WO2018032984A1

WO2018032984A1 - Access authentication method, ue, and access device

Info

Publication number: WO2018032984A1
Application number: PCT/CN2017/095922
Authority: WO
Inventors: 侯云静
Original assignee: 电信科学技术研究院
Priority date: 2016-08-16
Filing date: 2017-08-04
Publication date: 2018-02-22
Also published as: CN107770770A; TWI641271B; TW201808028A

Abstract

The present disclosure provides an access authentication method, a user terminal, and an access device. The method may comprise: a user terminal sends a temporary identifier to an access network, so that the access network sends the temporary identifier to a network function, and the network function determines, according to the temporary identifier, whether the UE is authenticated.

Description

Access authentication method, UE and access device

Cross-reference to related applications

The present application claims priority to Chinese Patent Application No. 201610676117.0, filed on Aug.

Technical field

The present disclosure relates to the field of communications technologies, and in particular, to an access authentication method, a user equipment (UE), and an access device.

Background technique

In a communication system, the UE often needs to connect to the core network through different access networks in different locations or in different scenarios. For example, after the UE is connected to the core network through an access network, the UE connects to the core network through another access network. However, in the current communication system, the UE needs to perform an authentication process each time it connects to the core network through the access network. There is a signaling interaction every time the authentication process, so there is a problem of signaling waste.

Summary of the invention

An object of the present disclosure is to provide an access authentication method, a UE, and an access device, which solve the problem of signaling waste.

In order to achieve the above object, an embodiment of the present disclosure provides an access authentication method, including: sending, by a UE, a temporary identifier to an access network, so that the access network sends the temporary identifier to a network function, where the network function is Determining, according to the temporary identifier, whether the UE is authenticated.

Optionally, the temporary identifier is a temporary identifier allocated by the network function to the UE when the UE connects to the core network through another access network.

Optionally, the method further includes: if the UE is not authenticated, the UE performs an authentication process initiated by the network function, where the UE is not authenticated, and the network function is not found according to the temporary identifier. The context of the UE.

Optionally, the UE further sends the security verification information to the access network, and the access network further sends the security verification information to the network function, so that the network function is based on the security verification information. Determining the legitimacy of the UE.

Optionally, the security verification information includes one or more of the following: an encrypted identifier, and an encryption. Request message or signature.

Optionally, the method further includes: if the verification fails, the UE performs an authentication process initiated by the network function; or if the verification fails, the UE receives the network function by using the UE A new identity sent by the connected access network; or if the verification fails, the user terminal receives a rejection message returned by the network function.

An embodiment of the present disclosure further provides an access authentication method, including: an access device receiving a temporary identifier sent by a UE; and the access device sending the temporary identifier to a network function, so that the network function is based on the temporary The identifier determines whether the UE is authenticated.

Optionally, the temporary identifier is a temporary identifier that is allocated to the UE when the UE is connected to the core network by using another access network, where the other access network does not include the access device. .

Optionally, the method further includes: if the network function searches for a context of the UE according to the temporary identifier, indicating that the UE is authenticated, and the access device receives the The UE has been authenticated.

Optionally, the access device further receives the security verification information sent by the UE, and the access network further sends the security verification information to the network function, so that the network function is verified according to security The information authenticates the UE.

Optionally, the security verification information includes one or more of the following: an encrypted identifier, an encrypted request message, or a signature.

The embodiment of the present disclosure further provides a UE, including: a sending module, configured to send a temporary identifier to the access network, so that the access network sends the temporary identifier to a network function, where the network function is The temporary identifier determines whether the UE is authenticated.

Optionally, the UE further includes: a first execution module, configured to perform an authentication process initiated by the network function if the UE is not authenticated, where the UE is not authenticated to be the network function according to the temporary The identity of the UE is not found to be identified.

Optionally, the UE further sends the security verification information to the access network, and the access network further sends the security verification information to the network function, so that the network function is based on the security check. The certificate information determines the legitimacy of the UE.

Optionally, the UE further includes: a second execution module, configured to perform an authentication process initiated by the network function if the verification fails, or a first receiving module, configured to: if the verification fails, receive The network function is sent by the access network that the UE has connected to the new identifier; or the second receiving module is configured to receive the reject message returned by the network function if the verification fails.

The embodiment of the present disclosure further provides an access device, including: a first receiving module, configured to receive a temporary identifier sent by the UE, and a sending module, configured to send the temporary identifier to the network function, so that the network function is based on The temporary identifier determines whether the UE is authenticated.

Optionally, the access device further includes: a second receiving module, configured to: if the network function searches for a context of the UE according to the temporary identifier, indicating that the UE is authenticated, and receiving the network function The sent prompt information that the UE has been authenticated.

The embodiment of the present disclosure further provides a user terminal, including: a processor, a transceiver, a memory, a user interface, and a bus interface, wherein: the processor is configured to read a program in the memory, and perform the following process: connecting through the transceiver Sending a temporary identifier to the network, so that the access network sends the temporary identifier to the network function, and the network function determines, according to the temporary identifier, whether the user terminal is authenticated; the transceiver is used in the processor. Receive and send data under control.

An embodiment of the present disclosure further provides an access device, including: a processor, a transceiver, a memory, a user interface, and a bus interface, where: a processor is configured to read a program in the memory, and execute the following Process: receiving, by the transceiver, a temporary identifier sent by the UE; sending, by the transceiver, the temporary identifier to the network function, so that the network function determines, according to the temporary identifier, whether the user terminal is authenticated; and the transceiver is configured to: Receive and transmit data under the control of the processor.

The above technical solutions of the present disclosure have at least the following advantageous effects. In the embodiment of the present disclosure, the UE sends a temporary identifier to the access network, so that the access network sends the temporary identifier to the network function, and the network function determines, according to the temporary identifier, whether the UE is authenticated. In this way, the UE only needs to send a temporary identifier to the access network, and the network function can determine whether the UE is authenticated according to the temporary identifier, so that the UE needs to perform the authentication process when connecting to the core network through an access network. Reduce signaling waste.

DRAWINGS

FIG. 1 is a schematic structural diagram of a network applicable to an embodiment of the present disclosure;

2 is a schematic flowchart of an access authentication method according to an embodiment of the present disclosure;

FIG. 3 is a schematic diagram of another access authentication method according to an embodiment of the present disclosure;

FIG. 4 is a schematic diagram of another access authentication method according to an embodiment of the present disclosure;

FIG. 5 is a schematic diagram of another access authentication method according to an embodiment of the present disclosure;

FIG. 6 is a schematic diagram of another access authentication method according to an embodiment of the present disclosure;

FIG. 7 is a schematic flowchart of another access authentication method according to an embodiment of the present disclosure;

FIG. 8 is a schematic structural diagram of a UE according to an embodiment of the present disclosure;

FIG. 9 is a schematic structural diagram of another UE according to an embodiment of the present disclosure;

FIG. 10 is a schematic structural diagram of another UE according to an embodiment of the present disclosure;

FIG. 11 is a schematic structural diagram of an access device according to an embodiment of the present disclosure;

FIG. 12 is a schematic structural diagram of another access device according to an embodiment of the present disclosure;

FIG. 13 is a schematic structural diagram of another UE according to an embodiment of the present disclosure;

FIG. 14 is a schematic structural diagram of another access device according to an embodiment of the present disclosure.

detailed description

The technical problems, the technical solutions, and the advantages of the present invention will be more clearly described in conjunction with the accompanying drawings and specific embodiments.

Referring to FIG. 1 , FIG. 1 is a schematic diagram of a network structure applicable to an embodiment of the present disclosure. As shown in FIG. 1 , the UE includes a UE, a non-3GPP access network entity, and a non-3GPP access layer function (Non-3GPP Access). Stratum Function, N3ASF), CP functions, UP functions, Application Function (AF), and Data Network (DN). Wherein Y1 represents an interface between the UE and a non-3GPP access network (eg, WLAN) entity, Y2 represents an interface between the UE and the N3ASF entity, and Y4 represents a location between the N3ASF entity and the non-3GPP access network entity. Interface, NG1 represents the interface between the UE and the control plane function, NG2 represents the interface between the functions of the N3ASF control plane, and can also be understood as the interface between the radio access network (RAN) and the control plane function. NG3 represents the interface between the N3ASF and the user plane function, and can also be understood as the interface between the RAN and the user plane function, NG4 represents the interface between the control plane function and the user plane function, and NG5 represents the control plane function and The interface between the AFs, NG6 represents the interface between the user plane function and the DN. In addition, the above N3ASF is a logical component of the access network, which terminates the NG2 or NG3 interface. The protocol used between the UE and the N3ASF is N3-AS, which can be used to transparently transmit NAS messages, user plane bearer information, and security information between the UE and the core network. Certainly, other access network entities, such as a 3GPP access network entity, may be included in the foregoing network structure, which is not limited in comparison with the embodiments of the present disclosure. It should be noted that, in the embodiment of the present disclosure, the implementation is not limited to the foregoing network structure, and the foregoing network structure is only an example.

In addition, the UE may be a mobile phone, a tablet personal computer, a laptop computer, a personal digital assistant (PDA), a mobile internet device (MID), or a wearable device. A terminal device such as a device (Wearable Device), it should be noted that the specific type of the UE is not limited in the embodiment of the present disclosure.

Referring to FIG. 2, an embodiment of the present disclosure provides an access authentication method. As shown in FIG. 2, the method includes the following steps: 201: A UE sends a temporary identifier to an access network, so that the access network sends a network function. And determining, by the network function, whether the UE is authenticated according to the temporary identifier by the network function.

In the embodiment of the present disclosure, the foregoing step can be used to enable the UE to send the temporary identifier to the access network, and the network function can determine whether the UR is authenticated according to the temporary identifier. For example, the network function can find the UE by using the temporary identifier. The context indicates that the UE has been authenticated, that is, the UE has been connected to the core network through other access networks. After the network function determines that the UE has been authenticated, it does not need to initiate an authentication process to the UE. Therefore, the UE can be avoided by the above steps. When connecting to the core network through different access networks, multiple authentication processes are performed to reduce signaling waste.

In the embodiment of the present disclosure, the network function may be a control plane function.

Optionally, the foregoing temporary identifier is a temporary identifier that is allocated by the network function to the UE when the UE connects to the core network through another access network.

In this implementation manner, the temporary identifier is a temporary identifier allocated by the network function when the UE connects to the core network through another access network. The other access network may be an access network different from the access technology of the access network in step 201. For example, the access network in step 201 is a 3GPP access network, and the other access networks may be It is an access network other than the 3GPP access network, such as a non-3GPP access network.

Optionally, the method further includes: if the UE is not authenticated, the UE performs an authentication process initiated by the network function, where the UE is not authenticated, and the network function does not find the location according to the temporary identifier. The context of the UE.

In this implementation, if the network function determines that the UE is not authenticated according to the foregoing temporary identifier, for example, the UE does not connect to the core network through another access network before performing the step 201, the network function may be initiated to the UE. The authentication process, that is, the above-mentioned UE performs the authentication process initiated by the above network function.

Optionally, the foregoing UE further sends the security verification information to the access network, and the access network (the access network in step 201) further sends the security verification information to the network function, so that The network function determines the legitimacy of the UE according to the security verification information.

The security verification information may be sent together with the temporary identifier, for example, sending a message carrying the security verification information and the temporary identifier to the access network. In addition, after the access network receives the security verification information, the security verification information is also sent to the network function, so that the network function can determine the legality of the UE according to the security verification information. In this way, the malicious terminal intercepts the identity of the UE, and the UE is connected to the core network. In addition, the foregoing security verification information may be that the UE and the network function are pre-negotiated, or the foregoing security verification information may be pre-designated by the network function or the like.

Optionally, the foregoing security verification information includes one or more of the following: an encrypted identifier, an encrypted request message, or a signature.

The request message may be an attach request or a connection to a core network request, if the foregoing security If the verification message includes the above request message, the network function may be to check the integrity of the request message by using the integrity key in the context of the UE, and decrypt the request message by using the key in the above context, and if the decryption is successful, determine the verification. By means, it is determined that the above UE is legal.

The identifier may be an International Mobile Subscriber Identification Number (IMSI) or an International Mobile Equipment Identity (IMEI). If the foregoing security verification information includes the foregoing identifier, the network function may be to use the security information in the context of the UE to decrypt the identifier. If the decryption succeeds, determine that the verification succeeds, that is, determine that the UE is legal.

Wherein, the signature may be a digital signature. The network function may be that the signature in the context of the foregoing UE is matched with the signature in the foregoing security verification information. If the matching succeeds, it is determined that the verification is passed, that is, the UE is determined to be legal.

Optionally, the method further includes: if the verification fails, the UE performs an authentication process initiated by the network function; or if the verification fails, the UE receives the network function by using the UE a new identity sent by the connected access network; or if the verification fails, the UE receives a reject message returned by the network function.

In this implementation manner, if the verification fails, the UE performs an authentication process initiated by the network function. Or if the verification fails, the UE receives a new identifier sent by the network function through the access network that the UE has connected, so that the UE can use the new identifier for authentication. In addition, if the verification fails, the receiving network rejects the reject message, that is, the network function rejects the UE to connect to the core network through the access network, so that the malicious terminal can intercept the identifier of the UE and impersonate the UE to connect to the core network.

Optionally, the UE may send the temporary identifier to the access network by using an RRC message, and the RRC message further includes an attach request. For example, the access network in step 201 is a 3GPP access network, and the UE has connected to the core network through the non-3GPP access network. As shown in FIG. 3, the method includes the following steps:

Step 1: The UE sends an RRC message to the 3GPP access network, where the RRC message includes an attach request and a temporary identifier, where the attach request may be an encrypted attach request.

Step 2: The 3GPP access network obtains the network function of the temporary identifier according to the temporary identifier, and sends an NG2 interface message to the network function, where the message includes an attach request and a temporary identifier.

Step 3: The network function finds the context of the UE according to the temporary identifier, and uses the security in the context. The full information determines the security of the attach request. If the attach request is secure (eg, using the integrity key to check the integrity of the message, the key can successfully decrypt the attach request), the network function stores the new connection in the context of the UE. Entering information of the network (ie, the 3GPP access network to which the foregoing 3GPP access network entity belongs), and then returning an NG2 interface message to the 3GPP access network, where the message includes an attach accept message;

Step 4: The 3GPP access network returns an RRC message to the UE, where the message includes an attach accept message.

In addition, the UE may also send the temporary identifier to the access network by using a connection setup message, for example, the message parameter of the connection setup message includes the temporary identifier. For example, if the access network in step 201 is a non-3GPP access network, and the UE has connected to the core network through the 3GPP access network, as shown in FIG. 4, the following steps are included:

Step 1: The UE sends a connection setup message to the non-3GPP access network, where the message parameter includes a temporary identifier allocated by the network function when the UE connects to the core network through the 3GPP access;

Step 2: The non-3GPP access network sends a connection request message to the N3ASF, where the message parameter is a temporary identifier provided by the UE. It should be noted that if the N3ASF and the non-3GPP access network are combined, this step is not performed;

Step 3: The N3ASF sends an NG2 interface message to the network function, where the message parameters include the access technology and the temporary identifier provided by the UE.

Step 4: The network function searches for the context of the UE according to the temporary identifier of the UE, and finds that the UE has connected to the core network through the 3GPP access network, and the network function sends an NG2 interface message to the N3ASF, where the message carries the authenticated prompt information.

Step 5: The N3ASF sends a connection reply message to the non-3GPP access network, where the message carries the authenticated prompt information. It should be noted that if the N3ASF and the non-3GPP access network are combined, this step is not performed;

Step 6. The non-3GPP access network sends a connection establishment complete message to the UE.

In addition, in this implementation manner, the connection establishment message may further include an encrypted identifier or a signature. For example, in this embodiment, the UE may further encrypt the IMSI or IMEI of the UE by using a security context, and the encrypted IMSI or The IMEI is sent to the non-3GPP access network entity through step 1. That is, in the above embodiment, the messages of steps 1, 2 and 3 also carry the encrypted IMSI or IMEI, or signature. In step 3, the network function uses the temporary identity to find the context of the UE, then decrypts the IMSI and IMEI using the security information in the context, or verifies the signature, if Decrypting the IMSI and IMEI or signature of the UE is correct, indicating that the UE is the correct UE. If the decrypted identifier is different from the IMSI or IMEI in the UE context, or the signature is incorrect, it indicates that the UE is a malicious terminal impersonating.

In addition, in this embodiment, since the connection establishment message and the connection completion message are transmitted between the UE and the access network, the protocol between the extended UE and the non-3GPP access network can be implemented.

In addition, the foregoing UE may further send the temporary identifier to the access network by using an Extensible Authentication Protocol (EAP) response message. For example, the access network in step 201 may be a non-3GPP access network, and the UE has been connected to the core network through the 3GPP access network. As shown in FIG. 5, the method includes the following steps:

Step 1. Establish a connection between the UE and the non-3GPP access network.

Step 2: The non-3GPP access network sends an EAP-REQ/Identity message to the UE, and initiates an EAP authentication process.

Step 3: The UE returns an EAP-RSP/Identity message to the non-3GPP access network, where the message carries the temporary identifier of the UE.

Step 4: The non-3GPP access network sends an EAP-RSP/Identity message to the N3ASF. It should be noted that if the N3ASF and the non-3GPP access network are set together, this step is not performed;

Step 5: The N3ASF sends an EAP-RSP/Identity message to the network function.

Step 6. The network function finds that the UE has connected to the core network through the 3GPP access, and the network function does not perform the authentication process on the UE again, and returns an EAP-Success message to the N3ASF.

Step 7: The N3ASF returns an EAP-Success message to the non-3GPP access network. It should be noted that if the N3ASF and the non-3GPP access network are set together, this step is not performed;

Step 8. The non-3GPP access network returns an EAP-Success message to the UE.

The UE may also carry the encrypted IMSI, IMEI, or signature in the EAP-RSP/Identity message, in order to ensure that the UE is a valid UE.

In addition, in this embodiment, there is no need to extend the protocol between the UE and the non-3GPP access network.

The foregoing UE may also send the foregoing temporary identifier to the access network by using a protocol request message. For example, the access network in step 201 may be an access network including the N3ASF, and the UE has connected to the core network through the 3GPP access network, which may be as shown in the figure. As shown in 6, it includes the following steps:

Step 1. The UE sends an N3-AS request message to the N3ASF, where the message includes the UE passing the 3GPP. The temporary identifier assigned to the network function when accessing the core network;

Step 2: The N3ASF obtains the network function of the temporary identifier according to the temporary identifier, and then sends an NG2 interface message to the network function, where the message includes the access technology and the temporary identifier.

Step 3: The network function searches for the context of the UE according to the temporary identifier, which indicates that the UE has performed the authentication process through the 3GPP access, and returns an NG2 interface message to the N3ASF, where the message includes the authenticated prompt information.

Step 4: The N3ASF returns an N3-AS reply message to the UE, where the message includes the authenticated prompt information.

In addition, in order to ensure that the UE is a legitimate UE, the messages of steps 1 and 2 may also include an encrypted IMSI, IMEI or signature.

It should be noted that, in the various optional embodiments introduced in the embodiments of the present disclosure, the embodiments may be implemented in combination with each other, or may be implemented separately.

In the embodiment of the present disclosure, the UE sends a temporary identifier to the access network, so that the access network sends the temporary identifier to the network function, and the network function determines, according to the temporary identifier, whether the UE is authenticated. In this way, the UE only needs to send a temporary identifier to the access network, and the network function can determine whether the UE is authenticated according to the temporary identifier, so that the UE needs to perform the authentication process when connecting to the core network through an access network. Reduce signaling waste.

Referring to FIG. 7, FIG. 7 is another access authentication method according to an embodiment of the present disclosure. As shown in FIG. 7, the method includes the following steps: 701: an access device receives a temporary identifier sent by a UE; 702, an access device to a network The function sends the temporary identifier, so that the network function determines, according to the temporary identifier, whether the UE is authenticated.

It should be noted that the foregoing access device may be an access device in the access network in step 201 in the embodiment shown in FIG. 2, where the access network in step 201 in the embodiment shown in FIG. The access device entity can be implemented in any implementation manner, and details are not described herein.

Optionally, the method further includes: if the network function searches for a context of the UE according to the temporary identifier, indicating that the UE is authenticated, and the access device receives the network function The sent information that the UE has been authenticated.

It should be noted that, in this embodiment, as an implementation manner of the access network (the access network in step 201) corresponding to the embodiment shown in FIG. 2-6, a specific implementation manner can be seen in FIG. 2-6. The related description of the illustrated embodiment is omitted, and the description is not repeated herein. In this embodiment, signaling waste is also reduced.

Referring to FIG. 8, a UE structure is shown. As shown in FIG. 8, the UE 800 includes the following module: a sending module 801, configured to send a temporary identifier to the access network, so as to enable the access network to perform network functions. Sending the temporary identifier, and determining, by the network function, whether the UE is authenticated according to the temporary identifier.

Optionally, as shown in FIG. 9, the UE 800 further includes: a first execution module 802, configured to perform an authentication process initiated by the network function if the UE is not authenticated, where the UE is not authenticated as the network The function does not find the context of the UE according to the temporary identifier.

Optionally, as shown in FIG. 10, the UE 800 further includes: a second execution module 803, configured to perform an authentication process initiated by the network function if the verification fails, or a first receiving module 804, where If the verification fails, the receiving the network function is sent by the access network that the UE has connected to the new identifier; or the second receiving module 805 is configured to receive the rejection of the network function if the verification fails. Message.

It should be noted that, in the embodiment, the UE 800 may be the UE in any of the method embodiments in the embodiments of the disclosure, and any implementation manner of the UE in the method embodiment in this disclosure may be used in this embodiment. The foregoing UE 800 is implemented, and the same beneficial effects are achieved, and details are not described herein again.

Referring to FIG. 11 , an embodiment of the present disclosure provides an access device. As shown in FIG. 11 , the access device 1100 includes the following modules: a first receiving module 1101, configured to receive a temporary identifier sent by the UE, and a sending module 1102. And the method is configured to send the temporary identifier to a network function, so that the network function determines, according to the temporary identifier, whether the UE is authenticated.

Optionally, as shown in FIG. 12, the access device 1100 further includes: a second receiving module 1103, configured to: if the network function searches for a context of the UE according to the temporary identifier, indicating that the UE is authenticated Receiving, by the network function, the prompt information that the UE has been authenticated.

It should be noted that, in the embodiment, the foregoing access device 1100 may be an access device in any of the method embodiments in the embodiments of the disclosure, and any implementation manner of the access device in the method embodiment in the embodiment of the disclosure It can be implemented by the foregoing access device 1100 in this embodiment, and achieve the same beneficial effects, and details are not described herein again.

Referring to FIG. 13, a structure of a UE is shown. The UE includes: a processor 1300, a transceiver 1310, a memory 1320, a user interface 1330, and a bus interface. The processor 1300 is configured to read the memory 1320. The program is configured to: send, by the transceiver 1310, a temporary identifier to the access network, so that the access network sends the temporary identifier to the network function, where the network function determines, according to the temporary identifier, whether the UE is verified. The transceiver 1310 is configured to receive and transmit data under the control of the processor 1300.

In FIG. 13, the bus architecture may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by processor 1300 and various circuits of memory represented by memory 1320. The bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein. The bus interface provides an interface. Transceiver 1310 can be a plurality of components, including a transmitter and a receiver, providing means for communicating with various other devices on a transmission medium. For different user equipments, the user interface 1330 may also be an interface capable of externally connecting the required devices, including but not limited to a keypad, a display, a speaker, a microphone, a joystick, and the like.

The processor 1300 is responsible for managing the bus architecture and general processing, and the memory 1320 can store data used by the processor 1300 in performing operations.

Optionally, the processor 1300 is further configured to: if the UE is not authenticated, perform an authentication process initiated by the network function, where the UE is not authenticated, and the network function does not find the foregoing according to the temporary identifier. The context of the UE.

Optionally, the processor 1300 further sends the security verification information to the access network by using the transceiver 1310, and the access network further sends the security verification information to the network function, so that the network function is performed. Determining the legitimacy of the UE according to the security verification information.

Optionally, the processor 1300 is further configured to: if the verification fails, perform an authentication process initiated by the network function; or if the verification fails, receive the access that the network function is connected through the UE A new identity sent by the network; or if the verification fails, the UE's request to connect to the core network through the access network is rejected by the network function.

It should be noted that, in this embodiment, the foregoing UE may be the UE in any of the method embodiments in the embodiments of the disclosure, and any implementation manner of the UE in the method embodiment in this disclosure may be used in this embodiment. The foregoing UE implements and achieves the same beneficial effects, and details are not described herein again.

Referring to FIG. 14, a structure of an access device is shown, where the access device includes: a processor 1400, The transceiver 1410, the memory 1420, the user interface 1430, and the bus interface, wherein the processor 1400 is configured to read the program in the memory 1420, and execute the following process: receiving, by the transceiver 1410, a temporary identifier sent by the UE; And sending the temporary identifier to the network function, so that the network function determines, according to the temporary identifier, whether the UE is authenticated. The transceiver 1410 is configured to receive and transmit data under the control of the processor 1400.

In FIG. 14, the bus architecture may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by processor 1400 and various circuits of memory represented by memory 1420. The bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein. The bus interface provides an interface. Transceiver 1410 can be a plurality of components, including a transmitter and a receiver, providing means for communicating with various other devices on a transmission medium. For different user equipments, the user interface 1430 may also be an interface capable of externally connecting the required devices, including but not limited to a keypad, a display, a speaker, a microphone, a joystick, and the like.

The processor 1400 is responsible for managing the bus architecture and general processing, and the memory 1420 can store data used by the processor 1400 in performing operations.

Optionally, the processor 1400 is further configured to: if the network function searches for the context of the UE according to the temporary identifier, indicating that the UE is authenticated, and receiving, by the network function, that the UE is authenticated Prompt message.

Optionally, the processor 1400 further receives the security verification information sent by the UE by using the transceiver 1410, and further sends the security verification information to the network function by using the transceiver 1410, so that the network function is based on security. The authentication information authenticates the UE.

It should be noted that, in the embodiment, the foregoing access device may be an access device in any of the embodiments of the method in the embodiments of the disclosure, and any implementation manner of the access device in the method embodiment in the embodiment of the disclosure may be used. Implemented by the above access device in this embodiment, and achieved the same The beneficial effects will not be described here.

In the several embodiments provided in the present application, it should be understood that the disclosed method and apparatus may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

In addition, each functional unit in various embodiments of the present disclosure may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

The above-described integrated unit implemented in the form of a software functional unit can be stored in a computer readable storage medium. The above software functional unit is stored in a storage medium and includes a plurality of instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform part of the steps of the transceiving method of the various embodiments of the present disclosure. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, and the program code can be stored. Medium.

The above is a preferred embodiment of the present disclosure, and it should be noted that those skilled in the art can also make several improvements and refinements without departing from the principles of the present disclosure. It should be considered as the scope of protection of this disclosure.

Claims

An access authentication method includes:

The user terminal sends a temporary identifier to the access network, so that the access network sends the temporary identifier to the network function, and the network function determines, according to the temporary identifier, whether the user terminal is authenticated.
The method according to claim 1, wherein the temporary identifier is a temporary identifier assigned by the network function to the user terminal when the user terminal connects to the core network through another access network.
The method of claim 1 wherein the method further comprises:

If the user terminal is not authenticated, the user terminal performs an authentication process initiated by the network function, where the user terminal does not authenticate that the network function does not find the context of the user terminal according to the temporary identifier.
The method according to any one of claims 1 to 3, wherein the user terminal further transmits security authentication information to the access network, and the access network further transmits the The security verification information is such that the network function determines the legitimacy of the user terminal according to the security verification information.
The method of claim 4, wherein the security verification information comprises one or more of the following:

Encrypted ID, encrypted request message, or signature.
The method of claim 4 wherein the method further comprises:

If the verification fails, the user terminal performs an authentication process initiated by the network function; or

If the verification fails, the user terminal receives a new identifier sent by the network function by using an access network that the user terminal has connected; or

If the verification fails, the user terminal receives a reject message returned by the network function.
An access authentication method includes:

The access device receives a temporary identifier sent by the user terminal;

And the access device sends the temporary identifier to the network function, so that the network function determines, according to the temporary identifier, whether the user terminal is authenticated.
The method of claim 7, wherein the temporary identifier is passed by the user terminal When the other access network is connected to the core network, the network function is a temporary identifier allocated by the user terminal, where the other access network does not include the access device.
The method of claim 8 wherein the method further comprises:

If the network function finds the context of the user terminal according to the temporary identifier, it indicates that the user terminal is authenticated, and the access device receives the prompt information that the user terminal has been authenticated by the network function.
The method according to any one of claims 7 to 9, wherein the access device further receives security verification information sent by the user terminal, and the access network further sends the network function to the network function. The security verification information is such that the network function authenticates the user terminal according to the security verification information.
The method of claim 10, wherein the security verification information comprises one or more of the following:

Encrypted ID, encrypted request message, or signature.
A user terminal comprising:

The sending module is configured to send a temporary identifier to the access network, so that the access network sends the temporary identifier to the network function, and the network function determines, according to the temporary identifier, whether the user terminal is authenticated.
The user terminal according to claim 12, wherein the temporary identifier is a temporary identifier assigned by the network function to the user terminal when the user terminal connects to the core network through another access network.
The user terminal of claim 12, wherein the user terminal further comprises:

a first execution module, configured to perform an authentication process initiated by the network function if the user terminal is not authenticated, where the user terminal is not authenticated to be the network function, and the user terminal is not found according to the temporary identifier Context.
The user terminal according to any one of claims 12 to 14, wherein the user terminal further sends security authentication information to the access network, and the access network further sends the network function to The security verification information is used to enable the network function to determine the legitimacy of the user terminal according to the security verification information.
The user terminal of claim 15, wherein the security verification information comprises the following One or more:

Encrypted ID, encrypted request message, or signature.
The user terminal of claim 15, wherein the user terminal further comprises:

a second execution module, configured to perform an authentication process initiated by the network function if the verification fails; or

a first receiving module, configured to: if the verification fails, receive a new identifier sent by the network function by using an access network that the user terminal has connected; or

The second receiving module is configured to receive a reject message returned by the network function if the verification fails.
An access device comprising:

a first receiving module, configured to receive a temporary identifier sent by the user terminal;

And a sending module, configured to send the temporary identifier to the network function, so that the network function determines, according to the temporary identifier, whether the user terminal is authenticated.
The access device according to claim 18, wherein the temporary identifier is a temporary identifier assigned by the network function to the user terminal when the user terminal connects to the core network through another access network, wherein the temporary identifier is Other access networks do not include the access device.
The access device of claim 19, wherein the access device further comprises:

a second receiving module, configured to: if the network function searches for a context of the user terminal according to the temporary identifier, indicating that the user terminal is authenticated, and receiving a prompt that the user terminal that is sent by the network function has been authenticated information.
The access device according to any one of claims 18 to 20, wherein the access device further receives security verification information sent by the user terminal, and the access network further sends the network function The security verification information is provided to enable the network function to authenticate the user terminal according to the security verification information.
The access device of claim 21, wherein the security verification information comprises one or more of the following:

Encrypted ID, encrypted request message, or signature.
A user terminal includes: a processor, a transceiver, a memory, a user interface, and a bus interface, wherein:

a processor, configured to read a program in the memory, to perform a process of: transmitting, by the transceiver, a temporary identifier to the access network, so that the access network sends the temporary identifier to the network function, where the network function is Determining, by the temporary identifier, whether the user terminal is authenticated;

A transceiver for receiving and transmitting data under the control of a processor.
An access device includes: a processor, a transceiver, a memory, a user interface, and a bus interface, wherein:

a processor, configured to read a program in the memory, to perform the following process: receiving, by the transceiver, a temporary identifier sent by the UE; sending, by the transceiver, the temporary identifier to the network function, so that the network function is based on the temporary identifier Determining whether the user terminal is authenticated;

A transceiver for receiving and transmitting data under the control of a processor.