WO2017197596A1 - 通信方法、网络侧设备和用户设备 - Google Patents

通信方法、网络侧设备和用户设备 Download PDF

Info

Publication number
WO2017197596A1
WO2017197596A1 PCT/CN2016/082480 CN2016082480W WO2017197596A1 WO 2017197596 A1 WO2017197596 A1 WO 2017197596A1 CN 2016082480 W CN2016082480 W CN 2016082480W WO 2017197596 A1 WO2017197596 A1 WO 2017197596A1
Authority
WO
WIPO (PCT)
Prior art keywords
certificate
user equipment
wireless communication
side device
network side
Prior art date
Application number
PCT/CN2016/082480
Other languages
English (en)
French (fr)
Inventor
李岩
朱方园
应江威
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201680085608.6A priority Critical patent/CN109155915A/zh
Priority to EP16901981.7A priority patent/EP3451723A4/en
Priority to PCT/CN2016/082480 priority patent/WO2017197596A1/zh
Publication of WO2017197596A1 publication Critical patent/WO2017197596A1/zh
Priority to US16/193,775 priority patent/US20190090132A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless

Definitions

  • the present invention relates to the field of communications, and in particular, to a communication method, a network side device, and a user equipment.
  • the user equipment (UE) and the network establish a Radio Resource Control (RRC) connection to the Evolved Node Base (eNodeB).
  • RRC Radio Resource Control
  • the encrypted uplink data is sent; the eNodeB sends the uplink data to the Mobility Management Entity (MME).
  • MME Mobility Management Entity
  • the MME After receiving the uplink data sent by the UE through the eNodeB, the MME decrypts the pre-encrypted message from the uplink data according to the locally stored encryption algorithm rule negotiated with the UE; and then the MME according to the Serving Gateway (SGW) The tunnel endpoint identifier of the address and the uplink data (the TEID sends the uplink data packet to the SGW, and then the SGW sends the packet to the Packet Data Network Gateway (PGW).
  • SGW Serving Gateway
  • the PGW returns the downlink data to the MME through the SGW.
  • the MME After receiving the downlink data, the MME encrypts the downlink data according to the locally stored encryption algorithm rule negotiated with the UE, and sends the encrypted downlink data to the eNodeB.
  • the eNodeB then sends the encrypted downlink data to the UE through an RRC message.
  • the UE decrypts the received downlink data to obtain downlink data before encryption.
  • the MME Core Network
  • contexts such as a Mobility Management (MM) context and a Session Management (SM) context of the UE.
  • MM Mobility Management
  • SM Session Management
  • M2M Machine to Machine
  • the UE involved in the M2M service has a fixed location and a low frequency of service communication.
  • the UE reports the message interval. It is very long, and even the message may be unidirectional (that is, only the UE needs to report the message, and the core network does not need to send the message).
  • the core network may not need to perform mobility management and session management on these UEs, that is, the core network may not need to store and maintain the MM context and SM context of these UEs to alleviate the operation burden of the core network.
  • the present invention provides a communication method, a network side device, and a user equipment, which can reduce the operational burden of the wireless communication network while realizing communication between the user equipment and the network side device.
  • the present invention provides a communication method, the communication method includes: a network side device receiving a certificate request message sent by a user equipment, where the certificate request message carries the wireless device to which the user equipment and the network side device belong The information of the key shared by the communication network or the information of the first certificate generated by the user equipment (Certificate Authority, CA); the network side device verifies according to the information of the key or the information of the first certificate The legality of the user equipment; when the network side device verifies that the user equipment is legal according to the information of the key or the information of the first certificate, the network side device generates a second And the network side device sends a certificate response message to the user equipment, where the certificate response message carries information about the second certificate.
  • CA Certificate Authority
  • the wireless communication network verifies the legality of the user equipment according to the information of the shared key or the first certificate generated by the user equipment, and generates a certificate for the legal user equipment, and the user equipment can use the certificate.
  • the wireless communication network communication that is, the MM context and the SM context in the wireless communication network, which do not need to save and maintain the user equipment, can implement communication between the user equipment and the wireless communication network according to the certificate. Therefore, the communication method of the embodiment of the present invention can realize stateless data transmission of the user equipment while reducing the storage and management burden of the wireless communication network.
  • the network side device verifies the legality of the user equipment according to the information of the key or the information of the first certificate, and the network side device obtains the information from the home user server.
  • the wireless communication network not only verifies the legality of the user equipment according to the information of the shared key or the second certificate generated by the CA for the user equipment, but also verifies the legality of the user equipment according to the subscription data of the user equipment. , thereby improving the security of communication.
  • the network side device generates the second certificate for the user equipment, where the network side device sends a certificate request message to the authentication center CA, where the certificate request is used to request the location
  • the CA generates the second certificate for the user equipment; the network side device receives a certificate reply message sent by the CA, and the certificate reply message carries information of the second certificate.
  • the wireless communication network may proxy the user equipment to apply for generating a certificate for the user equipment in the wireless communication network domain or the domain outside the domain.
  • the certificate can also be generated directly for the user equipment by the device in the wireless communication network.
  • the communication method further includes: the network side device receiving an uplink packet sent by the user equipment, where the uplink packet includes the second certificate, and using the wireless communication network
  • the certificate encrypts the first packet; the network side device verifies the legality of the user equipment according to the second certificate; and when the network side device verifies that the user equipment is legal according to the second certificate, The network side device decrypts the first packet.
  • the wireless communication network obtains the encrypted message from the user equipment and the certificate generated by the wireless communication network for the user equipment, and uses the certificate to decrypt the encrypted message when the user equipment is verified according to the certificate.
  • the wireless communication network can be made to eliminate the pre-storage of content for secure communication with the user equipment by the wireless communication network, that is, to reduce the operational burden of the wireless communication network.
  • the certificate response message further carries a certificate of the wireless communication network.
  • the communications method further includes: sending a downlink packet to the user equipment, where the downlink packet includes a second packet encrypted by using the second certificate.
  • the wireless communication network encrypts the downlink packet according to the certificate obtained from the user equipment, so that the wireless communication network can save the wireless communication network without pre-storing the content for secure communication between the wireless communication network and the user equipment.
  • the operational burden of the communication network is not limited to the Wi-Fi Protected Access
  • the network side device includes a control plane device in the wireless communication network.
  • the network side device includes a forwarding plane device or a base station in the wireless communication network, where the communication method further includes: the forwarding plane device or the base station from the wireless communication network
  • the control plane device obtains the private key information of the wireless communication network; the network side device decrypts the first packet, and the network side device uses the private key information to decrypt The first message.
  • the present invention provides a communication method, in which a user equipment sends a certificate request message to a network side device, where the certificate request message carries a key shared by the user equipment and a wireless communication network to which the network side device belongs.
  • the information or the authentication center CA is the information of the first certificate generated by the user equipment; the user equipment receives the certificate response message sent by the network side device, where the certificate response message carries the network side device as the user equipment.
  • the generated information of the second certificate, where the second certificate is a certificate generated by the network device when the user equipment is legal according to the information of the key or the information of the first certificate.
  • the user equipment applies for a certificate to the wireless communication network, where the certificate can be used to implement communication between the user equipment and the wireless communication network, that is, the subsequent user equipment carries the certificate during communication with the wireless communication network, so as to facilitate the wireless
  • the network side device in the communication network can verify the validity of the user equipment and/or decrypt the message according to the certificate, so that the network side device in the wireless communication network can save and maintain the MM context and the SM context of the UE, thereby being
  • the state-of-the-art data communication of the user equipment is realized while the storage and management burden of the network side device is at the same time.
  • the communications method further includes: the user equipment sends an uplink packet to the network side device, where the uplink packet includes the second certificate and a certificate encrypted using the wireless communication network The first packet is used by the network side device to verify the legitimacy of the user equipment.
  • the user equipment can improve the security of the packet according to the certificate encrypted message of the wireless communication network, and the user equipment sends the certificate generated by the wireless communication network for the wireless device to send the encrypted packet.
  • the communication system can decrypt the message when the user equipment is verified according to the certificate of the user equipment, thereby ensuring the security of the communication.
  • the certificate of the wireless communication network is pre-configured on the user equipment, or the certificate of the wireless communication network is obtained by the user equipment from the certificate response message.
  • the certificate of the wireless communication network may have been pre-configured on the user equipment or the certificate of the wireless communication network has been obtained from the certificate response message, and the certificate may be used to verify the legitimacy of the wireless communication network.
  • the communications method further includes: the user equipment receives a downlink packet sent by the wireless communications network, where the downlink packet includes the wireless communications network encrypting by using the second certificate a second message; the user equipment is authenticated according to the wireless communication network The book verifies the legitimacy of the wireless communication network; when the user equipment verifies that the wireless communication network is legal according to the certificate of the wireless communication network, the user equipment decrypts the second message.
  • the packet received by the user equipment is a packet encrypted by the wireless communication network according to the certificate of the user equipment acquired from the user equipment, so that the wireless communication network does not need to be stored and maintained for security with the user equipment for a long time.
  • the content of the communication can alleviate the burden on the wireless communication network.
  • the user equipment verifies the validity of the packet according to the certificate of the wireless communication network, so that the user equipment can only decrypt the packet sent by the legal wireless communication network, thereby improving the security of the communication.
  • the certificate of the wireless communication network may have been pre-configured on the user equipment or the certificate of the wireless communication network has been obtained from the communication process between the two, the certificate may be used to verify the legality of the wireless communication network.
  • the present invention provides a network side device, the network side device comprising a module for performing the communication method of the first aspect.
  • the present invention provides a user equipment, the user equipment comprising means for performing the communication method of the second aspect.
  • the present invention provides a network side device, which includes a memory, a processor, and a transceiver.
  • the memory is for storing a program
  • the processor is for executing a program
  • the transceiver is for communicating with other devices.
  • the processor invokes the transceiver to perform the method of the first aspect.
  • the present invention provides a user equipment including a memory, a processor, and a transceiver, the memory for storing a program, the processor for executing a program, and the transceiver for using with another device Communicate.
  • the processor invokes the transceiver to perform the method of the second aspect.
  • the present invention provides a wireless communication system, comprising the network side device according to the third aspect, and the user equipment according to the fourth aspect.
  • the present invention provides a computer readable medium storing program code for execution by a network side device, the program code comprising instructions for performing the method of the first aspect.
  • the present invention provides a computer readable medium storing program code for execution by a user device, the program code comprising instructions for performing the method of the second aspect.
  • FIG. 1 is a schematic structural diagram of a wireless communication network according to an embodiment of the present invention.
  • FIG. 2 is a schematic architectural diagram of a wireless communication network according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart of a communication method according to an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of a communication method according to an embodiment of the present invention.
  • FIG. 5 is a schematic flowchart of a communication method according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a network side device according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a user equipment according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a network side device according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a user equipment according to an embodiment of the present invention.
  • FIG. 1 or FIG. 2 may be hardware, functionally divided software, or both. structure.
  • the wireless communication network shown in FIG. 1 includes a base station, a Mobility Management Entity (MME), a Serving Gateway (SGW), and a Packet Data Network Gateway (PGW).
  • MME Mobility Management Entity
  • SGW Serving Gateway
  • PGW Packet Data Network Gateway
  • the wireless communication network described in FIG. 1 may be a conventional Evolved Packet Core (EPC) network.
  • EPC Evolved Packet Core
  • the base station may be Global System for Mobile (Global System for Mobile) Communication, GSM) system or Base Transceiver Station (BTS) in Code Division Multiple Access (CDMA) system, or Wideband Code Division Multiple Access (WCDMA) system
  • GSM Global System for Mobile
  • BTS Base Transceiver Station
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • the base station (NodeB) may also be an evolved base station (Evolutional Node B, eNB or eNodeB) in the LTE system, or a base station device, a small base station device, or the like in the future 5G network, which is not limited by the present invention.
  • the MME is a control plane device of the wireless communication network, and can determine, according to the mobility or the connection state of the user, what actions the user takes for an event, and the main functions include access control, mobility management, session management, and network element selection. , store user bearer information, and so on.
  • Mobility management supported by the MME includes attaching, detaching, tracking area update, switching, clearing users, and the like.
  • the MME is responsible for user mobility management, and also includes user context and mobility state management, assigning user temporary identity, authenticating and authorizing users, and the like.
  • the SGW is a forwarding plane device of the wireless communication network, and implements UE message forwarding through a transmission tunnel with the base station and the PGW.
  • the SGW is responsible for the establishment, modification, and release of bearers, and the quality of service (QoS) control.
  • QoS quality of service
  • the main QoS parameters of the bearer are supported, including the QoS Class Identifier (QCI) and the Address Resolution Protocol (ARP). ), Guaranteed Bit Rate (GBR).
  • QCI QoS Class Identifier
  • ARP Address Resolution Protocol
  • GBR Guaranteed Bit Rate
  • the SGW is also responsible for information storage, and stores Evolved Packet System (EPS) bearer context information, including tunnel identifiers, user identifiers, and the like.
  • EPS Evolved Packet System
  • the PGW is also a forwarding plane device, and its interface with an external packet data network (PDN) can be combined with the SGW.
  • PDN packet data network
  • the PGW is responsible for Internet Protocol (IP) address allocation, bearer setup, modification, and release, Policy and Charging Rules Function (PCRF) selection, QoS control, policy and charging enforcement functions, and EPS storage.
  • IP Internet Protocol
  • PCRF Policy and Charging Rules Function
  • the wireless communication network shown in FIG. 2 includes a base station, a Gateway-Control (GW-C), and a Gateway-User (GW-U).
  • the wireless communication network shown in FIG. 2 can also be referred to as a separate communication and forwarding communication network.
  • the control plane gateway integrates functions such as MME and gateway control plane. In addition to responsible for user mobility management, it also has IP address allocation, gateway user plane equipment, bearer management, and gateway user plane forwarding rules.
  • the control plane gateway can also be a control plane device.
  • the user plane gateway has functions such as user packet forwarding, encapsulation, and statistics.
  • User plane gateway can also It is called a forwarding plane device or a user plane device.
  • the wireless communication network shown in FIG. 1 or FIG. 2 may be a CIOT in which applications such as intelligent environment monitoring, smart meter reading, object tracking, smart city, smart farm or smart home can be implemented.
  • FIG. 3 is a schematic flowchart of a communication method according to an embodiment of the present invention. It should be understood that FIG. 3 illustrates steps or operations of the communication method, but these steps or operations are merely examples, and embodiments of the present invention may perform other operations or variations of the various operations in FIG. Moreover, the various steps in FIG. 3 may be performed in a different order than that presented in FIG. 3, and it is possible that not all operations in FIG. 3 are to be performed.
  • the user equipment sends a certificate request message to the base station in the wireless communication network, and the base station in the wireless communication network receives a certificate request message sent by the user equipment, where the certificate request message is used to request the wireless communication network to generate a certificate for the user equipment.
  • the base station sends a certificate request message received from the user equipment to the control plane device in the wireless communication network, where the control plane device receives the certificate request message of the user equipment sent by the base station.
  • the control plane device generates a second certificate for the user equipment according to the certificate request message.
  • the control plane device sends a certificate response message to the base station, where the base station receives a certificate response message sent by the control plane device, where the certificate response message carries information about the second certificate, where the second certificate is used by the wireless communication network. Secure communication between the user equipment.
  • the certificate response message sent by the control plane device to the base station may also carry the certificate of the wireless communication network.
  • the base station sends a certificate response message to the user equipment, where the user equipment receives the certificate response message sent by the base station.
  • the control plane device in the wireless communication network generates a certificate for the user equipment according to the request of the user equipment, so that the user equipment can use the certificate to communicate with the wireless communication network, and the wireless communication network does not need to be pre-stored.
  • the content of the MM context and the SM context of the user equipment is used to implement communication between the user equipment and the wireless communication network, so that communication between the user equipment and the wireless communication network can be realized while reducing the storage and management burden of the wireless communication network.
  • the certificate request message may carry information of a key shared by the user equipment with the wireless communication network or information of the first certificate generated by the CA for the user equipment.
  • the control plane device generates a second certificate for the user equipment according to the certificate request message, specifically: the control plane device verifies the legality of the user equipment according to the information of the key or the information of the first certificate; Control surface device And when the user equipment is verified according to the information of the key or the information of the first certificate, the second certificate is generated for the user equipment.
  • the wireless communication network verifies the legality of the user equipment according to the information of the shared key or the first certificate generated by the CA for the user equipment, and can further ensure that the wireless communication network only generates a certificate for the legal user equipment, thereby improving the security of the communication.
  • a specific implementation manner of the control plane device verifying the legitimacy of the user equipment according to the information of the key or the information of the first certificate is: the control plane device acquires a user from a Home Subscriber Server (HSS) The subscription data of the device; the control plane device then verifies the legality of the user equipment according to the information of the key or the information of the first certificate and the subscription data.
  • HSS Home Subscriber Server
  • the wireless communication network not only verifies the legality of the user equipment according to the information of the shared key or the first certificate generated by the CA for the user equipment, but also verifies the legality of the user equipment according to the subscription data of the user equipment, and can further improve the communication. Security.
  • the certificate request message in S310 and S320 may be an attach request message
  • the certificate response message in S340 and S350 may be an attach accept message
  • the user equipment is a secret key pair including a public key and a private key.
  • the certificate request message may carry the information of the identifier of the user equipment and the public key information of the user equipment, and the identifier of the user equipment may be an International Mobile Subscriber Identification Number (IMSI) or a mobile subscriber international integrated service digital network number (Mobile). Subscriber International Integrated Service Digital Network Number, MSISDN).
  • IMSI International Mobile Subscriber Identification Number
  • Mobile mobile subscriber international integrated service digital network number
  • MSISDN Subscriber International Integrated Service Digital Network Number
  • the control plane device can obtain the subscription data of the user equipment from the HSS according to the identification information of the user equipment, and verify the legality of the user equipment. After verifying that the user equipment is legal, the control plane device generates a certificate for the user equipment, and the certificate may include the identification information of the user equipment, the public key, and the identification information of the user equipment using the private key of the wireless communication network and the public key generated by the control plane device. Signature information.
  • the second certificate of the user equipment carried in the certificate response message in S340 and S350 includes the identifier information of the user equipment, the public key information of the user equipment, and the signature information of the wireless communication network.
  • FIG. 4 is a schematic flow chart of a communication method according to another embodiment of the present invention. It should be understood that FIG. 4 illustrates steps or operations of the communication method, but these steps or operations are merely examples, and embodiments of the present invention may perform other operations or variations of the various operations in FIG. Moreover, the various steps in FIG. 4 may be performed in a different order than that presented in FIG. 3, and may not be performed in FIG. All the operations.
  • FIG. 4 differs from the communication method shown in FIG. 3 in the following points.
  • control plane device After the control plane device receives the certificate request message sent by the base station in S320, the control plane device sends a certificate request message to the CA, and the CA receives the certificate application message sent by the control plane device.
  • the CA generates a second certificate for the user equipment.
  • the CA sends a certificate reply message to the control plane device, where the certificate reply message carries the second certificate generated by the CA for the user equipment.
  • the control plane device receives the certificate reply message sent by the CA.
  • the control plane device After obtaining the second certificate from the CA to the user equipment, the control plane device sends a certificate response message to the base station at S340, where the certificate response message carries the second certificate of the user equipment.
  • the control plane device may proxy the user equipment to apply for a certificate to the user equipment in the wireless communication network or the CA to fully utilize the function of the CA.
  • the certificate request message received by the control plane device from the base station in S320 is as shown in FIG.
  • the communication method may further include: the control plane device verifies the legality of the user equipment according to the information of the shared key carried in the certificate request message or the information of the second certificate.
  • the proxy user equipment sends a certificate request message to the CA at S332.
  • the specific implementation manner of the control plane device verifying the legality of the user equipment may be: Obtaining the subscription data of the user equipment from the HSS according to the identification information of the user equipment, and verifying the legality of the user equipment.
  • the proxy user equipment After the control plane device verifies that the user equipment is legal, the proxy user equipment sends a certificate request message to the CA.
  • the certificate application message may carry the identification information of the user equipment and the public key information of the user equipment.
  • the CA generates a second certificate for the user equipment according to the public key and the identifier of the user equipment, where the second certificate may include the identification information of the user equipment, the public key information, and the identification information of the user equipment according to the private key of the CA, Signature information generated by the public key of the user device.
  • the second certificate of the user equipment carried in the certificate response message in S340 and S350
  • the identification information of the user equipment, the public key information of the user equipment, and the signature information of the CA are included.
  • the CA in FIG. 4 may be a CA in a wireless communication network domain or a CA outside the wireless communication network domain, which is not limited by the present invention.
  • the communication method described in FIG. 3 and FIG. 4 mainly introduces how the network side device generates a certificate for the user equipment according to the request of the user equipment, and sends the certificate to the user equipment.
  • a method for securely communicating with a wireless communication network using the certificate after the user equipment obtains a certificate generated by the wireless communication network is described below with reference to FIG.
  • FIG. 5 is a schematic flowchart of a communication method according to an embodiment of the present invention. It should be understood that FIG. 5 illustrates steps or operations of the communication method, but these steps or operations are merely examples, and embodiments of the present invention may perform other operations or variations of the various operations in FIG. 5. Moreover, the various steps in FIG. 5 may be performed in a different order than that presented in FIG. 5, and it is possible that not all operations in FIG. 5 are to be performed.
  • the user equipment encrypts the packet by using a certificate of the wireless communication network.
  • S520 The user equipment sends an uplink packet to the control plane device, where the uplink packet includes a first packet obtained by using a certificate of the wireless communication network and a second certificate of the user equipment.
  • the control plane device receives the uplink packet sent by the user equipment.
  • the user equipment can send an uplink packet to the control plane device through the base station, that is, the uplink packet received by the control plane device is sent by the user equipment through the base station.
  • the control plane device verifies the legality of the user equipment according to the second certificate of the user equipment.
  • control plane device When the control plane device verifies that the user equipment is legal according to the second certificate of the user equipment, the control plane device decrypts the first packet.
  • the control plane device can send the packet obtained by decrypting the first packet to the server.
  • the control plane device When there is a packet that needs to be sent to the user equipment in the wireless communication network, the control plane device encrypts the packet by using the second certificate of the user equipment to obtain the second packet.
  • the encrypted message can be obtained by the control plane network element from the server.
  • the control plane device sends a downlink packet to the user equipment, where the downlink packet carries the second packet, and the user equipment receives the downlink packet sent by the control plane device.
  • the control plane device can send a downlink packet to the user equipment through the base station.
  • the user equipment verifies the legitimacy of the wireless communication network by using a certificate of the wireless communication network.
  • the control plane device obtains the encrypted message and the certificate of the user equipment from the user equipment, and then uses the certificate to decrypt the encrypted message when the user equipment is verified according to the certificate; and the control plane device can be used.
  • the certificate of the user equipment encrypts the packet that needs to be sent to the user equipment, so that the wireless communication network can not store the content of the MM context or the SM context of the user equipment in advance, but can implement the user equipment according to the certificate according to the user equipment. Communication between wireless communication networks while reducing the operational burden of the wireless communication network.
  • the UE is authenticated according to the International Mobile Subscriber Identification Number (IMSI) of the UE, that is, the shared key of the UE and the network.
  • IMSI International Mobile Subscriber Identification Number
  • the wireless communication network preserves the context of the UE, including the security context, the mobility management context, and the session management context.
  • the UE In the existing communication method of the wireless communication network, the UE has two states: an active state and an idle state.
  • the wireless communication network needs to maintain the UE context regardless of the state of the UE.
  • the wireless communication network does not need to perform session management and mobility management on the UE, that is, the wireless communication network does not need to know the state of the UE, and stores any state context of the UE, and the wireless communication network only receives the UE.
  • the transmitted message may be sent to the UE. Therefore, the communication method in the embodiment of the present invention may also be referred to as stateless transmission.
  • the certificate of the wireless communication network includes the public key of the wireless communication network.
  • the user equipment may specifically encrypt the message by using the public key of the wireless communication network to obtain the first message.
  • the second certificate of the user equipment includes the public key and signature information of the user equipment.
  • the second certificate of the user equipment may be generated by the control plane device or may be generated by the CA. If the second certificate is generated by the control plane device, the signature in the second certificate may be a signature obtained by the control plane device using the private key of the wireless communication network; if the second certificate is generated by the CA, the signature in the second certificate It can be a signature obtained by the CA using the CA's private key for encryption.
  • a specific implementation method for the control plane device to verify the legitimacy of the user equipment according to the second certificate of the user equipment is: if the second certificate is generated by the control plane device, the control plane device uses the wireless communication network.
  • the public key verifies the validity of the signature information in the second certificate, that is, verifies the legality of the user equipment; if the second certificate is generated by the CA, the control plane device uses the public key of the CA to verify the signature information in the second certificate.
  • Legitimacy that is, verifying the legitimacy of user equipment.
  • the control plane device verifies the user equipment according to the second certificate of the user equipment. After being legal, the control plane device decrypts the first message using the private key of the wireless communication network.
  • control plane device when there is a message in the wireless communication network that needs to be sent to the user equipment, the control plane device encrypts the message by using the public key in the second certificate to obtain the second message.
  • the user equipment verifies the legitimacy of the wireless communication network using the public key in the certificate of the wireless communication network.
  • the execution subject is a control plane device, that is, the control plane device verifies the legitimacy of the user equipment, decrypts or encrypts the message.
  • the communication method shown in FIG. 5, such as a base station or a forwarding plane device may also be implemented by other devices.
  • the base station or the forwarding plane device can acquire the private key of the wireless communication network from the control plane device.
  • the wireless communication network in the communication method shown in FIG. 3 to FIG. 5 may be a home network of the user equipment, or may be a visited network of the user equipment.
  • the user equipment can re-send the certificate request message to the visited network to implement the communication method in FIG. 3 or FIG. 4, so that the user equipment can obtain the network from the visited network. Visit the network to generate a certificate for it.
  • the communication method shown in FIG. 5 can be implemented with the visited network.
  • the network side device in the visited network decrypts the packet sent by the user equipment, and then forwards the decrypted packet to the home network of the user equipment.
  • the network side device in the visited network obtains the home network of the user equipment.
  • the packet sent to the user equipment is encrypted, and the packet is encrypted according to the certificate of the user equipment, and then the encrypted packet is sent to the user equipment.
  • the visited network does not maintain and store the relevant context of the user equipment.
  • the user equipment only needs to obtain the certificate generated by the visited network from the visited network, that is, the security communication with the visited network can be implemented according to the certificate.
  • the network side device and the user equipment for implementing the communication method of the embodiment of the present invention are described below with reference to FIG. 6 to FIG.
  • FIG. 6 is a schematic structural diagram of a network side device according to an embodiment of the present invention. It should be understood that the network side device 600 shown in FIG. 6 is merely an exemplary illustration, which may also include more or fewer components. The network side device in FIG. 6 can be implemented by the control plane device in FIG. 3, FIG. 4 and FIG. A step of. The network side device 600 shown in FIG. 6 includes a receiving module 610, a verification module 620, a generating module 630, and a sending module 640.
  • the receiving module 610 is configured to receive a certificate request message sent by the user equipment, where the certificate request message carries information about the key shared by the user equipment and the wireless communication network to which the network side device belongs, or the authentication center CA is the user. Information about the first certificate generated by the device.
  • the verification module 620 is configured to verify the legality of the user equipment according to the information of the key or the information of the first certificate;
  • the generating module 630 is configured to generate a second certificate for the user equipment when the verification module verifies that the user equipment is legal according to the information of the key or the information of the first certificate.
  • the sending module 640 is configured to send a certificate response message to the user equipment, where the certificate response message carries information about the second certificate.
  • the network side device of the wireless communication network verifies the legality of the user equipment according to the information of the shared key or the second certificate generated by the user equipment, and generates a certificate for the legal user equipment.
  • the communication with the wireless communication network is based on the certificate, so there is no need to store the MM context and SM context of the user equipment in the wireless communication network.
  • the communication method of the embodiment of the present invention can realize stateless data transmission of the user equipment while reducing the storage and management burden of the wireless communication network.
  • the verification module is specifically configured to: obtain subscription data of the user equipment from a home user server; according to information about the key or information of the first certificate, and the signing The data verifies the legitimacy of the user equipment.
  • the network side device not only verifies the legality of the user equipment according to the information of the shared key or the second certificate generated by the CA for the user equipment, but also verifies the legality of the user equipment according to the subscription data of the user equipment. , thereby improving the security of communication.
  • the generating module is specifically configured to: send a certificate request message to the authentication center CA, where the certificate request is used to request the CA to generate the second certificate for the user equipment; A certificate reply message sent by the CA, where the certificate reply message carries information of the second certificate.
  • the network side device may proxy the user equipment to apply for generating a certificate for the user equipment in the wireless communication network domain or the domain outside the domain.
  • the network side device can also directly generate a certificate for the user equipment.
  • the receiving module is further configured to receive, send by the user equipment.
  • the uplink packet, the uplink packet includes the second certificate and a first packet encrypted by using a certificate of the wireless communication network; wherein the network side device further includes a verification module and a decryption module;
  • the module is configured to verify validity of the user equipment according to the second certificate;
  • the decryption module is configured to decrypt the first packet when the verification module verifies that the user equipment is legal according to the second certificate.
  • the network side device obtains the encrypted message from the user equipment and the certificate generated by the wireless communication network for the user equipment, and uses the certificate to decrypt the encrypted message when the user equipment is verified according to the certificate.
  • the wireless communication network can be made to eliminate the pre-storage of content for secure communication with the user equipment by the wireless communication network, that is, to reduce the operational burden of the wireless communication network.
  • the certificate response message further carries a certificate of the wireless communication network.
  • the sending module is further configured to send a downlink packet to the user equipment, where the downlink packet includes a second packet encrypted by using the second certificate.
  • the network side device encrypts the downlink packet according to the certificate obtained from the user equipment, so that the wireless communication network can save the wireless communication network without pre-storing content for secure communication between the wireless communication network and the user equipment.
  • the operational burden of the communication network is not limited to the Wi-Fi Protected Access (WPA)
  • the wireless communication network can save the wireless communication network without pre-storing content for secure communication between the wireless communication network and the user equipment.
  • the network side device is a control plane device in the wireless communication network.
  • the network side device is a forwarding plane device or a base station in the wireless communication network, where the network side device further includes an acquiring module, configured to be controlled from the wireless communication network.
  • the device obtains the private key information of the wireless communication network; the decrypting module is specifically configured to decrypt the first packet by using the private key information.
  • FIG. 7 is a schematic structural diagram of a user equipment according to an embodiment of the present invention. It should be understood that the user device 700 shown in FIG. 7 is merely an exemplary illustration, which may also include more or fewer components. The user equipment of Figure 7 is capable of implementing the steps performed by the user equipment of Figures 3, 4 and 5. The user equipment 700 shown in FIG. 7 includes a sending module 710 and a receiving module 720.
  • the sending module 710 is configured to send a certificate request message to the network side device, where the certificate request message carries information about the key shared by the user equipment and the wireless communication network to which the network side device belongs, or the authentication center CA is the user. Information about the first certificate generated by the device.
  • the receiving module 720 is configured to receive a certificate response message sent by the network side device, where the certificate is The book response message carries information of the second certificate generated by the network side device for the user equipment, and the second certificate is that the network side device verifies the information according to the information of the key or the information of the first certificate.
  • the user equipment sends the shared key information to the wireless communication network or the second certificate generated by the CA for the user equipment, so that the wireless communication network can verify the user equipment according to the key or the first certificate.
  • Legitimate ensuring that the wireless communication network generates a certificate for the legal user equipment, and then the subsequent user equipment carries the certificate during communication with the wireless communication network, so that the network side device in the wireless communication network can verify the user equipment according to the certificate.
  • Legality and/or decryption of the message so that the network side device in the wireless communication network can save and maintain the context of the UE for authentication, thereby realizing statelessness while reducing the storage and management burden of the network side device. data communication.
  • the sending module is further configured to: send an uplink packet to the network side device, where the uplink packet includes the second certificate and the first encrypted by using a certificate of the wireless communication network a packet, where the second certificate is used by the network side device to verify the legitimacy of the user equipment.
  • the user equipment can improve the security of the packet according to the certificate encrypted message of the wireless communication network, and the user equipment sends the certificate generated by the wireless communication network for the wireless device to send the encrypted packet.
  • the communication system can decrypt the message when the user equipment is verified according to the certificate of the user equipment, thereby ensuring the security of the communication.
  • the receiving module is further configured to: receive a downlink packet sent by the network side device, where the downlink packet includes a second packet that is encrypted by the network side device by using the second certificate;
  • the user equipment further includes a verification module and a decryption module; the verification module is configured to verify validity of the wireless communication network according to the certificate of the wireless communication network; when the verification module is according to the wireless communication network When the certificate verifies that the wireless communication network is legal, the decryption module is configured to decrypt the second message.
  • the packet received by the user equipment is a packet encrypted by the wireless communication network according to the certificate of the user equipment acquired from the user equipment, so that the wireless communication network does not need to be stored and maintained for security with the user equipment for a long time.
  • the content of the communication can alleviate the burden on the wireless communication network.
  • the user equipment verifies the validity of the packet according to the certificate of the wireless communication network, so that the user equipment can only decrypt the packet sent by the legal wireless communication network, thereby improving the security of the communication.
  • the certificate of the wireless communication network is on the user equipment. Pre-configured, or the certificate of the wireless communication network is obtained by the user equipment from the certificate response message.
  • FIG. 8 is a schematic structural diagram of a network side device according to an embodiment of the present invention.
  • the network side device in Fig. 8 is capable of implementing the steps performed by the control plane device in Figs. 3 to 5.
  • the network side device 800 shown in FIG. 8 includes a memory 810, a processor 820, and a transceiver 830.
  • the memory 810 is configured to store a program.
  • the processor 820 is configured to execute a program in the memory 810.
  • the transceiver 830 is configured to receive, by the processor, a certificate request message sent by the user equipment, where the certificate request message carries information or authentication of a key shared by the user equipment and the wireless communication network to which the network side device belongs.
  • the central CA is information of the first certificate generated by the user equipment.
  • the processor 820 is specifically configured to verify the legality of the user equipment according to the information of the key or the information of the first certificate, and verify the user according to the information of the key or the information of the first certificate.
  • a second certificate is generated for the user equipment.
  • the transceiver 830 is further configured to send a certificate response message to the user equipment, where the certificate response message carries information about the second certificate.
  • the wireless communication network verifies the legality of the user equipment according to the information of the shared key or the first certificate generated by the user equipment, and generates a certificate for the legal user equipment, and the user equipment can use the certificate.
  • the wireless communication network communication that is, the MM context and the SM context in the wireless communication network, which do not need to save and maintain the user equipment, can implement communication between the user equipment and the wireless communication network according to the certificate. Therefore, the communication method of the embodiment of the present invention can realize stateless data transmission of the user equipment while reducing the storage and management burden of the wireless communication network.
  • the processor 820 is specifically configured to: acquire subscription data of the user equipment from a home user server; according to information about the key or information of the first certificate, and the The subscription data verifies the legitimacy of the user equipment.
  • the network side device not only verifies the legality of the user equipment according to the information of the shared key or the second certificate generated by the CA for the user equipment, but also verifies the legality of the user equipment according to the subscription data of the user equipment. To further improve the security of communications.
  • the processor 820 is specifically configured to: send a certificate request message to the authentication center CA, where the certificate request is used to request the CA to generate the second certificate for the user equipment; a certificate reply message sent by the CA, where the certificate reply message carries information of the second certificate.
  • the network side device may proxy the user equipment to apply for generating a certificate for the user equipment in the wireless communication network domain or the domain outside the domain.
  • the network side device can also directly generate a certificate for the user equipment.
  • the transceiver 830 is further configured to receive an uplink packet sent by the user equipment, where the uplink packet includes the second certificate and is encrypted by using a certificate of the wireless communication network. First message.
  • the processor 820 is further configured to verify the legality of the user equipment according to the second certificate. When the user equipment is verified according to the second certificate, the first packet is decrypted.
  • the network side device obtains the encrypted message from the user equipment and the certificate generated by the wireless communication network for the user equipment, and uses the certificate to decrypt the encrypted message when the user equipment is verified according to the certificate.
  • the wireless communication network can be made to eliminate the pre-storage of content for secure communication with the user equipment by the wireless communication network, that is, to reduce the operational burden of the wireless communication network.
  • the certificate response message further carries a certificate of the wireless communication network.
  • the transceiver 830 is further configured to send a downlink packet to the user equipment, where the downlink packet includes a second packet encrypted by using the second certificate.
  • the network side device encrypts the downlink packet according to the certificate obtained from the user equipment, so that the wireless communication network can save the wireless communication network without pre-storing content for secure communication between the wireless communication network and the user equipment.
  • the operational burden of the communication network is not limited to the Wi-Fi Protected Access (WPA)
  • the wireless communication network can save the wireless communication network without pre-storing content for secure communication between the wireless communication network and the user equipment.
  • the network side device is a control plane device in the wireless communication network.
  • the network side device is a forwarding plane device or a base station in the wireless communication network.
  • the processor 820 is further configured to: obtain private key information of the wireless communication network from a control plane device of the wireless communication network; and decrypt the first packet by using the private key information.
  • FIG. 9 is a schematic structural diagram of a user equipment according to an embodiment of the present invention.
  • the user equipment in FIG. 9 is capable of implementing the steps performed by the user equipment in FIGS. 3 through 5.
  • the user equipment 900 shown in FIG. 9 includes a memory 910, a processor 920, and a transceiver 930.
  • the memory 910 is configured to store a program.
  • the processor 920 is configured to execute a program in the memory 910.
  • the transceiver 930 is configured to send, by the processor 920, a certificate request message to the network side device, where the certificate request message carries information about a key shared by the user equipment and a wireless communication network to which the network side device belongs.
  • the information of the first certificate generated by the authentication center CA for the user equipment.
  • the transceiver 930 is further configured to receive a certificate response message sent by the network side device, where the certificate response message carries information about a first certificate generated by the network side device for the user equipment, where the first certificate is used by the user equipment and the Secure communication between wireless communication networks.
  • the user equipment applies for a certificate to the wireless communication network, where the certificate can be used to implement communication between the user equipment and the wireless communication network, that is, the subsequent user equipment carries the certificate during communication with the wireless communication network, so as to facilitate the wireless
  • the network side device in the communication network can verify the validity of the user equipment and/or decrypt the message according to the certificate, so that the network side device in the wireless communication network can save and maintain the MM context and the SM context of the UE, thereby being
  • the state-of-the-art data communication of the user equipment is realized while the storage and management burden of the network side device is at the same time.
  • the certificate request message carries information of a key shared by the user equipment with the wireless communication network or information of a second certificate generated by the authentication center CA for the user equipment,
  • the information of the key or the information of the second certificate is used by the network side device to verify the legitimacy of the user equipment.
  • the first certificate is a certificate generated by the network device when the user equipment is legal according to the information of the key or the second certificate information.
  • the user equipment sends the information of the shared key to the wireless communication network or the second certificate generated by the CA for the user equipment, so that the wireless communication network can verify the user equipment according to the key or the second certificate.
  • the legitimacy ensures that the wireless communication network only generates certificates for legitimate user equipment, ultimately improving the security of the communication.
  • the transceiver 930 is further configured to: send an uplink packet to the network side device, where the uplink packet includes the first certificate and a certificate encrypted by using a certificate of the wireless communication network.
  • a message, the first certificate is used by the network side device to verify the legitimacy of the user equipment.
  • the user equipment can improve the security of the packet according to the certificate encrypted message of the wireless communication network, and the user equipment sends the certificate generated by the wireless communication network for the wireless device to send the encrypted packet.
  • the communication system can decrypt the message when the user equipment is verified according to the certificate of the user equipment, thereby ensuring the security of the communication.
  • the transceiver 930 is further configured to: receive a network side device And a downlink packet, where the downlink packet includes a second packet that is encrypted by the network side device by using the first certificate.
  • the processor 920 is further configured to verify validity of the wireless communication network according to a certificate of the wireless communication network; when the wireless communication network is verified according to a certificate of the wireless communication network, the processor 920 is further configured to decrypt the second message.
  • the packet received by the user equipment is a packet encrypted by the wireless communication network according to the certificate of the user equipment acquired from the user equipment, so that the wireless communication network does not need to be stored and maintained for security with the user equipment for a long time.
  • the content of the communication can alleviate the burden on the wireless communication network.
  • the user equipment verifies the validity of the packet according to the certificate of the wireless communication network, so that the user equipment can only decrypt the packet sent by the legal wireless communication network, thereby improving the security of the communication.
  • the certificate of the wireless communication network is pre-configured on the user equipment, or the certificate of the wireless communication network is obtained by the user equipment from the certificate response message.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. You can choose some of them according to actual needs or All units are used to achieve the objectives of the solution of this embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present invention which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明提供一种通信方法、网络侧设备和用户设备。该通信方法包括：网络侧设备接收用户设备发送的证书请求消息，证书请求消息携带用户设备与网络侧设备所属的无线通信网络共享的密钥的信息或CA为用户设备生成的第一证书的信息；网络侧设备根据密钥的信息或第一证书的信息验证用户设备的合法性；当网络侧设备根据密钥的信息或第一证书的信息验证用户设备合法时，网络侧设备为用户设备生成第二证书；网络侧设备向用户设备发送证书响应消息，证书响应消息携带第二证书的信息。本发明的通信方法、网络侧设备和用户设备可以减小无线通信网络的运行负担。

Description

通信方法、网络侧设备和用户设备 技术领域
本发明涉及通信领域，尤其涉及通信方法、网络侧设备和用户设备。
背景技术
目前的演进分组系统(Evolved Packet System，EPS)网络中，用户设备(User Equipment，UE)与网络建立无线资源控制(Radio Resource Control，RRC)连接后，向演进型基站(Evolved Node Base，eNodeB)发送加密的上行数据；eNodeB再向移动性管理网元(Mobility Management Entity，MME)发送该上行数据。MME接收到UE通过eNodeB发送的上行数据后，根据本地存储的与UE协商好的加密算法规则，从上述上行数据中解密出加密前的报文；然后MME根据服务网关(Serving Gateway，SGW)的地址和上行数据的隧道端点标识(Tunnel Endpoint Identifier，TEID将上行数据报文发往SGW，再由SGW发送至分组数据网关(Packet Data Network Gateway，PGW)。
如果UE在上行数据中指示，网络需要返回下行数据，则PGW通过SGW将下行数据返回到MME。
MME收到下行数据后，根据本地存储的与UE协商好的加密算法规则，对下行数据进行加密数据，并将加密后的下行数据发送给eNodeB。eNodeB再将加密的下行数据通过RRC消息发送给UE。UE对接收到的下行数据进行解密，从而得到加密前的下行数据。
上述数据的传输方法中，MME(核心网)需要保存UE的移动性管理(Mobility Management，MM)上下文和会话管理(Session Management，SM)上下文等上下文。
而随着通信技术的发展，机器与机器(Machine to Machine，M2M)间通信的需求越来越大。未来的运营商业务不再局限于语音和数据流量，而会增加M2M业务。
M2M业务所涉及的UE多数情况下位置固定且业务通信频率低，如蜂窝物联网(Cellular Internet of Thing，CIOT)中的智能环境监测、智能抄表、物体追踪等场景下，UE上报报文间隔很长，甚至报文可能是单向的(即只需要UE上报报文，而核心网不需要下发报文)。此时，如果还需要核心网 来维护这样的UE的上下文，就会带来存储负担。也就是说，核心网可以不需要对这些UE进行移动性管理和会话管理，即核心网可以不用存储和维护这些UE的MM上下文和SM上下文，以减轻核心网的运营负担。
而如果核心网不存储和维护这些UE的MM上下文和SM上下文，那么怎么实现这些UE的报文的传输呢？
发明内容
本发明提供一种通信方法、网络侧设备和用户设备，实现用户设备与网络侧设备间的通信的同时，可以减小无线通信网络的运行负担。
第一方面，本发明提供了一种通信方法，所述通信方法包括：网络侧设备接收用户设备发送的证书请求消息，所述证书请求消息携带所述用户设备与所述网络侧设备所属的无线通信网络共享的密钥的信息或认证中心(CertificateAuthority，CA)为所述用户设备生成的第一证书的信息；所述网络侧设备根据所述密钥的信息或所述第一证书的信息验证所述用户设备的合法性；当所述网络侧设备根据所述密钥的信息或所述第一证书的信息验证所述用户设备合法时，所述网络侧设备为所述用户设备生成第二证书；所述网络侧设备向所述用户设备发送证书响应消息，所述证书响应消息携带所述第二证书的信息。
本发明实施例中，无线通信网络根据共享的密钥的信息或CA为所述用户设备生成的第一证书验证用户设备的合法性，为合法的用户设备生成证书，用户设备可以使用该证书与无线通信网络通信，即无线通信网络中不需要保存和维护用户设备的MM上下文和SM上下文就可以根据该证书来实现用户设备与无线通信网络间的通信。因此本发明实施例的通信方法，可以在减轻无线通信网络的存储和管理负担的同时，实现用户设备的无状态数据传输。
在一种可能的实现方式中，所述网络侧设备根据所述密钥的信息或所述第一证书的信息验证所述用户设备的合法性，包括：所述网络侧设备从归属用户服务器获取所述用户设备的签约数据；所述网络侧设备根据所述密钥的信息或所述第一证书的信息，以及所述签约数据验证所述用户设备的合法性。
本发明实施中，无线通信网络不仅根据共享的密钥的信息或CA为所述用户设备生成的第二证书验证用户设备的合法性，还要根据用户设备的签约数据来验证用户设备的合法性，从而提高通信的安全性。
在一种可能的实现方式中，所述网络侧设备为所述用户设备生成所述第二证书，包括：所述网络侧设备向认证中心CA发送证书申请消息，所述证书申请用于请求所述CA为所述用户设备生成所述第二证书；所述网络侧设备接收所述CA发送的证书答复消息，所述证书答复消息携带所述第二证书的信息。
本发明实施例中，无线通信网络接收到用户设备的证书申请后，可以代理该用户设备向该无线通信网络域中或域外的CA申请为该用户设备生成证书。当然，也可以由无线通信网络中的设备直接为用户设备生成证书。
在一种可能的实现方式中，所述通信方法还包括：所述网络侧设备接收所述用户设备发送的上行报文，所述上行报文包括所述第二证书和使用所述无线通信网络的证书加密的第一报文；所述网络侧设备根据所述第二证书验证所述用户设备的合法性；当所述网络侧设备根据所述第二证书验证所述用户设备合法时，所述网络侧设备解密所述第一报文。
本发明实施例中，无线通信网络从用户设备处获取加密报文以及无线通信网络为用户设备生成的证书，并在根据该证书验证用户设备合法时，使用该证书对加密报文进行解密，从而可以使得无线通信网络可以不用预先存储用于无线通信网络与用户设备安全通信的内容，即减轻了无线通信网络的运行负担。
在一种可能的实现方式中，所述证书响应消息还携带所述无线通信网络的证书。
在一种可能的实现方式中，所述通信方法还包括：向所述用户设备发送下行报文，所述下行报文包括使用所述第二证书加密的第二报文。
本发明实施例中，无线通信网络根据从用户设备处获取的证书对下行报文进行加密，进一步使得无线通信网络可以不用预先存储用于无线通信网络与用户设备安全通信的内容，即减轻了无线通信网络的运行负担。
在一种可能的实现方式中，所述网络侧设备包括所述无线通信网络中的控制面设备。
在一种可能的实现方式中，所述网络侧设备包括所述无线通信网络中的转发面设备或基站；其中，所述通信方法还包括：所述转发面设备或基站从所述无线通信网络的控制面设备获取所述无线通信网络的私钥信息；所述网络侧设备解密所述第一报文，包括：所述网络侧设备使用所述私钥信息解密 所述第一报文。
第二方面，本发明提供了一种通信方法，用户设备向网络侧设备发送证书请求消息，所述证书请求消息携带所述用户设备与所述网络侧设备所属的无线通信网络共享的密钥的信息或认证中心CA为所述用户设备生成的第一证书的信息；所述用户设备接收所述网络侧设备发送的证书响应消息，所述证书响应消息携带所述网络侧设备为所述用户设备生成的第二证书的信息，所述第二证书为所述网络侧设备根据所述密钥的信息或所述第一证书的信息验证所述用户设备合法时，为所述用户设备生成的证书。
本发明实施例中，用户设备向无线通信网络申请证书，该证书可用于实现用户设备与该无线通信网络间的通信，即后续用户设备与该无线通信网络通信过程中携带该证书，以便于无线通信网络中的网络侧设备可以根据该证书验证用户设备的合法性和/或解密报文，使得无线通信网络中的网络侧设备可以不用保存和维护UE的MM上下文和SM上下文，从而可以在减轻网络侧设备的存储和管理负担的同时，实现用户设备的无状态数据通信。
在一种可能的实现方式中，所述通信方法还包括：所述用户设备向网络侧设备发送上行报文，所述上行报文包括所述第二证书和使用所述无线通信网络的证书加密的第一报文，所述第二证书用于网络侧设备验证所述用户设备的合法性。
本发明实施例中，用户设备根据无线通信网络的证书加密报文，可以提高报文的安全性，且用户设备在包发送加密报文时还发送无线通信网络为其生成的证书，以使得无线通信系统可以在根据用户设备的证书验证用户设备合法时，才会解密报文，从而也保证了通信的安全性。
在一种可能的实现方式中，所述无线通信网络的证书是所述用户设备上预先配置的，或者所述无线通信网络的证书是所述用户设备从所述证书响应消息中获取的。
用户设备上可能已经预先配置了无线通信网络的证书或者已经从证书响应消息中获取到了无线通信网络的证书，并可以使用该证书验证无线通信网络的合法性。
在一种可能的实现方式中，所述通信方法还包括：所述用户设备接收所述无线通信网络发送的下行报文，所述下行报文包括所述无线通信网络使用所述第二证书加密后的第二报文；所述用户设备根据所述无线通信网络的证 书验证所述无线通信网络的合法性；当所述用户设备根据所述无线通信网络的证书验证所述无线通信网络合法时，所述用户设备解密所述第二报文。
本发明实施例中，用户设备接收的报文是无线通信网络根据从用户设备处获取的用户设备的证书加密的报文，因此无线通信网络中不需要长时间存储、维护用于与用户设备安全通信的内容，即可以减轻无线通信网络的负担。而且用户设备在接收到报文后，根据无线通信网络的证书验证其合法性，可以使得用户设备只解密合法无线通信网络发送的报文，从而也提高了通信的安全性。
本发明实施例中，虽然用户设备上可能已经预先配置了无线通信网络的证书或者已经从之间的通信过程中获取到了无线通信网络的证书，并可以使用该证书验证无线通信网络的合法性，
第三方面，本发明提供了一种网络侧设备，所述网络侧设备包括用于执行第一方面的通信方法的模块。
第四方面，本发明提供了一种用户设备，所述用户设备包括用于执行第二方面的通信方法的模块。
第五方面，本发明提供了一种网络侧设备，所述网络侧设备包括存储器、处理器和收发器。所述存储器用于存储程序，所述处理器用于执行程序，所述收发器用于与其他设备通信。当所述程序被执行时，所述处理器调用所述收发器执行第一方面的方法。
第六方面，本发明提供了一种用户设备，所述用户设备包括存储器、处理器和收发器，所述存储器用于存储程序，所述处理器用于执行程序，所述收发器用于与其他设备进行通信。当所述程序被执行时，所述处理器调用所述收发器执行第二方面的方法。
第七方面，本发明提供了一种无线通信系统，包括如第三方面所述的网络侧设备，以及如第四方面所述的用户设备。
第八方面，本发明提供一种计算机可读介质，所述计算机可读介质存储用于网络侧设备执行的程序代码，所述程序代码包括用于执行第一方面中的方法的指令。
第九方面，本发明提供一种计算机可读介质，所述计算机可读介质存储用于用户设备执行的程序代码，所述程序代码包括用于执行第二方面中的方法的指令。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对本发明实施例中所需要使用的附图作简单地介绍，显而易见地，下面所描述的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例的无线通信网络的示意性架构图。
图2是本发明实施例的无线通信网络的示意性架构图。
图3是本发明实施例的通信方法的示意性流程图。
图4是本发明实施例的通信方法的示意性流程图。
图5是本发明实施例的通信方法的示意性流程图。
图6是本发明实施例的网络侧设备的示意性结构图。
图7是本发明实施例的用户设备的示意性结构图。
图8是本发明实施例的网络侧设备的示意性结构图。
图9是本发明实施例的用户设备的示意性结构图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
为了便于理解，先根据图1和图2从整体上描述能够实施本发明实施例的通信方法的无线通信网络的示例图。应理解，本发明实施例并不限于图1或图2所示的系统架构中，此外，图1或图2中的装置可以是硬件，也可以是从功能上划分的软件或者以上二者的结构。
图1所示的无线通信网络包括基站、移动性管理实体(Mobility Management Entity，MME)、服务网关(Serving Gateway，SGW)和分组数据网关(Packet Data Network Gateway，PGW)。图1所述的无线通信网络可以是传统的演进型分组核心(Evolved Packet Core，EPC)网络。
本发明实施例中，基站可以是全球移动通信(Global System for Mobile  communication，GSM)系统或码分多址(Code Division Multiple Access，CDMA)系统中的基站(Base Transceiver Station，BTS)，也可以是宽带码分多址(Wideband Code Division Multiple Access，WCDMA)系统中的基站(NodeB)，还可以是LTE系统中的演进型基站(Evolutional Node B，eNB或eNodeB)，或者是未来5G网络中的基站设备、小基站设备等，本发明对此并不限定。
MME是无线通信网络的控制面设备，能够根据用户的移动性或者连接状态，决定针对一个事件，该对用户采取何种动作，主要功能包括接入控制、移动性管理、会话管理、网元选择、存储用户承载信息等等。MME支持的移动性管理包括附着、去附着、跟踪区更新、切换、清除用户等等。MME负责用户的移动性管理，还包括用户上下文和移动状态管理，分配用户临时身份标识，认证和授权用户等。
SGW是无线通信网络的转发面设备，通过与基站以及PGW之间的传输隧道实现UE报文转发。SGW负责承载的建立、修改和释放，服务质量(Quality of Service，QoS)控制，支持承载的主要QoS参数，包括服务质量分类标识(QoS Class Identifier，QCI)、地址解析协议(Address Resolution Protocol，ARP)、保证比特速率(Guaranteed Bit Rate，GBR)。SGW还负责信息存储，保存演进分组系统(Evolved Packet System，EPS)承载上下文信息，包括隧道标识、用户标识等。
PGW也是转发面设备，其与外部分组数据网络(Packet Data Network，PDN)的接口，可与SGW合设。PGW负责互联网协议(Internet Protocol，IP)地址分配，承载建立、修改和释放，策略与计费规则功能单元(Policy and Charging Rules Function，PCRF)选择，QoS控制，策略与计费执行功能，保存EPS承载上下文信息，包括隧道标识，用户标识等。
图2所示的无线通信网络包括基站、控制面网关(Gateway-Control，GW-C)和用户面网关(Gateway-User，GW-U)。图2所示的无线通信网络也可称为控制和转发分离的通信网络。
控制面网关集成了MME和网关控制面等功能，除了负责用户的移动性管理，还具有IP地址分配，选择网关用户面设备，承载管理，生成网关用户面转发规则等功能。控制面网关也可以成为控制面设备。
用户面网关具有用户报文转发，封装，统计等功能。用户面网关也可以 称为转发面设备或用户面设备。
图1或图2所示的无线通信网络可以是CIOT，在该CIOT中，可以实现智能环境监测、智能抄表、物体追踪、智能城市、智能农场或智能家庭等应用。
图3是本发明一个实施例的通信方法的示意性流程图。应理解，图3示出了通信方法的步骤或操作，但这些步骤或操作仅是示例，本发明实施例还可以执行其他操作或者图3中的各个操作的变形。此外，图3中的各个步骤可以按照与图3呈现的不同的顺序来执行，并且有可能并非要执行图3中的全部操作。
S310，用户设备向无线通信网络中的基站发送证书请求消息，无线通信网络中的基站接收用户设备发送的证书请求消息，该证书请求消息用于请求所述无线通信网络为所述用户设备生成证书。
S320，基站向无线通信网络中的控制面设备发送从用户设备处接收的证书请求消息，控制面设备接收基站发送的用户设备的证书请求消息。
S330，控制面设备根据所述证书请求消息为用户设备生成第二证书。
S340，控制面设备向基站发送证书响应消息，基站接收控制面设备发送的证书响应消息，所述证书响应消息携带所述第二证书的信息，所述第二证书用于所述无线通信网络与所述用户设备间的安全通信。控制面设备向基站发送的证书响应消息中还可以携带无线通信网络的证书。
S350，基站向用户设备发送证书响应消息，用户设备接收基站发送的证书响应消息。
本发明实施例中，无线通信网络中的控制面设备根据用户设备的请求，为用户设备生成证书，以使得用户设备可以使用该证书与无线通信网络进行通信，而无线通信网络中不需要预先存储用户设备的MM上下文和SM上下文等内容来实现用户设备与无线通信网络间的通信，从而在可以减轻无线通信网络的存储和管理负担的同时，也可以实现用户设备与无线通信网络间的通信。
S310中，证书请求消息可以携带用户设备与无线通信网络共享的密钥的信息或CA为用户设备生成的第一证书的信息。此时，相应地，控制面设备根据证书请求消息为用户设备生成第二证书，具体为：控制面设备根据所述密钥的信息或所述第一证书的信息验证用户设备的合法性；当控制面设备 根据所述密钥的信息或所述第一证书的信息验证用户设备合法时，为用户设备生成所述第二证书。
无线通信网络根据共享的密钥的信息或CA为用户设备生成的第一证书验证用户设备的合法性，可以进一步保证无线通信网络只为合法的用户设备生成证书，从而提高通信的安全性。
控制面设备根据所述密钥的信息或所述第一证书的信息验证所述用户设备的合法性的一种具体实施方式为：控制面设备从归属用户服务器(Home Subscriber Server，HSS)获取用户设备的签约数据；然后控制面设备再根据所述密钥的信息或所述第一证书的信息，以及所述签约数据验证用户设备的合法性。
无线通信网络除了根据共享的密钥的信息或CA为所述用户设备生成的第一证书验证用户设备的合法性，还要根据用户设备的签约数据来验证用户设备的合法性，可以进一步提高通信的安全性。
S310和S320中的证书请求消息可以是附着请求消息，S340和S350中的证书响应消息可以是附着接受消息。
此时，用户设备先生成包括公钥和私钥的秘钥对。证书请求消息可以携带用户设备的标识的信息和用户设备的公钥信息，用户设备的标识可以是国际移动用户识别码(International Mobile Subscriber Identification Number，IMSI)或移动用户国际综合业务数字网号码(Mobile Subscriber International Integrated Service Digital Network Number，MSISDN)。
S330中，控制面设备可以根据用户设备的标识信息从HSS获取用户设备的签约数据，并验证用户设备的合法性。当验证用户设备合法后，控制面设备为用户设备生成证书，该证书可以包括用户设备的标识信息、公钥以及控制面设备使用无线通信网络的私钥对用户设备的标识信息、公钥生成的的签名信息。
相应地，S340和S350中的证书响应消息中携带的用户设备的第二证书包括用户设备的标识信息、用户设备的公钥信息和无线通信网络的签名信息。
图4是本发明另一个实施例的通信方法的示意性流程图。应理解，图4示出了通信方法的步骤或操作，但这些步骤或操作仅是示例，本发明实施例还可以执行其他操作或者图4中的各个操作的变形。此外，图4中的各个步骤可以按照与图3呈现的不同的顺序来执行，并且有可能并非要执行图4中 的全部操作。
图4中与图3中相同的附图标记表示相同的含义，为了简洁，此处不再赘述。图4所示的通信方法与图3所示的通信方法不同之处如下。
控制面设备在S320接收了基站发送的证书请求消息后，在S332，控制面设备代理用户设备向CA发送证书申请消息，CA接收控制面设备发送的证书申请消息。
S334，CA为用户设备生成第二证书。
S336，CA向控制面设备发送证书答复消息，所述证书答复消息携带CA为用户设备生成的第二证书。控制面设备接收CA发送的证书答复消息。
控制面设备从CA获取到用户设备的第二证书后，在S340向基站发送证书响应消息，该证书响应消息携带用户设备的第二证书。
本发明实施例中，控制面设备接收到用户设备的证书申请后，可以代理该用户设备向该无线通信网络中或外的CA申请为该用户设备生成证书，以充分利用CA的功能。
具体地，当控制面设备在S320从基站接收的证书请求消息中携带有用户设备与无线通信网络共享的密钥的信息或CA为用户设备生成的第二证书的信息时，图4所示的通信方法还可以包括：控制面设备根据证书请求消息中携带的共享密钥的信息或所述第二证书的信息验证用户设备的合法性。
当控制面设备根据所述密钥的信息或所述第二证书的信息验证用户设备合法时，才会在S332代理用户设备向CA发送证书申请消息。
若证书请求消息中携带用户设备的标识的信息和用户设备的公钥信息，用户设备的标识可以是IMSI或MSISDN，则控制面设备验证用户设备的合法性的具体实施方式可以为：控制面设备根据用户设备的标识信息从HSS获取用户设备的签约数据，并验证用户设备的合法性。
当控制面设备验证用户设备合法后，才代理用户设备向CA发送证书申请消息。此时，证书申请消息中可以携带用户设备的标识信息和用户设备的公钥信息。
相应地，在S334，CA根据用户设备的公钥和标识为用户设备生成第二证书，第二证书可以包括用户设备的标识信息、公钥信息以及使用CA的私钥根据用户设备的标识信息、用户设备的公钥生成的签名信息。
相应地，S340和S350中的证书响应消息中携带的用户设备的第二证书 包括用户设备的标识信息、用户设备的公钥信息和CA的签名信息。
图4中的CA可以是无线通信网络域中的CA，也可以是无线通信网络域外的CA，本发明对此不作限制。
图3和图4介绍的通信方法主要介绍是网络侧设备如何根据用户设备的请求为用户设备生成证书，并将该证书发送给用户设备的通信过程。下面结合图5介绍用户设备获取到无线通信网络为其生成的证书后，如何使用该证书与无线通信网络安全通信的方法。
图5是本发明一个实施例的通信方法的示意性流程图。应理解，图5示出了通信方法的步骤或操作，但这些步骤或操作仅是示例，本发明实施例还可以执行其他操作或者图5中的各个操作的变形。此外，图5中的各个步骤可以按照与图5呈现的不同的顺序来执行，并且有可能并非要执行图5中的全部操作。
S510，用户设备使用无线通信网络的证书对报文加密。
S520，用户设备向控制面设备发送上行报文，该上行报文中包括使用无线通信网络的证书加密得到的第一报文和用户设备的第二证书。控制面设备接收用户设备发送的上行报文。
此处，用户设备可以通过基站向控制面设备发送上行报文，即控制面设备接收到的上行报文是用户设备通过基站发送的。
S530，控制面设备根据用户设备的第二证书验证用户设备的合法性。
S540，当控制面设备根据用户设备的第二证书验证用户设备合法时，控制面设备解密第一报文。控制面设备可以将解密第一报文得到的报文发送给服务器。
S550，当无线通信网络中有需要向用户设备发送的报文时，控制面设备使用用户设备的第二证书对报文加密，得到第二报文。被加密的报文可以是控制面网元从服务器处获取的。
S560，控制面设备向用户设备发送下行报文，所述下行报文中携带所述第二报文，用户设备接收控制面设备发送的下行报文。此处控制面设备可以通过基站向用户设备发送下行报文。
S570，用户设备使用无线通信网络的证书验证无线通信网络的合法性。
S580，当用户设备根据无线通信网络的证书验证无线通信网络合法时，用户设备解密第二报文。
本发明实施例中，控制面设备从用户设备处获取加密报文和用户设备的证书，然后在根据该证书验证用户设备合法时，使用该证书对加密报文进行解密；且控制面设备可以使用用户设备的证书对需要向用户设备发送的报文加密，从而可以使得无线通信网络可以不用预先存储用户设备的MM上下文或SM上下文等内容，而是根据根据用户设备的证书即可以实现用户设备与无线通信网络间的通信，同时减轻了无线通信网络的运行负担。
无线通信网络的现有附着流程中，根据UE的国际移动用户识别码(International Mobile SubscriberIdentification Number，IMSI)，也就是UE和网络的共享密钥来对UE进行鉴权。鉴权通过后，再创建无线通信网络与UE间的会话。这个过程中，无线通信网络会保存UE的上下文，包括安全上下文、移动管理上下文和会话管理上下文。
无线通信网络的现有的通信方法中，UE有两个状态：活动(active)状态和空闲(idle)状态。无论UE处于哪个状态，无线通信网络都需要维护UE上下文。
而使用本发明实施例的通信方法，无线通信网络不需要对UE进行会话管理和移动性管理，即无线通信网络不需要知道UE的状态，以及存储UE的任何状态上下文，无线通信网络只接收UE发送的报文或向UE发送报文即可，因此本发明实施例的通信方法也可以称为无状态传输。
无线通信网络的证书中包括无线通信网络的公钥，此时，S510中，用户设备具体可以使用无线通信网络的公钥加密报文，得到第一报文。
用户设备的第二证书包括用户设备的公钥和签名信息。如图3和图4中的通信方法所述，用户设备的第二证书可以是控制面设备生成的，也可以是CA生成的。若第二证书是控制面设备生成的，第二证书中的签名可以是控制面设备使用无线通信网络的私钥进行加密得到的签名；若第二证书是CA生成的，第二证书中的签名可以是CA使用CA的私钥进行加密得到的签名。
相应地，S530中，控制面设备根据用户设备的第二证书验证用户设备的合法性的一种具体实施方法为：若第二证书是控制面设备生成的，则控制面设备使用无线通信网络的公钥来验证第二证书中的签名信息的合法性，即验证用户设备的合法性；若第二证书是CA生成的，则控制面设备使用CA的公钥来验证第二证书中的签名信息的合法性，即验证用户设备的合法性。
相应地，在S540，控制面设备根据用户设备的第二证书验证用户设备 合法后，控制面设备使用无线通信网络的私钥解密第一报文。
相应地，在S550，当无线通信网络中有需要向用户设备发送的报文时，控制面设备使用第二证书中的公钥对报文加密，得到第二报文。
相应地，在S570，用户设备使用无线通信网络的证书中的公钥验证无线通信网络的合法性。
相应地，S580，当用户设备根据无线通信网络的证书验证无线通信网络合法时，用户设备用自己的私钥解密第二报文。
图5所示的通信方法中，执行主体为控制面设备，即由控制面设备来验证用户设备的合法性、解密或加密报文。但无线通信网络中，还可以由其他设备来实现如图5所示的通信方法，如基站或转发面设备。
当由基站或转发面设备解密报文时，基站或转发面设备可以从控制面设备获取无线通信网络的私钥。
可选地，图3至图5所示的通信方法中的无线通信网络可以是用户设备的归属地网络，也可以是用户设备的拜访地网络。
若用户设备发生移动，从归属地网络漫游到拜访地网络，则用户设备可以重新向拜访地网络发送证书请求消息，实现图3或图4中的通信方法，使得用户设备可以从拜访地网络获取拜访地网络为其生成的证书。
当用户设备从拜访地网络获取拜访地网络为其生成的证书后，可以与拜访地网络实现图5所示的通信方法。其中，拜访地网络中的网络侧设备解密用户设备发送的报文后，将解密所得的报文转发至用户设备的归属地网络；拜访地网络中的网络侧设备从用户设备的归属地网络获取需要向用户设备发送的报文，并根据用户设备的证书加密该报文，然后将加密后的报文发送给用户设备。
由此可以看出，用户设备发生漫游后，拜访地网络也不要维护和存储用户设备的相关上下文。用户设备只需要从拜访地网络获取拜访地网络为其生成的证书，即可以根据该证书实现与拜访地网络的安全性通信。
下面结合图6至图9介绍实现本发明实施例的通信方法的网络侧设备和用户设备。
图6是本发明实施例的网络侧设备的示意性结构图。应理解，图6所示的网络侧设备600仅仅是一种示例性说明，其还可以包括更多或更少的组成部分。图6中的网络侧设备能够实现图3、图4和图5中由控制面设备执行 的步骤。图6所示的网络侧设备600包括接收模块610、验证模块620、生成模块630和发送模块640。
接收模块610，用于接收用户设备发送的证书请求消息，所述证书请求消息携带所述用户设备与所述网络侧设备所属的无线通信网络共享的密钥的信息或认证中心CA为所述用户设备生成的第一证书的信息。
验证模块620，用于根据所述密钥的信息或所述第一证书的信息验证所述用户设备的合法性；
生成模块630，用于在所述验证模块根据所述密钥的信息或所述第一证书的信息验证所述用户设备合法时，为所述用户设备生成第二证书。
发送模块640，用于向所述用户设备发送证书响应消息，所述证书响应消息携带所述第二证书的信息。
本发明实施例中，无线通信网络的网络侧设备根据共享的密钥的信息或CA为所述用户设备生成的第二证书验证用户设备的合法性，为合法的用户设备生成证书，用户设备可以根据该证书与无线通信网络通信，因此无线通信网络中不需要存储用户设备的MM上下文和SM上下文。本发明实施例的通信方法可以在减轻无线通信网络的存储和管理负担的同时，实现用户设备的无状态数据传输。
可选地，作为一个实施例，所述验证模块具体用于：从归属用户服务器获取所述用户设备的签约数据；根据所述密钥的信息或所述第一证书的信息，以及所述签约数据验证所述用户设备的合法性。
本发明实施中，网络侧设备不仅根据共享的密钥的信息或CA为所述用户设备生成的第二证书验证用户设备的合法性，还要根据用户设备的签约数据来验证用户设备的合法性，从而提高通信的安全性。
可选地，作为一个实施例，所述生成模块具体用于：向认证中心CA发送证书申请消息，所述证书申请用于请求所述CA为所述用户设备生成所述第二证书；接收所述CA发送的证书答复消息，所述证书答复消息携带所述第二证书的信息。
本发明实施例中，网络侧设备接收到用户设备的证书申请后，可以代理该用户设备向该无线通信网络域中或域外的CA申请为该用户设备生成证书。当然，也可以由网络侧设备直接为用户设备生成证书。
可选地，作为一个实施例，所述接收模块还用于接收所述用户设备发送 的上行报文，所述上行报文包括所述第二证书和使用所述无线通信网络的证书加密的第一报文；其中，所述网络侧设备还包括验证模块和解密模块；所述验证模块用于根据所述第二证书验证所述用户设备的合法性；
所述解密模块用于在所述验证模块根据所述第二证书验证所述用户设备合法时，解密所述第一报文。
本发明实施例中，网络侧设备从用户设备处获取加密报文以及无线通信网络为用户设备生成的证书，并在根据该证书验证用户设备合法时，使用该证书对加密报文进行解密，从而可以使得无线通信网络可以不用预先存储用于无线通信网络与用户设备安全通信的内容，即减轻了无线通信网络的运行负担。
可选地，作为一个实施例，所述证书响应消息还携带所述无线通信网络的证书。
可选地，作为一个实施例，所述发送模块还用于向所述用户设备发送下行报文，所述下行报文包括使用所述第二证书加密的第二报文。
本发明实施例中，网络侧设备根据从用户设备处获取的证书对下行报文进行加密，进一步使得无线通信网络可以不用预先存储用于无线通信网络与用户设备安全通信的内容，即减轻了无线通信网络的运行负担。
可选地，作为一个实施例，所述网络侧设备为所述无线通信网络中的控制面设备。
可选地，作为一个实施例，所述网络侧设备为所述无线通信网络中的转发面设备或基站；其中，所述网络侧设备还包括获取模块，用于从所述无线通信网络的控制面设备获取所述无线通信网络的私钥信息；所述解密模块具体用于使用所述私钥信息解密所述第一报文。
图7是本发明实施例的用户设备的示意性结构图。应理解，图7所示的用户设备700仅仅是一种示例性说明，其还可以包括更多或更少的组成部分。图7中的用户设备能够实现图3、图4和图5中由用户设备执行的步骤。图7所示的用户设备700包括发送模块710、接收模块720。
发送模块710，用于向网络侧设备发送证书请求消息，所述证书请求消息携带所述用户设备与所述网络侧设备所属的无线通信网络共享的密钥的信息或认证中心CA为所述用户设备生成的第一证书的信息。
接收模块720，用于接收所述网络侧设备发送的证书响应消息，所述证 书响应消息携带所述网络侧设备为所述用户设备生成的第二证书的信息，所述第二证书为所述网络侧设备根据所述密钥的信息或所述第一证书的信息验证所述用户设备合法时，为所述用户设备生成的证书。
本发明实施例中，用户设备通过向无线通信网络发送共享的密钥的信息或CA为所述用户设备生成的第二证书，从而使得无线通信网络可以根据密钥或上述第一证书验证用户设备的合法性，保证无线通信网络为合法的用户设备生成证书，然后后续用户设备与该无线通信网络通信过程中携带该证书，以便于无线通信网络中的网络侧设备可以根据该证书验证用户设备的合法性和/或解密报文，使得无线通信网络中的网络侧设备可以不用保存和维护UE的用于鉴权的上下文，从而可以在减轻网络侧设备的存储和管理负担的同时，实现无状态数据通信。
可选地，作为一个实施例，所述发送模块还用于：向网络侧设备发送上行报文，所述上行报文包括所述第二证书和使用所述无线通信网络的证书加密的第一报文，所述第二证书用于网络侧设备验证所述用户设备的合法性。
本发明实施例中，用户设备根据无线通信网络的证书加密报文，可以提高报文的安全性，且用户设备在包发送加密报文时还发送无线通信网络为其生成的证书，以使得无线通信系统可以在根据用户设备的证书验证用户设备合法时，才会解密报文，从而也保证了通信的安全性。
可选地，作为一个实施例，所述接收模块还用于：接收网络侧设备发送的下行报文，所述下行报文包括网络侧设备使用所述第二证书加密后的第二报文；其中，所述用户设备还包括验证模块和解密模块；所述验证模块用于根据所述无线通信网络的证书验证所述无线通信网络的合法性；当所述验证模块根据所述无线通信网络的证书验证所述无线通信网络合法时，所述解密模块用于解密所述第二报文。
本发明实施例中，用户设备接收的报文是无线通信网络根据从用户设备处获取的用户设备的证书加密的报文，因此无线通信网络中不需要长时间存储、维护用于与用户设备安全通信的内容，即可以减轻无线通信网络的负担。而且用户设备在接收到报文后，根据无线通信网络的证书验证其合法性，可以使得用户设备只解密合法无线通信网络发送的报文，从而也提高了通信的安全性。
可选地，作为一个实施例，所述无线通信网络的证书是所述用户设备上 预先配置的，或者所述无线通信网络的证书是所述用户设备从所述证书响应消息中获取的。
图8是本发明实施例的网络侧设备的示意性结构。图8中的网络侧设备能够实现图3至图5中由控制面设备执行的步骤。图8所示的网络侧设备800包括存储器810、处理器820和收发器830。
存储器810，用于存储程序。
处理器820，用于执行所述存储器810中的程序。
收发器830，用于在处理器的调度下接收用户设备发送的证书请求消息，所述证书请求消息携带所述用户设备与所述网络侧设备所属的无线通信网络共享的密钥的信息或认证中心CA为所述用户设备生成的第一证书的信息。
处理器820具体用于根据所述密钥的信息或所述第一证书的信息验证所述用户设备的合法性和在根据所述密钥的信息或所述第一证书的信息验证所述用户设备合法时，为所述用户设备生成第二证书。
收发器830还用于向所述用户设备发送证书响应消息，所述证书响应消息携带所述第二证书的信息。
本发明实施例中，无线通信网络根据共享的密钥的信息或CA为所述用户设备生成的第一证书验证用户设备的合法性，为合法的用户设备生成证书，用户设备可以使用该证书与无线通信网络通信，即无线通信网络中不需要保存和维护用户设备的MM上下文和SM上下文就可以根据该证书来实现用户设备与无线通信网络间的通信。因此本发明实施例的通信方法，可以在减轻无线通信网络的存储和管理负担的同时，实现用户设备的无状态数据传输。
可选地，作为一个实施例，所述处理器820具体用于：从归属用户服务器获取所述用户设备的签约数据；根据所述密钥的信息或所述第一证书的信息，以及所述签约数据验证所述用户设备的合法性。
本发明实施中，网络侧设备不仅根据共享的密钥的信息或CA为所述用户设备生成的第二证书验证用户设备的合法性，还要根据用户设备的签约数据来验证用户设备的合法性，进一步提高通信的安全性。
可选地，作为一个实施例，所述处理器820具体用于：向认证中心CA发送证书申请消息，所述证书申请用于请求所述CA为所述用户设备生成所述第二证书；接收所述CA发送的证书答复消息，所述证书答复消息携带所述第二证书的信息。
本发明实施例中，网络侧设备接收到用户设备的证书申请后，可以代理该用户设备向该无线通信网络域中或域外的CA申请为该用户设备生成证书。当然，也可以由网络侧设备直接为用户设备生成证书。
可选地，作为一个实施例，所述收发器830还用于接收所述用户设备发送的上行报文，所述上行报文包括所述第二证书和使用所述无线通信网络的证书加密的第一报文。其中，所述处理器820还用于根据所述第二证书验证所述用户设备的合法性；当根据所述第二证书验证所述用户设备合法时，解密所述第一报文。
本发明实施例中，网络侧设备从用户设备处获取加密报文以及无线通信网络为用户设备生成的证书，并在根据该证书验证用户设备合法时，使用该证书对加密报文进行解密，从而可以使得无线通信网络可以不用预先存储用于无线通信网络与用户设备安全通信的内容，即减轻了无线通信网络的运行负担。
可选地，作为一个实施例，所述证书响应消息还携带所述无线通信网络的证书。
可选地，作为一个实施例，所述收发器830还用于向所述用户设备发送下行报文，所述下行报文包括使用所述第二证书加密的第二报文。
本发明实施例中，网络侧设备根据从用户设备处获取的证书对下行报文进行加密，进一步使得无线通信网络可以不用预先存储用于无线通信网络与用户设备安全通信的内容，即减轻了无线通信网络的运行负担。
可选地，作为一个实施例，所述网络侧设备为所述无线通信网络中的控制面设备。
可选地，作为一个实施例，所述网络侧设备为所述无线通信网络中的转发面设备或基站。其中，所述处理器820还用于：从所述无线通信网络的控制面设备获取所述无线通信网络的私钥信息；使用所述私钥信息解密所述第一报文。
图9是本发明实施例的用户设备的示意性结构。图9中的用户设备能够实现图3至图5中由用户设备执行的步骤。图9所示的用户设备900包括存储器910、处理器920和收发器930。
存储器910，用于存储程序。
处理器920，用于执行所述存储器910中的程序。
收发器930用于在处理器920的调度下，向网络侧设备发送证书请求消息，所述证书请求消息携带所述用户设备与所述网络侧设备所属的无线通信网络共享的密钥的信息或认证中心CA为所述用户设备生成的第一证书的信息。
收发器930还用于接收网络侧设备发送的证书响应消息，所述证书响应消息携带网络侧设备为所述用户设备生成的第一证书的信息，所述第一证书用于用户设备与所述无线通信网络间的安全通信。
本发明实施例中，用户设备向无线通信网络申请证书，该证书可用于实现用户设备与该无线通信网络间的通信，即后续用户设备与该无线通信网络通信过程中携带该证书，以便于无线通信网络中的网络侧设备可以根据该证书验证用户设备的合法性和/或解密报文，使得无线通信网络中的网络侧设备可以不用保存和维护UE的MM上下文和SM上下文，从而可以在减轻网络侧设备的存储和管理负担的同时，实现用户设备的无状态数据通信。
可选地，作为一个实施例，所述证书请求消息携带所述用户设备与所述无线通信网络共享的密钥的信息或认证中心CA为所述用户设备生成的第二证书的信息，所述密钥的信息或所述第二证书的信息用于网络侧设备验证所述用户设备的合法性。其中，所述第一证书为网络侧设备根据所述密钥的信息或所述第二证书信息验证所述用户设备合法时，为所述用户设备生成的证书。
本发明实施例中，用户设备通过向无线通信网络发送共享的密钥的信息或CA为所述用户设备生成的第二证书，从而使得无线通信网络可以根据密钥或上述第二证书验证用户设备的合法性，进而保证无线通信网络只为合法的用户设备生成证书，最终提高通信的安全性。
可选地，作为一个实施例，所述收发器930还用于：向网络侧设备发送上行报文，所述上行报文包括所述第一证书和使用所述无线通信网络的证书加密的第一报文，所述第一证书用于网络侧设备验证所述用户设备的合法性。
本发明实施例中，用户设备根据无线通信网络的证书加密报文，可以提高报文的安全性，且用户设备在包发送加密报文时还发送无线通信网络为其生成的证书，以使得无线通信系统可以在根据用户设备的证书验证用户设备合法时，才会解密报文，从而也保证了通信的安全性。
可选地，作为一个实施例，所述收发器930还用于：接收网络侧设备发 送的下行报文，所述下行报文包括网络侧设备使用所述第一证书加密后的第二报文。其中，所述处理器920还用于根据所述无线通信网络的证书验证所述无线通信网络的合法性；当根据所述无线通信网络的证书验证所述无线通信网络合法时，所述处理器920还用于解密所述第二报文。
本发明实施例中，用户设备接收的报文是无线通信网络根据从用户设备处获取的用户设备的证书加密的报文，因此无线通信网络中不需要长时间存储、维护用于与用户设备安全通信的内容，即可以减轻无线通信网络的负担。而且用户设备在接收到报文后，根据无线通信网络的证书验证其合法性，可以使得用户设备只解密合法无线通信网络发送的报文，从而也提高了通信的安全性。
可选地，作为一个实施例，所述无线通信网络的证书是所述用户设备上预先配置的，或者所述无线通信网络的证书是所述用户设备从所述证书响应消息中获取的。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或 者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以权利要求的保护范围为准。

Claims (24)

  1. 一种通信方法，其特征在于，包括：
    用户设备向网络侧设备发送证书请求消息，所述证书请求消息携带所述用户设备与所述网络侧设备所属的无线通信网络共享的密钥的信息或认证中心CA为所述用户设备生成的第一证书的信息；
    所述用户设备接收所述网络侧设备发送的证书响应消息，所述证书响应消息携带所述网络侧设备为所述用户设备生成的第二证书的信息，所述第二证书为所述网络侧设备根据所述密钥的信息或所述第一证书的信息验证所述用户设备合法时，为所述用户设备生成的证书。
  2. 如权利要求1所述的通信方法，其特征在于，所述通信方法还包括：
    所述用户设备向网络侧设备发送上行报文，所述上行报文包括所述第二证书和使用所述无线通信网络的证书加密的第一报文，所述第二证书用于网络侧设备验证所述用户设备的合法性。
  3. 如权利要求2所述的通信方法，其特征在于，所述通信方法还包括：
    所述用户设备接收网络侧设备发送的下行报文，所述下行报文包括网络侧设备使用所述第二证书加密后的第二报文；
    所述用户设备根据所述无线通信网络的证书验证所述无线通信网络的合法性；
    当所述用户设备根据所述无线通信网络的证书验证所述无线通信网络合法时，所述用户设备解密所述第二报文。
  4. 如权利要求2或3所述的通信方法，其特征在于，所述无线通信网络的证书是所述用户设备上预先配置的，或者所述无线通信网络的证书是所述用户设备从所述证书响应消息中获取的。
  5. 一种通信方法，其特征在于，所述通信方法包括：
    网络侧设备接收用户设备发送的证书请求消息，所述证书请求消息携带所述用户设备与所述网络侧设备所属的无线通信网络共享的密钥的信息或认证中心CA为所述用户设备生成的第一证书的信息；
    所述网络侧设备根据所述密钥的信息或所述第一证书的信息验证所述用户设备的合法性；
    当所述网络侧设备根据所述密钥的信息或所述第一证书的信息验证所述用户设备合法时，所述网络侧设备为所述用户设备生成第二证书；
    所述网络侧设备向所述用户设备发送证书响应消息，所述证书响应消息携带所述第二证书的信息。
  6. 如权利要求5所述的通信方法，其特征在于，所述网络侧设备根据所述密钥的信息或所述第一证书的信息验证所述用户设备的合法性，包括：
    所述网络侧设备从归属用户服务器获取所述用户设备的签约数据；
    所述网络侧设备根据所述密钥的信息或所述第一证书的信息，以及所述签约数据验证所述用户设备的合法性。
  7. 如权利要求5或6所述的通信方法，其特征在于，所述网络侧设备为所述用户设备生成所述第二证书，包括：
    所述网络侧设备向认证中心CA发送证书申请消息，所述证书申请用于请求所述CA为所述用户设备生成所述第二证书；
    所述网络侧设备接收所述CA发送的证书答复消息，所述证书答复消息携带所述第二证书的信息。
  8. 如权利要求5至7中任一项所述的传输方法，其特征在于，所述通信方法还包括：
    所述网络侧设备接收所述用户设备发送的上行报文，所述上行报文包括所述第二证书和使用所述无线通信网络的证书加密的第一报文；
    所述网络侧设备根据所述第二证书验证所述用户设备的合法性；
    当所述网络侧设备根据所述第二证书验证所述用户设备合法时，所述网络侧设备解密所述第一报文。
  9. 如权利要求5至8中任一项所述的通信方法，其特征在于，所述证书响应消息还携带所述无线通信网络的证书。
  10. 如权利要求5至9中任一项所述的传输方法，其特征在于，所述通信方法还包括：
    所述网络侧设备向所述用户设备发送下行报文，所述下行报文包括使用所述第二证书加密的第二报文。
  11. 如权利要求5至10中任一项所述的通信方法，其特征在于，所述网络侧设备包括所述无线通信网络中的控制面设备。
  12. 如权利要求5至10中所述的通信方法，其特征在于，所述网络侧设备包括所述无线通信网络中的转发面设备或基站；
    其中，所述通信方法还包括：
    所述转发面设备或基站从所述无线通信网络的控制面设备获取所述无线通信网络的私钥信息；
    所述网络侧设备解密所述第一报文，包括：
    所述网络侧设备使用所述私钥信息解密所述第一报文。
  13. 一种用户设备，其特征在于，包括：
    发送模块，用于向网络侧设备发送证书请求消息，所述证书请求消息携带所述用户设备与所述网络侧设备所属的无线通信网络共享的密钥的信息或认证中心CA为所述用户设备生成的第一证书的信息；
    接收模块，用于接收所述网络侧设备发送的证书响应消息，所述证书响应消息携带所述网络侧设备为所述用户设备生成的第二证书的信息，所述第二证书为所述网络侧设备根据所述密钥的信息或所述第一证书的信息验证所述用户设备合法时，为所述用户设备生成的证书。
  14. 如权利要求13所述的用户设备，其特征在于，所述发送模块还用于：向网络侧设备发送上行报文，所述上行报文包括所述第二证书和使用所述无线通信网络的证书加密的第一报文，所述第二证书用于网络侧设备验证所述用户设备的合法性。
  15. 如权利要求14所述的用户设备，其特征在于，所述接收模块还用于：接收网络侧设备发送的下行报文，所述下行报文包括网络侧设备使用所述第二证书加密后的第二报文；
    其中，所述用户设备还包括验证模块和解密模块；
    所述验证模块用于根据所述无线通信网络的证书验证所述无线通信网络的合法性；
    当所述验证模块根据所述无线通信网络的证书验证所述无线通信网络合法时，所述解密模块用于解密所述第二报文。
  16. 如权利要求14或15所述的用户设备，其特征在于，所述无线通信网络的证书是所述用户设备上预先配置的，或者所述无线通信网络的证书是所述用户设备从所述证书响应消息中获取的。
  17. 一种无线通信网络的网络侧设备，其特征在于，包括：
    接收模块，用于接收用户设备发送的证书请求消息，所述证书请求消息携带所述用户设备与所述网络侧设备所属的无线通信网络共享的密钥的信息或认证中心CA为所述用户设备生成的第一证书的信息；
    验证模块，用于根据所述密钥的信息或所述第一证书的信息验证所述用户设备的合法性；
    生成模块，用于在所述验证模块根据所述密钥的信息或所述第一证书的信息验证所述用户设备合法时，为所述用户设备生成第二证书；
    发送模块，用于向所述用户设备发送证书响应消息，所述证书响应消息携带所述第二证书的信息。
  18. 如权利要求17所述的网络侧设备，其特征在于，所述验证模块具体用于：
    从归属用户服务器获取所述用户设备的签约数据；
    根据所述密钥的信息或所述第一证书的信息，以及所述签约数据验证所述用户设备的合法性。
  19. 如权利要求17或18所述的网络侧设备，其特征在于，所述生成模块具体用于：
    向认证中心CA发送证书申请消息，所述证书申请用于请求所述CA为所述用户设备生成所述第二证书；
    接收所述CA发送的证书答复消息，所述证书答复消息携带所述第二证书的信息。
  20. 如权利要求17至19中任一项所述的网络侧设备，其特征在于，所述接收模块还用于接收所述用户设备发送的上行报文，所述上行报文包括所述第二证书和使用所述无线通信网络的证书加密的第一报文；
    其中，所述网络侧设备还包括验证模块和解密模块；
    所述验证模块用于根据所述第二证书验证所述用户设备的合法性；
    所述解密模块用于在所述验证模块根据所述第二证书验证所述用户设备合法时，解密所述第一报文。
  21. 如权利要求17至20中任一项所述的网络侧设备，其特征在于，所述证书响应消息还携带所述无线通信网络的证书。
  22. 如权利要求17至21中任一项所述的网络侧设备，其特征在于，所述发送模块还用于向所述用户设备发送下行报文，所述下行报文包括使用所述第二证书加密的第二报文。
  23. 如权利要求17至22中任一项所述的网络侧设备，其特征在于，所述网络侧设备为所述无线通信网络中的控制面设备。
  24. 如权利要求17至22中任一项所述的网络侧设备，其特征在于，所述网络侧设备为所述无线通信网络中的转发面设备或基站；
    其中，所述网络侧设备还包括获取模块，用于从所述无线通信网络的控制面设备获取所述无线通信网络的私钥信息；
    所述解密模块具体用于使用所述私钥信息解密所述第一报文。
PCT/CN2016/082480 2016-05-18 2016-05-18 通信方法、网络侧设备和用户设备 WO2017197596A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
CN201680085608.6A CN109155915A (zh) 2016-05-18 2016-05-18 通信方法、网络侧设备和用户设备
EP16901981.7A EP3451723A4 (en) 2016-05-18 2016-05-18 COMMUNICATION PROCESS, NETWORK EQUIPMENT AND USER DEVICE
PCT/CN2016/082480 WO2017197596A1 (zh) 2016-05-18 2016-05-18 通信方法、网络侧设备和用户设备
US16/193,775 US20190090132A1 (en) 2016-05-18 2018-11-16 Communication method, network-side device, and user equipment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/082480 WO2017197596A1 (zh) 2016-05-18 2016-05-18 通信方法、网络侧设备和用户设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/193,775 Continuation US20190090132A1 (en) 2016-05-18 2018-11-16 Communication method, network-side device, and user equipment

Publications (1)

Publication Number Publication Date
WO2017197596A1 true WO2017197596A1 (zh) 2017-11-23

Family

ID=60324691

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/082480 WO2017197596A1 (zh) 2016-05-18 2016-05-18 通信方法、网络侧设备和用户设备

Country Status (4)

Country Link
US (1) US20190090132A1 (zh)
EP (1) EP3451723A4 (zh)
CN (1) CN109155915A (zh)
WO (1) WO2017197596A1 (zh)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10454836B2 (en) 2016-11-01 2019-10-22 At&T Intellectual Property I, L.P. Method and apparatus for dynamically adapting a software defined network
US10469376B2 (en) * 2016-11-15 2019-11-05 At&T Intellectual Property I, L.P. Method and apparatus for dynamic network routing in a software defined network
US10264075B2 (en) 2017-02-27 2019-04-16 At&T Intellectual Property I, L.P. Methods, systems, and devices for multiplexing service information from sensor data
US10212289B2 (en) 2017-04-27 2019-02-19 At&T Intellectual Property I, L.P. Method and apparatus for managing resources in a software defined network
US10650023B2 (en) * 2018-07-24 2020-05-12 Booz Allen Hamilton, Inc. Process for establishing trust between multiple autonomous systems for the purposes of command and control
CN112771904B (zh) * 2018-10-04 2024-05-17 谷歌有限责任公司 分布式网络蜂窝身份管理
EP3720082A1 (de) * 2019-04-05 2020-10-07 Siemens Aktiengesellschaft Verfahren zum ausstellen einer kryptographisch geschützten authentizitätsbescheinigung für einen benutzer
CN111193732A (zh) * 2019-12-26 2020-05-22 国汽(北京)智能网联汽车研究院有限公司 一种车内通信方法、装置及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102196436A (zh) * 2010-03-11 2011-09-21 华为技术有限公司 安全认证方法、装置及系统
CN103051453A (zh) * 2012-12-17 2013-04-17 连连银通电子支付有限公司 一种基于数字证书的移动终端网络安全交易系统与方法
CN103210627A (zh) * 2010-11-15 2013-07-17 交互数字专利控股公司 证书认证和信道绑定
WO2014041806A1 (en) * 2012-09-13 2014-03-20 Nec Corporation Key management in machine type communication system
CN104717600A (zh) * 2013-12-16 2015-06-17 中兴通讯股份有限公司 一种m2m终端/终端外设的可及性管理方法及设备

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1191696C (zh) * 2002-11-06 2005-03-02 西安西电捷通无线网络通信有限公司 一种无线局域网移动设备安全接入及数据保密通信的方法
KR100759489B1 (ko) * 2004-11-18 2007-09-18 삼성전자주식회사 이동통신망에서 공개키 기반구조를 이용한 아이피보안터널의 보안 방법 및 장치
US20070150723A1 (en) * 2005-12-23 2007-06-28 Estable Luis P Methods and apparatus for increasing security and control of voice communication sessions using digital certificates
CN103167491B (zh) * 2011-12-15 2016-03-02 上海格尔软件股份有限公司 一种基于软件数字证书的移动终端唯一性认证方法
CN102624744B (zh) * 2012-04-06 2014-09-10 北京星网锐捷网络技术有限公司 网络设备的认证方法、装置、系统和网络设备
US9350550B2 (en) * 2013-09-10 2016-05-24 M2M And Iot Technologies, Llc Power management and security for wireless modules in “machine-to-machine” communications

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102196436A (zh) * 2010-03-11 2011-09-21 华为技术有限公司 安全认证方法、装置及系统
CN103210627A (zh) * 2010-11-15 2013-07-17 交互数字专利控股公司 证书认证和信道绑定
WO2014041806A1 (en) * 2012-09-13 2014-03-20 Nec Corporation Key management in machine type communication system
CN103051453A (zh) * 2012-12-17 2013-04-17 连连银通电子支付有限公司 一种基于数字证书的移动终端网络安全交易系统与方法
CN104717600A (zh) * 2013-12-16 2015-06-17 中兴通讯股份有限公司 一种m2m终端/终端外设的可及性管理方法及设备

Also Published As

Publication number Publication date
US20190090132A1 (en) 2019-03-21
CN109155915A (zh) 2019-01-04
EP3451723A1 (en) 2019-03-06
EP3451723A4 (en) 2019-05-01

Similar Documents

Publication Publication Date Title
WO2017197596A1 (zh) 通信方法、网络侧设备和用户设备
CN108347410B (zh) 安全实现方法、设备以及系统
CN107566115B (zh) 密钥配置及安全策略确定方法、装置
TWI733675B (zh) 具有加密的客戶端設備上下文的網路架構和安全
CN107079023B (zh) 用于下一代蜂窝网络的用户面安全
US10694376B2 (en) Network authentication method, network device, terminal device, and storage medium
US9240881B2 (en) Secure communications for computing devices utilizing proximity services
CN108293223B (zh) 一种数据传输方法、用户设备和网络侧设备
US11805409B2 (en) System and method for deriving a profile for a target endpoint device
WO2020248624A1 (zh) 一种通信方法、网络设备、用户设备和接入网设备
Mun et al. 3G-WLAN interworking: security analysis and new authentication and key agreement based on EAP-AKA
TW201703556A (zh) 網路安全架構
EP3284276B1 (en) Security improvements in a cellular network
WO2019096075A1 (zh) 一种消息保护的方法及装置
EP3700245B1 (en) Communication method and device
Fang et al. Security requirement and standards for 4G and 5G wireless systems
WO2012024905A1 (zh) 一种移动通讯网中数据加解密方法、终端和ggsn
WO2018137195A1 (zh) 消息保护方法、用户设备和核心网设备
EP3622736B1 (en) Privacy key in a wireless communication system
Baskaran et al. A lightweight incognito key exchange mechanism for LTE-A assisted D2D communication
CN116368833A (zh) 针对边缘计算服务的安全连接的建立和认证的方法和系统
WO2011143977A1 (zh) 终端移动到增强通用陆地无线接入网络（utran）时建立增强密钥的方法及系统
JP2020505845A (ja) 緊急アクセス中のパラメータ交換のための方法およびデバイス
KR101094057B1 (ko) 이동 통신시스템의 초기 시그널링 메시지 처리 방법 및장치
Singh et al. Heterogeneous networking: Security challenges and considerations

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16901981

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2016901981

Country of ref document: EP

Effective date: 20181129