息还包括 接入点名称APN信息，所述APN信息用于表征所述终端申请使用的非3GPP网络，所述核心网设备包括ePDG；
    所述处理器停止尝试接入所述3GPP网络，直到当所述终端的状态满足第一预设条件时，重新尝试接入所述3GPP网路时，具体用于：
    若所述ePDG属于归属地公共陆地移动网络HPLMN，则停止尝试接入所述3GPP网络，直到所述终端的状态满足以下至少一种：更换SIM卡、重新开机、尝试接入3GPP网络失败后超过第一预设时长，重新尝试通过所述APN信息对应的非3GPP网络接入所述3GPP网络；或者，
    若所述ePDG属于拜访地公共陆地移动网络VPLMN，则当重新选择非3GPP网络后，尝试通过重新选择的非3GPP网络接入所述3GPP网络。
  19. 根据权利要求17所述的终端，其特征在于，所述核心网设备不包括所述ePDG，所述第一预设条件包括所述终端尝试接入3GPP网络失败后超过第一预设时长。
  20. 根据权利要求12至19任意一项所述的终端，其特征在于，所述处理器进一步用于：
    若对所述核心网设备鉴权失败，则尝试重新接入所述3GPP网络；
    如果尝试预设次数均失败，则在第二预设时长后，重新尝试接入所述3GPP网络。
  21. 一种核心网设备，其特征在于，包括：
    接收器，用于接收终端发送的接入请求消息，所述接入请求消息至少包括所述终端的身份信息；
    处理器，用于当根据所述终端的身份信息，确定所述终端没有接入第三代合作伙伴计划3GPP网络的权限时，通过通信接口向所述终端发送无权接入消息，所述无权接入消息包括所述核心网设备的鉴权信息，所述鉴权信息用于使所述终端对所述核心网设备进行鉴权。
  22. 根据权利要求21所述的核心网设备，其特征在于：
    若所述核心网设备包括演进的分组数据域网关ePDG，则所述鉴权信息包括所述ePDG的证书信息和签名信息，或者，
    所述鉴权信息包括所述ePDG的证书信息和签名信息，以及鉴权向量集，所述鉴权向量集包括第一参数和消息鉴权码MAC；
    或者，
    所述核心网设备不包括所述ePDG，则所述鉴权信息包括第一消息摘要，所述第一消息摘要由归属用户服务器HSS根据预设算法、所述无权接入消息所携 带的失败消息码及所述终端的身份信息生成，或者，所述鉴权信息包括所述鉴权向量集。
PCT/CN2015/086390 2015-08-07 2015-08-07 终端接入3gpp网络的处理方法及装置 WO2017024449A1 (zh)

Priority Applications (9)

Application Number Priority Date Filing Date Title
EP19179058.3A EP3614741B1 (en) 2015-08-07 2015-08-07 Processing apparatus for terminal access to 3gpp network and communication system and corresponding system and computer program product
KR1020187005375A KR102084580B1 (ko) 2015-08-07 2015-08-07 3gpp 네트워크로의 단말 액세스를 위한 처리 방법 및 장치
CN201580053514.6A CN107079377B (zh) 2015-08-07 2015-08-07 终端接入3gpp网络的处理方法及装置
RU2018108140A RU2682849C1 (ru) 2015-08-07 2015-08-07 Способ обработки для терминального доступа к 3gpp сети и устройству
CN202010073023.0A CN111064756B (zh) 2015-08-07 2015-08-07 终端接入3gpp网络的处理方法及装置
PCT/CN2015/086390 WO2017024449A1 (zh) 2015-08-07 2015-08-07 终端接入3gpp网络的处理方法及装置
EP15900648.5A EP3324681B1 (en) 2015-08-07 2015-08-07 Processing method and device for accessing to 3gpp network by terminal
US15/890,936 US10278073B2 (en) 2015-08-07 2018-02-07 Processing method for terminal access to 3GPP network and apparatus
US16/357,950 US10681546B2 (en) 2015-08-07 2019-03-19 Processing method for sim card equipped terminal access to 3GPP network and apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2015/086390 WO2017024449A1 (zh) 2015-08-07 2015-08-07 终端接入3gpp网络的处理方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/890,936 Continuation US10278073B2 (en) 2015-08-07 2018-02-07 Processing method for terminal access to 3GPP network and apparatus

Publications (1)

Publication Number Publication Date
WO2017024449A1 true WO2017024449A1 (zh) 2017-02-16

Family

ID=57982932

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/086390 WO2017024449A1 (zh) 2015-08-07 2015-08-07 终端接入3gpp网络的处理方法及装置

Country Status (6)

Country Link
US (2) US10278073B2 (zh)
EP (2) EP3614741B1 (zh)
KR (1) KR102084580B1 (zh)
CN (2) CN111064756B (zh)
RU (1) RU2682849C1 (zh)
WO (1) WO2017024449A1 (zh)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102084580B1 (ko) * 2015-08-07 2020-03-04 후아웨이 테크놀러지 컴퍼니 리미티드 3gpp 네트워크로의 단말 액세스를 위한 처리 방법 및 장치
US20190069162A1 (en) * 2016-03-09 2019-02-28 Telefonaktiebolaget Lm Ericsson (Publ) Methods providing service limitation and related communication devices and network nodes
CN110234112B (zh) * 2018-03-05 2020-12-04 华为技术有限公司 消息处理方法、系统及用户面功能设备
BR112020026940A2 (pt) * 2018-06-30 2021-03-30 Nokia Solutions And Networks Oy Manipulação de falha de acesso não 3gpp a 5gcn não sendo permitido
CN109600432B (zh) * 2018-12-03 2021-08-03 上海科技大学 内容中心移动边缘网络用户动态接入方法
WO2020185204A1 (en) * 2019-03-11 2020-09-17 Hewlett-Packard Development Company, L.P. Network device compliance
CN112738794B (zh) * 2021-01-07 2022-09-27 展讯半导体(成都)有限公司 驻网方法、芯片、移动终端及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101483922A (zh) * 2008-01-09 2009-07-15 华为技术有限公司 控制接入的方法、接入网关和鉴权服务器
CN101778446A (zh) * 2009-01-09 2010-07-14 中兴通讯股份有限公司 演进分组系统中多接入控制方法与装置及多接入指示方法
US20140024370A1 (en) * 2012-07-17 2014-01-23 Apple Inc. Method and apparatus for establishing a communication connection

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008099254A2 (en) * 2007-02-12 2008-08-21 Nokia Corporation Authorizing n0n-3gpp ip access during tunnel establishment
CN101335993A (zh) * 2007-06-25 2008-12-31 华为技术有限公司 接入处理方法、装置及用户设备
US9775096B2 (en) * 2007-10-08 2017-09-26 Qualcomm Incorporated Access terminal configuration and access control
US9173148B2 (en) 2007-10-12 2015-10-27 Qualcomm Incorporated Identification of target node for wireless handoff
WO2010013914A2 (en) * 2008-07-28 2010-02-04 Samsung Electronics Co., Ltd. Method for permitting a ue to conditionally access an evolved packet core network
CN101656956B (zh) * 2008-08-22 2012-05-23 华为技术有限公司 一种接入3gpp网络的方法、系统和网关
CN101815296A (zh) * 2009-02-23 2010-08-25 华为技术有限公司 一种进行接入认证的方法、装置及系统
JP5052583B2 (ja) * 2009-04-10 2012-10-17 株式会社エヌ・ティ・ティ・ドコモ 移動通信方法及び移動局
WO2012095179A1 (en) * 2011-01-14 2012-07-19 Nokia Siemens Networks Oy External authentication support over untrusted access
US9001682B2 (en) * 2011-07-21 2015-04-07 Movik Networks Content and RAN aware network selection in multiple wireless access and small-cell overlay wireless access networks
CN103108401B (zh) * 2011-11-15 2015-10-07 中国移动通信集团公司 非3gpp网接入3gpp核心网的系统、方法和设备
US20130343269A1 (en) * 2012-06-21 2013-12-26 Telefonaktiebolaget L M Ericsson (Publ) Routing data over a non-3rd generation partnership project trusted network
CN104010380B (zh) * 2013-02-25 2017-07-21 华为终端有限公司 网络选择方法及用户设备
KR102179105B1 (ko) * 2013-07-08 2020-11-16 삼성전자 주식회사 무선 랜에서 제어 혼잡을 방지하는 방법 및 장치
US10965655B2 (en) * 2015-05-28 2021-03-30 Telefonaktiebolaget Lm Ericsson (Publ) Multiple PDN connections over untrusted WLAN access
KR102084580B1 (ko) * 2015-08-07 2020-03-04 후아웨이 테크놀러지 컴퍼니 리미티드 3gpp 네트워크로의 단말 액세스를 위한 처리 방법 및 장치

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101483922A (zh) * 2008-01-09 2009-07-15 华为技术有限公司 控制接入的方法、接入网关和鉴权服务器
CN101778446A (zh) * 2009-01-09 2010-07-14 中兴通讯股份有限公司 演进分组系统中多接入控制方法与装置及多接入指示方法
US20140024370A1 (en) * 2012-07-17 2014-01-23 Apple Inc. Method and apparatus for establishing a communication connection

Also Published As

Publication number Publication date
EP3324681A4 (en) 2018-07-11
EP3324681B1 (en) 2019-07-31
CN111064756B (zh) 2022-01-18
CN107079377B (zh) 2020-02-14
CN111064756A (zh) 2020-04-24
US10278073B2 (en) 2019-04-30
EP3614741B1 (en) 2021-09-29
RU2682849C1 (ru) 2019-03-21
EP3324681A1 (en) 2018-05-23
US20190215690A1 (en) 2019-07-11
CN107079377A (zh) 2017-08-18
US20180167813A1 (en) 2018-06-14
EP3614741A1 (en) 2020-02-26
US10681546B2 (en) 2020-06-09
KR20180033263A (ko) 2018-04-02
KR102084580B1 (ko) 2020-03-04

Similar Documents

Publication Publication Date Title
WO2017024449A1 (zh) 终端接入3gpp网络的处理方法及装置
US20200162913A1 (en) Terminal authenticating method, apparatus, and system
KR101508576B1 (ko) 홈 노드-ｂ 장치 및 보안 프로토콜
CA2841094C (en) Methods for attaching a wireless device to a foreign 3gpp wireless domain using alternative authentication mechanisms
US10425448B2 (en) End-to-end data protection
US9668139B2 (en) Secure negotiation of authentication capabilities
KR102408155B1 (ko) 비밀 식별자를 사용하는 사용자 장비에 관련된 동작
KR20100054178A (ko) 이동 통신 시스템에서 단말 보안 능력 관련 보안 관리 방안및 장치
WO2012174959A1 (zh) 一种机器到机器通信中组认证的方法、系统及网关
CN109788480B (zh) 一种通信方法及装置
WO2013185709A1 (zh) 一种呼叫认证方法、设备和系统
WO2013152740A1 (zh) 用户设备的认证方法、装置及系统
RU2704717C1 (ru) Способ обработки для терминального доступа к 3gpp сети и устройству
CN115884187A (zh) 消息传输方法及通信装置
Reddy et al. A Review of 3G-WLAN Interworking

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15900648

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 20187005375

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 2018108140

Country of ref document: RU