WO2018090986A1 - 一种鉴权方法、基站、用户设备和核心网网元 - Google Patents

一种鉴权方法、基站、用户设备和核心网网元 Download PDF

Info

Publication number
WO2018090986A1
WO2018090986A1 PCT/CN2017/111703 CN2017111703W WO2018090986A1 WO 2018090986 A1 WO2018090986 A1 WO 2018090986A1 CN 2017111703 W CN2017111703 W CN 2017111703W WO 2018090986 A1 WO2018090986 A1 WO 2018090986A1
Authority
WO
WIPO (PCT)
Prior art keywords
user equipment
core network
authentication
network element
authentication result
Prior art date
Application number
PCT/CN2017/111703
Other languages
English (en)
French (fr)
Inventor
许斌
权威
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17871597.5A priority Critical patent/EP3528522B1/en
Publication of WO2018090986A1 publication Critical patent/WO2018090986A1/zh
Priority to US16/415,819 priority patent/US10869197B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W72/00—Local resource management
    • H04W72/12—Wireless traffic scheduling
    • H04W72/1263—Mapping of traffic onto schedule, e.g. scheduled allocation or multiplexing of flows
    • H04W72/1268—Mapping of traffic onto schedule, e.g. scheduled allocation or multiplexing of flows of uplink data flows
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/104—Grouping of entities

Definitions

  • the present invention relates to the field of communications, and in particular, to an authentication method, a base station, a user equipment, and a core network element.
  • the UE When the user equipment (User Equipment, UE) in the idle state needs to transmit uplink data, the UE first needs to establish a Radio Resource Control (RRC) connection with the base station through random access, and enters the RRC connection state to obtain an uplink grant (Uplink). After Grant), subsequent uplink data transmission can be performed, however.
  • RRC Radio Resource Control
  • the application uses connectionless transmission, that is, the UE in the idle state.
  • the uplink data transmission is required, the random access is not transferred to the connected state, and the uplink data is directly transmitted on the common resource based on the contention based (CB) according to the configuration information in the broadcast message of the base station.
  • CB contention based
  • the base station when the base station receives the uplink data, the base station only forwards the uplink data packet according to the user equipment identifier carried in the data packet of the uplink data, and does not perform authentication on the UE that transmits the uplink data packet.
  • the unauthenticated UE data is sent to the core network, causing security problems.
  • the core network determines that the UE that sent the data is invalid after receiving the data, the received data needs to be discarded, resulting in waste of transmission resources.
  • the invention provides an authentication method, a base station, a user equipment and a core network element.
  • the base station authenticates the UE, which improves the security of the transmitted data and saves the transmission resources.
  • an embodiment of the present invention provides an authentication method, where the method includes:
  • the base station receives the first message sent by the user equipment, where the first message includes uplink data, and the user equipment identifier (such as the user plane gateway connectionless service identifier (UCLSI) or the international mobile subscriber identifier (International Mobile Subscriber Identification Number). IMSI) or Temporary Mobile Subscriber Identification Number (TMSI) or Globally Unique Temporary UE Identity (GUTI) and the first authentication result;
  • the user equipment identifier such as the user plane gateway connectionless service identifier (UCLSI) or the international mobile subscriber identifier (International Mobile Subscriber Identification Number).
  • IMSI user plane gateway connectionless service identifier
  • TMSI Temporary Mobile Subscriber Identification Number
  • GUI Globally Unique Temporary UE Identity
  • the base station sends an authentication request message to the network element of the core network, where the authentication request message includes the user equipment identifier or the group identifier of the group to which the user equipment belongs or the cell identifier of the cell to which the user equipment belongs.
  • the base station receives the authentication response message sent by the core network element, the authentication response message includes a second authentication result, and the second authentication result is an authentication result calculated by the core network element according to the authentication request message.
  • the base station compares the first authentication result with the second authentication result, and if the same, sends uplink data to the core network element.
  • the user equipment is authenticated by the base station, and the UE group identity or the cell identifier or the user equipment identifier of the cell to which the UE belongs is used for authentication, thereby preventing the data of the illegal UE from reaching the core network element or avoiding the data of the illegal UE. Reaching the core network improves security, and at the same time, the user equipment is protected against the core network elements in the prior art. If the user equipment corresponding to the received data is a non-legitimate user equipment, the data is discarded, which saves the transmission resources.
  • the first authentication result is an authentication result calculated by the user equipment according to the authentication code and the cell identifier; or the first authentication result is a user equipment.
  • the authentication result calculated according to the authentication code and the group identifier; or the first authentication result is an authentication result calculated by the user equipment according to the authentication code and the user equipment identifier; or the first authentication result is the user equipment according to the user
  • the base station may perform security verification of the UE by using the first authentication result calculated by the user equipment according to different manners.
  • the method further includes:
  • the base station determines whether to send uplink data to the core network element according to the network load or the service type or the amount of service data. On the basis of the security verification of the user equipment by the base station, the access control of the connectionless transmission is increased, and the influence of the UE transmission service caused by the excessive collision probability of the UE transmitting the connectionless transmission is avoided.
  • the method further includes:
  • the base station determines not to send uplink data to the core network, it sends information rejecting the connectionless transmission request to the user equipment to notify the user equipment to reject the connectionless transmission request.
  • an embodiment of the present invention provides an authentication method, where the method includes:
  • the user equipment sends a first request message to the core network element, where the first request message is used to request the connectionless transmission service.
  • the first request message may be an attach request message sent by the user equipment to the core network element, and the request message may include connectionless transmission request information.
  • the user equipment receives the response message sent by the core network element, and the response message includes the user equipment identifier allocated by the core network for the user equipment, or the user equipment identifier and the authentication code assigned by the core network to the user equipment;
  • the user equipment determines the first authentication result according to the response message
  • the user equipment sends a first message to the base station, where the first message includes uplink data, a user equipment identifier, and a first authentication result.
  • the base station performs security verification on the user equipment according to the first authentication result, improves security, and prevents data of the illegal UE from reaching the core network.
  • the user equipment determines, according to the response message, the first authentication result, including:
  • the user equipment determines the first authentication result according to the authentication code and the cell identifier of the cell to which the user equipment belongs;
  • the user equipment determines the first authentication result according to the authentication code and the group identifier of the group to which the user equipment belongs.
  • the user equipment determines the first authentication result according to the authentication code and the user equipment identifier.
  • the base station can authenticate the user equipment group level or the user equipment cell level, and the illegal UE data is prevented from reaching the core network, thereby improving security and saving transmission resources.
  • the user equipment determines, according to the response message, the first authentication result, including:
  • the user equipment determines a first authentication result according to the user equipment identifier and the first key, where the first key is a key of the user equipment itself.
  • the first request message includes the service data quantity of the user equipment or the service type of the user equipment At least one is convenient for the core network element to perform access control of the connectionless transmission request according to the service data quantity of the user equipment or the service type of the user equipment, so as to reduce the probability of collision of the UE with no connection transmission, and the delay is sensitive.
  • the service transmitted by the UE has an impact.
  • an embodiment of the present invention provides an authentication method, where the method includes:
  • the core network element receives the authentication request message sent by the base station, where the authentication request message includes the user equipment identifier allocated by the core network for the user equipment or the group identifier of the group to which the user equipment belongs or the cell identifier of the cell to which the user equipment belongs;
  • the core network element determines the first authentication result according to the authentication request message
  • the core network element sends a first authentication result to the base station.
  • the authentication method provided by the embodiment of the present invention implements the authentication of the user equipment group level or the user equipment cell level by the base station, thereby preventing the illegal UE data from reaching the core network, improving security, and saving transmission resources.
  • the method before the core network element receives the authentication request message sent by the base station, the method further includes:
  • the core network element determines the user equipment identifier according to the first request message
  • the core network element sends a first response message to the user equipment, where the first response message includes the user equipment identifier.
  • the core network element and the user equipment establish a connectionless transmission request, and allocate a user equipment identifier to the user equipment that requests the connectionless transmission service, so that the user equipment calculates the authentication result according to the allocated user equipment identifier, and is used by the base station to perform the user equipment safety verification.
  • the method before the core network element receives the authentication request message sent by the base station, the method further includes:
  • the core network element determines the user equipment identifier and the authentication code according to the first request message
  • the core network element sends a second response message to the user equipment, where the second response message includes the user equipment identifier and the authentication code.
  • the user equipment calculates the authentication result according to the user equipment identifier and the authentication code allocated by the core network element for the user equipment, and the user base station performs security verification on the user equipment according to the authentication result.
  • the core network element determines the first authentication result according to the authentication request message, including:
  • the core network element determines the first authentication result according to the user equipment identifier and the first key.
  • the core network element determines the first authentication result according to the authentication request message, including:
  • the core network element determines the first authentication result according to the group identifier or the cell identifier or the user equipment identifier, and the authentication code.
  • the first request message includes the user equipment At least one of a quantity of business data or a type of service of the user equipment; the method further comprising:
  • the core network element determines whether to accept the connectionless transmission request of the user equipment according to the service data quantity of the user equipment or the service type of the user equipment.
  • the access control of the user equipment requesting the connectionless transmission service is performed by the network element of the core network, so that the number of UEs that can perform connectionless transmission according to specific conditions can be determined by the network side, and the collision probability of the UE without connection connection is increased. Therefore, the service transmitted by the delay-sensitive UE is affected.
  • the core network element determines, according to the first request message, the connectionless transmission request of the user equipment, including:
  • the core network element determines to accept the connectionless transmission request of the user equipment in the first preset time
  • the core network element determines to accept the connectionless transmission request of the user equipment.
  • the core network element determines to accept the connectionless transmission request of the user equipment.
  • the user equipment identifier is used to indicate that the core network element accepts the connectionless transmission request of the user equipment.
  • the method further includes:
  • the core network element sends a third response message to the user equipment, and the third response message includes information that rejects the connection request of the user equipment without connection, to notify the user equipment to reject the connectionless transmission service.
  • an embodiment of the present invention provides a base station, where the base station includes:
  • a receiving unit configured to receive a first message sent by the user equipment, where the first message includes uplink data, a user equipment identifier (such as a user plane gateway (UPGW Connectionless Service, UCLSI), and the like) and a first authentication result;
  • a user equipment identifier such as a user plane gateway (UPGW Connectionless Service, UCLSI), and the like
  • a sending unit configured to send an authentication request message to the core network element, where the authentication request message includes a user equipment identifier or a group identifier of a group to which the user equipment belongs or a cell identifier of a cell to which the user equipment belongs;
  • the receiving unit is further configured to receive an authentication response message sent by the core network element, where the authentication response message includes a second authentication result, where the second authentication result is an authentication result calculated by the core network element according to the authentication request message;
  • the processing unit is configured to compare the first authentication result with the second authentication result. If the same, the sending unit sends the uplink data to the core network element.
  • the user equipment is authenticated by the base station, and the UE group identity or the cell identifier or the user equipment identifier of the cell to which the UE belongs is used for authentication, thereby preventing the data of the illegal UE from reaching the core network element or avoiding the data of the illegal UE. Reaching the core network improves the security.
  • the user equipment is authenticated against the core network element in the prior art. If the user equipment corresponding to the received data is a non-legal user equipment, the data is discarded, saving the transmission. Resources.
  • the first authentication result is an authentication result calculated by the user equipment according to the authentication code and the cell identifier; or the first authentication result is a user equipment.
  • the authentication result calculated according to the authentication code and the group identifier; or the first authentication result is an authentication result calculated by the user equipment according to the authentication code and the user equipment identifier; or the first authentication result is the user equipment according to the user The authentication result calculated by the device key and the user equipment identifier.
  • the processing unit is further configured to determine whether to go to the core according to a network load or a service type or a quantity of service data.
  • the network element sends uplink data.
  • the access control of the connectionless transmission is increased, and the influence of the UE transmission service caused by the excessive collision probability of the UE transmitting the connectionless transmission is avoided.
  • the sending unit sends the user equipment to reject the connectionless connection.
  • the requested information is transmitted to inform the user that the device rejects the connectionless transmission request.
  • an embodiment of the present invention provides a user equipment, where the user equipment includes:
  • a sending unit configured to send a first request message to the core network element, where the first request message is used to request a connectionless transmission service
  • the receiving unit is configured to receive a response message sent by the network element of the core network, where the response message includes a user equipment identifier that is allocated by the core network for the user equipment, or an authentication code that is allocated by the user equipment identifier and the core network.
  • a processing unit configured to determine a first authentication result according to the response message
  • the sending unit is further configured to send a first message to the base station, where the first message includes uplink data, a user equipment identifier, and a first authentication result.
  • the base station performs security verification on the user equipment according to the first authentication result, improves security, and prevents data of the illegal UE from reaching the core network.
  • the processing unit determines, according to the response message, the first authentication result, including:
  • the processing unit determines the first authentication result according to the authentication code and the cell identifier of the cell to which the user equipment belongs;
  • the processing unit determines the first authentication result according to the authentication code and the group identifier of the group to which the user equipment belongs.
  • the processing unit determines the first authentication result according to the authentication code and the user equipment identifier.
  • the base station can authenticate the user equipment group level or the user equipment cell level, and the illegal UE data is prevented from reaching the core network, thereby improving security and saving transmission resources.
  • the processing unit determines, according to the response message, the first authentication result, including:
  • the processing unit determines a first authentication result according to the user equipment identifier and the first key, where the first key is a key of the user equipment itself.
  • the first request message includes the service data quantity of the user equipment or the service type of the user equipment At least one is convenient for the core network element to perform access control of the connectionless transmission request according to the service data quantity of the user equipment or the service type of the user equipment, so as to reduce the probability of collision of the UE with no connection transmission, and the delay is sensitive.
  • the service transmitted by the UE has an impact.
  • the embodiment of the present invention provides a core network element, where the core network element includes:
  • a receiving unit configured to receive an authentication request message sent by the base station, where the authentication request message includes a user equipment identifier allocated by the core network for the user equipment, or a group identifier of a group to which the user equipment belongs, or a cell identifier of a cell to which the user equipment belongs;
  • a processing unit configured to determine, according to the authentication request message, a first authentication result
  • a sending unit configured to send a first authentication result to the base station.
  • the core network element provided by the embodiment of the present invention implements the authentication of the user equipment group level or the user equipment cell level by the base station, thereby preventing the illegal UE data from reaching the core network, improving security, and saving transmission resources.
  • the receiving unit is further configured to receive a first request message sent by the user equipment, where the first request message is used to request a connectionless transmission service;
  • the processing unit is further configured to determine the user equipment identifier according to the first request message
  • the sending unit is further configured to send a first response message to the user equipment, where the first response message includes a user equipment identifier.
  • the core network element and the user equipment establish a connectionless transmission request, and allocate a user equipment identifier to the user equipment that requests the connectionless transmission service, so that the user equipment calculates the authentication result according to the allocated user equipment identifier, and is used by the base station to perform the user equipment safety verification.
  • the receiving unit is further configured to receive a first request message sent by the user equipment, where the first request message is used to request a connectionless transmission service;
  • the processing unit is further configured to determine the user equipment identifier and the authentication code according to the first request message;
  • the sending unit is further configured to send a second response message to the user equipment, where the second response message includes the user equipment identifier and the authentication code.
  • the user equipment calculates the authentication result according to the user equipment identifier and the authentication code allocated by the core network element for the user equipment, and the user base station performs security verification on the user equipment according to the authentication result.
  • the processing unit determines, according to the authentication request message, the first authentication result, including:
  • the processing unit determines the first authentication result according to the user equipment identifier and the first key.
  • the processing unit determines, according to the authentication request message, the first authentication result, including:
  • the processing unit determines the first authentication result according to the group identifier or the cell identifier or the user equipment identifier, and the authentication code.
  • the first request message includes the user equipment At least one of the amount of business data or the type of service of the user equipment.
  • the processing unit is further configured to determine, according to the service data quantity of the user equipment or the service type of the user equipment, whether to accept the connectionless transmission request of the user equipment.
  • the access control of the user equipment requesting the connectionless transmission service is performed by the network element of the core network, so that the number of UEs that can perform connectionless transmission according to specific conditions can be determined by the network side, and the collision probability of the UE without connection connection is increased. Therefore, the service transmitted by the delay-sensitive UE is affected.
  • the processing unit determines, according to the first request message, that the connectionless transmission request of the user equipment is accepted, including:
  • the processing unit determines to accept the connectionless transmission request of the user equipment.
  • the processing unit determines to accept the connectionless transmission request of the user equipment.
  • the processing unit determines to accept the connectionless transmission request of the user equipment.
  • the user equipment identifier is used to indicate that the core network element accepts the connectionless transmission request of the user equipment.
  • the sending unit is further configured to send a third response message to the user equipment, where the third response message includes rejecting the user equipment No connection transfer request information.
  • a seventh aspect of the present invention provides a base station, where the base station includes a receiver, a transmitter, and a processor.
  • the base station provided by the seventh aspect has a design that implements the first aspect and each possible implementation of the first aspect.
  • the function of the solution, and the corresponding technical effect of the first aspect can be achieved, and the base station provided by the fourth aspect can complete the first aspect and the possible implementation designs of the first aspect by using the base station provided by the seventh aspect, for the sake of brevity, I will not repeat them here.
  • An eighth aspect of the present invention provides a user equipment, where the user equipment includes a receiver, a transmitter, and a processor.
  • the user equipment provided by the eighth aspect has various possibilities for performing the second aspect and the second aspect.
  • the function of the implemented design solution can achieve the corresponding technical effect of the second aspect, and the user equipment provided by the fifth aspect can complete the second aspect and the possible implementation schemes of the second aspect by using the user equipment provided by the eighth aspect. For the sake of brevity, it will not be repeated here.
  • a ninth aspect of the present invention provides a core network element, where the core network element includes a receiver, a transmitter, and a processor.
  • the core network element provided by the ninth aspect has the third aspect and The function of each possible implementation of the third aspect, and the corresponding technical effect of the third aspect can be achieved, and the core network element provided by the sixth aspect can complete the third aspect by using the core network element provided by the ninth aspect and The various possible implementations of the third aspect are briefly described and will not be described again here.
  • the authentication method, the base station, the user equipment, and the core network element provided by the present invention ensure the data of the unlawful UE reaches the core network element by using the security verification of the user equipment by the base station side, or the data of the unlawful UE is prevented from reaching the core.
  • the network is used to improve the security.
  • the core network element of the prior art performs security verification on the user equipment. If the user equipment corresponding to the received data is a non-legal user equipment, the data is discarded, and the transmission resource is saved.
  • FIG. 1 is a schematic structural diagram of an LTE network according to an embodiment of the present invention.
  • FIG. 2 is a flowchart of an authentication method according to an embodiment of the present invention.
  • FIG. 3 is a flowchart of an authentication method according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of another authentication method according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of a connection control method for connectionless transmission according to an embodiment of the present invention.
  • FIG. 6 is a flowchart of a connection control method for connectionless transmission according to an embodiment of the present invention.
  • FIG. 7 is a flowchart of another connection control method for connectionless transmission according to an embodiment of the present invention.
  • FIG. 8 is a flowchart of still another connection control method for connectionless transmission according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a base station according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of a user equipment according to an embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of a core network element according to an embodiment of the present disclosure.
  • FIG. 12 is a schematic structural diagram of another base station according to an embodiment of the present disclosure.
  • FIG. 13 is a schematic structural diagram of another user equipment according to an embodiment of the present disclosure.
  • FIG. 14 is a schematic structural diagram of another core network element according to an embodiment of the present invention.
  • the invention provides an authentication method, a base station, a user equipment and a core network element.
  • the UE calculates the authentication result according to the parameters (such as the authentication code, UCLSI), and carries the authentication result in the uplink data and sends the result to the base station, and the base station compares the authentication result with the core network. The authentication result of the network element is compared. If the two authentication results are the same, the base station forwards the uplink data to the core network element. Otherwise, the base station discards the received uplink data.
  • the parameters such as the authentication code, UCLSI
  • the authentication method, the base station, the user equipment, and the core network element provided by the present invention are mainly applied to various wireless communication systems, such as Long Term Evolution (LTE), Universal Mobile Telecommunications System (UMTS), Similar to LTE or 5G wireless communication structure, the specific architecture is not limited.
  • LTE Long Term Evolution
  • UMTS Universal Mobile Telecommunications System
  • Similar to LTE or 5G wireless communication structure the specific architecture is not limited.
  • the network architecture includes user equipment 110, base station 120, and core network equipment 130.
  • a user equipment (UE) 110 may be referred to as a terminal equipment, and may also be called a terminal, a mobile station (MS), and a mobile terminal (mobile). Terminal), a notebook computer, etc., the user equipment can communicate with one or more core networks via a radio access network (RAN), for example, the user equipment can be a mobile telephone (or "cellular" telephone) Or a computer with a mobile terminal, etc., for example, the user device can also be a portable, pocket, handheld, computer built-in or in-vehicle mobile device that exchanges voice and/or data with the wireless access network.
  • RAN radio access network
  • the user equipment can be a mobile telephone (or "cellular" telephone) Or a computer with a mobile terminal, etc.
  • the user device can also be a portable, pocket, handheld, computer built-in or in-vehicle mobile device that exchanges voice and/or data with the wireless access network.
  • the base station 120 which may also be referred to as an access network device, such as a RAN, primarily implements communication with user equipment.
  • the core network device 130 may be referred to as a core network element (Control Plane, CP), and is responsible for processing data sent by user equipment and performing related signaling interaction.
  • CP Control Plane
  • the data transmission is performed through the connectionless transmission, that is, when the UE in the idle state has the uplink data transmission, the random access is not transferred to the connected state, but According to the configuration in the base station broadcast message, the data is directly transmitted based on the competition on the common resource. At the same time, in order to ensure the security of data, the technical solution of the present invention has been proposed.
  • FIG. 2 is a flowchart of an authentication method according to an embodiment of the present invention. As shown in FIG. 2, the method may include the following steps:
  • the user equipment sends a first request message to the core network element.
  • an attach procedure is first required, and the UE sends an attach request message to the core network element, and the attach request message may be referred to as a first request message. If the UE needs to perform connectionless transmission, it needs to carry a connectionless transmission request in the attach request message. That is, the first request message is used to request a connectionless transmission service, or the UE sends a connectionless transmission request message to the core network element.
  • the core network element determines the user equipment identifier, or the user equipment identifier and the authentication code, according to the first request message.
  • the core network element allocates the user equipment identifier to the requesting user equipment.
  • the user equipment identifier may be a user plane gateway connectionless transmission service identifier (UPGW Connectionless).
  • Service information ULSI
  • IMSI International Mobile Subscriber Identification Number
  • TMSI Temporary Mobile Subscriber Identification Number
  • GUTI Globally Unique Temporary UE Identity
  • the base station is instructed to forward the uplink data sent by the UE to a corresponding Packet Data Unit (PDU) session, so as to facilitate the core network element.
  • PDU Packet Data Unit
  • the core network element may further allocate an authentication code to the user equipment requesting connectionless transmission, so that the UE performs security verification according to the authentication code.
  • one UE may be assigned an authentication code, and one group may be assigned an authentication code.
  • the core network element randomly selects one of the plurality of authentication codes and allocates it to the UE.
  • the core network element sends a response message to the user equipment.
  • the core network element sends an attach accept response message to the user equipment, which may be referred to as a first response message, where the first response message may include a user equipment identifier.
  • the core network element sends an attach accept response message to the user equipment, which may be referred to as a second response message, where the second response message may include a user equipment identifier and an authentication code.
  • the user equipment determines a first authentication result according to the response message.
  • the first authentication result is an authentication result calculated by the user equipment according to the user equipment key and the user equipment identifier.
  • the first authentication result may be that the user equipment determines the authentication result according to the authentication code and the cell identifier of the cell to which the user equipment belongs or the group identifier or the user equipment identifier of the group to which the user equipment belongs.
  • the user equipment sends a first message to the base station, where the first message includes uplink data, a user equipment identifier, and a first authentication result.
  • the user equipment receives the response message sent by the core network element to notify the user equipment core network element to accept the attachment.
  • the user equipment sends the uplink data to the base station, and the user equipment calculates the uplink data according to the authentication code.
  • the authentication result is carried in the uplink data.
  • the base station sends an authentication request message to the core network element.
  • the authentication request message may include a user equipment identifier, a group identifier of a group to which the user equipment requesting to establish connectionless transmission, or a cell identifier of a cell to which the user equipment to which the connectionless transmission is requested is established, so that the core network element is configured according to the core network element.
  • the authentication request message calculates the authentication result and performs security verification.
  • the core network element determines a second authentication result according to the authentication request message.
  • the second authentication result is a group ID of the group to which the user equipment belongs to the core network element according to the request and the authentication code of the authentication code assigned to the user equipment by the core network; or the core network element according to the request Establish no connection
  • the authentication code calculates the authentication result.
  • one cell may correspond to one or more authentication codes. If a cell corresponds to multiple authentication codes, the core network element needs to use the authentication algorithm to calculate multiple authentication results by using the cell identifier and the corresponding multiple authentication codes, and send the multiple authentication results to the base station.
  • the core network element sends an authentication response message to the base station.
  • the authentication response message may include a user equipment identifier and an authentication result calculated by the core network element.
  • the base station compares the first authentication result with the second authentication result.
  • the base station compares the first authentication result obtained by the user equipment with the second authentication result obtained from the core network element. If the base station receives the multiple authentication results sent by the core network element, the authentication result is compared with the first authentication result, and the authentication result obtained from the user equipment is obtained from the core network element. If the authentication result of the at least one authentication result is the same, the authentication is performed, and S295 is performed; otherwise, the base station discards the data to improve the security of the data, and the core network element verifies the user equipment relative to the prior art. When the device is a non-legitimate user device, the received data transmitted by the user device is discarded, and the transmission resource is saved.
  • the base station sends uplink data to the core network element according to the user equipment identifier.
  • the base station sends the uplink data corresponding to the first authentication result to the corresponding PDU session according to the user equipment identifier, that is, sends the core data to the core network element for subsequent deal with.
  • the method may further include: the base station sending the feedback information to the user equipment to notify the user equipment whether the connectionless transmission is successful. For example, if the first authentication result and the second authentication result are the same, the base station sends the connectionless transmission success information to the user equipment; if the first authentication result and the second authentication result are different, the base station sends no connection to the user equipment. Transmission failure information.
  • the authentication method provided by the embodiment of the present invention performs security verification on the user equipment by using the base station, and uses the UE group identifier or the cell identifier or the user equipment identifier of the cell to which the UE belongs to perform authentication, thereby preventing the data of the illegal UE from reaching the core network.
  • the user, or the data of the unreasonable UE is prevented from reaching the core network, and the security is improved.
  • the user equipment of the core network is authenticated by the core network element in the prior art. If the user equipment corresponding to the received data is verified as a non-legal user, The device discards its data and saves transmission resources.
  • S260 and S270 may be executed before S240 and S250, which is not limited in the embodiment of the present invention.
  • the first request message includes at least one of a service data quantity of the user equipment or a service type of the user equipment; as shown in FIG. 2, the method further includes:
  • the core network element determines whether to accept the connectionless transmission request of the user equipment according to the service data quantity of the user equipment or the service type of the user equipment.
  • the access control of the core network element to the connectionless transmission is implemented, so that the network side can limit the number of UEs that perform connectionless transmission according to specific conditions, and avoid the excessive probability of collision of the UE with no connection transmission, thereby being sensitive to delay.
  • the impact of the UE's transmitted traffic For details, please refer to the description of FIG. 6.
  • the method may further include:
  • the base station determines whether to send the uplink data to the core network element according to a network load or a service type or a service data quantity.
  • the UE that avoids the connectionless transmission is excessively caused to increase the collision probability, thereby affecting the service transmitted by the delay-sensitive UE.
  • the method may further include:
  • the base station determines not to send the uplink data to the core network, send, to the user equipment, information that rejects the connectionless transmission request, to notify the user equipment to reject the connectionless transmission.
  • FIG. 3 is a flowchart of an authentication method according to an embodiment of the present invention. As shown in FIG. 3, the method may include the following steps:
  • the user equipment sends an attach request message to the core network element, where the attach request message includes connectionless transmission request information.
  • the core network element determines, according to the attach request message, the user plane gateway connectionless transport service identifier UCLSI and the authentication code.
  • the UCLSI is configured to: when the UE performs connectionless transmission, instruct the base station to forward the uplink data sent by the UE to a corresponding Packet Data Unit (PDU) session, so that the core network element performs subsequent processing.
  • PDU Packet Data Unit
  • the core network element allocates an authentication code to the user equipment requesting connectionless transmission, so that the UE performs security verification according to the authentication code.
  • one UE may be assigned an authentication code, and one group may be assigned an authentication code.
  • the core network element randomly selects one of the plurality of authentication codes and allocates it to the UE.
  • the core network element sends a response message to the user equipment, where the response message may include a UC LSI and an authentication code.
  • the user equipment determines the first authentication result according to the authentication code and the cell identifier of the cell to which the user equipment belongs or the group identifier or the user equipment identifier of the group to which the user equipment belongs.
  • the user equipment sends a first message to the base station, where the first message includes uplink data, a UC LSI, and a first authentication result.
  • the user equipment receives the response message sent by the core network element to notify the user equipment core network element to accept the attachment.
  • the user equipment sends the uplink data to the base station, and the user equipment calculates the uplink data according to the authentication code.
  • the authentication result is carried in the uplink data.
  • S360 The base station sends an authentication request message to the core network element.
  • the authentication request message may include a UCLSI, a group identifier of a group to which the user equipment requesting to establish connectionless transmission, or a cell identifier of a cell to which the user equipment to which the connectionless transmission is requested is established, so that the core network element is authenticated according to the right
  • the request message calculates the authentication result and performs security verification.
  • the core network element determines a second authentication result according to the authentication request message.
  • the second authentication result is a group ID of the group to which the user equipment belongs to the core network element according to the request and the authentication code of the authentication code assigned to the user equipment by the core network; or the core network element according to the request Establish no connection
  • the authentication code calculates the authentication result.
  • one cell may correspond to one or more authentication codes. If a cell corresponds to multiple authentication codes, the core network element needs to use the authentication algorithm to calculate multiple authentication results by using the cell identifier and the corresponding multiple authentication codes, and send the multiple authentication results to the base station.
  • the core network element sends an authentication response message to the base station.
  • the authentication response message may include an authentication result calculated by the UCLSI and the core network element.
  • the base station compares the first authentication result with the second authentication result.
  • the base station compares the first authentication result obtained by the user equipment with the second authentication result obtained from the core network element. If the base station receives the multiple authentication results sent by the core network element, the authentication result is compared with the first authentication result, and the authentication result obtained from the user equipment is obtained from the core network element. If one of the at least one authentication result is the same, the authentication is passed, and S395 is performed; otherwise, the base station discards the data to improve the security of the data, and the core network element authenticates the user equipment in the prior art. When the device is a non-legitimate user device, the received data transmitted by the user device is discarded, and the transmission resource is saved.
  • the base station sends uplink data to the core network element according to the UCLSI.
  • the base station sends the uplink data corresponding to the first authentication result to the corresponding PDU session according to the UCLSI, that is, sends the core data to the core network element for subsequent processing.
  • the method may further include: the base station sending the feedback information to the user equipment to notify the user equipment whether the connectionless transmission is successful. For example, if the first authentication result and the second authentication result are the same, the base station sends the connectionless transmission success information to the user equipment; if the first authentication result and the second authentication result are different, the base station sends no connection to the user equipment. Transmission failure information.
  • the base station determines not to send uplink data to the core network element, sending, to the user equipment, information that rejects the connectionless transmission request.
  • the authentication method provided by the embodiment of the present invention performs security verification on the user equipment by using the base station, and uses the UE group identifier or the cell identifier or the user equipment identifier of the cell to which the UE belongs to perform authentication, thereby preventing the data of the illegal UE from reaching the core network.
  • the user, or the data of the unreasonable UE is prevented from reaching the core network, and the security is improved.
  • the user equipment of the core network is authenticated by the core network element in the prior art. If the user equipment corresponding to the received data is verified as a non-legal user, The device discards its data and saves transmission resources.
  • S360 and S370 may be performed before S340 and S350, which is not limited in the embodiment of the present invention.
  • FIG. 4 is another authentication method according to an embodiment of the present invention. As shown in FIG. 4, the authentication method may include the following steps:
  • the user equipment sends a connectionless transmission request message to the core network element.
  • This step S310 is the same as the process of S210 in FIG. 2, and is not described here for brevity.
  • the core network element determines, according to the connectionless transmission request message, the user plane gateway connectionless transmission service identifier UCLSI.
  • This step S420 is the same as the process of determining the UCLSI by the core network element in S220 in FIG. 2, and the function of the UCLSI. The same is true for the sake of brevity and will not be described here.
  • the core network element sends a response message to the user equipment.
  • S310, S320, and S330 of the embodiment of the present invention correspond to S210, S220, and S230 in FIG. 2, respectively.
  • the difference is that the core network element in the S420 does not allocate an authentication code to the user equipment that requests the connectionless transmission.
  • the response message sent by the core network element to the user equipment does not include the authentication code.
  • S410, S420, and S430 are the same as the processes of S210, S220, and S230 in FIG. 2, and are not described here for brevity.
  • the user equipment determines the first authentication result according to the UCLSI and its own user key.
  • the user equipment calculates an authentication result by using an authentication algorithm according to the UCLSI and the user key included in the response message sent by the core network element, and the authentication result is called the first authentication.
  • the user key of the user equipment itself may be referred to as a first key.
  • the user equipment sends a first message to the base station, where the first message includes the uplink data UCLSI and the first authentication result.
  • the user equipment When the user equipment receives the response message sent by the core network element and accepts the connection of the user equipment, the user equipment sends the uplink data to the base station, and the calculated authentication result is carried in the uplink data.
  • the base station sends an authentication request message to the core network element.
  • the authentication request message may include UCLSI.
  • the core network element determines a second authentication result according to the UCLSI and a user key of the corresponding user equipment.
  • the core network element may calculate an authentication result by using an authentication algorithm according to the UC LSI and the user key of the corresponding user equipment, where the authentication result is a second authentication result.
  • the core network element sends an authentication response message to the base station.
  • the authentication response message includes a UCLSI and a second authentication result.
  • the base station compares the first authentication result with the second authentication result.
  • the base station sends uplink data to the core network element.
  • This step is the same as the process of S295 in FIG. 2, and is not described here for brevity.
  • the method may further include: the base station sending the feedback information to the user equipment to notify the user equipment whether the connectionless transmission is successful. For example, if the first authentication result and the second authentication result are the same, the base station sends the connectionless transmission success information to the user equipment; if the first authentication result and the second authentication result are different, the base station sends no connection to the user equipment. Transmission failure information.
  • the authentication method provided by the embodiment of the present invention performs security verification on the user equipment by using the base station, so that the data of the unlawful UE reaches the core network element, or the data of the unlawful UE is prevented from reaching the core network, thereby improving security.
  • the user equipment is authenticated by the core network element in the prior art. If the user equipment corresponding to the received data is a non-legal user equipment, the data is discarded, and the transmission resource is saved.
  • the present invention also provides an access control method for controlling connectionless transmission.
  • the user equipment is controlled by the core network element or the base station to use the connectionless transmission service.
  • the method may include the following steps:
  • the core network element receives an attach request message sent by the user equipment.
  • the attach request message includes connectionless transmission request information, and may further include at least one of a service data amount of the user equipment or a service data type of the user equipment.
  • the core network element may receive an attach request message sent by at least one user equipment, and count the number of connectionless transmission request information sent by the received user equipment.
  • the core network element determines, according to the connectionless transmission request information, that the user equipment is accepted for connectionless transmission.
  • the core network element determines whether to accept the connectionless transmission request of the user equipment according to the network load or the service data quantity of the user equipment or the service data type of the user equipment.
  • the core network element determines, according to the connectionless request information, that the user equipment is accepted to perform connectionless transmission, including:
  • the core network element determines to accept the user equipment for connectionless transmission.
  • the core network element determines to accept the user equipment for connectionless transmission
  • the core network element determines to accept the user equipment for connectionless transmission.
  • the core network element determines whether to reject the UE to use no connection according to relevant conditions (for example, the core network element according to the network responsibility, the amount of service data of the UE, and the service type of the UE, etc.) Transfer service.
  • the core network element may determine that the user equipment is not allowed to perform connectionless transmission according to the connectionless request information.
  • the core network element may determine that the user equipment is not allowed to perform connectionless transmission according to the connectionless request information.
  • the core network element rejects the connectionless transmission request of the UE.
  • the core network element rejects the connectionless transmission request of the UE.
  • the core network element rejects the connectionless transmission request of the UE.
  • the first preset time, the first preset threshold, the second preset threshold, and the preset service type may be set according to requirements, which is not limited in the embodiment of the present invention. .
  • the core network element sends a first response message to the user equipment.
  • the first response message is used to indicate that the user equipment is accepted for connectionless transmission.
  • the core network element needs to pre-configure information indicating that the user equipment uses the connectionless transmission service, or requires the core network element and the user equipment to negotiate in advance to perform connectionless transmission.
  • the core network element configuration is required to accept or reject the user equipment for connectionless transmission.
  • the core network element may indicate connection with the user equipment by UCLSI allocated for the user equipment requesting connectionless transmission, and connectionless transmission may be performed. Then, when the attach accept response message sent by the core network element to the user equipment does not include the UCLSI allocated for the UE, the core network element rejects the connectionless transmission request of the user equipment. In other words, if the UE does not receive the UCLSI, the connectionless transmission request is rejected.
  • the schematic diagram of the process is shown in Figure 6.
  • the core network element may further send a second response message to the user equipment, where the second response message includes information that rejects connectionless transmission, as shown in FIG. 7.
  • the user equipment sends the uplink data to the base station according to the first response message sent by the core network element.
  • the base station After receiving the uplink data, the base station determines whether to reject the connectionless transmission request of the user equipment according to the network load or the amount of service data or the service type.
  • the base station after receiving the uplink data sent by the user, the base station sends information to the user equipment that determines to reject the connectionless transmission of the user equipment according to the network load.
  • the rejection information may further include a reason for rejecting the connectionless transmission or a time value indicating that the user equipment rolls back for a period of time and then performs a connectionless transmission request or related information for assisting the user equipment to perform random access, such as a preamble.
  • the embodiment of the present invention increases the access control of the connectionless transmission on the network side, so that the network side can limit the number of UEs that perform connectionless transmission according to specific conditions, and avoid the excessive probability of collision of the UEs with connectionless transmission, thereby correcting the time.
  • the service transmitted by the delay-sensitive UE has an impact.
  • connectionless transmission access provided by FIG. 5 to FIG. 8 can be used in combination with the authentication control methods of FIG. 3 and FIG. 4 to improve data security by verifying user equipment by the base station, and
  • the control of the connectionless transmission access by the network side reduces the influence of the excessive collision probability of the UE on the transmission of the UE due to the connectionless transmission of the UE.
  • FIG. 2 to FIG. 8 describe the authentication method of the present invention.
  • the base station, the user equipment, and the core network element provided by the present invention are respectively described in detail below through FIG. 9 to FIG.
  • FIG. 9 is a schematic structural diagram of a base station according to an embodiment of the present invention. As shown in FIG. 9, the base station includes a receiving unit 610, a transmitting unit 620, and a processing unit 630.
  • the receiving unit 610 is configured to receive a first message sent by the user equipment, where the first message includes uplink data, a user equipment identifier, and a first authentication result.
  • the sending unit 620 is configured to send an authentication request message to the core network element, where the authentication request message includes the user equipment identifier or the group identifier of the group to which the user equipment belongs or the cell identifier of the cell to which the user equipment belongs.
  • the receiving unit 610 is further configured to receive an authentication response message sent by the core network element, where the authentication response message includes a second authentication result, where the second authentication result is an authentication result calculated by the core network element according to the authentication request message. ;
  • the processing unit 630 is configured to compare the first authentication result with the second authentication result. If the same, the sending unit sends the uplink data to the core network element.
  • the user equipment is authenticated by the base station, and the UE group identity or the cell identifier or the user equipment identifier of the cell to which the UE belongs is used for authentication, thereby preventing the data of the illegal UE from reaching the core network element or avoiding the data of the illegal UE. Reaching the core network improves the security.
  • the user equipment is authenticated against the core network element in the prior art. If the user equipment corresponding to the received data is a non-legal user equipment, the data is discarded, saving the transmission. Resources.
  • the first authentication result is an authentication result calculated by the user equipment according to the authentication code and the cell identifier; or the first authentication result is an authentication result calculated by the user equipment according to the authentication code and the group identifier; Or the first authentication result is an authentication result calculated by the user equipment according to the authentication code and the user equipment identifier; or the first authentication result is an authentication result calculated by the user equipment according to the user equipment key and the user equipment identifier.
  • the processing unit 630 is further configured to determine whether to send uplink data to the core network element according to the network load or the type of service or the amount of service data. On the basis of the base station performing security verification on the user equipment, the access control for the connectionless transmission is increased, and the UE transmission service caused by the excessive collision probability of the UE with no connection transmission is avoided. ring.
  • the sending unit sends information rejecting the connectionless transmission request to the user equipment to notify the user equipment to reject the connectionless transmission request.
  • the base station provided by the embodiment of the present invention may implement S260, S280, S290, and S295 in FIG. 2, and details are not described herein again for brevity.
  • FIG. 10 is a schematic structural diagram of a user equipment according to an embodiment of the present invention. As shown in FIG. 10, the user equipment includes a transmitting unit 710, a receiving unit 720, and a processing unit 730.
  • the sending unit 710 is configured to send a first request message to the core network element, where the first request message is used to request a connectionless transmission service;
  • the receiving unit 720 is configured to receive a response message sent by the network element of the core network, where the response message includes a user equipment identifier allocated by the core network for the user equipment, or an identifier of the user equipment and an authentication code allocated by the core network to the user equipment.
  • the processing unit 730 is configured to determine, according to the response message, a first authentication result
  • the sending unit 710 is further configured to send a first message to the base station, where the first message includes uplink data, a user equipment identifier, and a first authentication result.
  • the base station performs security verification on the user equipment according to the first authentication result, improves security, and prevents data of the illegal UE from reaching the core network.
  • the processing unit 730 determines the first authentication result according to the response message, including:
  • the processing unit 730 determines the first authentication result according to the authentication code and the cell identifier of the cell to which the user equipment belongs; or the processing unit 730 determines the first authentication result according to the authentication code and the group identifier of the group to which the user equipment belongs; or the processing unit 730 determines a first authentication result according to the authentication code and the user equipment identifier.
  • the base station can authenticate the user equipment group level or the user equipment cell level, and the illegal UE data is prevented from reaching the core network, thereby improving security and saving transmission resources.
  • the processing unit 730 determines the first authentication result according to the response message, including:
  • the processing unit 730 determines a first authentication result according to the user equipment identifier and the first key, where the first key is a key of the user equipment itself.
  • the first request message includes at least one of a service data quantity of the user equipment or a service type of the user equipment, so that the core network element facilitates the connectionless transmission request according to the service data quantity of the user equipment or the service type of the user equipment.
  • the access control reduces the number of UEs that are connected to the connection, causing the collision probability to increase, which affects the services transmitted by the delay-sensitive UE.
  • the base station provided in this embodiment of the present invention may implement S210, S240, and S250 in FIG. 2, and details are not described herein again for brevity.
  • FIG. 11 is a schematic structural diagram of a core network element according to an embodiment of the present invention. As shown in FIG. 11, the core network element includes a receiving unit 810, a processing unit 820, and a sending unit 830.
  • the receiving unit 810 is configured to receive an authentication request message sent by the base station, where the authentication request message includes a user equipment identifier allocated by the core network for the user equipment or a group identifier of the group to which the user equipment belongs or a cell identifier of the cell to which the user equipment belongs;
  • the processing unit 820 is configured to determine, according to the authentication request message, a first authentication result
  • the sending unit 830 is configured to send a first authentication result to the base station.
  • the core network element provided by the embodiment of the present invention implements the authentication of the user equipment group level or the user equipment cell level by the base station, thereby preventing the illegal UE data from reaching the core network, improving security, and saving transmission resources.
  • the receiving unit 810 is further configured to receive a first request message sent by the user equipment, where the first request message is used to request a connectionless transmission service;
  • the processing unit 820 is further configured to determine, according to the first request message, a user equipment identifier
  • the sending unit 830 is further configured to send a first response message to the user equipment, where the first response message includes a user equipment identifier.
  • the core network element and the user equipment establish a connectionless transmission request, and allocate a user equipment identifier to the user equipment that requests the connectionless transmission service, so that the user equipment calculates the authentication result according to the allocated user equipment identifier, and is used by the base station to perform the user equipment safety verification.
  • the processing unit 820 determines, according to the authentication request message, the first authentication result, including:
  • the processing unit 820 determines the first authentication result according to the user equipment identifier and the first key.
  • the receiving unit 810 is further configured to receive a first request message sent by the user equipment, where the first request message is used to request a connectionless transmission service;
  • the processing unit 820 is further configured to determine, according to the first request message, a user equipment identifier and an authentication code;
  • the sending unit 830 is further configured to send a second response message to the user equipment, where the second response message includes a user equipment identifier and an authentication code.
  • the user equipment calculates the authentication result according to the user equipment identifier and the authentication code allocated by the core network element for the user equipment, and the user base station performs security verification on the user equipment according to the authentication result.
  • the processing unit 820 determines, according to the authentication request message, the first authentication result, including:
  • the processing unit 820 determines the first authentication result according to the group identifier or the cell identifier or the user equipment identifier, and the authentication code.
  • S310, S320, S330, and S370 in FIG. 3 may be referred to in S310, S320, S330, and S370 in FIG. 3 for brevity, and details are not described herein again.
  • the first request message includes at least one of a quantity of service data of the user equipment or a service type of the user equipment.
  • the processing unit 820 is further configured to determine, according to the service data quantity of the user equipment or the service type of the user equipment, whether to accept the connectionless transmission request of the user equipment.
  • the access control of the user equipment requesting the connectionless transmission service is performed by the network element of the core network, so that the number of UEs that can perform connectionless transmission according to specific conditions can be determined by the network side, and the collision probability of the UE without connection connection is increased. Therefore, the service transmitted by the delay-sensitive UE is affected.
  • the processing unit 820 determines, according to the first request message, that the connectionless transmission request of the user equipment is accepted, including:
  • the processing unit 820 determines to accept the connectionless transmission request of the user equipment.
  • the processing unit 820 determines to accept the connectionless transmission request of the user equipment.
  • the processing unit 820 determines to accept the connectionless transmission request of the user equipment.
  • the first preset time, the first preset threshold, the second preset threshold, and the preset service type may be set according to requirements, which is not limited in the embodiment of the present invention. .
  • the user equipment identifier is used to indicate that the core network element accepts the connectionless transmission request of the user equipment.
  • the sending unit 830 is further configured to send a third response message to the user equipment, where the third response message includes information that rejects the user equipment connectionless transmission request, as shown in FIG. 7.
  • the receiving unit 610 in the base station provided in FIG. 9 , the receiving unit 720 in the user equipment provided in FIG. 10 , and the receiving unit 810 in the core network element provided in FIG. 11 may receive Device.
  • the sending unit 620 in the base station provided in FIG. 9 in the embodiment of the present invention, the sending unit 710 in the user equipment provided in FIG. 10, and the sending unit 830 in the core network element provided in FIG. 11 may be the transmitter.
  • the processing unit 630 in the base station provided in FIG. 9 in the embodiment of the present invention, the processing unit 730 in the user equipment provided in FIG. 10, and the processing unit 820 in the core network element provided in FIG. 11 may be processors.
  • FIG. 12 is a schematic structural diagram of another base station according to an embodiment of the present invention. As shown in FIG. 12, the base station may include a receiver 910, a transmitter 920, and a processor 930.
  • a receiving unit configured to receive a first message sent by the user equipment, where the first message includes uplink data, a user equipment identifier, and a first authentication result;
  • the sender 910 is configured to send an authentication request message to the core network element, where the authentication request message includes a user equipment identifier or a group identifier of a group to which the user equipment belongs or a cell identifier of a cell to which the user equipment belongs;
  • the receiver 920 is further configured to receive an authentication response message sent by the core network element, where the authentication response message includes a second authentication result, where the second authentication result is an authentication result calculated by the core network element according to the authentication request message. ;
  • the processor 930 is configured to compare the first authentication result with the second authentication result. If the same, the sending unit sends the uplink data to the core network element.
  • the user equipment is authenticated by the base station, and the UE group identity or the cell identifier or the user equipment identifier of the cell to which the UE belongs is used for authentication, thereby preventing the data of the illegal UE from reaching the core network element or avoiding the data of the illegal UE. Reaching the core network improves the security.
  • the user equipment is authenticated against the core network element in the prior art. If the user equipment corresponding to the received data is a non-legal user equipment, the data is discarded, saving the transmission. Resources.
  • the base station provided by the embodiment of the present invention may implement steps S260, S290, S295, and S297 executed by the base station in FIG. 2, S360, S390, and S395 in FIG. 3, S460, S490, and S495 in FIG. 4, and the base station provided in FIG. Steps S260, S290, S295, and S297 executed by the base station in FIG. 2, S360, S390, and S395 in FIG. 3, and S460, S490, and S495 in FIG. 4 are performed by the base station provided in the embodiment of the present invention. A brief description will not be repeated here.
  • FIG. 13 is a schematic structural diagram of another user equipment according to an embodiment of the present invention.
  • the user equipment can include a transmitter 1010, a receiver 1020, and a processor 1030.
  • the sender 1010 is configured to send a first request message to the core network element, where the first request message is used to request a connectionless transmission service.
  • the receiver 1020 is configured to receive a response message sent by the network element of the core network, where the response message includes a user equipment identifier allocated by the core network for the user equipment, or an identifier of the user equipment and an authentication code allocated by the core network to the user equipment.
  • the processor 1030 is configured to determine a first authentication result according to the response message.
  • the transmitter 1010 is further configured to send a first message to the base station, where the first message includes uplink data, a user equipment identifier, and a first authentication result.
  • the base station performs security verification on the user equipment according to the first authentication result, improves security, and prevents data of the illegal UE from reaching the core network.
  • the user equipment provided by the embodiment of the present invention may implement steps S210, S240, and S250 performed by the user equipment in FIG. 2, S310, S340, and S350 in FIG. 3, S410, S440, and S450 in FIG. 4, and the user provided in FIG. Steps S210, S240, and S250 performed by the user equipment in FIG. 2, S310, S340, and S350 in FIG. 3, and S410, S440, and S450 in FIG. 4 are performed by the user equipment provided by the embodiment of the present invention. For the sake of brevity, it will not be repeated here.
  • FIG. 14 is a schematic structural diagram of another core network element according to an embodiment of the present invention.
  • the core network element may include a receiver 1110, a processor 1120, and a transmitter 1130.
  • the receiver 1110 is configured to receive an authentication request message sent by the base station, where the authentication request message includes a user equipment identifier that is allocated by the core network for the user equipment, or a group identifier of the group to which the user equipment belongs, or a cell identifier of the cell to which the user equipment belongs.
  • the processor 1120 is configured to determine, according to the authentication request message, a first authentication result
  • the transmitter 1130 is configured to send a first authentication result to the base station.
  • the core network element provided by the embodiment of the present invention implements the authentication of the user equipment group level or the user equipment cell level by the base station, thereby preventing the illegal UE data from reaching the core network, improving security, and saving transmission resources.
  • the core network element provided by the embodiment of the present invention may implement steps S220, S230, S270, S280, and S296 executed by the core network element in FIG. 2, S320, S330, S370, and S380 in FIG. 3, and S420 in FIG. S430, S470, S480, and S510, S520, and S530 in FIG. 5, and each logical unit of the core network element provided in FIG. 11 can complete the core network element in FIG. 2 by using the core network element provided by the embodiment of the present invention. Steps S220, S230, S270, S280, and S296, S320, S330, S370, and S380 in FIG. 3, S420, S430, S470, and S480 in FIG. 4, and S510, S520, and S530 in FIG. Description, no longer repeat here.
  • the base station provided in FIG. 12, the user equipment provided in FIG. 13, and the processor 930/1030/1120 in the core network element provided in FIG. 14 may be a central processing unit (CPU), and may also be Other general purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • each step of the above method can be integrated by hardware in the processor 930/1030/1120
  • the logic circuit or the instruction in the form of software is completed.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory, and the processor 930/1030/1120 reads the information in the memory and combines the hardware to complete the steps of the above method. To avoid repetition, it will not be described in detail here.
  • the base station provided in FIG. 12 may further include a memory 940.
  • the user equipment provided in FIG. 13 may further include 1040.
  • the core network element provided in FIG. 14 may further include 1140.
  • the memory is used to store instructions and data.
  • the memory 940/1040/1140 can include read only memory and random access memory and provides instructions and data to the processor 940/1040/1140.
  • a portion of the memory may also include a non-volatile random access memory.
  • the steps of a method or algorithm described in connection with the embodiments disclosed herein can be implemented in hardware, a software module executed by a processor, or a combination of both.
  • the software module can be placed in random access memory (RAM), memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or technical field. Any other form of storage medium known.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明涉及一种鉴权方法、基站、用户设备和核心网网元。该鉴权方法包括：基站接收用户设备发送的第一消息，第一消息包括上行数据，用户设备标识和第一鉴权结果；向核心网网元发送鉴权请求消息，鉴权请求消息包括用户设备标识或用户设备所属群组的群组标识或用户设备所属小区的小区标识；接收所述核心网网元发送的鉴权响应消息，鉴权响应消息包括第二鉴权结果，第二鉴权结果为核心网网元根据鉴权请求消息计算的鉴权结果；比较所述第一鉴权结果与第二鉴权结果，若相同，则向核心网网元发送上行数据。通过基站对用户设备进行安全验证，避免了不合法UE的数据到达核心网网元，提高了安全性，同时相对现有技术节省了传输资源。

Description

一种鉴权方法、基站、用户设备和核心网网元 技术领域
本发明涉及通信领域，尤其涉及一种鉴权方法、基站、用户设备和核心网网元。
背景技术
当处于空闲态的用户设备(User Equipment，UE)需要传输上行数据时，UE首先需要通过随机接入与基站建立无线资源控制(Radio Resource Control，RRC)连接，进入RRC连接状态获取上行授权(Uplink Grant)后才可以进行后续的上行数据传输，然而。UE状态转换涉及的RRC连接建立过程会带来很大的延迟，为满足5G通信网络中业务的时延要求，现有技术中对某些场景的应用采用无连接传输，即处于空闲态的UE需要上行数据传输时，不进行随机接入转入连接态，直接根据基站广播消息中的配置信息，在公共资源上基于竞争(contention based，CB)直接发送上行数据。
但现有技术的无线传输中，基站接收到上行数据时，只是根据上行数据的数据包中携带的用户设备标识转发上行数据包，并没有对传输上行数据包的UE进行鉴权，这样会使未经鉴权的UE数据发送到核心网，引起安全性问题，另外，如果核心网接收到数据后确定发送该数据的UE不合法，需要将接收到的数据丢弃，造成传输资源的浪费。
发明内容
本发明提供一种鉴权方法、基站、用户设备和核心网网元，通过基站对UE进行鉴权，提高了传输数据的安全性，同时节省了传输资源。
第一方面，本发明实施例提供一种鉴权方法，该方法包括：
基站接收用户设备发送的第一消息，第一消息包括上行数据，用户设备标识(如用户面网关无连接传输服务标识(UPGW Connectionless Service，UCLSI)或者国际移动用户识别码(International Mobile Subscriber Identification Number，IMSI)或者临时移动用户识别码(Temporary Mobile Subscriber Identification Number，TMSI)或者全球唯一临时用户设备标识(Globally Unique Temporary UE Identity，GUTI)等)和第一鉴权结果；
基站向核心网网元发送鉴权请求消息，鉴权请求消息包括用户设备标识或用户设备所属群组的群组标识或用户设备所属小区的小区标识；
基站接收核心网网元发送的鉴权响应消息，鉴权响应消息包括第二鉴权结果，第二鉴权结果为核心网网元根据鉴权请求消息计算的鉴权结果；
基站比较第一鉴权结果与第二鉴权结果，若相同，则向核心网网元发送上行数据。
通过基站对用户设备进行安全验证，利用UE群组标识或者UE所属小区的小区标识或者用户设备标识进行鉴权，避免了不合法UE的数据到达核心网网元，或者说避免不合法UE的数据到达核心网，提高了安全性，同时相对现有技术中核心网网元对用户设备进行安 全验证，若验证接收到的数据对应的用户设备为非合法用户设备，则丢弃其数据，节省了传输资源。
结合第一方面，在第一方面的第一种可能实现的方式中，第一鉴权结果为用户设备根据鉴权码和小区标识计算得到的鉴权结果；或者第一鉴权结果为用户设备根据鉴权码和群组标识计算得到的鉴权结果；或者第一鉴权结果为用户设备根据鉴权码和用户设备标识计算得到的鉴权结果；或者第一鉴权结果为用户设备根据用户设备密钥和用户设备标识计算得到的鉴权结果。基站可以通过用户设备根据不同的方式计算的第一鉴权结果进行UE的安全验证。
结合第一方面或者第一方面的第一种可能实现的方式，在第一方面的第二种可能实现的方式中，该方法还包括：
基站根据网络负载或者业务类型或者业务数据量确定是否向核心网网元发送上行数据。在基站对用户设备进行安全验证的基础上，增加了对无连接传输的接入控制，避免了无连接传输的UE过多印发冲突概率上升造成的UE传输业务的影响。
结合第一方面的第二种可能实现的方式，在第一方面的第三种可能实现的方式中，该方法还包括：
若基站确定不向核心网发送上行数据，则向用户设备发送拒绝无连接传输请求的信息，以通知用户设备拒绝无连接传输请求。
第二方面，本发明实施例提供了一种鉴权方法，该方法包括：
用户设备向核心网网元发送第一请求消息，第一请求消息用于请求无连接传输服务。在本发明实施例中，第一请求消息可以为用户设备向核心网网元发送的附着(attach)请求消息，该请求消息中可以包括无连接传输请求信息。
用户设备接收核心网网元发送的响应消息，响应消息包括核心网为用户设备分配的用户设备标识，或者用户设备标识和核心网为用户设备分配的鉴权码；
用户设备根据响应消息确定第一鉴权结果；
用户设备向基站发送第一消息，第一消息包括上行数据，用户设备标识和第一鉴权结果。以便于基站根据第一鉴权结果对该用户设备进行安全验证，提高安全性，并避免不合法UE的数据到达核心网。
结合第二方面，在第二方面的第一种可能实现的方式中，用户设备根据响应消息确定第一鉴权结果，包括：
用户设备根据鉴权码和用户设备所属小区的小区标识确定第一鉴权结果；
或者用户设备根据鉴权码和用户设备所属群组的群组标识确定第一鉴权结果。
或者用户设备根据鉴权码和用户设备标识确定第一鉴权结果。
以实现基站对用户设备群组级别或者用户设备小区级别的鉴权，避免了不合法UE数据到达核心网，提高安全性，同时节省传输资源。
结合第二方面，在第二方面的第二种可能实现的方式中，用户设备根据响应消息确定第一鉴权结果，包括：
用户设备根据用户设备标识和第一密钥确定第一鉴权结果，第一密钥为用户设备自身的密钥。
结合第二方面至第二方面的第二种可能实现的方式，在第二方面的第三种可能实现的方式中，第一请求消息包括用户设备的业务数据量或用户设备的业务类型中的至少一个，便于核心网网元根据用户设备的业务数据量或用户设备的业务类型对无连接传输请求的接入控制，以降低无连接传输的UE过多引发冲突概率上升，对时延敏感的UE传输的业务造成影响。
第三方面，本发明实施例提供一种鉴权方法，该方法包括：
核心网网元接收基站发送的鉴权请求消息，鉴权请求消息包括核心网为用户设备分配的用户设备标识或用户设备所属群组的群组标识或用户设备所属小区的小区标识；
核心网网元根据鉴权请求消息确定第一鉴权结果；
核心网网元向基站发送第一鉴权结果。
通过本发明实施例提供的鉴权方法，以实现基站对用户设备群组级别或者用户设备小区级别的鉴权，避免了不合法UE数据到达核心网，提高安全性，同时节省传输资源。
结合第三方面，在第三方面的第一种可能实现的方式中，在核心网网元接收基站发送的鉴权请求消息之前，该方法还包括：
核心网网元接收用户设备发送的第一请求消息，第一请求消息用于请求无连接传输服务；
核心网网元根据第一请求消息确定用户设备标识；
核心网网元向用户设备发送第一响应消息，第一响应消息包括用户设备标识。
核心网网元与用户设备建立无连接传输请求，并为请求无连接传输服务的用户设备分配用户设备标识，以便于用户设备根据分配的用户设备标识计算鉴权结果，用于基站对用户设备进行安全验证。
结合第三方面，在第三方面的第二种可能实现的方式中，在核心网网元接收基站发送的鉴权请求消息之前，该方法还包括：
核心网网元接收用户设备发送的第一请求消息，第一请求消息用于请求无连接传输服务；
核心网网元根据第一请求消息确定用户设备标识和鉴权码；
核心网网元向用户设备发送第二响应消息，第二响应消息包括用户设备标识和鉴权码。
以便于用户设备根据核心网网元为用户设备分配的用户设备标识和鉴权码计算鉴权结果，用户基站根据鉴权结果对用户设备进行安全验证。
结合第三方面的第一种可能实现的方式，在第三方面的第三种可能实现的方式中，核心网网元根据鉴权请求消息确定第一鉴权结果，包括：
核心网网元根据用户设备标识和第一密钥确定第一鉴权结果。
结合第三方面的第二种可能实现的方式，在第三方面的第四种可能实现的方式中，核心网网元根据鉴权请求消息确定第一鉴权结果，包括：
核心网网元根据群组标识或小区标识或用户设备标识，以及鉴权码确定第一鉴权结果。
结合第三方面，或第三方面的第一种至第四种可能实现方式中的任一可能实现的方式，在第三方面的第五种可能实现的方式中，第一请求消息包括用户设备的业务数据量或用户设备的业务类型中的至少一个；该方法还包括：
核心网网元根据用户设备的业务数据量或用户设备的业务类型确定是否接受用户设备的无连接传输请求。通过核心网网元对请求无连接传输服务的用户设备进行接入控制，实现了网络侧可以根据具体情况限定是否进行无连接传输的UE数量，避免无连接传输的UE过多引发冲突概率上升，从而对时延敏感的UE传输的业务造成影响。
结合第三方面的第五种可能实现的方式，在第三方面的第六种可能实现的方式中，核心网网元根据第一请求消息确定接受用户设备的无连接传输请求，包括：
在第一预设时间内，若核心网网元接收到的无连接请求消息的数量未满足第一预设阈值，则核心网网元确定接受用户设备的无连接传输请求；或者，
若用户设备的业务数据量未满足第二预设阈值，则核心网网元确定接受用户设备的无连接传输请求；或者，
若用户设备的业务类型为预设业务类型，则核心网网元确定接受用户设备的无连接传输请求。
结合第三方面的第五种可能实现的方式，在第三方面的第七种可能实现的方式中，用户设备标识用于指示核心网网元接受用户设备的无连接传输请求。
结合第三方面的第五种可能实现的方式，在第三方面的第八种可能实现的方式中，该方法还包括：
核心网网元向用户设备发送第三响应消息，第三响应消息包括拒绝用户设备无连接传输请求的信息，以通知用户设备拒绝无连接传输服务。
第四方面，本发明实施例提供一种基站，基站包括：
接收单元，用于接收用户设备发送的第一消息，第一消息包括上行数据，用户设备标识(如用户面网关无连接传输服务标识(UPGW Connectionless Service，UCLSI)等)和第一鉴权结果；
发送单元，用于向核心网网元发送鉴权请求消息，鉴权请求消息包括用户设备标识或用户设备所属群组的群组标识或用户设备所属小区的小区标识；
接收单元，还用于接收核心网网元发送的鉴权响应消息，鉴权响应消息包括第二鉴权结果，第二鉴权结果为核心网网元根据鉴权请求消息计算的鉴权结果；
处理单元，用于比较第一鉴权结果与第二鉴权结果，若相同，则发送单元向核心网网元发送上行数据。
通过基站对用户设备进行安全验证，利用UE群组标识或者UE所属小区的小区标识或者用户设备标识进行鉴权，避免了不合法UE的数据到达核心网网元，或者说避免不合法UE的数据到达核心网，提高了安全性，同时相对现有技术中核心网网元对用户设备进行安全验证，若验证接收到的数据对应的用户设备为非合法用户设备，则丢弃其数据，节省了传输资源。
结合第四方面，在第四方面的第一种可能实现的方式中，第一鉴权结果为用户设备根据鉴权码和小区标识计算得到的鉴权结果；或者第一鉴权结果为用户设备根据鉴权码和群组标识计算得到的鉴权结果；或者第一鉴权结果为用户设备根据鉴权码和用户设备标识计算得到的鉴权结果；或者第一鉴权结果为用户设备根据用户设备密钥和用户设备标识计算得到的鉴权结果。
结合第四方面或者第四方面的第一种可能实现的方式，在第四方面的第二种可能实现的方式中处理单元，还用于根据网络负载或者业务类型或者业务数据量确定是否向核心网网元发送上行数据。在基站对用户设备进行安全验证的基础上，增加了对无连接传输的接入控制，避免了无连接传输的UE过多印发冲突概率上升造成的UE传输业务的影响。
结合第四方面的第二种可能实现的方式，在第四方面的第三种可能实现的方式中，，若处理单元确定不向核心网发送上行数据，则发送单元向用户设备发送拒绝无连接传输请求的信息，以通知用户设备拒绝无连接传输请求。
第五方面，本发明实施例提供了一种用户设备，该用户设备包括：
发送单元，用于向核心网网元发送第一请求消息，第一请求消息用于请求无连接传输服务；
接收单元，用于接收核心网网元发送的响应消息，响应消息包括核心网为用户设备分配的用户设备标识，或者用户设备标识和核心网为用户设备分配的鉴权码；
处理单元，用于根据响应消息确定第一鉴权结果；
发送单元，还用于向基站发送第一消息，第一消息包括上行数据，用户设备标识和第一鉴权结果。
以便于基站根据第一鉴权结果对该用户设备进行安全验证，提高安全性，并避免不合法UE的数据到达核心网。
结合第五方面，在第五方面的第一种可能实现的方式中，处理单元根据响应消息确定第一鉴权结果，包括：
处理单元根据鉴权码和用户设备所属小区的小区标识确定第一鉴权结果；
或者处理单元根据鉴权码和用户设备所属群组的群组标识确定第一鉴权结果。
或者处理单元根据鉴权码和用户设备标识确定第一鉴权结果。
以实现基站对用户设备群组级别或者用户设备小区级别的鉴权，避免了不合法UE数据到达核心网，提高安全性，同时节省传输资源。
结合第五方面，在第五方面的第二种可能实现的方式中，处理单元根据响应消息确定第一鉴权结果，包括：
处理单元根据用户设备标识和第一密钥确定第一鉴权结果，第一密钥为用户设备自身的密钥。
结合第五方面至第五方面的第二种可能实现的方式，在第五方面的第三种可能实现的方式中，第一请求消息包括用户设备的业务数据量或用户设备的业务类型中的至少一个，便于核心网网元根据用户设备的业务数据量或用户设备的业务类型对无连接传输请求的接入控制，以降低无连接传输的UE过多引发冲突概率上升，对时延敏感的UE传输的业务造成影响。
第六方面，本发明是实施例提供一种核心网网元，该核心网网元包括：
接收单元，用于接收基站发送的鉴权请求消息，鉴权请求消息包括核心网为用户设备分配的用户设备标识或用户设备所属群组的群组标识或用户设备所属小区的小区标识；
处理单元，用于根据鉴权请求消息确定第一鉴权结果；
发送单元，用于向基站发送第一鉴权结果。
通过本发明实施例提供的核心网网元，以实现基站对用户设备群组级别或者用户设备小区级别的鉴权，避免了不合法UE数据到达核心网，提高安全性，同时节省传输资源。
结合第六方面，在第六方面的第一种可能实现的方式中，接收单元，还用于接收用户设备发送的第一请求消息，第一请求消息用于请求无连接传输服务；
处理单元，还用于根据第一请求消息确定用户设备标识；
发送单元，还用于向用户设备发送第一响应消息，第一响应消息包括用户设备标识。
核心网网元与用户设备建立无连接传输请求，并为请求无连接传输服务的用户设备分配用户设备标识，以便于用户设备根据分配的用户设备标识计算鉴权结果，用于基站对用户设备进行安全验证。
结合第六方面，在第六方面的第二种可能实现的方式中，接收单元，还用于接收用户设备发送的第一请求消息，第一请求消息用于请求无连接传输服务；
处理单元，还用于根据第一请求消息确定用户设备标识和鉴权码；
发送单元，还用于向用户设备发送第二响应消息，第二响应消息包括用户设备标识和鉴权码。
以便于用户设备根据核心网网元为用户设备分配的用户设备标识和鉴权码计算鉴权结果，用户基站根据鉴权结果对用户设备进行安全验证。
结合第六方面的第一种可能实现的方式，在第六方面的第三种可能实现的方式中，处理单元根据鉴权请求消息确定第一鉴权结果，包括：
处理单元根据用户设备标识和第一密钥确定第一鉴权结果。
结合第六方面的第二种可能实现的方式，在第六方面的第四种可能实现的方式中，处理单元根据鉴权请求消息确定第一鉴权结果，包括：
处理单元根据群组标识或小区标识或用户设备标识，以及鉴权码确定第一鉴权结果。
结合第六方面，或第六方面的第一种至第四种可能实现方式中的任一可能实现的方式，在第六方面的第五种可能实现的方式中，第一请求消息包括用户设备的业务数据量或用户设备的业务类型中的至少一个。
处理单元，还用于根据用户设备的业务数据量或用户设备的业务类型确定是否接受用户设备的无连接传输请求。
通过核心网网元对请求无连接传输服务的用户设备进行接入控制，实现了网络侧可以根据具体情况限定是否进行无连接传输的UE数量，避免无连接传输的UE过多引发冲突概率上升，从而对时延敏感的UE传输的业务造成影响。
结合第六方面的第五种可能实现的方式，在第六方面的第六种可能实现的方式中，处理单元根据第一请求消息确定接受用户设备的无连接传输请求，包括：
在第一预设时间内，若接收单元接收到的无连接请求消息的数量未满足第一预设阈值，则处理单元确定接受用户设备的无连接传输请求；或者，
若用户设备的业务数据量未满足第二预设阈值，则处理单元确定接受用户设备的无连接传输请求；或者，
若用户设备的业务类型为预设业务类型，则处理单元确定接受用户设备的无连接传输请求。
结合第六方面的第五种可能实现的方式，在第六方面的第七种可能实现的方式中，用户设备标识用于指示核心网网元接受用户设备的无连接传输请求。
结合第六方面的第五种可能实现的方式，在第六方面的第八种可能实现的方式中，发送单元，还用于向用户设备发送第三响应消息，第三响应消息包括拒绝用户设备无连接传输请求的信息。
第七方面本发明实施例提供一种基站，该基站包括接收器，发送器和处理器，基于同一发明构思，第七方面提供的基站具有执行第一方面以及第一方面的各个可能实现的设计方案的功能，并可以达到第一方面的相应技术效果，且第四方面提供的基站可以通过第七方面提供的基站完成第一方面以及第一方面的各个可能实现的设计方案，为简洁描述，在这里不再赘述。
第八方面本发明实施例提供一种用户设备，该用户设备包括接收器，发送器和处理器，基于同一发明构思，第八方面提供的用户设备具有执行第二方面以及第二方面的各个可能实现的设计方案的功能，并可以达到第二方面的相应技术效果，且第五方面提供的用户设备可以通过第八方面提供的用户设备完成第二方面以及第二方面的各个可能实现的设计方案，为简洁描述，在这里不再赘述。
第九方面本发明实施例提供一种核心网网元，该核心网网元包括接收器，发送器和处理器，基于同一发明构思，第九方面提供的核心网网元具有执行第三方面以及第三方面的各个可能实现的设计方案的功能，并可以达到第三方面的相应技术效果，且第六方面提供的核心网网元可以通过第九方面提供的核心网网元完成第三方面以及第三方面的各个可能实现的设计方案，为简洁描述，在这里不再赘述。
本发明提供的鉴权方法、基站、用户设备和核心网网元通过基站侧对用户设备的安全验证，避免了不合法UE的数据到达核心网网元，或者说避免不合法UE的数据到达核心网，提高了安全性，同时相对现有技术中核心网网元对用户设备进行安全验证，若验证接收到的数据对应的用户设备为非合法用户设备，则丢弃其数据，节省了传输资源。
附图说明
图1为本发明实施例提供LTE网络架构示意图；
图2为本发明实施例提供的一种鉴权方法流程图；
图3为本发明实施例提供的一种鉴权方法流程图；
图4为本发明实施例提供的另一种鉴权方法流程图；
图5为本发明实施例提供的一种无连接传输的接入控制方法流程图；
图6为本发明实施例提供的一种无连接传输的接入控制方法流程图；
图7为本发明实施例提供的另一种无连接传输的接入控制方法流程图；
图8为本发明实施例提供的又一种无连接传输的接入控制方法流程图；
图9为本发明实施例提供的一种基站的结构示意图；
图10为本发明实施例提供的一种用户设备的结构示意图；
图11为本发明实施例提供的一种核心网网元的结构示意图；
图12为本发明实施例提供的另一种基站的结构示意图；
图13为本发明实施例提供的另一种用户设备的结构示意图；
图14为本发明实施例提供的另一种核心网网元的结构示意图。
具体实施方式
本发明提供了一种鉴权方法、基站、用户设备和核心网网元。通过UE与核心网进行无连接传输时，UE根据参数(如鉴权码、UCLSI)计算出鉴权结果，并将鉴权结果携带在上行数据中发送给基站，基站将鉴权结果与核心网网元计算的鉴权结果进行对比，若两个鉴权结果相同，则基站将上行数据转发给核心网网元，反之，基站将接收到的上行数据丢弃。
本发明提供的鉴权方法、基站、用户设备和核心网网元主要应用于各种无线通信系统，如长期演进(Long Term Evolution，LTE)、通用移动通信系统(Universal Mobile Telecommunications System，UMTS)、类似LTE或者5G的无线通信结构，具体架构不作限定。
下面以LTE网络架构为例对本发明实施例进行说明。如图1所示，该网络架构包括用户设备110、基站120和核心网设备130。
在本发明实施例中，用户设备(user equipment，UE)110可以称之为终端设备(terminal equipment)，也可以称之为终端(terminal)，移动台(mobile station，MS)，移动终端(mobile terminal)，笔记本电脑等，该用户设备可以经无线接入网(radio access network，RAN)与一个或多个核心网进行通信，例如，用户设备可以是移动电话(或称为“蜂窝”电话)或具有移动终端的计算机等，例如，用户设备还可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，它们与无线接入网交换语音和/或数据。
基站120也可以称之为接入网设备，例如RAN，主要实现与用户设备进行通信。核心网设备130可以称之为核心网网元(Control Plane，CP)，负责处理用户设备发来的数据以及进行相关的信令交互。
本发明为了满足业务的时延需求，在UE需要传输上行数据时，通过无连接传输进行数据传输，即处于空闲态的UE有上行数据传输时，不进行随机接入转入连接态，而是根据基站广播消息中的配置，在公共资源上基于竞争直接发送数据。同时，为了保证数据的安全性，提出了本发明的技术方案。
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述。
图2为本发明实施例提供的一种鉴权方法流程图。如图2所示，该方法可以包括以下步骤：
S210，用户设备向核心网网元发送第一请求消息。
当用户设备UE开机后，首先需要进行附着(attach)过程，UE向核心网网元发送附着请求(attach request)消息，该附着请求消息可以称之为第一请求消息。如果UE需要进行无连接传输，则需要在附着请求消息中携带无连接(connectionless)传输请求， 即第一请求消息用于请求无连接传输服务，或者说UE向核心网网元发送无连接传输请求消息。
S220，核心网网元根据第一请求消息确定用户设备标识，或者用户设备标识和鉴权码。
可选地，核心网网元接收到第一请求消息后，为该请求用户设备分配用户设备标识，在本发明实施例中，该用户设备标识可以为用户面网关无连接传输服务标识(UPGW Connectionless Service information，UCLSI)，或者国际移动用户识别码(International Mobile Subscriber Identification Number，IMSI)或者临时移动用户识别码(Temporary Mobile Subscriber Identification Number，TMSI)或者全球唯一临时用户设备标识(Globally Unique Temporary UE Identity，GUTI)，在本发明实施例中对此不作限制。若该用户设备的标识用于在UE进行无连接传输时，指示基站将该UE发送的上行数据转发到对应的数据分组单元(Packet Data Unit，PDU)会话(session)，以便于核心网网元进行后续处理。
可选地，在本发明实施例中，核心网网元还可以为该请求无连接传输的用户设备分配一个鉴权码(authentication code)，以便于UE根据该鉴权码进行安全验证。
在本发明实施例中，可以规定为一个UE分配一个鉴权码，也可以规定为一个群组分配一个鉴权码。在UE进行附着的时候，核心网网元从多个鉴权码中随机选择一个分配给UE。
S230，核心网网元向用户设备发送响应消息。
可选地，核心网网元向用户设备发送附着接受(attach accept)响应消息，可以称之为第一响应消息，该第一响应消息中可以包括用户设备标识。
可选地，核心网网元向用户设备发送附着接受(attach accept)响应消息，可以称之为第二响应消息，该第二响应消息中可以包括用户设备标识和鉴权码。
S240，用户设备根据响应消息确定第一鉴权结果。
可选地，第一鉴权结果为所述用户设备根据用户设备密钥和所述用户设备标识计算得到的鉴权结果。可选地，该第一鉴权结果可以为用户设备根据鉴权码和用户设备所属小区的小区标识或者用户设备所属群组的群组标识或者用户设备标识确定鉴权结果。
S250，用户设备向基站发送第一消息，该第一消息包括上行数据、用户设备标识和第一鉴权结果。
用户设备接收到核心网网元发送的响应消息，以通知用户设备核心网网元接受附着，用于设备可以进行无连接传输时，用户设备向基站发送上行数据，并将根据鉴权码计算的鉴权结果携带在上行数据中。
S260，基站向核心网网元发送鉴权请求消息。
该鉴权请求消息中可以包括用户设备标识、请求建立无连接传输的用户设备所属群组的群组标识，或者请求建立无连接传输的用户设备所属小区的小区标识，以便于核心网网元根据鉴权请求消息计算鉴权结果，进行安全验证。
S270，核心网网元根据鉴权请求消息确定第二鉴权结果。
第二鉴权结果为核心网网元根据请求建立无连接传输的用户设备所属群组的群组标识与核心网分配给该用户设备的鉴权码计算鉴权结果；或者核心网网元根据请求建立无连 接传输的用户设备所属小区的小区标识与核心网分配给该用户设备的鉴权码计算鉴权结果；或者核心网网元根据请求建立无连接传输的用户设备标识与核心网分配给该用户设备的鉴权码计算鉴权结果。
在本发明实施例中，一个小区可以对应一个或者多个鉴权码。如果一个小区对应多个鉴权码，那么核心网网元需要将小区标识与对应的多个鉴权码分别利用鉴权算法计算出多个鉴权结果，并发送给基站。
S280，核心网网元向基站发送鉴权响应消息。
该鉴权响应消息中可以包括用户设备标识和核心网网元计算的鉴权结果。
S290，基站对比第一鉴权结果和第二鉴权结果。
基站将从用户设备获取的第一鉴权结果和从核心网网元获取的第二鉴权结果进行对比。如果基站接收到核心网网元发送的多个鉴权结果时，需要将每个鉴权结果与第一鉴权结果进行比较，若从用户设备获取的鉴权结果与从核心网网元获取的至少一个鉴权结果中的一个鉴权结果相同，则鉴权通过，执行S295；反之，则基站丢弃其数据，以提高数据的安全性，同时相对现有技术中，核心网网元验证用户设备为非合法用户设备时丢弃接收到的该用户设备传输的数据，节省了传输资源。
S295，基站根据用户设备标识向核心网网元发送上行数据。
当第一鉴权结果和第二鉴权结果相同时，基站将该第一鉴权结果对应的上行数据，根据用户设备标识发送到对应的PDU会话，即发送给核心网网元，以进行后续处理。
可选地，基站对比第一鉴权结果和第二鉴权结果后，该方法还可以包括：基站向用户设备发送反馈信息，以通知用户设备无连接传输是否成功。例如：若第一鉴权结果和第二鉴权结果相同，则基站向用户设备发送无连接传输成功信息；若第一鉴权结果和第二鉴权结果不同，则基站向用户设备发送无连接传输失败信息。
本发明实施例提供的鉴权方法，通过基站对用户设备进行安全验证，利用UE群组标识或者UE所属小区的小区标识或者用户设备标识进行鉴权，避免了不合法UE的数据到达核心网网元，或者说避免不合法UE的数据到达核心网，提高了安全性，同时相对现有技术中核心网网元对用户设备进行安全验证，若验证接收到的数据对应的用户设备为非合法用户设备，则丢弃其数据，节省了传输资源。
需要说明的是，在本发明实施例中，S260和S270可以在S240和S250之前执行，本发明实施例中对此不作限制。
可选地，在本发明实施例中，第一请求消息包括用户设备的业务数据量或用户设备的业务类型中的至少一个；如图2所示，该方法还包括：
S296，核心网网元根据用户设备的业务数据量或用户设备的业务类型确定是否接受用户设备的无连接传输请求。以实现核心网网元对无连接传输的接入控制，使得网络侧可以根据具体情况限定是否进行无连接传输的UE数量，避免无连接传输的UE过多引发冲突概率上升，从而对时延敏感的UE传输的业务造成影响。具体描述请参见图6的描述。
可选地，在本发明实施例中，如图2所示，基站接收到用户设备发送的第一消息后，该方法还可以包括：
S297，基站根据网络负载或者业务类型或者业务数据量确定是否向所述核心网网元发送所述上行数据。以实现从基站控制无连接的接入，避免无连接传输的UE过多引发冲突概率上升，从而对时延敏感的UE传输的业务造成影响。
可选地，该方法还可以包括：
S298，若基站确定不向核心网发送所述上行数据，则向所述用户设备发送拒绝无连接传输请求的信息，以通知用户设备拒绝无连接传输。
下面以用户设备标识为GCLSI为例，对本发明的技术方案进行描述。
图3为本发明实施例提供的一种鉴权方法流程图。如图3所示，该方法可以包括以下步骤：
S310，用户设备向核心网网元发送附着请求消息，该附着请求消息中包括无连接传输请求信息。
其具体过程与图2中的S210的过程相同，为简洁描述，在这里不再赘述。
S320，核心网网元根据附着请求消息确定用户面网关无连接传输服务标识UCLSI和鉴权码。
该UCLSI用于在UE进行无连接传输时，指示基站将该UE发送的上行数据转发到对应的数据分组单元(Packet Data Unit，PDU)会话(session)，以便于核心网网元进行后续处理。
核心网网元为该请求无连接传输的用户设备分配一个鉴权码(authentication code)，以便于UE根据该鉴权码进行安全验证。
在本发明实施例中，可以规定为一个UE分配一个鉴权码，也可以规定为一个群组分配一个鉴权码。在UE进行附着的时候，核心网网元从多个鉴权码中随机选择一个分配给UE。
S330，核心网网元向用户设备发送响应消息，该响应消息中可以包括UCLSI和鉴权码。
S340，用户设备根据鉴权码和用户设备所属小区的小区标识或者用户设备所属群组的群组标识或者用户设备标识确定鉴权结果确定第一鉴权结果。
S350，用户设备向基站发送第一消息，该第一消息包括上行数据、UCLSI和第一鉴权结果。
用户设备接收到核心网网元发送的响应消息，以通知用户设备核心网网元接受附着，用于设备可以进行无连接传输时，用户设备向基站发送上行数据，并将根据鉴权码计算的鉴权结果携带在上行数据中。
S360，基站向核心网网元发送鉴权请求消息。
该鉴权请求消息中可以包括UCLSI、请求建立无连接传输的用户设备所属群组的群组标识，或者请求建立无连接传输的用户设备所属小区的小区标识，以便于核心网网元根据鉴权请求消息计算鉴权结果，进行安全验证。
S370，核心网网元根据鉴权请求消息确定第二鉴权结果。
第二鉴权结果为核心网网元根据请求建立无连接传输的用户设备所属群组的群组标识与核心网分配给该用户设备的鉴权码计算鉴权结果；或者核心网网元根据请求建立无连 接传输的用户设备所属小区的小区标识与核心网分配给该用户设备的鉴权码计算鉴权结果；或者核心网网元根据请求建立无连接传输的用户设备标识与核心网分配给该用户设备的鉴权码计算鉴权结果。
在本发明实施例中，一个小区可以对应一个或者多个鉴权码。如果一个小区对应多个鉴权码，那么核心网网元需要将小区标识与对应的多个鉴权码分别利用鉴权算法计算出多个鉴权结果，并发送给基站。
S380，核心网网元向基站发送鉴权响应消息。
该鉴权响应消息中可以包括UCLSI和核心网网元计算的鉴权结果。
S390，基站对比第一鉴权结果和第二鉴权结果。
基站将从用户设备获取的第一鉴权结果和从核心网网元获取的第二鉴权结果进行对比。如果基站接收到核心网网元发送的多个鉴权结果时，需要将每个鉴权结果与第一鉴权结果进行比较，若从用户设备获取的鉴权结果与从核心网网元获取的至少一个鉴权结果中的一个鉴权结果相同，则鉴权通过，执行S395；反之，则基站丢弃其数据，以提高数据的安全性，同时相对现有技术中，核心网网元验证用户设备为非合法用户设备时丢弃接收到的该用户设备传输的数据，节省了传输资源。
S395，基站根据UCLSI向核心网网元发送上行数据。
当第一鉴权结果和第二鉴权结果相同时，基站将该第一鉴权结果对应的上行数据，根据UCLSI发送到对应的PDU会话，即发送给核心网网元，以进行后续处理。
可选地，基站对比第一鉴权结果和第二鉴权结果后，该方法还可以包括：基站向用户设备发送反馈信息，以通知用户设备无连接传输是否成功。例如：若第一鉴权结果和第二鉴权结果相同，则基站向用户设备发送无连接传输成功信息；若第一鉴权结果和第二鉴权结果不同，则基站向用户设备发送无连接传输失败信息。
可选地，若基站确定不向和核心网网元发送上行数据时，向用户设备发送拒绝无连接传输请求的信息。
本发明实施例提供的鉴权方法，通过基站对用户设备进行安全验证，利用UE群组标识或者UE所属小区的小区标识或者用户设备标识进行鉴权，避免了不合法UE的数据到达核心网网元，或者说避免不合法UE的数据到达核心网，提高了安全性，同时相对现有技术中核心网网元对用户设备进行安全验证，若验证接收到的数据对应的用户设备为非合法用户设备，则丢弃其数据，节省了传输资源。
需要说明的是，在本发明实施例中，S360和S370可以在S340和S350之前执行，本发明实施例中对此不作限制。
图4为本发明实施例提供的另一种鉴权方法。如图4所示，该鉴权方法可以包括以下步骤：
S410，用户设备向核心网网元发送无连接传输请求消息。
该步骤S310与图2中的S210的过程相同，为简洁描述，在这里不再赘述。
S420，核心网网元根据无连接传输请求消息确定用户面网关无连接传输服务标识UCLSI。
该步骤S420与图2中的S220中的核心网网元确定UCLSI的过程相同，UCLSI的功能 也相同，为简洁描述，在这里不再赘述。
S430，核心网网元向用户设备发送响应消息。
本发明实施例的S310、S320、S330分别对应图2中的S210、S220、S230。区别在于，S420中核心网网元不为请求无连接传输的用户设备分配了鉴权码，在S430中，核心网网元向用户设备发送的响应消息中也不包括鉴权码，除此外，S410、S420、S430与图2中的S210、S220、S230的过程相同，为简洁描述，在这里不再赘述。
S440，用户设备根据UCLSI和自身的用户密钥确定第一鉴权结果。
在本发明实施例中，用户设备根据核心网网元发送的响应消息中包括的UCLSI和自身的用户密钥，采用鉴权算法计算出一个鉴权结果，该鉴权结果称之为第一鉴权结果，用户设备自身的用户密钥可以称之为第一密钥。
S450，用户设备向基站发送第一消息，该第一消息包括上行数据UCLSI和第一鉴权结果。
用户设备接收到核心网网元发送的接受用户设备附着，可以进行无连接传输的响应消息时，用户设备向基站发送上行数据，并将计算的鉴权结果携带在上行数据中。
S460，基站向核心网网元发送鉴权请求消息。
该鉴权请求消息中可以包括UCLSI。
S470，核心网网元根据UCLSI和对应用户设备的用户密钥确定第二鉴权结果。
可选地，核心网网元可以根据UCLSI和对应用户设备的用户密钥，采用鉴权算法计算出一个鉴权结果，该鉴权结果为第二鉴权结果。
S480，核心网网元向基站发送鉴权响应消息。
该鉴权响应消息包括UCLSI和第二鉴权结果。
S490，基站对比第一鉴权结果和第二鉴权结果。
若第一鉴权结果和第二鉴权结果相同，则执行S,495；若第一鉴权结果和第二鉴权结果不同，则基站将接收到的上行数据丢弃。
S495，基站向核心网网元发送上行数据。
该步骤与图2中的S295的过程相同，为简洁描述，在这里不再赘述。
可选地，基站对比第一鉴权结果和第二鉴权结果后，该方法还可以包括：基站向用户设备发送反馈信息，以通知用户设备无连接传输是否成功。例如：若第一鉴权结果和第二鉴权结果相同，则基站向用户设备发送无连接传输成功信息；若第一鉴权结果和第二鉴权结果不同，则基站向用户设备发送无连接传输失败信息。
本发明实施例提供的鉴权方法，通过基站对用户设备进行安全验证，避免了不合法UE的数据到达核心网网元，或者说避免不合法UE的数据到达核心网，提高了安全性，同时相对现有技术中核心网网元对用户设备进行安全验证，若验证接收到的数据对应的用户设备为非合法用户设备，则丢弃其数据，节省了传输资源。
另外，本发明还提供一种控制无连接传输的接入控制方法。通过核心网网元或者基站控制用户设备使用无连接传输服务。
下面通过图5对本发明的方案进行详细说明。如图5所示，该方法可以包括以下步骤：
S510，核心网网元接收用户设备发送的附着请求消息。
该附着请求消息中包括无连接传输请求信息，还可以包括可以包括用户设备的业务数据量或用户设备的业务数据类型中的至少一个。
在本发明实施例中，核心网网元可以接收至少一个用户设备发送的附着请求消息，并统计接收到的用户设备发送的无连接传输请求信息的数量。
S520，核心网网元根据无连接传输请求信息确定接受用户设备进行无连接传输。
核心网网元根据网络负载或用户设备的业务数据量或用户设备的业务数据类型确定是否接受用户设备的无连接传输请求。
可选地，核心网网元根据无连接请求信息确定接受用户设备进行无连接传输，包括：
在第一预设时间内，若核心网网元接收到的无连接请求信息的数量未满足第一预设阈值，则核心网网元确定接受用户设备进行无连接传输；或者，
若用户设备的业务数据量未满足第二预设阈值，则核心网网元确定接受用户设备进行无连接传输；或者，
若用户设备的业务类型为预设业务类型，则核心网网元确定接受用户设备进行无连接传输。
或者说，在UE请求无连接传输服务时，核心网网元根据相关条件(例如核心网网元根据网络负责情况、UE的业务数据量、以及UE的业务类型等)确定是否拒绝UE使用无连接传输服务。
换句话讲，核心网网元可以根据无连接请求信息确定不接受用户设备进行无连接传输。例如：
若一段时间内请求无连接服务的UE的数量超过预设阈值，则核心网网元拒绝UE的无连接传输请求。
若UE的业务数量超过预设阈值时，核心网网元拒绝UE的无连接传输请求。
若对于某些不需要无连接传输的业务，比如对时延不敏感的业务等，核心网网元拒绝UE的无连接传输请求。
需要说明的是，本发明实施例中，第一预设时间、第一预设阈值、第二预设阈值以及预设业务类型可以根据需求进行设定，在本发明实施例中对此不作限制。
S530，核心网网元向用户设备发送第一响应消息。
该第一响应消息用于指示接受用户设备进行无连接传输。
在本发明是实施例中，核心网网元需要预先配置指示用户设备使用无连接传输服务的信息，或者需要核心网网元和用户设备预先协商可以进行无连接传输的方式。
或者说需要核心网网元配置接受或者拒绝用户设备进行无连接传输的信息。例如：核心网网元通过为请求无连接传输的用户设备分配的UCLSI来指示接受用户设备附着，可以进行无连接传输。那么当核心网网元向用户设备发送的接受附着(attach accept)响应消息中不包括为UE分配的UCLSI时，表示核心网网元拒绝用户设备的无连接传输请求。换句话讲，如果UE没有收到UCLSI则说明无连接传输请求被拒绝。该过程示意图如图6所示。
可选地，核心网网元还可以向用户设备发送第二响应消息，第二响应消息包括拒绝无连接传输的信息，如图7所示。
可选地，用户设备根据核心网网元发送的第一响应消息向基站发送上行数据。
基站接收到上行数据后，根据网络负载或业务数据量或业务类型确定是否拒绝用户设备的无连接传输请求。
如图8所示，当基站接收到用户发送的上行数据后，根据网络负载向用户设备发送确定拒绝该用户设备的无连接传输的信息。其中拒绝信息中进一步可以包含拒绝无连接传输的原因或者指示用户设备回退一段时间再进行无连接传输请求的时间值或者用于辅助用户设备进行随机接入的相关信息，如前导码。
本发明实施例增加了网络侧对无连接传输的接入控制，使得网络侧可以根据具体情况限定是否进行无连接传输的UE数量，避免无连接传输的UE过多引发冲突概率上升，从而对时延敏感的UE传输的业务造成影响。
需要说明的是，图5至图8所提供的无连接传输接入的控制方法可以结合图3和图4的鉴权控制方法使用，以通过基站对用户设备的验证提高数据的安全性，并通过网络侧对无连接传输接入的控制降低了由于无连接传输UE的过多引发冲突概率上升对UE传输业务的影响。
以上图2至图8描述了本发明的鉴权方法，下面通过图9至图14分别对本发明提供的基站、用户设备和核心网网元进行详细说明。
图9为本发明实施例提供的一种基站的结构示意图。如图9所示，该基站包括接收单元610、发送单元620和处理单元630。
接收单元610，用于接收用户设备发送的第一消息，第一消息包括上行数据，用户设备标识和第一鉴权结果。
发送单元620，用于向核心网网元发送鉴权请求消息，鉴权请求消息包括用户设备标识或用户设备所属群组的群组标识或用户设备所属小区的小区标识；
接收单元610，还用于接收核心网网元发送的鉴权响应消息，鉴权响应消息包括第二鉴权结果，第二鉴权结果为核心网网元根据鉴权请求消息计算的鉴权结果；
处理单元630，用于比较第一鉴权结果与第二鉴权结果，若相同，则发送单元向核心网网元发送上行数据。
通过基站对用户设备进行安全验证，利用UE群组标识或者UE所属小区的小区标识或者用户设备标识进行鉴权，避免了不合法UE的数据到达核心网网元，或者说避免不合法UE的数据到达核心网，提高了安全性，同时相对现有技术中核心网网元对用户设备进行安全验证，若验证接收到的数据对应的用户设备为非合法用户设备，则丢弃其数据，节省了传输资源。
可选地，第一鉴权结果为用户设备根据鉴权码和小区标识计算得到的鉴权结果；或者第一鉴权结果为用户设备根据鉴权码和群组标识计算得到的鉴权结果；或者第一鉴权结果为用户设备根据鉴权码和用户设备标识计算得到的鉴权结果；或者第一鉴权结果为用户设备根据用户设备密钥和用户设备标识计算得到的鉴权结果。
可选地，处理单元630，还用于根据网络负载或者业务类型或者业务数据量确定是否向核心网网元发送上行数据。在基站对用户设备进行安全验证的基础上，增加了对无连接传输的接入控制，避免了无连接传输的UE过多印发冲突概率上升造成的UE传输业务的影 响。
可选地，若处理单元630确定不向核心网发送上行数据，则发送单元向用户设备发送拒绝无连接传输请求的信息，以通知用户设备拒绝无连接传输请求。
本发明实施例提供的基站可以实现图2中S260、S280、S290和S295，为简洁描述在这里不再赘述。
图10为本发明实施例提供的一种用户设备的结构示意图。如图10所示，该用户设备包括发送单元710、接收单元720和处理单元730。
发送单元710，用于向核心网网元发送第一请求消息，第一请求消息用于请求无连接传输服务；
接收单元720，用于接收核心网网元发送的响应消息，响应消息包括核心网为用户设备分配的用户设备标识，或者用户设备标识和核心网为用户设备分配的鉴权码；
处理单元730，用于根据响应消息确定第一鉴权结果；
发送单元710，还用于向基站发送第一消息，第一消息包括上行数据，用户设备标识和第一鉴权结果。
以便于基站根据第一鉴权结果对该用户设备进行安全验证，提高安全性，并避免不合法UE的数据到达核心网。
可选地，处理单元730根据响应消息确定第一鉴权结果，包括：
处理单元730根据鉴权码和用户设备所属小区的小区标识确定第一鉴权结果；或者处理单元730根据鉴权码和用户设备所属群组的群组标识确定第一鉴权结果；或者处理单元730根据鉴权码和用户设备标识确定第一鉴权结果。以实现基站对用户设备群组级别或者用户设备小区级别的鉴权，避免了不合法UE数据到达核心网，提高安全性，同时节省传输资源。
可选地，处理单元730根据响应消息确定第一鉴权结果，包括：
处理单元730根据用户设备标识和第一密钥确定第一鉴权结果，第一密钥为用户设备自身的密钥。
可选地，第一请求消息包括用户设备的业务数据量或用户设备的业务类型中的至少一个，便于核心网网元根据用户设备的业务数据量或用户设备的业务类型对无连接传输请求的接入控制，降低无连接传输的UE过多引发冲突概率上升，对时延敏感的UE传输的业务造成影响。
本发明实施例提供的基站可以实现图2中S210、S240和S250，为简洁描述在这里不再赘述。
图11为本发明实施例提供的一种核心网网元的结构示意图。如图11所示，该核心网网元包括接收单元810、处理单元820和发送单元830,。
接收单元810，用于接收基站发送的鉴权请求消息，鉴权请求消息包括核心网为用户设备分配的用户设备标识或用户设备所属群组的群组标识或用户设备所属小区的小区标识；
处理单元820，用于根据鉴权请求消息确定第一鉴权结果；
发送单元830，用于向基站发送第一鉴权结果。
通过本发明实施例提供的核心网网元，以实现基站对用户设备群组级别或者用户设备小区级别的鉴权，避免了不合法UE数据到达核心网，提高安全性，同时节省传输资源。
可选地，接收单元810，还用于接收用户设备发送的第一请求消息，第一请求消息用于请求无连接传输服务；
处理单元820，还用于根据第一请求消息确定用户设备标识；
发送单元830，还用于向用户设备发送第一响应消息，第一响应消息包括用户设备标识。
该过程描述类似于图2中的S210、S220和S230，为简洁描述，在这里不再赘述。
核心网网元与用户设备建立无连接传输请求，并为请求无连接传输服务的用户设备分配用户设备标识，以便于用户设备根据分配的用户设备标识计算鉴权结果，用于基站对用户设备进行安全验证。
可选地，处理单元820根据鉴权请求消息确定第一鉴权结果，包括：
处理单元820根据用户设备标识和第一密钥确定第一鉴权结果。
本发明实施例提供的方案可以完成图4中的S410、S420、S430和S470，为简洁描述，在这里不再赘述。
可选地，作为本发明另一个实施例，接收单元810，还用于接收用户设备发送的第一请求消息，第一请求消息用于请求无连接传输服务；
处理单元820，还用于根据第一请求消息确定用户设备标识和鉴权码；
发送单元830，还用于向用户设备发送第二响应消息，第二响应消息包括用户设备标识和鉴权码。
以便于用户设备根据核心网网元为用户设备分配的用户设备标识和鉴权码计算鉴权结果，用户基站根据鉴权结果对用户设备进行安全验证。
可选地，处理单元820根据鉴权请求消息确定第一鉴权结果，包括：
处理单元820根据群组标识或小区标识或者用户设备标识，以及鉴权码确定第一鉴权结果。
本发明实施例提供的方案可以完成图3中的S310、S320、S330以及S370，其具体描述可以参见图3中的S310、S320、S330以及S370，为简洁描述，在这里不再赘述。
可选地，第一请求消息包括用户设备的业务数据量或用户设备的业务类型中的至少一个。
处理单元820，还用于根据用户设备的业务数据量或用户设备的业务类型确定是否接受用户设备的无连接传输请求。
该具体过程与图2中的S296，以及图5中的S510、S520的描述过程相同，为简洁描述，在这里不再赘述。
通过核心网网元对请求无连接传输服务的用户设备进行接入控制，实现了网络侧可以根据具体情况限定是否进行无连接传输的UE数量，避免无连接传输的UE过多引发冲突概率上升，从而对时延敏感的UE传输的业务造成影响。
可选地，处理单元820根据第一请求消息确定接受用户设备的无连接传输请求，包括：
在第一预设时间内，若接收单元810接收到的无连接请求消息的数量未满足第一预设阈值，则处理单元820确定接受用户设备的无连接传输请求；或者，
若用户设备的业务数据量未满足第二预设阈值，则处理单元820确定接受用户设备的无连接传输请求；或者，
若用户设备的业务类型为预设业务类型，则处理单元820确定接受用户设备的无连接传输请求。
需要说明的是，本发明实施例中，第一预设时间、第一预设阈值、第二预设阈值以及预设业务类型可以根据需求进行设定，在本发明实施例中对此不作限制。
可选地，作为本发明一个实施例，用户设备标识用于指示核心网网元接受用户设备的无连接传输请求。
可选地，发送单元830，还用于向用户设备发送第三响应消息，第三响应消息包括拒绝用户设备无连接传输请求的信息，如图7所示。
需要说明的是，在本发明实施例中图9提供的基站中的接收单元610，图10提供的用户设备中的接收单元720以及图11提供的核心网网元中的接收单元810可以为接收器。本发明实施例中图9提供的基站中的发送单元620，图10提供的用户设备中的发送单元710以及图11提供的核心网网元中的发送单元830可以为发送器。本发明实施例中图9提供的基站中的处理单元630，图10提供的用户设备中的处理单元730以及图11提供的核心网网元中的处理单元820可以为处理器。
图12为本发明实施例提供的另一种基站的结构示意图。如图12所示，该基站可以包括接收器910、发送器920和处理器930。
接收单元，用于接收用户设备发送的第一消息，第一消息包括上行数据，用户设备标识和第一鉴权结果；
发送器910，用于向核心网网元发送鉴权请求消息，鉴权请求消息包括用户设备标识或用户设备所属群组的群组标识或用户设备所属小区的小区标识；
接收器920，还用于接收核心网网元发送的鉴权响应消息，鉴权响应消息包括第二鉴权结果，第二鉴权结果为核心网网元根据鉴权请求消息计算的鉴权结果；
处理器930，用于比较第一鉴权结果与第二鉴权结果，若相同，则发送单元向核心网网元发送上行数据。
通过基站对用户设备进行安全验证，利用UE群组标识或者UE所属小区的小区标识或者用户设备标识进行鉴权，避免了不合法UE的数据到达核心网网元，或者说避免不合法UE的数据到达核心网，提高了安全性，同时相对现有技术中核心网网元对用户设备进行安全验证，若验证接收到的数据对应的用户设备为非合法用户设备，则丢弃其数据，节省了传输资源。
本发明实施例提供的基站可以实现图2中基站执行的步骤S260、S290、S295、S297，图3中的S360、S390、S395，图4中的S460、S490、S495，且图11提供的基站的各个逻辑单元可以通过本发明实施例提供的基站完成图2中基站执行的步骤S260、S290、S295、S297，图3中的S360、S390、S395，图4中的S460、S490、S495，为简洁描述，在这里不再赘述。
图13为本发明实施例提供的另一种用户设备的结构示意图。如图13所示，该用户设备可以包括发送器1010、接收器1020和处理器1030。
发送器1010，用于向核心网网元发送第一请求消息，第一请求消息用于请求无连接传输服务；
接收器1020，用于接收核心网网元发送的响应消息，响应消息包括核心网为用户设备分配的用户设备标识，或者用户设备标识和核心网为用户设备分配的鉴权码；
处理器1030，用于根据响应消息确定第一鉴权结果；
发送器1010，还用于向基站发送第一消息，第一消息包括上行数据，用户设备标识和第一鉴权结果。
以便于基站根据第一鉴权结果对该用户设备进行安全验证，提高安全性，并避免不合法UE的数据到达核心网。
本发明实施例提供的用户设备可以实现图2中用户设备执行的步骤S210、S240、S250，图3中的S310、S340、S350，图4中的S410、S440、S450，且图10提供的用户设备的各个逻辑单元可以通过本发明实施例提供的用户设备完成图2中用户设备执行的步骤S210、S240、S250，图3中的S310、S340、S350，图4中的S410、S440、S450，为简洁描述，在这里不再赘述。
图14为本发明实施例提供的另一种核心网网元的结构示意图。如图14所示，该核心网网元可以包括接收器1110、处理器1120和发送器1130。
接收器1110，用于接收基站发送的鉴权请求消息，鉴权请求消息包括核心网为用户设备分配的用户设备标识或用户设备所属群组的群组标识或用户设备所属小区的小区标识；
处理器1120，用于根据鉴权请求消息确定第一鉴权结果；
发送器1130，用于向基站发送第一鉴权结果。
通过本发明实施例提供的核心网网元，以实现基站对用户设备群组级别或者用户设备小区级别的鉴权，避免了不合法UE数据到达核心网，提高安全性，同时节省传输资源。
本发明实施例提供的核心网网元可以实现图2中核心网网元执行的步骤S220、S230、S270、S280、S296，图3中的S320、S330、S370、S380，图4中的S420、S430、S470、S480，以及图5中的S510、S520和S530，且图11提供的核心网网元的各个逻辑单元可以通过本发明实施例提供的核心网网元完成图2中核心网网元执行的步骤S220、S230、S270、S280、S296，图3中的S320、S330、S370、S380，图4中的S420、S430、S470、S480，以及图5中的S510、S520和S530，为简洁描述，在这里不再赘述。
应理解，在图12提供的基站、图13提供的用户设备以以及图14提供的核心网网元中的处理器930/1030/1120可以是中央处理单元(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现成可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
在实现过程中，上述方法的各步骤可以通过处理器930/1030/1120中的硬件的集成 逻辑电路或者软件形式的指令完成。结合本发明实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器930/1030/1120读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
另外，图12提供的基站还可以包括存储器940。图13提供的用户设备还可以包括1040。图14提供的核心网网元还可以包括1140。存储器用于存储指令和数据。
存储器940/1040/1140可以包括只读存储器和随机存取存储器，并向处理器940/1040/1140提供指令和数据。存储器的一部分还可以包括非易失性随机存取存储器。
专业人员应该还可以进一步意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
结合本文中所公开的实施例描述的方法或算法的步骤可以用硬件、处理器执行的软件模块，或者二者的结合来实施。软件模块可以置于随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的存储介质中。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (37)

  1. 一种鉴权方法，其特征在于，所述方法包括：
    基站接收用户设备发送的第一消息，所述第一消息包括上行数据，用户设备标识和第一鉴权结果；
    所述基站向核心网网元发送鉴权请求消息，所述鉴权请求消息包括所述用户设备标识或所述用户设备所属群组的群组标识或所述用户设备所属小区的小区标识；
    所述基站接收所述核心网网元发送的鉴权响应消息，所述鉴权响应消息包括第二鉴权结果，所述第二鉴权结果为所述核心网网元根据所述鉴权请求消息计算的鉴权结果；
    所述基站比较所述第一鉴权结果与所述第二鉴权结果，若相同，则向所述核心网网元发送所述上行数据。
  2. 根据权利要求1所述的方法，其特征在于，第一鉴权结果为所述用户设备根据鉴权码和所述小区标识计算得到的鉴权结果；或者第一鉴权结果为所述用户设备根据鉴权码和所述群组标识计算得到的鉴权结果；或者第一鉴权结果为所述用户设备根据鉴权码和所述用户设备标识计算得到的鉴权结果；或者第一鉴权结果为所述用户设备根据用户设备密钥和所述用户设备标识计算得到的鉴权结果。
  3. 根据权利要求1或2所述的方法，其特征在于，所述方法还包括：
    所述基站根据网络负载或者业务类型或者业务数据量确定是否向所述核心网网元发送所述上行数据。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    若基站确定不向核心网发送所述上行数据，则向所述用户设备发送拒绝无连接传输请求的信息。
  5. 一种鉴权方法，其特征在于，所述方法包括：
    用户设备向核心网网元发送第一请求消息，所述第一请求消息用于请求无连接传输服务；
    所述用户设备接收所述核心网网元发送的响应消息，所述响应消息包括所述核心网为所述用户设备分配的用户设备标识，或者所述用户设备标识和所述核心网为所述用户设备分配的鉴权码；
    所述用户设备根据所述响应消息确定第一鉴权结果；
    所述用户设备向基站发送第一消息，所述第一消息包括上行数据，所述用户设备标识和所述第一鉴权结果。
  6. 根据权利要求5所述的方法，其特征在于，所述用户设备根据所述响应消息确定第一鉴权结果，包括：
    所述用户设备根据所述鉴权码和所述用户设备所属小区的小区标识确定所述第一鉴权结果；
    或者所述用户设备根据所述鉴权码和所述用户设备所属群组的群组标识确定所述第一鉴权结果。
    或者所述用户设备根据所述鉴权码和所述用户设备标识确定所述第一鉴权结果。
  7. 根据权利要求5所述的方法，其特征在于，所述用户设备根据所述响应消息确定第一鉴权结果，包括：
    所述用户设备根据所述用户设备标识和第一密钥确定所述第一鉴权结果，所述第一密钥为所述用户设备自身的密钥。
  8. 根据权利要求5至7任一项所述的方法，其特征在于，所述第一请求消息包括所述用户设备的业务数据量或所述用户设备的业务类型中的至少一个。
  9. 一种鉴权方法，其特征在于，所述方法包括：
    核心网网元接收基站发送的鉴权请求消息，所述鉴权请求消息包括所述核心网为所述用户设备分配的用户设备标识或用户设备所属群组的群组标识或用户设备所属小区的小区标识；
    所述核心网网元根据所述鉴权请求消息确定第一鉴权结果；
    所述核心网网元向所述基站发送所述第一鉴权结果。
  10. 根据权利要求9所述的方法，其特征在于，在所述核心网网元接收基站发送的鉴权请求消息之前，所述方法还包括：
    所述核心网网元接收用户设备发送的第一请求消息，所述第一请求消息用于请求无连接传输服务；
    所述核心网网元根据所述第一请求消息确定所述用户设备标识；
    所述核心网网元向所述用户设备发送第一响应消息，所述第一响应消息包括所述用户设备标识。
  11. 根据权利要求9所述的方法，其特征在于，在所述核心网网元接收基站发送的鉴权请求消息之前，所述方法还包括：
    所述核心网网元接收用户设备发送的第一请求消息，所述第一请求消息用于请求无连接传输服务；
    所述核心网网元根据所述第一请求消息确定所述用户设备标识和鉴权码；
    所述核心网网元向所述用户设备发送第二响应消息，所述第二响应消息包括所述用户设备标识和所述鉴权码。
  12. 根据权利要求10所述的方法，其特征在于，所述核心网网元根据所述鉴权请求消息确定第一鉴权结果，包括：
    所述核心网网元根据所述用户设备标识和第一密钥确定所述第一鉴权结果。
  13. 根据权利要求11所述的方法，其特征在于，所述核心网网元根据所述鉴权请求消息确定第一鉴权结果，包括：
    所述核心网网元根据所述群组标识或所述小区标识或所述用户设备标识，以及所述鉴权码确定所述第一鉴权结果。
  14. 根据权利要求9至13任一项所述的方法，其特征在于，所述第一请求消息包括用户设备的业务数据量或用户设备的业务类型中的至少一个；所述方法还包括：
    所述核心网网元根据所述用户设备的业务数据量或所述用户设备的业务类型确定是否接受所述用户设备的无连接传输请求。
  15. 根据权利要求14所述的方法，其特征在于，所述核心网网元根据所述第一请求消息确定接受所述用户设备的无连接传输请求，包括：
    在第一预设时间内，若所述核心网网元接收到的所述无连接请求消息的数量未满足第一预设阈值，则所述核心网网元确定接受所述用户设备的无连接传输请求；或者，
    若所述用户设备的业务数据量未满足第二预设阈值，则所述核心网网元确定接受所述用户设备的无连接传输请求；或者，
    若所述用户设备的业务类型为预设业务类型，则所述核心网网元确定接受所述用户设备的无连接传输请求。
  16. 根据权利要求14所述的方法，其特征在于，
    所述用户设备标识用于指示所述核心网网元接受所述用户设备的无连接传输请求。
  17. 根据权利要求14所述的方法，其特征在于，所述方法还包括：
    所述核心网网元向所述用户设备发送第三响应消息，所述第三响应消息包括拒绝所述用户设备无连接传输请求的信息。
  18. 一种基站，其特征在于，所述基站包括：
    接收单元，用于接收用户设备发送的第一消息，所述第一消息包括上行数据，用户设备标识和第一鉴权结果；
    发送单元，用于向核心网网元发送鉴权请求消息，所述鉴权请求消息包括所述用户设备标识或所述用户设备所属群组的群组标识或所述用户设备所属小区的小区标识；
    所述接收单元，还用于接收所述核心网网元发送的鉴权响应消息，所述鉴权响应消息包括第二鉴权结果，所述第二鉴权结果为所述核心网网元根据所述鉴权请求消息计算的鉴权结果；
    处理单元，用于比较所述第一鉴权结果与所述第二鉴权结果，若相同，则所述发送单元向所述核心网网元发送所述上行数据。
  19. 根据权利要求17所述的基站，其特征在于，第一鉴权结果为所述用户设备根据鉴权码和所述小区标识计算得到的鉴权结果；或者第一鉴权结果为所述用户设备根据鉴权码和所述群组标识计算得到的鉴权结果；或者第一鉴权结果为所述用户设备根据鉴权码和所述用户设备标识计算得到的鉴权结果；或者第一鉴权结果为所述用户设备根据用户设备密钥和所述用户设备标识计算得到的鉴权结果。
  20. 根据权利要求18或19所述的基站，其特征在于，所述处理单元，还用于根据网络负载或者业务类型或者业务数据量确定是否向所述核心网网元发送所述上行数据。
  21. 根据权利要求20所述的基站，其特征在于，若所述处理单元确定不向核心网发送所述上行数据，则所述发送单元向所述用户设备发送拒绝无连接传输请求的信息。
  22. 一种用户设备，其特征在于，所述用户设备包括：
    发送单元，用于向核心网网元发送第一请求消息，所述第一请求消息用于请求无连接传输服务；
    接收单元，用于接收所述核心网网元发送的响应消息，所述响应消息包括所述核心网为所述用户设备分配的用户设备标识，或者所述用户设备标识和所述核心网为所述用户设备分配的鉴权码；
    处理单元，用于根据所述响应消息确定第一鉴权结果；
    所述发送单元，还用于向基站发送第一消息，所述第一消息包括上行数据，所述用户设备标识和所述第一鉴权结果。
  23. 根据权利要求22所述的用户设备，其特征在于，所述处理单元根据所述响应消息确定第一鉴权结果，包括：
    所述处理单元根据所述鉴权码和所述用户设备所属小区的小区标识确定所述第一鉴权结果；
    或者所述处理单元根据所述鉴权码和所述用户设备所属群组的群组标识确定所述第一鉴权结果。
    或者所述处理单元根据所述鉴权码和所述用户设备标识确定所述第一鉴权结果。
  24. 根据权利要求22所述的用户设备，其特征在于，所述处理单元根据所述响应消息确定第一鉴权结果，包括：
    所述处理单元根据所述用户设备标识和第一密钥确定所述第一鉴权结果，所述第一密钥为所述用户设备自身的密钥。
  25. 根据权利要求22至24任一项所述的用户设备，其特征在于，所述第一请求消息包括所述用户设备的业务数据量或所述用户设备的业务类型中的至少一个。
  26. 一种核心网网元，其特征在于，所述核心网网元包括：
    接收单元，用于接收基站发送的鉴权请求消息，所述鉴权请求消息包括所述核心网为所述用户设备分配的用户设备标识或用户设备所属群组的群组标识或用户设备所属小区的小区标识；
    处理单元，用于根据所述鉴权请求消息确定第一鉴权结果；
    发送单元，用于向所述基站发送所述第一鉴权结果。
  27. [根据细则91更正 09.02.2018]
    根据权利要求26所述的核心网网元，其特征在于，
    所述接收单元，还用于接收用户设备发送的第一请求消息，所述第一请求消息用于请求无连接传输服务；
    所述处理单元，还用于根据所述第一请求消息确定所述用户设备标识；
    所述发送单元，还用于向所述用户设备发送第一响应消息，所述第一响应消息包括所述用户设备标识。
  28. 根据权利要求26所述的核心网网元，其特征在于，
    所述接收单元，还用于接收用户设备发送的第一请求消息，所述第一请求消息用于请求无连接传输服务；
    所述处理单元，还用于根据所述第一请求消息确定所述用户设备标识和鉴权码；
    所述发送单元，还用于向所述用户设备发送第二响应消息，所述第二响应消息包括所述用户设备标识和所述鉴权码。
  29. 根据权利要求27所述的方法，其特征在于，所述处理单元根据所述鉴权请求消息确定第一鉴权结果，包括：
    所述处理单元根据所述用户设备标识和第一密钥确定所述第一鉴权结果。
  30. 根据权利要求28所述的核心网网元，其特征在于，所述处理单元根据所述鉴权请求消息确定第一鉴权结果，包括：
    所述处理单元根据所述群组标识或所述小区标识或者用户设备标识，以及所述鉴权码确定所述第一鉴权结果。
  31. 根据权利要求26至30任一项所述的核心网网元，其特征在于，所述第一请求消息包括用户设备的业务数据量或用户设备的业务类型中的至少一个；
    所述处理单元，还用于根据所述用户设备的业务数据量或所述用户设备的业务类型确 定是否接受所述用户设备的无连接传输请求。
  32. 根据权利要求31所述的核心网网元，其特征在于，所述处理单元根据所述第一请求消息确定接受所述用户设备的无连接传输请求，包括：
    在第一预设时间内，若所述接收单元接收到的所述无连接请求消息的数量未满足第一预设阈值，则所述处理单元确定接受所述用户设备的无连接传输请求；或者，
    若所述用户设备的业务数据量未满足第二预设阈值，则所述处理单元确定接受所述用户设备的无连接传输请求；或者，
    若所述用户设备的业务类型为预设业务类型，则所述处理单元确定接受所述用户设备的无连接传输请求。
  33. 根据权利要求31所述的核心网网元，其特征在于，
    所述用户设备标识用于指示所述核心网网元接受所述用户设备的无连接传输请求。
  34. 根据权利要求31所述的核心网网元，其特征在于，
    所述发送单元，还用于向所述用户设备发送第三响应消息，所述第三响应消息包括拒绝所述用户设备无连接传输请求的信息。
  35. 一种装置，其特征在于，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述程序时实现：
    向核心网网元发送第一请求消息，所述第一请求消息用于请求无连接传输服务；
    接收所述核心网网元发送的响应消息，所述响应消息包括所述核心网为所述用户设备分配的用户设备标识，或者所述用户设备标识和所述核心网为所述用户设备分配的鉴权码；
    根据所述响应消息确定第一鉴权结果；
    向基站发送第一消息，所述第一消息包括上行数据，所述用户设备标识和所述第一鉴权结果。
  36. 一种装置，其特征在于，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述程序时实现：
    接收基站发送的鉴权请求消息，所述鉴权请求消息包括所述核心网为所述用户设备分配的用户设备标识或用户设备所属群组的群组标识或用户设备所属小区的小区标识；
    根据所述鉴权请求消息确定第一鉴权结果；
    向所述基站发送所述第一鉴权结果。
  37. 一种计算机可读存储介质，其特征在于，包括指令，当其在设备上运行时，使得该设备执行如权利要求1至21中任一项所述的方法。
PCT/CN2017/111703 2016-11-18 2017-11-17 一种鉴权方法、基站、用户设备和核心网网元 WO2018090986A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP17871597.5A EP3528522B1 (en) 2016-11-18 2017-11-17 Authentication method, base station, user equipment, and core network element
US16/415,819 US10869197B2 (en) 2016-11-18 2019-05-17 Authentication method, base station, user equipment, and core network element

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611034792.X 2016-11-18
CN201611034792.XA CN108076461B (zh) 2016-11-18 2016-11-18 一种鉴权方法、基站、用户设备和核心网网元

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/415,819 Continuation US10869197B2 (en) 2016-11-18 2019-05-17 Authentication method, base station, user equipment, and core network element

Publications (1)

Publication Number Publication Date
WO2018090986A1 true WO2018090986A1 (zh) 2018-05-24

Family

ID=62145255

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/111703 WO2018090986A1 (zh) 2016-11-18 2017-11-17 一种鉴权方法、基站、用户设备和核心网网元

Country Status (4)

Country Link
US (1) US10869197B2 (zh)
EP (1) EP3528522B1 (zh)
CN (1) CN108076461B (zh)
WO (1) WO2018090986A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021147053A1 (zh) * 2020-01-22 2021-07-29 华为技术有限公司 数据传输方法、装置及系统

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11019487B2 (en) * 2017-12-11 2021-05-25 Qualcomm Incorporated Systems and methods for uplink high efficiency location in a wireless network
CN111030964A (zh) * 2018-10-09 2020-04-17 中国移动通信有限公司研究院 一种响应Detach指令的方法和设备
FR3104875B1 (fr) * 2019-12-17 2024-05-10 Electricite De France Procédé de gestion d’authentification d’un équipement dans un système de communication de données, et système pour la mise en œuvre du procédé
US20230049987A1 (en) * 2020-02-04 2023-02-16 Qualcomm Incorporated Certificate based application descriptors for network slice selection
CN111628869B (zh) * 2020-05-27 2022-07-22 南通华欣民福工业技术有限公司 一种基站存储n的节点与基站双向认证方法
CN114567548B (zh) * 2022-01-26 2023-11-07 三维通信股份有限公司 基站的安全网关配置管理方法、系统和电子装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1771718A (zh) * 2003-02-10 2006-05-10 弗拉里奥恩技术公司 用于在无线通信系统内使用的安全方法
CN101588580A (zh) * 2009-06-30 2009-11-25 华为技术有限公司 一种用户接入控制方法、家庭基站网关及系统
CN102149164A (zh) * 2011-03-28 2011-08-10 上海华为技术有限公司 一种业务数据的传送、发送方法和相关装置
CN102625306A (zh) * 2011-01-31 2012-08-01 电信科学技术研究院 认证方法、系统和设备
WO2016021817A1 (ko) * 2014-08-04 2016-02-11 엘지전자 주식회사 무선 통신 시스템에서 단말을 인증 하는 방법 및 이를 위한 장치
CN105391803A (zh) * 2015-12-15 2016-03-09 腾讯科技（深圳）有限公司 消息推送方法及装置

Family Cites Families (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2002247029A (ja) * 2000-02-02 2002-08-30 Sony Corp 認証装置、認証システムおよびその方法、処理装置、通信装置、通信制御装置、通信システムおよびその方法、情報記録方法およびその装置、情報復元方法およびその装置、その記録媒体
CN1549482B (zh) * 2003-05-16 2010-04-07 华为技术有限公司 一种实现高速率分组数据业务认证的方法
US7194763B2 (en) * 2004-08-02 2007-03-20 Cisco Technology, Inc. Method and apparatus for determining authentication capabilities
US8260259B2 (en) * 2004-09-08 2012-09-04 Qualcomm Incorporated Mutual authentication with modified message authentication code
US9350716B2 (en) * 2007-03-20 2016-05-24 At&T Intellectual Property I, Lp System and method for authentication of a communication device
KR101556906B1 (ko) * 2008-12-29 2015-10-06 삼성전자주식회사 선인증을 통한 이종 무선 통신망 간의 핸드오버 방법
JP5521057B2 (ja) * 2010-03-09 2014-06-11 アルカテル−ルーセント ユーザ機器を認証するための方法および装置
EP2395780B1 (en) * 2010-06-14 2019-08-07 Koninklijke KPN N.V. Authenticity verification of authentication messages
CN102438330A (zh) * 2011-12-06 2012-05-02 大唐移动通信设备有限公司 一种附着到e-tran的方法及移动性管理实体
US20140334371A1 (en) * 2012-01-27 2014-11-13 Samsung Electronics Co., Ltd. Method and apparatus for transmitting and receiving data by using plurality of carriers in mobile communication systems
US9277429B2 (en) * 2013-08-06 2016-03-01 Cellos Software Ltd. Monitoring probe for identifying a user plane identifier of a user device
US9590962B2 (en) * 2014-07-07 2017-03-07 Alcatel-Lucent Usa Inc. Using cookies to identify security contexts for connectionless service
CA2997591A1 (en) * 2014-09-05 2016-03-10 Lastwall Networks Inc. Method and system for real-time authentication of user access to a resource
US9497624B2 (en) * 2014-10-30 2016-11-15 Alcatel-Lucent Usa Inc. Connectionless wireless access
JP6473228B2 (ja) * 2015-05-25 2019-02-20 オリンパス株式会社 無線通信端末、無線通信システム、無線通信方法、及びプログラム
JP2019004197A (ja) * 2015-11-10 2019-01-10 シャープ株式会社 端末装置、ｃ−ｓｇｎおよび通信制御方法
JP2019009480A (ja) * 2015-11-10 2019-01-17 シャープ株式会社 端末装置、ｃ−ｓｇｎおよび通信制御方法
JP2019009481A (ja) * 2015-11-10 2019-01-17 シャープ株式会社 端末装置、ｃ−ｓｇｎおよび通信制御方法
EP3407666B1 (en) * 2016-01-19 2022-08-31 LG Electronics Inc. Method for resuming connection in wireless communication system and device for same
US11343673B2 (en) * 2016-07-14 2022-05-24 Telefonaktiebolaget Lm Ericsson (Publ) Enhanced aggregated re-authentication for wireless devices

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1771718A (zh) * 2003-02-10 2006-05-10 弗拉里奥恩技术公司 用于在无线通信系统内使用的安全方法
CN101588580A (zh) * 2009-06-30 2009-11-25 华为技术有限公司 一种用户接入控制方法、家庭基站网关及系统
CN102625306A (zh) * 2011-01-31 2012-08-01 电信科学技术研究院 认证方法、系统和设备
CN102149164A (zh) * 2011-03-28 2011-08-10 上海华为技术有限公司 一种业务数据的传送、发送方法和相关装置
WO2016021817A1 (ko) * 2014-08-04 2016-02-11 엘지전자 주식회사 무선 통신 시스템에서 단말을 인증 하는 방법 및 이를 위한 장치
CN105391803A (zh) * 2015-12-15 2016-03-09 腾讯科技（深圳）有限公司 消息推送方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3528522A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021147053A1 (zh) * 2020-01-22 2021-07-29 华为技术有限公司 数据传输方法、装置及系统

Also Published As

Publication number Publication date
EP3528522B1 (en) 2021-03-31
CN108076461B (zh) 2020-09-18
US10869197B2 (en) 2020-12-15
US20190274041A1 (en) 2019-09-05
CN108076461A (zh) 2018-05-25
EP3528522A4 (en) 2019-09-18
EP3528522A1 (en) 2019-08-21

Similar Documents

Publication Publication Date Title
WO2018090986A1 (zh) 一种鉴权方法、基站、用户设备和核心网网元
WO2018126534A1 (zh) 授权验证方法和装置
US9184977B2 (en) System for controlling access to device-to-device communication services in wireless network
US9942210B2 (en) Key derivation method and apparatus for local access under control of a cellular network
US11503469B2 (en) User authentication method and apparatus
US20130160101A1 (en) Wireless Communication Systems and Methods
WO2017166221A1 (zh) 无线接入控制方法、装置及系统
WO2018126961A1 (zh) 通信的方法、接入网设备和终端
US11889301B2 (en) Security verification when resuming an RRC connection
WO2019134704A1 (zh) 一种更新密钥的方法及装置
WO2016154884A1 (zh) 通信方法、用户设备和基站
WO2018137152A1 (zh) 短消息传输方法、设备和系统
WO2021203891A1 (zh) 控制网络切片认证的方法、装置、设备及存储介质
WO2017054183A1 (zh) 业务承载拥塞控制的方法及设备
CN116723507B (zh) 针对边缘网络的终端安全方法及装置
EP3228108B1 (en) Method, computer program and network node for ensuring security of service requests
WO2018201366A1 (zh) 寻呼方法和设备
WO2011044815A1 (zh) 具有优先级的业务实现方法、MSC/VLR、MME和eNodeB
WO2022022710A1 (zh) 切换方法、装置及通信设备
WO2023125604A1 (zh) 一种通信方法及装置
WO2023122889A1 (zh) 一种通信处理方法及装置、终端设备、接入网设备
CN115884187A (zh) 消息传输方法及通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17871597

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017871597

Country of ref document: EP

Effective date: 20190513