WO2019095746A1 - 拒绝接入方法、装置及系统、存储介质和处理器 - Google Patents

拒绝接入方法、装置及系统、存储介质和处理器 Download PDF

Info

Publication number
WO2019095746A1
WO2019095746A1 PCT/CN2018/099811 CN2018099811W WO2019095746A1 WO 2019095746 A1 WO2019095746 A1 WO 2019095746A1 CN 2018099811 W CN2018099811 W CN 2018099811W WO 2019095746 A1 WO2019095746 A1 WO 2019095746A1
Authority
WO
WIPO (PCT)
Prior art keywords
base station
terminal
access
message
access message
Prior art date
Application number
PCT/CN2018/099811
Other languages
English (en)
French (fr)
Inventor
谢振华
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to KR1020207017196A priority Critical patent/KR102344352B1/ko
Priority to RU2020119750A priority patent/RU2746890C1/ru
Priority to EP18877661.1A priority patent/EP3713273A4/en
Priority to CA3082504A priority patent/CA3082504C/en
Priority to JP2020526952A priority patent/JP7045455B2/ja
Publication of WO2019095746A1 publication Critical patent/WO2019095746A1/zh
Priority to US16/874,515 priority patent/US11516727B2/en
Priority to US17/994,733 priority patent/US11716673B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/18—Management of setup rejection or failure
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H04W48/06—Access restriction performed under specific conditions based on traffic conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/19—Connection re-establishment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W92/00—Interfaces specially adapted for wireless communication networks
    • H04W92/16—Interfaces between hierarchically similar devices
    • H04W92/20—Interfaces between hierarchically similar devices between access points

Definitions

  • the present application relates to the field of communications, and in particular, to a denial access method, apparatus and system, computer storage medium and processor.
  • FIG. 1 is a schematic diagram of a process for denying access in the related art according to the present invention.
  • the base station system is configured to establish a wireless connection with the terminal, so that the terminal can access the mobile network, and the process of the solution includes the following steps:
  • Step 101 The terminal (UE) accesses the wireless mobile network through the A base station system (such as gNB, or eNB1).
  • the A base station system retains the UE-related security information, including the key, and then the UE enters an inactive state.
  • the UE and the A base station system still retain the information for communication, including the security information, but release the wireless connection resources;
  • Step 102 The terminal wants to resume the access to the mobile network at a certain time, but the UE may move to the coverage of the B base station system, and the UE sends a recovery access request to the B base station system, for example, sending an RRC Resume Request message;
  • Step 103 The B base station system receives the recovery access request, and hopes that the terminal tries to resume the access again after waiting for a period of time, and then sends a reject access message to the UE, for example, sends a Reject message.
  • the illegal base station may also send a denial of access message to the terminal, so that the terminal cannot always access the network, and even the illegal base station sends the short waiting time information to make the terminal frequent.
  • the transmission resumes the access request and is rejected, causing the terminal to run out of power.
  • the embodiments of the present invention provide a method, a device, and a system for refusing access, a computer storage medium, and a processor, to at least solve the technical problem that the terminal cannot perform the validity check on the denied access message in the related art.
  • a method for denying access includes: receiving, by a first base station, an access request of a terminal; and sending, by the first base station, a reject access message to the terminal;
  • the incoming message carries at least: a check value generated based on the key of the terminal and at least part of the content of the denied access message.
  • another method for denying access including: a terminal sending an access request to a first base station; and receiving, by the terminal, a reject access message fed back by the first base station;
  • the denial of access message carries at least: a check value generated based on a key of the terminal and at least part of the content of the denial of access message.
  • a method for denying access including: receiving, by a second base station, a request message for a terminal from a first base station; and sending, by the second base station, a response message to the first base station;
  • the request message carries part or all of the content of the denied access message for the terminal, where the response message carries a part generated based on the key and part or all of the content of the denied access message. Said check value.
  • a denial access device which is applied to a first base station, and includes: a first receiving module configured to receive an access request of the terminal; and a first sending module configured to The terminal sends a reject access message, where the reject access message carries at least: a check value generated based on the key of the terminal and at least part of the content of the denied access message.
  • a denial access device which is applied to a terminal, and includes: a sending module configured to send an access request to the first base station; and a receiving module configured to receive the first base station feedback Denying the access message; wherein the reject access message carries at least: a check value generated based on a key of the terminal and at least part of the content of the denied access message.
  • a deny access device which is applied to a second base station, and includes: a receiving module configured to receive a request message for a terminal from a first base station; and a sending module configured to The first base station sends a response message, where the request message carries: part or all of the content of the denied access message for the terminal, wherein the response message carries the key based on the key and the denied access message The check value generated by at least part of the content.
  • a denial access system including a first base station and a terminal;
  • the terminal is configured to send an access request
  • the first base station is configured to receive an access request, and send a reject access message based on the access request;
  • the terminal is configured to receive the denied access message
  • the denial of access message carries at least: a check value generated based on a key of the terminal and at least part of the content of the denial of access message.
  • a first storage medium comprising a stored program, the program running to perform the aforementioned denial access method applied to the first base station.
  • a second storage medium comprising a stored program that executes the aforementioned denial access method applied to the terminal while the program is running.
  • a third storage medium comprising a stored program, the program running to perform the aforementioned denial access method applied to the second base station.
  • a first processor for running a program, the program running to perform the aforementioned denial access method applied to the first base station.
  • a second processor for running a program, the program running to perform the aforementioned denial access method applied to the terminal.
  • a third processor for running a program, the program running to perform the aforementioned denial access method applied to the second base station.
  • the terminal can use the check-in value generated by the terminal based on the key of the terminal and the partial content or the entire content of the denied access message in the reject access message.
  • the check value is checked for validity to determine the legality of the transmitting base station, and the technical problem that the terminal cannot verify the validity of the denied access message in the related art is solved, and the security of interaction between the base station and the terminal is improved.
  • FIG. 2 is a flow chart of a method for denying access according to an embodiment of the present invention
  • FIG. 3 is a flow chart of another method for denying access according to an embodiment of the present invention.
  • FIG. 4 is a structural block diagram of a denial access device according to an embodiment of the present invention.
  • FIG. 5 is a structural block diagram of another denial access device according to an embodiment of the present invention.
  • FIG. 6 is a structural block diagram of a denial access system according to an embodiment of the present invention.
  • FIG. 7 is a schematic flowchart 1 of a method for denying access according to an embodiment of the present invention.
  • FIG. 8 is a second schematic flowchart of a method for denying access according to an embodiment of the present invention.
  • FIG. 9 is a schematic flowchart 3 of a method for denying access according to an embodiment of the present invention.
  • the network architecture in the embodiment of the present application includes: a base station and a terminal; wherein the base station interacts with the terminal.
  • FIG. 2 is a flowchart of a method for denying access according to an embodiment of the present invention. As shown in FIG. 2, the process includes the following steps. :
  • Step S202 The first base station receives an access request of the terminal.
  • Step S204 The first base station sends a reject access message to the terminal, where the reject access message carries at least: a check value generated based on the terminal's key and at least part of the content of the denied access message.
  • the terminal can use the check value to check the validity of the rejecting access message to determine the legitimacy of the transmitting base station, and solve the problem that the terminal cannot be related in the related art.
  • the technical problem of verifying the legality of denying access messages improves the security of interaction between the base station and the terminal.
  • the execution body of the foregoing steps may be a base station, such as gNB, eNB, NB, etc., but is not limited thereto.
  • the deny access request may further carry: a waiting time for indicating that the terminal attempts to access next time.
  • the method in this embodiment further includes acquiring the check value, which can be obtained and obtained in the following manner.
  • the method further includes:
  • the first base station sends a request message to the second base station, where the request message carries part or all of the content of the denied access message.
  • the first base station receives a response message for the request message that is fed back by the second base station, where the response message carries a check value generated based on at least part of the content of the key and the denied access message.
  • a check value generated based on at least part of the content of the key and the denied access message.
  • the Hash-based Message Authentication Code-Secure Hash Algorithm-256 (Hash-based Message Authentication Code-Secure Hash Algorithm-256) is used as a parameter for the key and the waiting time.
  • the value of the HMAC-SHA-256 function, or the value of the SHA-256 (Secure Hash Function) function by splicing the key and the waiting attempt time into a string.
  • the method before the first base station sends the reject access message to the terminal, the method further includes:
  • the first base station sends a security information request to the second base station.
  • the first base station receives a security information response that is sent by the second base station, where the security information response carries the key.
  • the first base station generates a check value according to at least part of the content of the key and the denied access message.
  • checksums also called tokens
  • This type of hash algorithm maps the input value to a fixed-length value, and the probability of collision is very low, that is, the possibility that different inputs get the same output is very low, so that by comparison The output value can determine whether the input values are the same.
  • the terminal rejects the access message.
  • the second base station releases the connection with the terminal before the terminal sends the access request to the first base station.
  • the second base station saves related information of the terminal, such as a key.
  • FIG. 3 is a flowchart of another method for denying access according to an embodiment of the present invention. As shown in FIG. 3, the process includes The following steps:
  • Step S302 the terminal sends an access request to the first base station.
  • Step S304 The terminal receives the reject access message fed back by the first base station, where the reject access message carries at least: a check value generated based on the terminal key and at least part of the content of the reject access message.
  • the method further includes:
  • the terminal calculates a check value according to at least part of a content of the key and the denied access message.
  • the embodiment further provides a method for denying access, comprising: receiving, by the second base station, a request message for the terminal from the first base station; and sending, by the second base station, a response message to the first base station, where the request message carries: Rejecting part or all of the content of the access message, wherein the response message carries a check value generated based on at least part of the content of the key and the denied access message.
  • the second base station releases the connection with the terminal before receiving the request message from the first base station.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.
  • a refusal access device and a system are provided to implement the foregoing embodiments and preferred embodiments, which are not described again.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 4 is a structural block diagram of a denial-access device according to an embodiment of the present invention, which is applied to a first base station, as shown in FIG. 4, the device includes:
  • the first receiving module 40 is configured to receive an access request of the terminal
  • the first sending module 42 is configured to send a reject access message to the terminal
  • the reject access message carries: a check value generated based on the terminal's key and at least part of the content of the denied access message.
  • the device further includes: a second sending module, configured to send a request message to the second base station before the first sending module 42 sends the reject access message to the terminal, where the request message carries the part that rejects the access message or all content;
  • the second receiving module is configured to receive a response message fed back by the second base station, where the response message carries a check value generated based on the key and part or all of the content of the denied access message.
  • the device further includes: a third sending module, configured to send a security information request to the second base station before the first sending module 42 sends the reject access message to the terminal;
  • the third receiving module is configured to receive a security information response fed back by the second base station, where the security information response carries the key;
  • a generating module configured to generate a check value based on part or all of the key and the denied access message.
  • the first sending module is further configured to: when the first base station has at least one of the following conditions, send a reject access message to the terminal: the current congestion coefficient is greater than the first threshold, and the number of currently accessed terminals is greater than the second Threshold.
  • FIG. 5 is a structural block diagram of another device for denying access according to an embodiment of the present invention, which is applied to a terminal, and includes:
  • the sending module 50 is configured to send an access request to the first base station
  • the receiving module 52 is configured to receive a reject access message fed back by the first base station
  • the reject access message carries: a check value generated based on the terminal's key and at least part of the content (partial content or all content) of the denied access message.
  • the device further includes: a calculation module, configured to: after the receiving module 52 receives the reject access message fed back by the first base station, calculate a check value according to the partial content or the entire content of the key and the denied access message;
  • the processing module is configured to accept the reject access message when the calculated check value is the same as the received check value, and discard the denied access when the calculated check value is different from the received check value. Message.
  • the embodiment further provides a denial access device, which is applied to the second base station, and includes:
  • a receiving module configured to receive a request message for the terminal from the first base station, where the request message carries: part or all of the content of the deny access message for the terminal; and the sending module is configured to send a response message to the first base station, where The response message carries a check value generated based on the key and at least part of the content (some or all of the content) of the denied access message.
  • FIG. 6 is a structural block diagram of a denial access system, including a first base station 60 and a terminal 62, according to an embodiment of the present invention.
  • the terminal 62 is configured to send an access request.
  • the first base station 60 is configured to receive an access request and send a reject access message
  • the terminal 62 is configured to receive the reject access message fed back by the first base station 60.
  • the reject access message carries at least: a check value generated based on the terminal's key and at least part of the content of the denied access message.
  • the first base station 60 includes:
  • the first receiving module 600 is configured to receive an access request sent by the terminal, specifically the second sending module 620.
  • the first sending module 602 is configured to send a reject access message to the terminal, specifically the second receiving module 622.
  • Terminal 62 includes:
  • the second sending module 620 is configured to send an access request to the first base station 60, specifically the first receiving module 600.
  • the second receiving module 622 is configured to receive a reject access message fed back by the first base station, specifically the first sending module 602.
  • the reject access message carries: a check value generated based on the terminal's key and at least part of the content (partial content or all content) of the denied access message.
  • the system further includes a second base station, where the second base station includes: a third receiving module configured to receive a request message for the terminal from the first base station; and a third sending module configured to send a response to the first base station a message; wherein the request message carries: part or all of the content of the reject access message for the terminal, wherein the response message carries a check value generated based on the key and part or all of the content of the denied access message.
  • the first base station 60 and terminal 62 may also include one or more devices included in the above.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination.
  • the forms are located in different processors.
  • This embodiment is an optional embodiment according to the present application, and is described in detail in conjunction with specific embodiments.
  • the embodiment provides a related method for rejecting access of an inactive terminal.
  • FIG. 7 is a schematic flowchart 1 of a method for denying access according to an embodiment of the present invention. As shown in FIG. 7, the process includes:
  • Steps 201 to 202 the same as steps 101 to 102 of FIG. 1;
  • Step 203 The B base station system receives the recovery access request. Because of congestion, etc., the terminal is expected to wait for a period of time before attempting to resume the access again, and then sends an unserviceable request to the A base station system, for example, sending a Service Deny Request message. , carrying waiting time information, such as wait timer;
  • Step 204 The A base station system calculates the token based on the key associated with the UE and the waiting time, for example, calculating the value of the HMAC-SHA-256 function by using the key and the waiting attempt time as parameters, or splicing the key and the waiting attempt time. Calculate the value of its SHA-256 function for a string;
  • Step 205 The A base station system sends an unserviceable response to the B base station system, for example, sending a Service Deny Response message, carrying the waiting time information and the calculated token;
  • Step 206 The B base station system sends a reject access message to the UE, for example, sends a Reject message, carries the received waiting time information and the token, and the terminal calculates the token by using the same calculation method, and compares the calculated token with the received token. Whether the tokens are the same, if they are the same, the denial of access message is accepted, otherwise it is not accepted, such as discarding the message.
  • FIG. 8 is a second schematic flowchart of a method for denying access according to an embodiment of the present invention. As shown in FIG. 8, the process includes:
  • Steps 301 to 302 the same as steps 101 to 102 of FIG. 1;
  • Step 303 The B-base station system receives the re-establishment of the access request, and the terminal is expected to re-recover the access after waiting for a period of time, and then sends a security information request to the A-base station system, for example, sending a Security Info Request message;
  • Step 304 The A base station system sends a security information response to the B base station system, for example, sends a Security Info Response message, and carries security information related to the UE, including a key.
  • Step 305 The B base station system calculates the token based on the key associated with the UE and the waiting time, for example, calculating the value of the HMAC-SHA-256 function by using the key and the waiting attempt time as parameters, or splicing the key and the waiting attempt time. Calculate the value of its SHA-256 function for a string;
  • Step 306 The B base station system sends a reject access message to the UE, for example, sends a Reject message, carries the waiting time information and the token, and the terminal calculates the token by using the same calculation method, and compares the calculated token with the received token. Whether they are the same, if they are the same, the reject access message is accepted, otherwise it is not accepted, such as discarding the message.
  • FIG. 9 is a third schematic flowchart of a method for denying access according to an embodiment of the present invention. As shown in FIG. 9, the process includes:
  • Steps 401 to 402 the same as steps 101 to 102 of FIG. 1;
  • Step 403 The B-base station system receives the re-establishment of the access request, and the terminal is expected to re-recover the access after waiting for a period of time, and then sends a forwarding request to the A-base station system, for example, sending a Forward Request message, carrying B. a reject access message to be sent by the base station to the UE, such as a Reject message, the reject access message carrying waiting time information, such as a wait timer;
  • Step 404 The A base station system calculates a message check code based on the key associated with the UE and the reject access message, for example, calculating the value of the HMAC-SHA-256 function by using the content of the key and the reject access message as parameters;
  • Step 405 The A base station system sends a forwarding response to the B base station system, for example, sends a Forward Response message, and carries the processed denied access message, that is, the rejected access message carries the message check code.
  • Step 406 The B base station system sends a reject access message to the UE, and the terminal calculates the message check code by using the same calculation method of the A base station, and compares whether the calculated message check code and the received message check code are the same.
  • the reject access message is accepted, otherwise it is not accepted, such as discarding the message.
  • Embodiments of the present invention also provide three types of computer storage media including respective stored programs.
  • the program stored in the first type of computer storage medium executes the aforementioned denial access method applied to the first base station while the program stored in the second type of computer storage medium executes the aforementioned rejection applied to the terminal The access method; the program stored in the third computer storage medium executes the aforementioned denial access method applied to the second base station while the program is running.
  • the foregoing storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • Embodiments of the present invention also provide three processors, each for each to run a program.
  • the first processor performs the foregoing denial access method applied to the first base station when running the program stored in the first storage medium.
  • the second processor performs the aforementioned denial access method applied to the terminal when running the program stored in the second storage medium.
  • the third processor executes the aforementioned denial access method applied to the second base station while running the program stored in the third storage medium.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.
  • the terminal may receive the reject access message by using the check key generated by the terminal based on the key of the terminal and the partial or all content of the denied access message.
  • the check value is checked for validity to determine the legality of the transmitting base station, and the technical problem that the terminal cannot verify the validity of the denied access message in the related art is solved, and the security of interaction between the base station and the terminal is improved.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明实施例公开了一种拒绝接入方法、装置及系统，其中方法包括：第一基站接收终端的接入请求；所述第一基站向所述终端发送拒绝接入消息；其中，所述拒绝接入消息至少携带：基于所述终端的密钥和所述拒绝接入消息的至少部分内容生成的校验值。还公开了相关计算机存储介质和处理器。

Description

拒绝接入方法、装置及系统、存储介质和处理器
相关申请的交叉引用
本申请基于申请号为201711144738.5、申请日为2017年11月17日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的内容在此以引入方式并入本申请。
技术领域
本申请涉及通信领域，具体而言，涉及一种拒绝接入方法、装置及系统、计算机存储介质和处理器。
背景技术
第三代合作伙伴计划(3GPP，3rd Generation Partnership Project)提出了一种拒绝非激活态终端接入的方案，如图1所示，图1为本发明相关技术中拒绝接入的流程示意图，其中，基站系统用于与终端建立无线连接，从而使得终端可以接入移动网络，该方案的流程包括如下步骤：
步骤101：终端(UE)曾通过A基站系统(比如gNB，或eNB1)接入无线移动网络，A基站系统保留有UE相关的安全信息，包括密钥，而后UE进入非激活状态，在该状态下，UE和A基站系统仍旧会保留通讯用的信息，包括安全信息，但都将无线连接资源释放；
步骤102：终端某个时候希望重新恢复接入移动网络，但UE可能移动到了B基站系统的覆盖之下，UE向B基站系统发送恢复接入请求，比如发送RRC Resume Request消息；
步骤103：B基站系统接收到恢复接入请求，希望终端在等待一段时间后再尝试重新恢复接入，于是向UE发送拒绝接入消息，比如发送Reject消息。
相关技术中，如果由于Reject消息没有任何安全保护，非法基站也可以发送拒绝接入消息给终端，从而使终端始终无法接入网络，甚至非法基站通过发送很短的等待尝试时间信息，使得终端频繁发送恢复接入请求并被拒绝，导致终端电力耗尽。
针对相关技术中存在的上述问题，目前尚未发现有效的解决方案。
发明内容
本发明实施例提供了一种拒绝接入方法、装置及系统、计算机存储介质和处理器，以至少解决相关技术中终端无法对拒绝接入消息进行合法性校验的技术问题。
根据本发明的一个实施例，提供了一种拒绝接入方法，包括：第一基站接收终端的接入请求；所述第一基站向所述终端发送拒绝接入消息；其中，所述拒绝接入消息至少携带：基于所述终端的密钥和所述拒绝接入消息的至少部分内容生成的校验值。
根据本发明的一个实施例，提供了另一种拒绝接入方法，包括：终端向第一基站发送接入请求；所述终端接收所述第一基站反馈的拒绝接入消息；其中，所述拒绝接入消息至少携带：基于所述终端的密钥和所述拒绝接入消息的至少部分内容生成的校验值。
根据本发明的一个实施例，提供了又一种拒绝接入方法，包括：第二基站接收来自第一基站的针对终端的请求消息；所述第二基站向所述第一基站发送响应消息；其中，所述请求消息携带：针对所述终端的拒绝接入消息的部分或全部内容，其中，所述响应消息携带基于所述密钥和所述拒绝接入消息的部分或全部内容生成的所述校验值。
根据本发明的另一个实施例，提供了一种拒绝接入装置，应用在第一基站，包括：第一接收模块，配置为接收终端的接入请求；第一发送模块，配置为向所述终端发送拒绝接入消息；其中，所述拒绝接入消息至少携带： 基于所述终端的密钥和所述拒绝接入消息的至少部分内容生成的校验值。
根据本发明的另一个实施例，提供了一种拒绝接入装置，应用在终端，包括：发送模块，配置为向第一基站发送接入请求；接收模块，配置为接收所述第一基站反馈的拒绝接入消息；其中，所述拒绝接入消息至少携带：基于所述终端的密钥和所述拒绝接入消息的至少部分内容生成的校验值。
根据本发明的另一个实施例，提供了一种拒绝接入装置，应用在第二基站，包括：接收模块，配置为接收来自第一基站的针对终端的请求消息；发送模块，配置为向所述第一基站发送响应消息；其中，所述请求消息携带：针对所述终端的拒绝接入消息的部分或全部内容，其中，所述响应消息携带基于所述密钥和所述拒绝接入消息的至少部分内容生成的所述校验值。
根据本发明的又一个实施例，提供了一种拒绝接入系统，包括第一基站及终端；其中，
所述终端，配置为发送接入请求；
所述第一基站，配置为接收接入请求，并发送基于所述接入请求的拒绝接入消息；
所述终端，配置为接收所述拒绝接入消息；
其中，所述拒绝接入消息至少携带：基于所述终端的密钥和所述拒绝接入消息的至少部分内容生成的校验值。
根据本发明的又一个实施例，还提供了第一种存储介质，所述存储介质包括存储的程序，所述程序运行时执行前述应用于第一基站中的拒绝接入方法。
根据本发明的又一个实施例，还提供了第二种存储介质，所述存储介质包括存储的程序，所述程序运行时执行前述应用于终端中的拒绝接入方法。
根据本发明的又一个实施例，还提供了第三种存储介质，所述存储介质包括存储的程序，所述程序运行时执行前述应用于第二基站中的拒绝接入方法。
根据本发明的又一个实施例，还提供了第一种处理器，所述处理器用于运行程序，所述程序运行时执行前述应用于第一基站中的拒绝接入方法。
根据本发明的又一个实施例，还提供了第二种处理器，所述处理器用于运行程序，所述程序运行时执行前述应用于终端中的拒绝接入方法。
根据本发明的又一个实施例，还提供了第三种处理器，所述处理器用于运行程序，所述程序运行时执行前述应用于第二基站中的拒绝接入方法。
通过本发明实施例，通过在拒绝接入消息中携带基于所述终端的密钥和所述拒绝接入消息的部分内容或全部内容生成的校验值，终端在接收到拒绝接入消息可以使用校验值进行合法性校验，以确定发送基站的合法性，解决了相关技术中终端无法对拒绝接入消息进行合法性校验的技术问题，提高了基站与终端间交互的安全性。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1为本发明相关技术中拒绝接入的流程示意图；
图2是根据本发明实施例的一种拒绝接入方法的流程图；
图3是根据本发明实施例的另一种拒绝接入方法的流程图；
图4是根据本发明实施例的一种拒绝接入装置的结构框图；
图5是根据本发明实施例的另一种拒绝接入装置的结构框图；
图6是根据本发明实施例的拒绝接入系统的结构框图；
图7为本发明实施例的拒绝接入方法的流程示意图一；
图8为本发明实施例的拒绝接入方法的流程示意图二；
图9为本发明实施例的拒绝接入方法的流程示意图三。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
实施例1
本申请实施例运行的网络架构包括：基站、终端；其中，基站与终端之间进行交互。
在本实施例中提供了一种运行于上述网络架构的拒绝接入方法，图2是根据本发明实施例的一种拒绝接入方法的流程图，如图2所示，该流程包括如下步骤：
步骤S202，第一基站接收终端的接入请求；
步骤S204，第一基站向终端发送拒绝接入消息；其中，所述拒绝接入消息至少携带：基于终端的密钥和拒绝接入消息的至少部分内容生成的校验值。
本领域技术人员应该理解：所述拒绝接入消息的至少部分内容可以为拒绝接入消息的部分内容或全部内容。
通过上述步骤，通过在拒绝接入消息中携带校验值，终端在接收到拒绝接入消息可以使用校验值进行合法性校验，以确定发送基站的合法性，解决了相关技术中终端无法对拒绝接入消息进行合法性校验的技术问题， 提高了基站与终端间交互的安全性。
可选地，上述步骤的执行主体可以为基站，如gNB，eNB，NB等，但不限于此。
可选的，拒绝接入请求还可以携带：用于指示所述终端下次尝试接入的等待时间。
可选地，本实施例的方法还包括获取该校验值，可以通过以下方式获取和得到。
在第一基站向终端发送拒绝接入消息之前，方法还包括：
S11，第一基站向第二基站发送请求消息，其中，请求消息携带拒绝接入消息的部分或全部内容；
S12，第一基站接收第二基站反馈的针对所述请求消息的响应消息，其中，响应消息携带基于密钥和拒绝接入消息的至少部分内容生成的校验值。生成校验值的方式可以有多种，比如以密钥和等待尝试时间为参数计算哈希消息认证码-安全散列算法-256(Hash-based Message Authentication Code-Secure Hash Algorithm-256，简称为HMAC-SHA-256函数的值，或将密钥和等待尝试时间拼接为一个字符串计算其SHA-256(安全哈什函数)函数的值。
作为另一种方式，在第一基站向终端发送拒绝接入消息之前，方法还包括：
S21，第一基站向第二基站发送安全信息请求；
S22，第一基站接收第二基站反馈的安全信息响应，其中，安全信息响应携带密钥；
S23，第一基站根据密钥和拒绝接入消息的至少部分内容生成校验值。生成校验值(也叫令牌)的方式可以有多种，比如以密钥和等待尝试时间为参数计算HMAC-SHA-256函数的值，或将密钥和等待尝试时间拼接为一 个字符串计算其SHA-256函数的值，这类Hash算法可将输入值映射为一个固定长度的值，且发生冲突的可能性非常低，即不同输入得到相同输出的可能性非常低，从而使得通过比较输出值可以判断输入值是否相同。
可选的，在第一基站当前拥塞系数大于第一阈值，和/或，当前已接入的终端的数量大于第二阈值时，向终端发送拒绝接入消息。
在本实施例中，第二基站在终端向第一基站发送接入请求之前，释放与终端的连接。在终端接入到第二基站时，第二基站保存了终端的相关信息，如密钥等。
在本实施例中提供了另一种运行于上述网络架构的拒绝接入方法，图3是根据本发明实施例的另一种拒绝接入方法的流程图，如图3所示，该流程包括如下步骤：
步骤S302，终端向第一基站发送接入请求；
步骤S304，终端接收第一基站反馈的拒绝接入消息；其中，拒绝接入消息至少携带：基于终端的密钥和拒绝接入消息的至少部分内容生成的校验值。
可选的，在终端接收第一基站反馈的拒绝接入消息之后，方法还包括：
S31，终端根据密钥和拒绝接入消息的至少部分内容计算得到校验值；
S32，在计算得到的校验值与接收到的校验值相同时，接受拒绝接入消息，在计算得到的校验值与接收到的校验值不相同时，丢弃拒绝接入消息。密钥可以预先预置在终端内。
本实施例还提供了一种拒绝接入方法，包括：第二基站接收来自第一基站的针对终端的请求消息；第二基站向第一基站发送响应消息；其中，请求消息携带：针对终端的拒绝接入消息的部分或全部内容，其中，响应消息携带基于密钥和拒绝接入消息的至少部分内容生成的校验值。
可选的，第二基站在接收来自第一基站的请求消息之前，释放与终端 的连接。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
实施例2
在本实施例中还提供了一种拒绝接入装置和系统，用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图4是根据本发明实施例的一种拒绝接入装置的结构框图，应用在第一基站，如图4所示，该装置包括：
第一接收模块40，配置为接收终端的接入请求；
第一发送模块42，配置为向终端发送拒绝接入消息；
其中，拒绝接入消息携带：基于终端的密钥和拒绝接入消息的至少部分内容生成的校验值。
可选的，装置还包括：第二发送模块，配置为在第一发送模块42向终端发送拒绝接入消息之前，向第二基站发送请求消息，其中，请求消息携带拒绝接入消息的部分或全部内容；
相应地，第二接收模块，配置为接收第二基站反馈的响应消息，其中， 响应消息携带基于密钥和拒绝接入消息的部分或全部内容生成的校验值。
可选的，装置还包括：第三发送模块，配置为在第一发送模块42向终端发送拒绝接入消息之前，向第二基站发送安全信息请求；
相应地，第三接收模块，配置为接收第二基站反馈的安全信息响应，其中，安全信息响应携带密钥；
生成模块，配置为根据密钥和拒绝接入消息的部分或全部内容生成校验值。
可选的，第一发送模块，还配置为在第一基站具备以下条件至少之一时，向终端发送拒绝接入消息：当前拥塞系数大于第一阈值，当前已接入的终端的数量大于第二阈值。
图5是根据本发明实施例的另一种拒绝接入装置的结构框图，应用在终端中，包括：
发送模块50，配置为向第一基站发送接入请求；
接收模块52，配置为接收第一基站反馈的拒绝接入消息；
其中，拒绝接入消息携带：基于终端的密钥和拒绝接入消息的至少部分内容(部分内容或全部内容)生成的校验值。
装置还包括：计算模块，配置为在接收模块52接收第一基站反馈的拒绝接入消息之后，根据密钥和拒绝接入消息的部分内容或全部内容计算得到校验值；
处理模块，配置为在计算得到的校验值与接收到的校验值相同时，接受拒绝接入消息，在计算得到的校验值与接收到的校验值不相同时，丢弃拒绝接入消息。
本实施例还提供了一种拒绝接入装置，应用在第二基站，包括：
接收模块，配置为接收来自第一基站的针对终端的请求消息，其中请求消息携带：针对终端的拒绝接入消息的部分或全部内容；发送模块，配 置为向第一基站发送响应消息；其中，响应消息携带基于密钥和拒绝接入消息的至少部分内容(部分或全部内容)生成的校验值。
图6是根据本发明实施例的拒绝接入系统的结构框图，包括第一基站60和终端62。
其中，
终端62，配置为发送接入请求；
第一基站60，配置为接收接入请求，发送拒绝接入消息；
终端62，配置为接收第一基站60反馈的拒绝接入消息；其中，拒绝接入消息至少携带：基于终端的密钥和拒绝接入消息的至少部分内容生成的校验值。
在一个可选的实施例中，第一基站60包括：
第一接收模块600，配置为接收终端、具体是第二发送模块620发送的接入请求；
第一发送模块602，配置为向终端、具体是第二接收模块622发送拒绝接入消息；
终端62包括：
第二发送模块620，配置为向第一基站60、具体是第一接收模块600发送接入请求；
第二接收模块622，配置为接收第一基站、具体是第一发送模块602反馈的拒绝接入消息；
其中，拒绝接入消息携带：基于终端的密钥和拒绝接入消息的至少部分内容(部分内容或全部内容)生成的校验值。
可选的，系统还包括第二基站，其中，第二基站包括：第三接收模块，配置为接收来自第一基站的针对终端的请求消息；第三发送模块，配置为向第一基站发送响应消息；其中，请求消息携带：针对终端的拒绝接入消 息的部分或全部内容，其中，响应消息携带基于密钥和拒绝接入消息的部分或全部内容生成的校验值。
第一基站60和终端62还可以包括上述内容所包括的一个或多个装置。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
实施例3
本实施例是根据本申请的可选实施例，用于结合具体的实施方式进行详细说明。
可以理解，本实施例提供了一种拒绝非激活态终端接入的相关方法。
图7为本发明实施例的拒绝接入方法的流程示意图一，如图7所示，该流程包括：
步骤201～202：与图1的步骤101～102相同；
步骤203：B基站系统接收到恢复接入请求，由于自身拥塞等原因，希望终端在等待一段时间后再尝试重新恢复接入，于是向A基站系统发送无法服务的请求，比如发送Service Deny Request消息，携带等待尝试时间信息，比如wait timer；
步骤204：A基站系统基于与UE相关的密钥及等待尝试时间计算令牌，比如以密钥和等待尝试时间为参数计算HMAC-SHA-256函数的值，或将密钥和等待尝试时间拼接为一个字符串计算其SHA-256函数的值；
步骤205，A基站系统向B基站系统发送无法服务响应，比如发送Service Deny Response消息，携带等待尝试时间信息和计算到的令牌；
步骤206：B基站系统向UE发送拒绝接入消息，比如发送Reject消息，携带收到的等待尝试时间信息和令牌，终端使用相同的计算方法计算令牌，并比较计算的令牌和收到的令牌是否相同，如果相同则接受该拒绝接入消 息，否则不接受，比如丢弃该消息。
图8为本发明实施例的拒绝接入方法的流程示意图二，如图8所示，该流程包括：
步骤301～302：与图1的步骤101～102相同；
步骤303：B基站系统接收到恢复接入请求，由于自身拥塞等原因，希望终端在等待一段时间后再尝试重新恢复接入，于是向A基站系统发送安全信息请求，比如发送Security Info Request消息；
步骤304，A基站系统向B基站系统发送安全信息响应，比如发送Security Info Response消息，携带UE相关的安全信息，包括密钥；
步骤305：B基站系统基于与UE相关的密钥及等待尝试时间计算令牌，比如以密钥和等待尝试时间为参数计算HMAC-SHA-256函数的值，或将密钥和等待尝试时间拼接为一个字符串计算其SHA-256函数的值；
步骤306：B基站系统向UE发送拒绝接入消息，比如发送Reject消息，携带等待尝试时间信息和令牌，终端使用相同的计算方法计算令牌，并比较计算的令牌和收到的令牌是否相同，如果相同则接受该拒绝接入消息，否则不接受，比如丢弃该消息。
图9为本发明实施例的拒绝接入方法的流程示意图三，如图9所示，该流程包括：
步骤401～402：与图1的步骤101～102相同；
步骤403：B基站系统接收到恢复接入请求，由于自身拥塞等原因，希望终端在等待一段时间后再尝试重新恢复接入，于是向A基站系统发送转发请求，比如发送Forward Request消息，携带B基站要发送给UE的拒绝接入消息，比如Reject消息，该拒绝接入消息携带等待尝试时间信息，比如wait timer；
步骤404：A基站系统基于与UE相关的密钥及拒绝接入消息计算消息校验码，比如以密钥和拒绝接入消息的内容为参数计算HMAC-SHA-256函数的值；
步骤405，A基站系统向B基站系统发送转发响应，比如发送Forward Response消息，携带处理过的拒绝接入消息，即该拒绝接入消息携带消息校验码；
步骤406：B基站系统向UE发送拒绝接入消息，终端使用A基站相同的计算方法计算消息校验码，并比较计算的消息校验码和收到的消息校验码是否相同，如果相同则接受该拒绝接入消息，否则不接受，比如丢弃该消息。
实施例4
本发明的实施例还提供了三种计算机存储介质，该三种计算机存储介质包括各自存储的程序。其中，第一种计算机存储介质中存储的程序运行时执行前述的应用于第一基站中的拒绝接入方法；第二种计算机存储介质中存储的程序运行时执行前述的应用于终端中的拒绝接入方法；第三种计算机存储介质中存储的程序运行时执行前述的应用于第二基站中的拒绝接入方法。
在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
本发明的实施例还提供了三种处理器，每种处理器用于各自运行程序。其中，第一种处理器在运行第一种存储介质存储的程序时执行前述的应用于第一基站中的拒绝接入方法。第二种处理器在运行第二种存储介质存储的程序时执行前述的应用于终端中的拒绝接入方法。第三种处理器在运行 第三种存储介质存储的程序时执行前述的应用于第二基站中的拒绝接入方法。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用硬件实施例、软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、 嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
以上所述，仅为本发明的较佳实施例而已，并非用于限定本发明的保护范围。
工业实用性
本发明实施例中，通过在拒绝接入消息中携带基于所述终端的密钥和所述拒绝接入消息的部分内容或全部内容生成的校验值，终端在接收到拒绝接入消息可以使用校验值进行合法性校验，以确定发送基站的合法性，解决了相关技术中终端无法对拒绝接入消息进行合法性校验的技术问题，提高了基站与终端间交互的安全性。

Claims (27)

  1. 一种拒绝接入方法，包括：
    第一基站接收终端的接入请求；
    所述第一基站向所述终端发送拒绝接入消息；
    其中，所述拒绝接入消息至少携带：基于所述终端的密钥和所述拒绝接入消息的至少部分内容生成的校验值。
  2. 根据权利要求1所述的方法，其中，在所述第一基站向所述终端发送拒绝接入消息之前，所述方法还包括：
    所述第一基站向第二基站发送请求消息，其中，所述请求消息携带所述拒绝接入消息的部分或全部内容；
    所述第一基站接收所述第二基站反馈的响应消息，其中，所述响应消息携带基于所述密钥和所述拒绝接入消息的至少部分内容生成的所述校验值。
  3. 根据权利要求1所述的方法，其中，在所述第一基站向所述终端发送拒绝接入消息之前，所述方法还包括：
    所述第一基站向第二基站发送安全信息请求；
    所述第一基站接收所述第二基站反馈的安全信息响应，其中，所述安全信息响应携带所述密钥；
    所述第一基站根据所述密钥和所述拒绝接入消息的至少部分内容生成所述校验值。
  4. 根据权利要求1所述的方法，其中，所述第一基站向所述终端发送拒绝接入消息包括：
    在所述第一基站具备以下条件至少之一时，向所述终端发送所述拒绝接入消息：当前拥塞系数大于第一阈值，当前已接入的终端的数量大于第二阈值。
  5. 根据权利要求1所述的方法，其中，所述拒绝接入消息的部分内容包含用于指示所述终端下次尝试接入的等待时间。
  6. 根据权利要求2或3所述的方法，其中，所述第二基站在所述终端向所述第一基站发送所述接入请求之前，释放与所述终端的连接。
  7. 一种拒绝接入方法，包括：
    终端向第一基站发送接入请求；
    所述终端接收所述第一基站反馈的针对所述接入请求的拒绝接入消息；
    其中，所述拒绝接入消息至少携带：基于所述终端的密钥和所述拒绝接入消息的至少部分内容生成的校验值。
  8. 根据权利要求7所述的方法，其中，在所述终端接收所述第一基站反馈的拒绝接入消息之后，所述方法还包括：
    所述终端根据所述密钥和所述拒绝接入消息的至少部分内容计算得到校验值；
    在计算得到的校验值与接收到的校验值相同时，接受所述拒绝接入消息，在计算得到的校验值与接收到的校验值不相同时，丢弃所述拒绝接入消息。
  9. 根据权利要求7所述的方法，其中，所述拒绝接入消息的部分内容包含用于指示所述终端下次尝试接入的等待时间。
  10. 一种拒绝接入方法，其中，包括：
    第二基站接收来自第一基站的针对终端的请求消息；
    所述第二基站向所述第一基站发送响应消息；
    其中，所述请求消息携带：针对所述终端的拒绝接入消息的部分内容或全部内容，其中，所述响应消息携带基于密钥和所述拒绝接入消息至少部分内容生成的校验值。
  11. 根据权利要求10所述的方法，其中，所述拒绝接入消息的部分内容包含用于指示所述终端下次尝试接入的等待时间。
  12. 根据权利要求10所述的方法，其中，所述第二基站在接收来自所述第一基站的所述请求消息之前，释放与所述终端的连接。
  13. 一种拒绝接入装置，应用在第一基站，包括：
    第一接收模块，配置为接收终端的接入请求；
    第一发送模块，配置为向所述终端发送拒绝接入消息；
    其中，所述拒绝接入消息至少携带：基于所述终端的密钥和所述拒绝接入消息的至少部分内容生成的校验值。
  14. 根据权利要求13所述的装置，其中，所述装置还包括：
    第二发送模块，配置为在所述第一发送模块向所述终端发送拒绝接入消息之前，向第二基站发送请求消息，其中，所述请求消息携带所述拒绝接入消息的部分或全部内容；
    第二接收模块，配置为接收所述第二基站反馈的响应消息，其中，所述响应消息携带基于所述密钥和所述拒绝接入消息的部分或全部内容生成的所述校验值。
  15. 根据权利要求13所述的装置，其中，所述装置还包括：
    第三发送模块，配置为在所述第一发送模块向所述终端发送拒绝接入消息之前，向第二基站发送安全信息请求；
    第三接收模块，配置为接收所述第二基站反馈的安全信息响应，其中，所述安全信息响应携带所述密钥；
    生成模块，配置为根据所述密钥和所述拒绝接入消息的部分或全部内容生成所述校验值。
  16. 根据权利要求13所述的装置，其中，所述第一发送模块，还配置为在所述第一基站具备以下条件至少之一时，向所述终端发送所述拒绝 接入消息：当前拥塞系数大于第一阈值，当前已接入的终端的数量大于第二阈值。
  17. 一种拒绝接入装置，应用在终端，包括：
    发送模块，配置为向第一基站发送接入请求；
    接收模块，配置为接收所述第一基站反馈的拒绝接入消息；
    其中，所述拒绝接入消息至少携带：基于所述终端的密钥和所述拒绝接入消息的至少部分内容生成的校验值。
  18. 根据权利要求17所述的装置，其中，所述装置还包括：
    计算模块，配置为在所述接收模块接收所述第一基站反馈的拒绝接入消息之后，根据所述密钥和所述拒绝接入消息的部分内容或全部内容计算得到校验值；
    处理模块，配置为在计算得到的校验值与接收到的校验值相同时，接受所述拒绝接入消息，在计算得到的校验值与接收到的校验值不相同时，丢弃所述拒绝接入消息。
  19. 一种拒绝接入装置，应用在第二基站，包括：
    接收模块，配置为接收来自第一基站的针对终端的请求消息；
    发送模块，配置为向所述第一基站发送响应消息；
    其中，所述请求消息至少携带：针对所述终端的拒绝接入消息的部分或全部内容，其中，所述响应消息携带基于密钥和所述拒绝接入消息的至少部分内容生成的校验值。
  20. 一种拒绝接入系统，包括第一基站及终端；其中，
    所述终端，配置为发送接入请求；
    所述第一基站，配置为接收接入请求，并发送基于所述接入请求的拒绝接入消息；
    所述终端，配置为接收所述拒绝接入消息；
    其中，所述拒绝接入消息至少携带：基于所述终端的密钥和所述拒绝接入消息的至少部分内容生成的校验值。
  21. 根据权利要求20所述的系统，其中，所述系统还包括第二基站，所述第二基站，配置为：
    接收来自第一基站的针对终端的请求消息；
    并向所述第一基站发送针对请求消息的响应消息；
    其中，所述请求消息携带：针对所述终端的拒绝接入消息的部分或全部内容，其中，所述响应消息携带基于所述密钥和所述拒绝接入消息的至少部分内容生成的所述校验值。
  22. 一种存储介质，所述存储介质包括存储的程序，其中，所述程序运行时执行权利要求1至6中任一项所述的方法。
  23. 一种存储介质，所述存储介质包括存储的程序，其中，所述程序运行时执行权利要求7至9中任一项所述的方法。
  24. 一种存储介质，所述存储介质包括存储的程序，其中，所述程序运行时执行权利要求10至12中任一项所述的方法。
  25. 一种处理器，所述处理器用于运行程序，其中，所述程序运行时执行权利要求1至6中任一项所述的方法。
  26. 一种处理器，所述处理器用于运行程序，其中，所述程序运行时执行权利要求7至9中任一项所述的方法。
  27. 一种处理器，所述处理器用于运行程序，其中，所述程序运行时执行权利要求10至12中任一项所述的方法。
PCT/CN2018/099811 2017-11-17 2018-08-10 拒绝接入方法、装置及系统、存储介质和处理器 WO2019095746A1 (zh)

Priority Applications (7)

Application Number Priority Date Filing Date Title
KR1020207017196A KR102344352B1 (ko) 2017-11-17 2018-08-10 액세스 거부 방법, 장치, 및 시스템, 및 저장 매체 및 프로세서
RU2020119750A RU2746890C1 (ru) 2017-11-17 2018-08-10 Способ, устройство и система отклонения доступа, носитель информации и процессор
EP18877661.1A EP3713273A4 (en) 2017-11-17 2018-08-10 METHOD, DEVICE AND SYSTEM FOR REJECTING ACCESS, AND STORAGE MEDIUM AND PROCESSOR
CA3082504A CA3082504C (en) 2017-11-17 2018-08-10 Access rejection method, apparatus and system, and storage medium and processor
JP2020526952A JP7045455B2 (ja) 2017-11-17 2018-08-10 アクセス拒否方法、装置、およびシステム、ならびに記憶媒体およびプロ
US16/874,515 US11516727B2 (en) 2017-11-17 2020-05-14 Access rejection method, apparatus and system, and storage medium and processor
US17/994,733 US11716673B2 (en) 2017-11-17 2022-11-28 Access rejection method, apparatus and system, and storage medium and processor

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711144738.5A CN109803260B (zh) 2017-11-17 2017-11-17 拒绝接入方法、装置及系统
CN201711144738.5 2017-11-17

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/874,515 Continuation US11516727B2 (en) 2017-11-17 2020-05-14 Access rejection method, apparatus and system, and storage medium and processor

Publications (1)

Publication Number Publication Date
WO2019095746A1 true WO2019095746A1 (zh) 2019-05-23

Family

ID=66540026

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/099811 WO2019095746A1 (zh) 2017-11-17 2018-08-10 拒绝接入方法、装置及系统、存储介质和处理器

Country Status (8)

Country Link
US (2) US11516727B2 (zh)
EP (1) EP3713273A4 (zh)
JP (1) JP7045455B2 (zh)
KR (1) KR102344352B1 (zh)
CN (2) CN109803260B (zh)
CA (1) CA3082504C (zh)
RU (1) RU2746890C1 (zh)
WO (1) WO2019095746A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113811022B (zh) * 2021-08-12 2024-03-12 天翼物联科技有限公司 异常终端拒绝方法、系统、装置及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102804829A (zh) * 2009-06-24 2012-11-28 诺基亚公司 用于避免欺骗接入点的拒绝服务攻击的方法和装置
CN107071775A (zh) * 2017-05-15 2017-08-18 奇酷互联网络科技（深圳）有限公司 移动终端及其重定向接入基站的方法和装置
US20170332436A1 (en) * 2016-05-13 2017-11-16 Htc Corporation Device and Method Handling a Radio Resource Control Connection Resume Procedure

Family Cites Families (31)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2340344A (en) * 1998-07-29 2000-02-16 Nokia Mobile Phones Ltd Bilateral Data Transfer Verification for Programming a Cellular Phone
KR100689508B1 (ko) * 2003-09-04 2007-03-02 삼성전자주식회사 통신 시스템에서 핸드오버 수행 방법
CN101022330A (zh) * 2006-02-13 2007-08-22 华为技术有限公司 提高密钥管理授权消息安全性的方法和模块
KR20080081753A (ko) * 2007-03-06 2008-09-10 한국전자통신연구원 기지국 제어 중심의 멀티홉 릴레이 망에서 트랜스페어런트ｒｓ간 핸드오버 절차
KR100981965B1 (ko) * 2007-11-06 2010-09-13 한국전자통신연구원 이동통신 시스템에서의 인트라 핸드오버 방법
US8086267B2 (en) * 2009-02-19 2011-12-27 Ford Global Technologies, Llc System and method for provisioning a wireless networking connection
CN102342141A (zh) * 2009-03-05 2012-02-01 交互数字专利控股公司 用于H(e)NB完整性验证和确认的方法和装置
CN101951603B (zh) * 2010-10-14 2013-05-22 中国电子科技集团公司第三十研究所 一种无线局域网接入控制方法及系统
US9112905B2 (en) * 2010-10-22 2015-08-18 Qualcomm Incorporated Authentication of access terminal identities in roaming networks
EP2557890B1 (en) * 2011-08-12 2019-07-17 BlackBerry Limited Simplified ue + enb messaging
CN102595561B (zh) * 2012-03-30 2015-04-29 华为技术有限公司 无线资源控制连接重建的方法及终端
CN104685952B (zh) * 2012-10-04 2018-06-08 Lg电子株式会社 在无线通信系统中基于延迟容忍信息处理操作的方法和支持该方法的设备
JP6218166B2 (ja) * 2013-03-04 2017-10-25 国立研究開発法人情報通信研究機構 基地局間ハンドオーバ方法
CN104302011A (zh) * 2013-07-16 2015-01-21 中兴通讯股份有限公司 一种无线资源控制连接重建立的方法、系统及装置
CN103945358B (zh) * 2014-04-17 2017-10-27 福建三元达网络技术有限公司 一种私有小区安全接入的方法、私有小区、用户终端及系统
EP3235293B1 (en) 2014-12-17 2023-08-23 Telefonaktiebolaget LM Ericsson (publ) Method and apparatus for mobility management
US10285060B2 (en) 2015-10-30 2019-05-07 Alcatel-Lucent Usa Inc. Preventing attacks from false base stations
EP3193557B1 (en) 2016-01-12 2020-04-22 HTC Corporation Device and method of handling radio resource control connection
US10772033B2 (en) * 2016-01-27 2020-09-08 Mediatek Singapore Pte. Ltd. Avoiding reselection of a fake cell in a wireless communication network
US10873464B2 (en) * 2016-03-10 2020-12-22 Futurewei Technologies, Inc. Authentication mechanism for 5G technologies
US10367677B2 (en) * 2016-05-13 2019-07-30 Telefonaktiebolaget Lm Ericsson (Publ) Network architecture, methods, and devices for a wireless communications network
EP3908045B1 (en) * 2016-07-13 2024-10-23 Samsung Electronics Co., Ltd. Access control method and apparatus for use in mobile communication
EP3487258B1 (en) * 2016-08-11 2021-11-10 Samsung Electronics Co., Ltd. Method, terminal and base station for resuming a conection
KR20180035638A (ko) * 2016-09-29 2018-04-06 삼성전자주식회사 RRC Inactive 및 active 상태에서 data 전송 결정 및 방법 및 장치
WO2018131956A1 (en) * 2017-01-16 2018-07-19 Samsung Electronics Co., Ltd. Method and apparatus for communication in wireless mobile communication system
KR102222830B1 (ko) * 2017-03-21 2021-03-04 삼성전자 주식회사 이동통신에서 연결 모드의 비연속 수신 모드를 지원하는 방법 및 장치
EP3603122A4 (en) * 2017-03-23 2020-10-21 Nokia Technologies Oy MOBILITY SUPPORT DURING A STATE OF LOW ACTIVITY
KR102446197B1 (ko) * 2017-06-14 2022-09-22 삼성전자주식회사 Pdcp pdu들의 무결성 검사 실패의 핸들링을 위한 방법 및 사용자 단말기
US20200214070A1 (en) * 2017-06-14 2020-07-02 Samsung Electronics Co., Ltd Method and user equipment (ue) for reconnecting rrc connection with radio access network (ran) node
CN113891315A (zh) * 2017-11-16 2022-01-04 华为技术有限公司 一种请求恢复连接的方法及装置
US11153792B2 (en) * 2018-04-18 2021-10-19 Qualcomm Incorporated Signaling for inactive mobility

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102804829A (zh) * 2009-06-24 2012-11-28 诺基亚公司 用于避免欺骗接入点的拒绝服务攻击的方法和装置
US20170332436A1 (en) * 2016-05-13 2017-11-16 Htc Corporation Device and Method Handling a Radio Resource Control Connection Resume Procedure
CN107071775A (zh) * 2017-05-15 2017-08-18 奇酷互联网络科技（深圳）有限公司 移动终端及其重定向接入基站的方法和装置

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
"LS on security during Resume reject in INACTIVE state in NR", 3GPP TSG-RAN WG2 MEETING #99BIS R2-1712052, 16 October 2017 (2017-10-16), XP051356063 *
See also references of EP3713273A4 *
ZTE: "Security aspects of RESUME REJECT in INACTIVE state in NR", 3GPP TSG SA WG3 (SECURITY) MEETING #89 S3-173072, 20 November 2017 (2017-11-20), XP051380333 *

Also Published As

Publication number Publication date
CA3082504C (en) 2022-09-27
JP2021503809A (ja) 2021-02-12
KR20200087226A (ko) 2020-07-20
CN109803260A (zh) 2019-05-24
CN114501448A (zh) 2022-05-13
US20230093723A1 (en) 2023-03-23
CN109803260B (zh) 2022-01-11
EP3713273A1 (en) 2020-09-23
KR102344352B1 (ko) 2021-12-28
RU2746890C1 (ru) 2021-04-21
JP7045455B2 (ja) 2022-03-31
EP3713273A4 (en) 2021-08-04
US11516727B2 (en) 2022-11-29
US11716673B2 (en) 2023-08-01
CA3082504A1 (en) 2019-05-23
US20200404575A1 (en) 2020-12-24

Similar Documents

Publication Publication Date Title
US11825303B2 (en) Method for performing verification by using shared key, method for performing verification by using public key and private key, and apparatus
US20200214070A1 (en) Method and user equipment (ue) for reconnecting rrc connection with radio access network (ran) node
US11627623B2 (en) Connection resume request method and apparatus
US8594632B1 (en) Device to-device (D2D) discovery without authenticating through cloud
KR101879916B1 (ko) 3gpp lte에서 모바일 통신 디바이스 간의 근접성 발견, 인증 및 링크 설정
US11706618B2 (en) Data packet verification method and device
Pratas et al. Massive machine-type communication (mMTC) access with integrated authentication
WO2017167102A1 (zh) 消息完整性认证信息的生成和验证方法、装置及验证系统
CN107104932A (zh) 密钥更新方法、装置及系统
CN112235799B (zh) 终端设备入网鉴权方法及系统
US11716673B2 (en) Access rejection method, apparatus and system, and storage medium and processor
CN105828330A (zh) 一种接入方法及装置
CN110087338B (zh) 一种窄带物联网进行鉴权的方法及设备
WO2018126791A1 (zh) 一种认证方法及装置、计算机存储介质
CN112508482A (zh) 基于区块链的物流快递签收管理方法、系统及存储介质
WO2016180145A1 (zh) 一种无线网络鉴权方法及核心网网元、接入网网元、终端
CN111212424B (zh) 一种从eps到5gs互操作时鉴权ue的方法及系统
EP4322458A1 (en) Post quantum integration for password-authenticated key exchange
EP4322457A1 (en) Improved security establishment methods and systems
US20220104012A1 (en) Authentication processing method and device, storage medium and electronic device
CN106612205B (zh) 一种节点认证方法、系统及代理节点
CN118828492A (zh) 认证方法、相关设备及存储介质
CN114245383A (zh) 一种基于amf取消订阅信令的安全检测方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18877661

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 3082504

Country of ref document: CA

ENP Entry into the national phase

Ref document number: 2020526952

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 20207017196

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2018877661

Country of ref document: EP

Effective date: 20200617