WO2019184728A1 - 终端设备的位置确定方法和设备 - Google Patents

终端设备的位置确定方法和设备 Download PDF

Info

Publication number
WO2019184728A1
WO2019184728A1 PCT/CN2019/078310 CN2019078310W WO2019184728A1 WO 2019184728 A1 WO2019184728 A1 WO 2019184728A1 CN 2019078310 W CN2019078310 W CN 2019078310W WO 2019184728 A1 WO2019184728 A1 WO 2019184728A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
location information
base station
location
message
Prior art date
Application number
PCT/CN2019/078310
Other languages
English (en)
French (fr)
Inventor
何承东
李华
赵绪文
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19777491.2A priority Critical patent/EP3745787A4/en
Publication of WO2019184728A1 publication Critical patent/WO2019184728A1/zh
Priority to US17/004,171 priority patent/US11096142B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W64/00—Locating users or terminals or network equipment for network management purposes, e.g. mobility management
    • H04W64/003—Locating users or terminals or network equipment for network management purposes, e.g. mobility management locating network equipment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/47—Fraud detection or prevention means
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/80—Rating or billing plans; Tariff determination aspects
    • H04M15/8033—Rating or billing plans; Tariff determination aspects location-dependent, e.g. business or home
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/80—Rating or billing plans; Tariff determination aspects
    • H04M15/8038—Roaming or handoff
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H04W4/029—Location-based management or tracking services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/24—Accounting or billing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H04W48/04—Access restriction performed under specific conditions based on user or terminal location or mobility data, e.g. moving direction, speed
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H04W60/04—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration using triggered events
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W64/00—Locating users or terminals or network equipment for network management purposes, e.g. mobility management
    • H04W64/006—Locating users or terminals or network equipment for network management purposes, e.g. mobility management with additional information processing, e.g. for direction or speed determination
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices

Definitions

  • the embodiments of the present invention relate to the field of communications technologies, and in particular, to a method and a device for determining a location of a terminal device.
  • the 4th Generation Communication System (4G) was found to have a major vulnerability.
  • the attacker can use this vulnerability to fabricate and forward fake information, allowing the attacker to impersonate the victim to access the network and misrepresent the victim's location information.
  • Figure 1 is a message interaction diagram of an attack mode.
  • a normal terminal device User Equipment, UE
  • the pseudo base station Malicious eNB
  • a pseudo base station and a pseudo UE form a malicious network across two areas.
  • the pseudo base station forwards the attach request of the normal UE to the remote pseudo UE, and the pseudo UE forwards to the remote core network device through the remote legal base station.
  • the pseudo base station and the pseudo UE forward the response message sent by the core network device to the normal UE, so that the normal UE can successfully access the network through the pseudo base station and the pseudo UE.
  • the network-aware user location and the user's actual location may be inconsistent.
  • the normal UE and the pseudo base station are in the city A
  • the pseudo UE, and the legal base station are in the city B.
  • the attacker can forward the message through the pseudo base station and the pseudo UE, so that the normal UE accesses the legal base station located in the city B, so that the network considers that the normal UE is located in the city B.
  • the above attack method causes the network to locate the location error of the terminal device, and the legitimate UE may be guided by the attacker to access the roaming network, resulting in a charging dispute.
  • the embodiment of the present invention provides a method and a device for determining a location of a terminal device.
  • the core network device determines whether the location of the terminal device is incorrect by comparing the location information provided by the base station and the location information provided by the terminal device, thereby avoiding the location. The error of the information caused a billing dispute.
  • the embodiment of the present application provides a method for determining a location of a terminal device, where the method includes: acquiring, by the core network device, location information of the terminal device reported by the terminal device and location information reported by the first base station; and determining, by the core network device, the terminal device Whether the location information matches the location information reported by the first base station; if the location information of the terminal device does not match the location information reported by the first base station, the core network device sends a reject message to the terminal device.
  • the core network device is a mobile management device, and the core network device obtains the location information of the terminal device reported by the terminal device, including: the mobility management device passes the non-access layer The initial attach request message or the registration request message or the security mode command completion response message acquires the location information of the terminal device reported by the terminal device.
  • the core network device is a location management network element, and the core network device obtains the location information of the terminal device reported by the terminal device and the location information reported by the first base station, including: The location management network element receives the request message sent by the mobility management device, where the request message includes the location information of the terminal device and the location information reported by the first base station.
  • the location information of the terminal device includes at least one of the following: location information broadcast by the second base station, where the second base station is a base station that is accessed by the terminal device.
  • the auxiliary location information wherein the auxiliary location information is information provided by the auxiliary positioning device, and the auxiliary location information is used to indicate the location where the terminal device is located; the location information broadcast by the third base station, wherein the third base station is the second base station A base station that is less than a preset distance.
  • the embodiment of the present application provides a method for determining a location of a terminal device, where the method includes: acquiring, by the terminal device, location information of the terminal device, where location information of the terminal device is used to indicate a current location of the terminal device; The device sends the location information of the terminal device; if the terminal device receives the rejection message sent by the core network device, the device processes the reason according to the reason value carried in the rejection message.
  • the terminal device sends the location information of the terminal device to the core network device, including: the initial attach request message or the registration request message or the security of the terminal device through the non-access stratum
  • the mode command completes the response message, and sends the location information of the terminal device to the core network device.
  • the method further includes: if the cause value is used to indicate that the location is inconsistent, the terminal device re-initiates the registration or re-initiates the attach after the preset time period.
  • the method further includes: determining, by the terminal device, whether the current location of the terminal device is abnormal according to the location information of the terminal device; if the current location of the terminal device is abnormal, the terminal device performs prompt.
  • the location information of the terminal device includes at least one of the following: location information broadcast by the second base station, where the second base station is a base station that is accessed by the terminal device.
  • the auxiliary location information wherein the auxiliary location information is information provided by the auxiliary positioning device, and the auxiliary location information is used to indicate the location where the terminal device is located; the location information broadcast by the third base station, wherein the third base station is the second base station.
  • the embodiment of the present application provides a method for determining a location of a terminal device, where the method includes: the mobility management device sends a location request message to the terminal device; the mobility management device receives the location response message sent by the terminal device, where the location response message includes The location information reported by the terminal device; the mobility management device determines whether the location information reported by the first base station and the location information reported by the terminal device match; if the location information reported by the first base station does not match the location information reported by the terminal device, the mobility management device A deregistration message or a detach message is sent to the terminal device.
  • the mobile management device determines whether the location information reported by the first base station and the location information reported by the terminal device match the terminal device, including: the mobility management device to the location management network element Transmitting the location information reported by the first base station and the location information reported by the terminal device; the mobile management device receives the location matching result returned by the location management network element, where the location matching result is used to indicate the location information reported by the first base station and the location information reported by the terminal device Whether it matches.
  • the location information reported by the terminal device includes at least one of the following: location information broadcast by the second base station, where the second base station is accessed by the terminal device.
  • the embodiment of the present application provides a method for determining a location of a terminal device, where the method includes: the terminal device receives a location request message sent by the core network device; the terminal device sends a location response message to the core network device, where the location response message includes The current location information of the terminal device; if the terminal device receives the de-registration or detach message sent by the core network device, the terminal device processes the value according to the reason value in the de-registration or detachment message.
  • the current location information of the terminal device includes at least one of the following: location information broadcast by the second base station, where the second base station is accessed by the terminal device.
  • the base station The auxiliary location information, wherein the auxiliary location information is information provided by the auxiliary positioning device, and the auxiliary location information is used to indicate the location where the terminal device is located; the location information broadcast by the third base station, wherein the third base station is the second base station The base station terminal device whose distance is less than the preset distance.
  • the embodiment of the present application provides a method for determining a location of a terminal device, where the method includes: the core network device acquires location information reported by the first base station; and the core network device determines the non-access layer according to the location information reported by the first base station.
  • the integrity protection key ; the core network device sends a non-access stratum security mode command message to the terminal device; wherein the non-access stratum security mode command message is integrity protected by using the non-access stratum integrity protection key.
  • the method further includes: if the core network device receives the security mode command reject message sent by the terminal device, sending an attach reject or registration reject message to the terminal device.
  • the core network device is a mobility management device, and the core network device determines the non-access stratum integrity protection key according to the location information reported by the first base station, including: The management device sends the location information reported by the first base station to the data management network element; the mobility management device receives the access security management entity key sent by the data management network element, where the access security management entity key is the data management network element according to the The location information reported by the base station is determined; the mobility management device acquires the non-access stratum integrity protection key according to the access security management entity key.
  • the embodiment of the present application provides a method for determining a location of a terminal device, where the method includes: the terminal device receives a non-access stratum security mode command message sent by the core network device; and the terminal device determines the non-determination based on the current location information of the terminal device.
  • the access layer integrity protection key; the terminal device performs integrity verification on the non-access stratum security mode command message according to the non-access stratum integrity protection key.
  • the method further includes: if the terminal device performs integrity check failure on the non-access stratum security mode command message according to the non-access stratum integrity protection key
  • the security mode reject message of the non-access stratum is sent to the core network device, and the non-access stratum security mode reject message carries a cause value indicating that the location is inconsistent.
  • the embodiment of the present application provides a method for determining a location of a terminal device, where the method includes: the mobility management device acquires location information reported by the first base station; and the mobility management device determines, according to the location information reported by the first base station, the first base station. Temporary key; the mobility management device transmits the temporary key used by the first base station to the first base station.
  • the embodiment of the present application provides a method for determining a location of a terminal device, where the method includes: the terminal device receives an access layer security mode command message sent by the first base station; and the terminal device determines the access according to the current location information of the terminal device. Layer integrity protection key; the terminal device performs integrity check on the access layer security mode command message according to the access layer integrity protection key.
  • the method further includes: if the terminal device fails the integrity check of the access layer security mode command message according to the access layer integrity protection key, A base station transmits an access layer security mode reject message.
  • a ninth aspect the embodiment of the present application provides a method for determining a location of a terminal device, where the method includes: determining, by a first base station, an access layer integrity protection key according to location information of the first base station; The security protection key performs integrity protection on the access layer security mode command message; the first base station sends an access layer security mode command message to the terminal device.
  • the embodiment of the present application provides a core network device, including: a transceiver module, configured to acquire location information of a terminal device reported by a terminal device, and location information reported by the first base station, where the processing module is configured to determine the terminal device. The location information is matched with the location information reported by the first base station, and the transceiver module is further configured to: if the location information of the terminal device does not match the location information reported by the first base station, send a reject message to the terminal device.
  • a core network device including: a transceiver module, configured to acquire location information of a terminal device reported by a terminal device, and location information reported by the first base station, where the processing module is configured to determine the terminal device. The location information is matched with the location information reported by the first base station, and the transceiver module is further configured to: if the location information of the terminal device does not match the location information reported by the first base station, send a reject message to the terminal device.
  • the core network device is a mobility management device
  • the transceiver module is specifically configured to: complete, by using a non-access stratum initial attach request message or a registration request message or a security mode command.
  • the location information of the terminal device reported by the terminal device is obtained by using the response message.
  • the core network device is a location management network element
  • the transceiver module is specifically configured to: receive a request message sent by the mobility management device, where the request message includes location information of the terminal device. And location information reported by the first base station.
  • the location information of the terminal device includes at least one of the following: location information broadcast by the second base station, where the second base station is a base station that is accessed by the terminal device.
  • the auxiliary location information wherein the auxiliary location information is information provided by the auxiliary positioning device, and the auxiliary location information is used to indicate the location where the terminal device is located; the location information broadcast by the third base station, wherein the third base station is the second base station.
  • the embodiment of the present application provides a terminal device, including: a processing module, configured to acquire location information of a terminal device, where location information of the terminal device is used to indicate a current location of the terminal device, and a transceiver module is used for the core device.
  • the network device sends the location information of the terminal device
  • the processing module is further configured to: if the transceiver module receives the reject message sent by the core network device, process, according to the cause value carried in the reject message.
  • the transceiver module is specifically configured to: complete the response message by using a non-access stratum initial attach request message or a registration request message or a security mode command, to the core network device Send the location information of the terminal device.
  • the transceiver module is further configured to: if the cause value is used to indicate that the location is inconsistent, re-initiate registration or re-initiate the attachment after the preset time period.
  • the processing module is further configured to: determine, according to the location information of the terminal device, whether the current location of the terminal device is abnormal, and if the current location of the terminal device is abnormal, prompting .
  • the location information of the terminal device includes at least one of the following: location information broadcast by the second base station, where the second base station is accessed by the terminal device.
  • the base station terminal device terminal device whose distance is less than the preset distance.
  • the embodiment of the present application provides a mobility management device, including: a transceiver module, configured to send a location request message to a terminal device, and receive a location response message sent by the terminal device, where the location response message includes a location reported by the terminal device.
  • the information processing module is configured to determine whether the location information reported by the first base station and the location information reported by the terminal device match, and the transceiver module is further configured to: if the location information reported by the first base station does not match the location information reported by the terminal device, A deregistration message or a detach message is sent to the terminal device.
  • the transceiver module is configured to: send the location information reported by the first base station and the location information reported by the terminal device to the location management network element, and receive the location management network element.
  • the returned location matching result is used to indicate whether the location information reported by the first base station and the location information reported by the terminal device match.
  • the location information of the terminal device includes at least one of the following: location information broadcast by the second base station, where the second base station is accessed by the terminal device.
  • the base station terminal device terminal device whose distance is less than the preset distance.
  • the embodiment of the present application provides a terminal device, including: a transceiver module, configured to receive a location request message sent by a core network device, and send a location response message to a core network device, where the location response message includes a current location of the terminal device.
  • the location information the processing module, is configured to: if the transceiver module receives the deregistration or detachment message sent by the core network device, process the value according to the reason value in the deregistration or detachment message.
  • the location information of the terminal device includes at least one of the following: location information broadcast by the second base station, where the second base station is accessed by the terminal device.
  • the base station terminal device terminal device whose distance is less than the preset distance.
  • the embodiment of the present application provides a core network device, including: a transceiver module, configured to acquire location information reported by a first base station, and a processing module, configured to determine a non-access layer according to location information reported by the first base station The integrity protection key, the transceiver module is further configured to send a non-access stratum security mode command message to the terminal device, where the non-access stratum security mode command message is integrity protected by using a non-access stratum integrity protection key of.
  • the transceiver module is further configured to: when receiving the security mode command rejection message sent by the terminal device, send an attach rejection or registration rejection message to the terminal device.
  • the core network device is a mobility management network element
  • the transceiver module is specifically configured to: send the location information reported by the first base station to the data management network element; and receive the data.
  • the embodiment of the present application provides a terminal device, including: a transceiver module, configured to receive a non-access stratum security mode command message sent by a core network device, where the processing module is configured to determine, according to current location information of the terminal device, The non-access stratum integrity protection key performs integrity check on the non-access stratum security mode command message according to the non-access stratum integrity protection key.
  • the transceiver module is further configured to perform integrity check on the non-access stratum security mode command message according to the non-access stratum integrity protection key. If the test fails, the non-access stratum security mode reject message is sent to the core network device, and the non-access stratum security mode reject message carries a cause value indicating the location inconsistency.
  • the embodiment of the present application provides a mobility management device, including: a transceiver module, configured to acquire location information reported by a first base station, and a processing module, configured to determine, according to location information reported by the first base station, use by the first base station The temporary key, the transceiver module is further configured to send the temporary key used by the first base station to the first base station.
  • the embodiment of the present application provides a terminal device, including: a transceiver module, configured to receive an access layer security mode command message sent by a first base station, and a processing module, configured to determine, according to current location information of the terminal device, The layer integrity protection key performs integrity check on the access layer security mode command message according to the access layer integrity protection key.
  • the transceiver module is further configured to: if the integrity check failure of the access layer security mode command message is performed according to the access layer integrity protection key, An access layer security mode reject message is sent to the first base station.
  • the embodiment of the present application provides a base station, including: a processing module, configured to determine an access layer integrity protection key according to location information of the first base station, and access the access layer according to the access layer integrity protection key pair
  • the layer security mode command message performs integrity protection
  • the transceiver module is configured to send an access layer security mode command message to the terminal device.
  • the embodiment of the present application provides a core network device, including: a memory, a processor, a transceiver, and a computer program, where the computer program is stored in the memory, and the processor runs the computer program to execute The method for determining a location of a terminal device according to any one of the first, third, fifth, and seventh aspects.
  • the embodiment of the present application provides a terminal device, including: a memory, a processor, a transceiver, and a computer program, where the computer program is stored in the memory, and the processor runs the computer program to execute The method for determining a location of a terminal device according to any one of the second, sixth, and eighth aspects.
  • an embodiment of the present application provides a base station, including: a memory, a processor, a transceiver, and a computer program, where the computer program is stored in the memory, and the processor runs the computer program to execute The method for determining a location of a terminal device according to any one of the nine aspects.
  • the embodiment of the present application provides a storage medium, comprising: a readable storage medium and a computer program, wherein the computer program is used to implement the location determining method of the terminal device according to any one of the aspects.
  • the embodiment of the present application provides a method and a device for determining a location of a terminal device. By comparing whether the location information of the terminal device reported by the terminal device matches the location information reported by the base station, it can be determined whether the location of the terminal device is misjudged, the accuracy of determining the location of the terminal device is improved, and the charging dispute is avoided.
  • Figure 1 is a message interaction diagram of an attack mode
  • FIG. 2 is a network architecture diagram of a communication system to which an embodiment of the present application is applied;
  • FIG. 3 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 1 of the present application;
  • FIG. 4 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 2 of the present application;
  • FIG. 5 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 3 of the present application.
  • FIG. 6 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 4 of the present application.
  • FIG. 7 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 5 of the present application.
  • FIG. 8 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 6 of the present application.
  • FIG. 9 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 7 of the present application.
  • FIG. 10 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 8 of the present application.
  • FIG. 11 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 9 of the present application.
  • FIG. 12 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 10 of the present application.
  • FIG. 13 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 11 of the present application.
  • FIG. 14 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 12 of the present application.
  • FIG. 15 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 13 of the present application.
  • FIG. 16 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 14 of the present application;
  • FIG. 17 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 15 of the present application.
  • FIG. 18 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 16 of the present application.
  • FIG. 19 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 17 of the present application.
  • FIG. 20 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 18 of the present application.
  • FIG. 21 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 19 of the present application.
  • FIG. 22 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 20 of the present application.
  • FIG. 23 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 21 of the present application.
  • FIG. 24 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 22 of the present application.
  • FIG. 25 is a schematic structural diagram of a terminal device according to an embodiment of the present disclosure.
  • FIG. 26 is a schematic structural diagram of a base station according to an embodiment of the present disclosure.
  • FIG. 27 is a schematic structural diagram of a core network device according to an embodiment of the present application.
  • FIG. 28 is another schematic structural diagram of a terminal device according to an embodiment of the present disclosure.
  • FIG. 29 is another schematic structural diagram of a base station according to an embodiment of the present disclosure.
  • FIG. 30 is another schematic structural diagram of a core network device according to an embodiment of the present application.
  • FIG. 2 is a network architecture diagram of a communication system to which the embodiment of the present application is applied.
  • the communication system may include a terminal device 11, a base station 12, and a core network device 13. Uplink communication can be performed between the terminal device 11 and the base station 12.
  • the terminal device 11 can perform uplink and downlink communication between the base station 12 and the core network device 13.
  • the terminal device 11 related to the embodiment of the present application for example, a mobile phone, a tablet computer, a handheld device, an in-vehicle device, a wearable device, a computing device, and various forms of mobile stations (MSs) and terminals having wireless connection functions
  • MSs mobile stations
  • the terminal and the like are not limited in the embodiment of the present application.
  • the base station 12 involved in the embodiment of the present application may be any device having a management wireless network resource, or various wireless access points.
  • an evolved base station evolutional node B, eNB or eNodeB
  • a relay station or an access point in an LTE communication system e.g., a 5G base station
  • g node B, gNB 5G base station
  • NX wireless node
  • the embodiment of the present application is not limited.
  • the core network device 13 involved in the embodiment of the present application may include, for example, a Mobility Management Entity (MME) applied to a 4G network, a home subscriber server (HSS), and an evolved service mobile location center (EvolvedServing). Mobile Location Centre, E-SMLC), etc.
  • MME Mobility Management Entity
  • HSS home subscriber server
  • EvolvedServing evolved service mobile location center
  • E-SMLC Mobile Location Centre
  • AMF Access and Mobility Management Function
  • AUSF Authentication Server Function
  • UDM Unified Data Management
  • the location management function (LMF) and the like are not limited in the embodiment of the present application.
  • the MME and the AMF may also be referred to as a mobility management device, and the E-SMLC and the LMF may also be referred to as a location management network element or a location management device.
  • HSS and UDM can be referred to as data management network elements or data management devices.
  • the embodiments of the present application relate to three types of base stations, which may be referred to as a first base station, a second base station, and a third base station, respectively.
  • the first base station is a base station connected to the terminal device core network device.
  • the terminal device may be located within the coverage of the first base station or may not be located within the coverage of the first base station.
  • the first base station corresponding to the normal UE is a legal base station located in the city B.
  • the terminal device can access the cell of the second base station. That is, the terminal device is located within the coverage of the second base station. It can be understood that the first base station and the second base station may be the same base station, or may be two different base stations.
  • the second base station corresponding to the normal UE is a pseudo base station located in the city A.
  • the first base station and the second base station corresponding to the normal UE are different.
  • the first base station and the second base station are the same base station. If there is a malicious or illegal base station, the second base station is a malicious or illegal base station, and the first base station is a legal base station. At this time, the first base station and the second base station are different base stations.
  • the third base station is a base station adjacent to the second base station.
  • the terminal device can receive the signal transmitted by the third base station.
  • the number of the third base station is not limited in this embodiment of the present application.
  • a base station having a distance from the second base station that is less than a preset distance is referred to as a third base station.
  • the preset distance is 500 meters.
  • the base station with the second base station as a center and the radius within a range of 500 meters is the third base station.
  • the preset distance is not limited here, it can be 100 meters, 200 meters, 500 meters, 1000 meters and so on.
  • the third base station may be other base stations (not shown) that are geographically adjacent to the pseudo base station.
  • the "location information of the base station” and the “location information reported by the base station” have similar meanings in some scenarios, and can be understood as the current location of the terminal device indicated by the base station side.
  • the location information reported by the base station may be a tracking area identity (TAI).
  • TAI tracking area identity
  • the “location information of the terminal device”, the “current location information of the terminal device”, and the “location information reported by the terminal device” have similar meanings in some scenarios, and can be understood as the terminal device indicated by the UE side. current position.
  • the location information of the terminal device may be reported to the core network device through the NAS message, or may not be reported to the core network device.
  • the location information of the terminal device may include at least one of the following:
  • the second base station corresponding to the normal UE is a pseudo base station.
  • the location information of the terminal device may be location information of the pseudo base station broadcast by the pseudo base station.
  • the pseudo base station does not tamper with its location information.
  • the location information of the pseudo base station is labeled TAI-A.
  • the location information of the terminal device is TAI-A.
  • the first base station corresponding to the normal UE is a legal base station located in the city B.
  • the location information reported by the legal base station is marked as TAI-B.
  • the location information (TAI-A) of the terminal device does not match the location information (TAI-B) reported by the legal base station.
  • the pseudo base station can tamper with its location information.
  • the location information of the pseudo base station can be changed from TAI-A ⁇ to TAI-B.
  • the location information of the terminal device is TAI-B.
  • the first base station corresponding to the normal UE is a legal base station located in the city B.
  • the location information reported by the legal base station is marked as TAI-B.
  • the location information (TAI-B) of the terminal device is consistent with the location information (TAI-B) reported by the legal base station.
  • the auxiliary location information is information provided by the auxiliary positioning device, and the auxiliary location information is used to indicate the location where the terminal device is located.
  • the auxiliary location information may include: latitude and longitude information obtained by the terminal device through a Global Navigation Satellite System (GNSS), and a network service set identifier obtained by the terminal device through a wireless local area network (WLAN). (network service set identifier, SSID) and so on.
  • GNSS Global Navigation Satellite System
  • WLAN wireless local area network
  • the auxiliary location information indicates the region where the terminal device is located, when the location information broadcast by the second base station does not match the auxiliary location information, the current location of the terminal device may be abnormal.
  • the current location of the UE may be abnormal.
  • the terminal device may receive the broadcast message sent by the at least one third base station, so that the location information of the third base station carried in the broadcast message may be obtained.
  • the current location of the terminal device may be abnormal.
  • the current location of the UE may be abnormal.
  • the method and device for determining the location of the terminal device determine whether the location information reported by the terminal device matches the location information reported by the base station by the core network device. It can be determined whether the location of the user is abnormal, or the location information is added in the key derivation in the authentication process and the integrity protection process, so that the terminal device can be prevented from accessing the network when the location information does not match, thereby solving the terminal device.
  • FIG. 3 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 1 of the present application.
  • the method for determining the location of the terminal device provided in this embodiment may be applied to a 4G communication network or a 5G communication network or other communication network.
  • the network element involved in this embodiment may include a terminal device, a base station, and a core network device.
  • the method for determining a location of a terminal device provided by this embodiment may include:
  • the terminal device acquires location information of the terminal device.
  • the location information of the terminal device is used to indicate the current location of the terminal device.
  • the location information of the terminal device may include at least one of the following:
  • auxiliary location information wherein the auxiliary location information is information provided by the auxiliary positioning device, and the auxiliary location information is used to indicate a location where the terminal device is located;
  • the location information broadcast by the third base station wherein the third base station is a base station whose distance from the second base station is less than a preset distance.
  • the terminal device acquires location information of the terminal device, and may include at least one of the following:
  • the terminal device receives the broadcast message sent by the second base station, where the broadcast message carries the location information of the second base station.
  • the terminal device acquires the auxiliary location information.
  • the terminal device receives the broadcast message sent by the third base station, where the broadcast message carries the location information of the third base station.
  • the terminal device sends the location information of the terminal device to the core network device.
  • the core network device receives the location information of the terminal device sent by the terminal device.
  • the terminal device sends the location information of the terminal device to the core network device, including:
  • the terminal device may complete the response message by using the initial attach request message or the registration request message or the security mode command of the non-access stratum, and send the location information of the terminal device to the core network device.
  • the location information of the terminal device is sent to the core network device by using the initial attach request message or the registration request message, and the core network device can determine whether the location of the terminal device is abnormal, thereby reducing the message interaction during the attach process or the registration process. It saves air interface resources and improves resource utilization.
  • the location information of the terminal device is sent to the core network device by using the non-access stratum security mode command completion response message.
  • the access layer security mode command completes the response message for integrity protection, so that the location of the terminal device can be further improved. The accuracy.
  • the core network device receives the location information reported by the first base station.
  • S102 and S103 are not limited in this embodiment. That is, S102 may be executed first, and then S103 may be performed. Alternatively, S103 may be performed first, and then S102 may be performed. Alternatively, S102 and S103 are simultaneously executed. At this time, the location information of the terminal device and the location information reported by the first base station may be carried in a message, or may be carried in different messages.
  • the core network device is a mobility management device
  • the location information of the terminal device reported by the terminal device may be:
  • the mobile management device obtains the location information of the terminal device reported by the terminal device by completing the response message by using the initial attach request message or the registration request message or the security mode command of the non-access stratum.
  • the NAS-PDU in the NAS message carries the location information of the terminal device.
  • the first base station may package the NAS-PDU (the location information of the terminal device) and the location information reported by the first base station, and send the message to the core network device through the S1/N2 interface message.
  • the core network device is a location management network element
  • the location information of the terminal device reported by the terminal device and the location information reported by the first base station may be:
  • the location management network element receives the request message sent by the mobility management device, where the request message includes the location information of the terminal device and the location information reported by the first base station.
  • the mobility management device is an AMF or an MME.
  • the core network device determines whether the location information of the terminal device matches the location information reported by the first base station.
  • the determining, by the core network device, whether the location information of the terminal device matches the location information reported by the first base station may include:
  • the core network device determines whether the location information broadcast by the second base station is consistent with the location information reported by the first base station.
  • the location information of the terminal device is matched with the location information reported by the first base station, and the current location of the terminal device is normal.
  • the information is inconsistent, it is determined that the location information of the terminal device does not match the location information reported by the first base station, and the current location of the terminal device is abnormal.
  • the pseudo base station does not tamper with its location information
  • the location information broadcast by the second base station is TAI-A
  • the location information reported by the first base station is TAI-B.
  • the two are inconsistent, and it can be determined that the current location of the terminal device is abnormal.
  • the implementation method only compares whether the location information broadcast by the second base station is consistent with the location information reported by the first base station, and the method is simple and easy, the data processing efficiency is improved, and the misjudgment of the location of the terminal device is avoided.
  • the core network device determines whether the location information of the terminal device matches the location information reported by the first base station, and may include:
  • the core network device determines whether the auxiliary location information matches the location information reported by the first base station.
  • the location information of the terminal device matches the location information reported by the first base station, and the current location of the terminal device is normal.
  • the location information of the terminal device does not match the location information reported by the first base station, and the current location of the terminal device is abnormal.
  • the auxiliary location information indicates that the location information reported by the UE in the city A and the first base station (legal base station) is TAI-B, indicating the city B. At this time, the two are inconsistent, and it can be determined that the current location of the terminal device is abnormal.
  • the auxiliary location information and the location information reported by the first base station are different types of information, and it is necessary to determine whether the area indicated by the auxiliary location information is consistent with the area indicated by the location information reported by the first base station. Since the auxiliary location information indicates the location where the terminal device is actually located, the accuracy of determining the location of the terminal device is improved, and the misjudgment of the location of the terminal device is avoided.
  • the core network device determines whether the location information of the terminal device matches the location information reported by the first base station, and may include :
  • the core network device determines whether the location information broadcast by the third base station is consistent with the location information reported by the first base station.
  • the location information of the terminal device is matched with the location information reported by the first base station, and the current location of the terminal device is normal.
  • the information is inconsistent, it is determined that the location information of the terminal device does not match the location information reported by the first base station, and the current location of the terminal device is abnormal.
  • the location information broadcast by the third base station is TAI-A
  • the location information reported by the first base station is TAI-B, indicating the city B.
  • the two are inconsistent, and it can be determined that the current location of the terminal device is abnormal.
  • the method is simple and easy to implement by comparing the location information broadcast by the third base station with the location information reported by the first base station, which improves data processing efficiency and avoids misjudgment of the location of the terminal device.
  • the core network device determines whether the location information of the terminal device and the location information reported by the first base station are Matches can include:
  • the core network device determines whether the location information broadcast by the second base station is consistent with the location information reported by the first base station.
  • the information is inconsistent, it is determined that the location information of the terminal device does not match the location information reported by the first base station, and the current location of the terminal device is abnormal.
  • auxiliary location information matches the location information reported by the first base station.
  • the location information of the terminal device does not match the location information reported by the first base station, and the current location of the terminal device is abnormal.
  • the location information of the terminal device matches the location information reported by the first base station, and the current location of the terminal device is normal.
  • the core network device determines whether the auxiliary location information matches the location information reported by the first base station.
  • the location information of the terminal device does not match the location information reported by the first base station, and the current location of the terminal device is abnormal.
  • the location information of the terminal device is matched with the location information reported by the first base station, and the current location of the terminal device is normal.
  • the information is inconsistent, it is determined that the location information of the terminal device does not match the location information reported by the first base station, and the current location of the terminal device is abnormal.
  • the location information of the terminal device may include at least two types of location information: location information broadcasted by the second base station, auxiliary location information, and location information broadcast by the third base station.
  • the core network device determines whether the location information of the terminal device matches the location information reported by the first base station, and determines whether the location information reported by the first base station matches each location information in the location information of the terminal device. This embodiment does not limit the order of judgment of each location information.
  • the core network device sends a reject message to the terminal device.
  • the terminal device receives the reject message sent by the core network.
  • the reason value may be carried in the reject message, where the cause value is used to indicate that the location is inconsistent.
  • the reject message may be an attach reject message or a registration reject message.
  • the method may further include:
  • An abnormal event is reported to the operation and maintenance (OM) device.
  • the abnormal event indicates that the location of the terminal device is inconsistent.
  • the terminal device If the terminal device receives the reject message sent by the core network, the terminal device performs processing according to the cause value carried in the reject message.
  • the terminal device may re-initiate registration or re-initiate the attachment after the preset time period.
  • This embodiment does not limit the specific value of the preset time period.
  • the terminal device reports the location information of the terminal device to the core network device, and the core network device compares the location information reported by the terminal device with the location information reported by the first base station, and may Determining whether the location of the terminal device is misjudged improves the accuracy of determining the location of the terminal device.
  • S105 and S106 are only one type of processing performed by the core network device and the terminal device when the location information of the terminal device does not match the location information reported by the first base station. It can be understood that if the location information of the terminal device does not match the location information reported by the first base station, the core network device can continue to perform other processes, and the terminal device performs other processes accordingly. For example, if the location information of the terminal device does not match the location information reported by the first base station, the core network device may not send a message. After the terminal device does not receive the message sent by the core network device after a period of time, the existing process may be performed correspondingly.
  • the method for determining a location of the terminal device may further include:
  • the terminal device determines, according to the location information of the terminal device, whether the current location of the terminal device is abnormal.
  • the user equipment may determine, by using the obtained user equipment location information, whether the current location of the user equipment is abnormal. If it is abnormal, you can prompt to remind the user that there may be a risk of being attacked, so that the user can take corresponding measures to improve security and avoid cost disputes.
  • the terminal device may not initiate registration, or re-initiate registration after a preset time period according to the preset policy.
  • This embodiment does not limit the manner of prompting. For example, a prompt message can be generated and a prompt message can be displayed.
  • This embodiment does not limit the specific content and display manner of the display information. For example, the display information can be displayed by popping up a prompt window on the display of the user device. Or, you can make a prompt by sound.
  • the terminal device determines, according to the location information of the terminal device, whether the current location of the terminal device is abnormal, and may include:
  • the terminal device determines whether the location information broadcast by the second base station matches the auxiliary location information.
  • the pseudo base station tampers with its location information, and changes the location information of the pseudo base station from TAI-A to TAI-B, indicating city B.
  • the auxiliary location information indicates that the UE is in city A. At this time, the two are inconsistent, and it can be determined that the current location of the terminal device is abnormal.
  • the auxiliary location information and the location information broadcast by the second base station are different types of information, and it is necessary to determine whether the area indicated by the auxiliary location information is consistent with the area indicated by the location information broadcast by the second base station. Since the auxiliary location information indicates the location where the terminal device is actually located, the accuracy of determining the location of the terminal device is improved, and the misjudgment of the location of the terminal device is avoided.
  • the terminal device determines, according to the location information of the terminal device, whether the current location of the terminal device is Anomalies can include:
  • the terminal device determines whether the location information broadcast by the second base station and the location information broadcast by the third base station are consistent.
  • the pseudo base station tampers with its location information, and changes the location information of the pseudo base station from TAI-A to TAI-B, indicating city B.
  • the location information broadcast by the third base station is TAI-A.
  • the location information broadcast by the second base station does not match the location information broadcast by the third base station, it may be determined that the current location of the terminal device is abnormal.
  • the method is simple and easy, and the misjudgment of the location of the terminal device is avoided.
  • the method for determining a location of the terminal device may further include:
  • the terminal device receives the location request message sent by the core network device.
  • the terminal device acquires current location information of the terminal device according to the location request message.
  • the terminal device sends a location response message to the core network device, where the location response message includes current location information of the terminal device.
  • the core network device determines whether the first location information reported by the first base station and the current location information reported by the terminal device match.
  • the deregistration message or the detach message is sent to the terminal device.
  • the embodiment provides a method for determining a location of a terminal device, where the core network device obtains the location information of the terminal device reported by the terminal device and the location information reported by the first base station, and the core network device determines the location information of the terminal device and the first If the location information reported by the base station matches, if the location information of the terminal device does not match the location information reported by the first base station, the core network sends a reject message to the terminal device, and if the terminal device receives the reject message sent by the core network, The reason value carried in the rejection message is processed.
  • the method for determining the location of the terminal device provided by the embodiment, the terminal device reports the location information of the terminal device to the core network device, and the core network device compares the location information of the terminal device reported by the terminal device with the location information reported by the base station, and can determine Whether the location of the terminal device is misjudged, the accuracy of determining the location of the terminal device is improved, and the charging dispute is avoided.
  • the present embodiment provides a specific implementation manner of the location determining method of the terminal device, which can be applied to an LTE communication system or a 5G communication system or other communication, on the basis of the embodiment shown in FIG.
  • the network element involved in the LTE communication system may include a terminal device (UE), a base station eNB (first base station eNB1, second base station eNB2), and a mobility management device (MME).
  • UE terminal device
  • eNB first base station eNB1, second base station eNB2
  • MME mobility management device
  • the network elements involved in the 5G communication system may include: a terminal device (UE), a base station gNB (a first base station gNB1, a second base station gNB2), and a mobility management device (AMF). It should be noted that, in some scenarios, the first base station eNB1 and the second base station eNB2 may be the same base station, and the first base station gNB1 and the second base station gNB2 may be the same base station. As shown in FIG. 4, the method for determining a location of a terminal device provided by the present application may include:
  • the UE establishes an RRC connection with eNB2/gNB2.
  • the UE may acquire location information (represented by "Location Information-UE") of the terminal device from the eNB2/gNB2.
  • the UE acquires location information ("Location Information - UE") of the terminal device.
  • the UE sends an initial attach request/registration request message (initial Attach/Registration) to the MME/AMF through eNB1/gNB1.
  • the initial attach request message or the registration request message is a NAS message, where the NAS-PDU can carry location information of the terminal device.
  • eNB1/gNB1 forwards the initial attach request message/registration request message to the MME/AMF through the S1/N2 interface.
  • the eNB1/gNB1 packs the NAS-PDU (Location Information-UE) and the location information reported by the eNB1/gNB1 (indicated by "Location Information - eNB1/gNB1"), and transmits it to the MME/AMF through the S1/N2 interface.
  • NAS-PDU Location Information-UE
  • Location Information - eNB1/gNB1 Location Information
  • MME/AMF compares the location information of the terminal device reported by the NAS layer UE with the location information reported by the eNB1/gNB1 through the S1/N2 interface.
  • the attach reject message or the registration reject message may be sent to the UE, where The reason value carried indicates that the location of the terminal device is inconsistent.
  • the MME/AMF determines that the location information of the terminal device reported by the UE matches the location information reported by the eNB/gNB1 through the S1/N2 interface, the subsequent process is performed normally, and the UE may receive the normal response message sent by the MME/AMF.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to an LTE communication network or a 5G communication network.
  • the terminal device reports the location information of the terminal device to the mobility management device by using the initial attach request message or the registration request message, and the mobile management device compares the location information of the terminal device reported by the terminal device with the location information reported by the base station, and can determine the terminal device. Whether there is a misjudgment of the location improves the accuracy of the location determination of the terminal device and avoids the billing dispute.
  • FIG. 5 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 3 of the present application.
  • this embodiment provides a specific implementation manner of the location determining method of the terminal device, which can be applied to the LTE communication system and the 5G communication system.
  • the network elements involved in the LTE communication system may include a terminal device (UE), a base station eNB (first base station eNB1, second base station eNB2), a mobility management device (MME), and a location management device (E-SMLC).
  • UE terminal device
  • eNB first base station eNB1, second base station eNB2
  • MME mobility management device
  • E-SMLC location management device
  • the network elements involved in the 5G communication system may include: a terminal device (UE), a base station gNB (a first base station gNB1, a second base station gNB2), a mobility management device (AMF), and a location management device (LMF).
  • UE terminal device
  • base station gNB a first base station gNB1, a second base station gNB2
  • AMF mobility management device
  • LMF location management device
  • the first base station eNB1 and the second base station eNB2 may be the same base station
  • the first base station gNB1 and the second base station gNB2 may be the same base station.
  • the method for determining a location of a terminal device provided by the present application may include:
  • RRC radio resource control
  • the UE may acquire location information (represented by "Location Information-UE") of the terminal device from the eNB2/gNB2.
  • the UE acquires location information ("Location Information - UE") of the terminal device.
  • the UE sends an initial attach request/registration request message (initial Attach/Registration) to the MME/AMF through eNB1/gNB1.
  • the initial attach request message or the registration request message is a NAS message, where the NAS-PDU can carry location information of the terminal device.
  • eNB1/gNB1 forwards the initial attach request message/registration request message to the MME/AMF through the S1/N2 interface.
  • the eNB1/gNB1 packs the NAS-PDU (Location Information-UE) and the location information reported by the eNB1/gNB1 (indicated by "Location Information - eNB1/gNB1"), and transmits it to the MME/AMF through the S1/N2 interface.
  • NAS-PDU Location Information-UE
  • Location Information - eNB1/gNB1 Location Information
  • the MME/AMF sends a request message to the E-SMLC/LMF.
  • the request message carries the location information of the terminal device reported by the UE and the location information reported by the eNB1/gNB1.
  • the E-SMLC/LMF compares the location information of the terminal device reported by the UE at the NAS layer with the location information reported by the eNB/gNB1 through the S1/N2 interface.
  • the E-SMLC/LMF sends a request response message (response message) to the MME/AMF.
  • the request response message may carry a location comparison result, and the location comparison result indicates whether the location information of the terminal device reported by the UE and the location information reported by the eNB1/gNB1 match.
  • the MME/AMF may send an attach reject message or a registration reject message to the UE, where The cause value indicates that the location of the terminal device is inconsistent.
  • the subsequent process is performed normally, and the UE may receive the normal message sent by the MME/AMF.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to an LTE communication network or a 5G communication network.
  • the terminal device reports the location information of the terminal device to the mobility management device by using the initial attach request message or the registration request message, and the mobility management device transmits the location information of the terminal device and the location information reported by the base station to the location management device, where the location management device compares the terminal device Whether the location information of the reported terminal device matches the location information reported by the base station, whether the location of the terminal device is misjudged, the accuracy of determining the location of the terminal device is improved, and the charging dispute is avoided.
  • FIG. 6 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 4 of the present application.
  • this embodiment provides another specific implementation manner of the location determining method of the terminal device, which can be applied to the LTE communication system and the 5G communication system.
  • the network element involved in the LTE communication system may include a terminal device (UE), a base station eNB (first base station eNB1, second base station eNB2), and a mobility management device (MME).
  • the network elements involved in the 5G communication system may include: a terminal device (UE), a base station gNB (a first base station gNB1, a second base station gNB2), and a mobility management device (AMF).
  • UE terminal device
  • eNB first base station eNB1, second base station eNB2
  • MME mobility management device
  • the network elements involved in the 5G communication system may include: a terminal device (UE), a base station gNB (a first base station gNB
  • the first base station eNB1 and the second base station eNB2 may be the same base station, and the first base station gNB1 and the second base station gNB2 may be the same base station.
  • the method for determining a location of a terminal device may include:
  • RRC radio resource control
  • the UE may acquire location information (represented by "Location Information-UE") of the terminal device from the eNB2/gNB2.
  • the UE acquires location information of the terminal device.
  • the UE sends an initial attach request/registration request message (initial Attach/Registration) to the MME/AMF through eNB1/gNB1.
  • eNB1/gNB1 forwards the initial attach request message/registration request message to the MME/AMF through the S1/N2 interface.
  • the eNB1/gNB1 transmits the location information reported by the eNB1/gNB1 (indicated by "location information - eNB1/gNB1") to the MME/AMF through the S1/N2 interface.
  • the MME/AMF stores the location information reported by the eNB1/gNB1.
  • the MME/AMF sends a Non-Access Layer Security Mode Command (NAS Security Mode Command) message to the UE.
  • NAS Security Mode Command Non-Access Layer Security Mode Command
  • the UE sends a Non-Access Stratum Security Mode Command Complete Response message (NAS Security Mode complete) to the MME/AMF.
  • NAS Security Mode complete Non-Access Stratum Security Mode Command Complete Response message
  • the non-access stratum security mode completion message is a NAS message, where the NAS PDU can carry location information of the terminal device.
  • MME/AMF compares the location information of the terminal device reported by the NAS layer UE with the location information reported by the eNB1/gNB1 through the S1/N2 interface.
  • the attach reject message or the registration reject message may be sent to the UE, where The reason value carried indicates that the location of the terminal device is inconsistent.
  • the MME/AMF determines that the location information of the terminal device reported by the UE matches the location information reported by the eNB/gNB1 through the S1/N2 interface, the subsequent process is performed normally, and the UE may receive the normal response message sent by the MME/AMF.
  • the non-access stratum security mode command completion response message may further include indication information, where the indication information is used to indicate whether the location information of the terminal device is included in the non-access stratum security mode command completion response message.
  • steps 1 and 4 are not limited in this embodiment. Step 1 can be performed before step 7, and step 4 can be performed before step 8.
  • eNB1/gNB1 reports "location information - eNB1/gNB1", which may also be implemented in step 7, that is, eNB1/gNB1 may have any S1/N2 message between steps 1-7. Report location information in the middle.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to an LTE communication network or a 5G communication network.
  • the terminal device reports the location information of the terminal device to the mobility management device by using the non-access stratum security mode command completion response message, and the mobile management device compares the location information of the terminal device reported by the terminal device with the location information reported by the base station, and determines the terminal. Whether the location of the device is misjudged or not, and the billing dispute is avoided.
  • FIG. 7 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 5 of the present application.
  • this embodiment provides another specific implementation manner of the location determining method of the terminal device, which can be applied to the LTE communication system and the 5G communication system.
  • the network elements involved in the LTE communication system may include a terminal device (UE), a base station eNB (first base station eNB1, second base station eNB2), a mobility management device (MME), and a location management device (E-SMLC).
  • UE terminal device
  • eNB first base station eNB1, second base station eNB2
  • MME mobility management device
  • E-SMLC location management device
  • the network elements involved in the 5G communication system may include: a terminal device (UE), a base station gNB (a first base station gNB1, a second base station gNB2), a mobility management device (AMF), and a location management device (LMF).
  • UE terminal device
  • base station gNB a first base station gNB1, a second base station gNB2
  • AMF mobility management device
  • LMF location management device
  • the first base station eNB1 and the second base station eNB2 may be the same base station
  • the first base station gNB1 and the second base station gNB2 may be the same base station.
  • the method for determining a location of a terminal device provided by the present application may include:
  • 0-7 can refer to the embodiment shown in FIG. 6, and the principles are similar, and details are not described herein again.
  • the MME/AMF sends a request message to the E-SMLC/LMF.
  • the request message carries the location information of the terminal device reported by the UE and the location information reported by the eNB1/gNB1.
  • the E-SMLC/LMF compares the location information of the terminal device reported by the UE at the NAS layer with the location information reported by the eNB/gNB1 through the S1/N2 interface.
  • the E-SMLC/LMF sends a request response message (response message) to the MME/AMF.
  • the request response message may carry a location comparison result, and the location comparison result indicates whether the location information of the terminal device reported by the UE and the location information reported by the eNB1/gNB1 match.
  • the MME/AMF may send an attach reject message or a registration reject message to the UE, where The cause value indicates that the location of the terminal device is inconsistent.
  • the subsequent process is performed normally, and the UE may receive the normal message sent by the MME/AMF.
  • the non-access stratum security mode command completion response message may further include indication information, where the indication information is used to indicate whether the location information of the terminal device is included in the non-access stratum security mode command completion response message.
  • steps 1 and 4 are not limited in this embodiment. Step 1 can be performed before step 7, and step 4 can be performed before step 8.
  • eNB1/gNB1 reports "location information - eNB1/gNB1", which may also be implemented in step 7, that is, eNB1/gNB1 may have any S1/N2 message between steps 1-7. Report location information in the middle.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to an LTE communication network or a 5G communication network.
  • the terminal device reports the location information of the terminal device to the mobility management device by using the non-access stratum security mode command completion response message, and the mobility management device transmits the location information of the terminal device and the location information reported by the base station to the location management device, where the location management device compares Whether the location information of the terminal device reported by the terminal device matches the location information reported by the base station, whether the location of the terminal device is misjudged or not, and the charging dispute is avoided.
  • FIG. 8 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 6 of the present application.
  • the method for determining the location of the terminal device provided in this embodiment can be applied to a 5G communication system.
  • the network elements involved in the 5G communication system may include: a terminal device (UE), a base station (a first base station gNB1 and a second base station gNB2), and a core network (AMF, AUSE, and UDM). It should be noted that in some scenarios, the first base station gNB1 and the second base station gNB2 may be the same base station.
  • the method for determining a location of a terminal device provided by the present application may include:
  • the UE establishes an RRC connection with gNB2.
  • the UE may acquire location information (represented by "Location Information-UE") of the terminal device from the gNB2.
  • the location information of the terminal device may be location information (eg, TAI) of gNB2.
  • the UE sends a registration request message (Registration Request) to the AMF through gNB1.
  • the registration request message is a NAS message.
  • the registration request message sent by gNB1 to the AMF includes the location information of gNB1 (indicated by "Location Information - gNB1").
  • the AMF sends an Authentication Initial Request (Authentication Initiation Request) to the AUSF.
  • the authentication initial request message includes "location information - gNB1".
  • the AUSF sends an Authentication Information Request message to the UDM.
  • the authentication information request message includes "location information - gNB1".
  • the UE initiates a registration process.
  • the AMF obtains the location information reported by the gNB1 through the N2 interface, and then reports the location information reported by the gNB1 to the UDM through the AUSF.
  • XRES* represents an expected response for 5G
  • KDF() represents a key derivation function
  • XRES** represents a location information authentication expected response value
  • Ki is the user
  • the user's root key is stored in the data management device (such as UDM), and RAND is a random number.
  • the UDM can determine the authentication parameter XRES** according to the location information reported by the gNB1.
  • an identifier may be set, the identifier being used to indicate that the UE is required to use the location information-UE to calculate the RES**.
  • the identification can be set in the AUTN.
  • the flag may be carried exclusively by one parameter and passed to the UE via AUSF/AMF.
  • the UDM sends an Authentication Information Response message to the AUSF.
  • the authentication information response message includes RAND, AUTN, Kausf, XRES**.
  • RAND represents a random number
  • AUTN represents an authentication token
  • Kausf represents an AUSF key (Keys for AUSF).
  • the AUSF sends an Authentication Initiation Response (Agency Initiation Response) to the AMF.
  • the authentication initial response message includes RAND, AUTN, Kausf, HXRES* (the abstract value of the expected response Hash eXpected RESponse).
  • the AMF sends an Authentication Request message to the UE through gNB1.
  • the authentication request message includes RAND, AUTN.
  • the RES* indicates an authentication response value (response), and the RES** indicates that the location information authentication expected response value is included, where Ki is the root key of the user saved on the user USIM, and RAND is a random number.
  • the UE may determine the authentication parameter RES** according to the obtained location information of the terminal device.
  • the UE may further determine, according to the identifier sent by the network side, whether to use the location information-UE to calculate the RES**. If the UE calculates RES**, it sends RES** to the AMF. Otherwise send RES* to AMF.
  • the UE sends an Authentication response message to the AMF through gNB1.
  • the RES** is included in the authentication response message.
  • AMF calculates HRES** based on RES** and compares it to HRES*.
  • HRES** indicates (the digest value of the response containing the location information) and HRES* (the digest value of the response is Hash RESponse).
  • the AMF may send an authentication rejection message to the UE through gNB1.
  • the AMF can also compare whether the location information of the terminal device reported by the UE and the location information reported by the gNB1 are consistent. If the location information of the terminal device reported by the UE is the same as the location information reported by the gNB1, the authentication reject message may carry the cause value. The cause value indicates that the location of the user equipment is inconsistent. The location information of the terminal device reported by the UE may be carried in the non-access stratum message before the step 10, so that the location information of the terminal device reported by the UE is sent to the AMF.
  • steps 5-7 and 9-10 can refer to the existing authentication process, and the related information (Authentication Information Response, Authentication Initiation Response, Authentication Request, Authentication response) and related parameters (RAND, AUTN, Kausf) and The existing authentication process is similar.
  • the difference is that the XRES** is determined by the UDM according to the location information - gNB1, and the RES** is determined by the UE according to the location information - UE.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to a 5G communication network.
  • the terminal device determines the RES** by the obtained location information of the terminal device, and transmits the RES** to the AMF.
  • the UDM determines the XRES** according to the location information reported by the base station, and the AMF determines the HRES* according to the XRES**, and compares it with the HRES** determined according to the RES** to determine whether the HRES* and the HRES** are consistent, and can determine the terminal device. Whether there is a misjudgment of the location improves the accuracy of the location determination of the terminal device.
  • FIG. 9 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 7 of the present application.
  • the location determining method of the terminal device provided by this embodiment may be applied to a 5G communication system.
  • the network elements involved in the 5G communication system may include: a terminal device (UE), a base station (a first base station gNB1 and a second base station gNB2), and a core network device (AMF, AUSE, and UDM). It should be noted that in some scenarios, the first base station gNB1 and the second base station gNB2 may be the same base station.
  • the method for determining a location of a terminal device provided by the present application may include:
  • the AMF sends an Authentication Confirmation Request message to the AUSF.
  • the authentication confirmation request message includes the RES** reported by the UE.
  • AUSF compares RES** with XRES** to determine if RES** is consistent with XRES**.
  • the AUSF may send an authentication rejection message to the AMF.
  • the AUSF or the AMF may also compare whether the location information of the terminal device reported by the UE and the location information reported by the gNB1 are consistent. If the location information of the terminal device reported by the UE is the same as the location information reported by the gNB1, the authentication reject message may carry the cause value. The cause value indicates that the location of the user equipment is inconsistent.
  • the location information of the terminal device reported by the UE may be carried in the non-access stratum message before the step 11, so that the location information of the terminal device reported by the UE is sent to the AUSF or the AMF.
  • the AUSF can send an Authentication Confirmation Response message to the AMF.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to a 5G communication network.
  • the terminal device determines the RES** by the obtained location information of the terminal device, and transmits the RES** to the AUSF through the AMF.
  • the UDM determines XRES** according to the location information reported by the base station.
  • the AUSF compares whether the RES** and the XRES** are consistent, and can determine whether the location of the terminal device is misjudged, and improves the accuracy of determining the location of the terminal device.
  • FIG. 10 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 8 of the present application.
  • the location determining method of the terminal device provided by this embodiment may be applied to an LTE communication system.
  • the network elements involved in the LTE communication system may include: a terminal device (UE), a base station (a first base station eNB1 and a second base station eNB2), and a core network device (MME and HSS). It should be noted that in some scenarios, the first base station eNB1 and the second base station eNB2 may be the same base station.
  • the method for determining a location of a terminal device provided by the present application may include:
  • the UE establishes an RRC connection with eNB2.
  • the UE may acquire location information (represented by "Location Information-UE") of the terminal device from the eNB2.
  • the location information of the terminal device may be location information (for example, TAI) of the eNB2.
  • the UE sends a registration request message (Registration Request) to the MME through the eNB1.
  • Registration Request a registration request message
  • the registration request message is a NAS message.
  • the registration request message transmitted by the eNB1 to the MME includes location information of the eNB1 (indicated by "Location Information - eNB1").
  • the MME sends an Authentication Information Request message to the HSS.
  • the authentication information request message includes "location information - eNB1".
  • the UE initiates a registration process.
  • the MME obtains the location information reported by the eNB1 through the S1 interface, and then reports the location information reported by the eNB1 to the HSS.
  • XRES represents the expected expected response for 4G
  • Ki is the same root key stored in the HSS and USIM card
  • RAND is a random number.
  • the HSS can determine the authentication parameter XRES** according to the location information reported by the eNB1.
  • an identifier may be set, the identifier being used to indicate that the UE is required to use the location information-UE to calculate the RES**.
  • the identification can be set in the AUTN.
  • the flag may be carried by one parameter exclusively and delivered to the UE through the MME.
  • the HSS sends an Authentication Information Response message to the MME.
  • the authentication information response message includes RAND, AUTN, Kasme, XRES**.
  • Kasme represents the key to access the security management entity Access Security Management Entity.
  • the MME sends an Authentication Request message to the UE through the eNB1.
  • the authentication request message includes RAND, AUTN.
  • RES represents the authentication response value (response)
  • RES** represents the location information authentication expected response value
  • Ki is the user's root key in the user SIM
  • RAND is a random number.
  • the UE may determine the authentication parameter RES** according to the obtained location information of the terminal device.
  • the UE may further determine, according to the identifier sent by the network side, whether to use the location information-UE to calculate the RES**. If the UE calculates RES**, RES** is sent to the MME. Otherwise, the RES is sent to the MME.
  • the UE sends an Authentication Response message to the MME through the eNB1.
  • the RES** is included in the authentication response message.
  • MME compares RES** with XRES** to determine if RES** is consistent with XRES**.
  • the MME may send an authentication rejection message to the UE through the eNB1.
  • the MME may further compare whether the location information of the terminal device reported by the UE and the location information reported by the eNB1 are consistent. If the location information of the terminal device reported by the UE is consistent with the location information reported by the eNB1, the authentication reject message may carry the cause value. The cause value indicates that the location of the user equipment is inconsistent.
  • the location information of the terminal device reported by the UE may be carried in the non-access stratum message before the step 8, so that the location information of the terminal device reported by the UE is sent to the MME.
  • steps 4-5 and 7 can refer to the existing authentication process, the related information (Authentication Information Response, Authentication Request, Authentication response) and related parameters (RAND, AUTN, Kasme) and existing authentication.
  • the process is similar. The difference is that the XRES** is determined by the HSS according to the location information - eNB1, and the RES** is determined by the UE according to the location information - UE.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to an LTE communication network.
  • the terminal device determines the RES** by the obtained location information of the terminal device, and transmits the RES** to the MME.
  • the HSS determines XRES** according to the location information reported by the base station, and the MME determines whether the RES** and the XRES** are consistent, and can determine whether the location of the terminal device is misjudged, and improves the accuracy of determining the location of the terminal device.
  • FIG. 11 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 9 of the present application.
  • the location determining method of the terminal device provided by this embodiment may be applied to a 5G communication system.
  • the network elements involved in the 5G communication system may include: a terminal device (UE), a base station (a first base station gNB1 and a second base station gNB2), and a core network device (AMF, AUSE, and UDM). It should be noted that in some scenarios, the first base station gNB1 and the second base station gNB2 may be the same base station.
  • the method for determining a location of a terminal device provided by the present application may include:
  • the UE establishes an RRC connection with gNB2.
  • the UE may acquire location information (represented by "Location Information-UE") of the terminal device from the gNB2.
  • the location information of the terminal device may be location information (eg, TAI) of gNB2.
  • the UE sends a registration request message (Registration Request) to the AMF through gNB1.
  • the registration request message is a NAS message.
  • the registration request message sent by gNB1 to the AMF includes the location information of gNB1 (indicated by "Location Information - gNB1").
  • the AMF sends an Authentication Initial Request (Authentication Initiation Request) to the AUSF.
  • the authentication initial request message includes "location information - gNB1".
  • the AUSF sends an Authentication Information Request message to the UDM.
  • the UDM sends an Authentication Information Response message to the AUSF.
  • the authentication information response message includes RAND, AUTN, Kausf, and XRES*.
  • the AUSF can determine the authentication parameters XRES** and HXRES** according to the location information reported by gNB1.
  • HXRES** represents a digest value of the expected response containing the location information.
  • the AUSF may set an identifier, where the identifier is used to indicate that the UE is required to use the location information-UE to calculate the RES**.
  • the identification can be set in the AUTN.
  • the flag may be carried exclusively by one parameter and passed to the UE via the AMF.
  • the AUSF sends an Authentication Initiation Response (Agency Initiation Response) to the AMF.
  • the authentication initial response message includes RAND, AUTN, Kausf, HXRES**.
  • the AMF sends an Authentication Request message to the UE through gNB1.
  • the authentication request message includes RAND, AUTN.
  • the UE may determine the authentication parameter RES** according to the obtained location information of the terminal device.
  • the UE may further determine, according to the identifier sent by the network side, whether to use the location information-UE to calculate the RES**. If the UE calculates RES**, it sends RES** to the AMF. Otherwise send RES* to AMF.
  • the UE sends an Authentication response message to the AMF through gNB1.
  • the RES** is included in the authentication response message.
  • AMF calculates HRES** based on RES** and compares it to HXRES**.
  • the AMF may send an authentication rejection message to the UE through the gNB1.
  • the AMF can also compare whether the location information of the terminal device reported by the UE and the location information reported by the gNB1 are consistent. If the location information of the terminal device reported by the UE is the same as the location information reported by the gNB1, the authentication reject message may carry the cause value. The cause value indicates that the location of the user equipment is inconsistent. The location information of the terminal device reported by the UE may be carried in the non-access stratum message before the step 10, so that the location information of the terminal device reported by the UE is sent to the AMF.
  • Steps 0-2, 7-9 in this embodiment are similar to steps 0-2, 7-9 in the embodiment shown in FIG.
  • XRES** is calculated by UDM and HXRES* is calculated by AUSF.
  • XRES** and HXRES** are calculated by the AUSF.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to a 5G communication network.
  • the terminal device determines the RES** by the obtained location information of the terminal device, and transmits the RES** to the AMF.
  • the AUSF determines XRES** and HXRES** according to the location information reported by the base station, and the AMF determines whether the HRES** and the HXRES** determined according to the RES** are consistent, and can determine whether the location of the terminal device is misjudged, and improve the location of the terminal device. Determine the accuracy.
  • FIG. 12 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 10 of the present application.
  • the location determining method of the terminal device provided by this embodiment may be applied to a 5G communication system.
  • the network elements involved in the 5G communication system may include: a terminal device (UE), a base station (a first base station gNB1 and a second base station gNB2), and a core network device (AMF, AUSE, and UDM). It should be noted that in some scenarios, the first base station gNB1 and the second base station gNB2 may be the same base station.
  • the method for determining a location of a terminal device provided by the present application may include:
  • the AMF sends an Authentication Confirmation Request message to the AUSF.
  • the authentication confirmation request message includes the RES** reported by the UE.
  • AUSF compares RES** with XRES** to determine if RES** is consistent with XRES**.
  • the AUSF may send an authentication rejection message to the AMF.
  • the AUSF or the AMF may also compare whether the location information of the terminal device reported by the UE and the location information reported by the gNB1 are consistent. If the location information of the terminal device reported by the UE is the same as the location information reported by the gNB1, the authentication reject message may carry the cause value. The cause value indicates that the location of the user equipment is inconsistent.
  • the location information of the terminal device reported by the UE may be carried in the non-access stratum message before the step 11, so that the location information of the terminal device reported by the UE is sent to the AUSF or the AMF.
  • the AUSF can send an Authentication Confirmation Response message to the AMF.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to a 5G communication network.
  • the terminal device determines the RES** by the obtained location information of the terminal device, and transmits the RES** to the AUSF through the AMF.
  • the AUSF determines XRES** according to the location information reported by the base station.
  • the AUSF compares whether the RES** and the XRES** are consistent, and can determine whether the location of the terminal device is misjudged, and improves the accuracy of determining the location of the terminal device.
  • FIG. 13 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 11 of the present application.
  • the location determining method of the terminal device provided by this embodiment may be applied to an LTE communication system.
  • the network elements involved in the LTE communication system may include: a terminal device (UE), a base station (a first base station eNB1 and a second base station eNB2), and a core network device (MME and HSS). It should be noted that in some scenarios, the first base station eNB1 and the second base station eNB2 may be the same base station.
  • the method for determining a location of a terminal device provided by the present application may include:
  • the UE establishes an RRC connection with eNB2.
  • the UE may acquire location information (represented by "Location Information-UE") of the terminal device from the eNB2.
  • the location information of the terminal device may be location information (for example, TAI) of the eNB2.
  • the UE sends a registration request message (Registration Request) to the MME through the eNB1.
  • Registration Request a registration request message
  • the registration request message is a NAS message.
  • the registration request message transmitted by the eNB1 to the MME includes location information of the eNB1 (indicated by "Location Information - eNB1").
  • the MME sends an Authentication Information Request message to the HSS.
  • the HSS sends an Authentication Information Response message to the MME.
  • the authentication information response message includes RAND, AUTN, Kasme, and XRES.
  • the MME can determine the authentication parameter XRES** according to the location information reported by the eNB1.
  • an identifier may be set, the identifier being used to indicate that the UE is required to use the location information-UE to calculate the RES**.
  • the identification can be set in the AUTN.
  • the flag may be carried by a parameter and delivered to the UE.
  • the MME sends an Authentication Request message to the UE through the eNB1.
  • the authentication request message includes RAND, AUTN.
  • the UE may determine the authentication parameter RES** according to the obtained location information of the terminal device.
  • the UE may further determine, according to the identifier sent by the network side, whether to use the location information-UE to calculate the RES**. If the UE calculates RES**, RES** is sent to the MME. Otherwise, the RES is sent to the MME.
  • the UE sends an Authentication Response message to the MME through the eNB1.
  • the RES** is included in the authentication response message.
  • MME compares RES** with XRES** to determine if RES** is consistent with XRES**.
  • the MME may send an authentication rejection message to the UE through the eNB1.
  • the MME may further compare whether the location information of the terminal device reported by the UE and the location information reported by the eNB1 are consistent. If the location information of the terminal device reported by the UE is consistent with the location information reported by the eNB1, the authentication reject message may carry the cause value. The cause value indicates that the location of the user equipment is inconsistent.
  • the location information of the terminal device reported by the UE may be carried in the non-access stratum message before the step 8, so that the location information of the terminal device reported by the UE is sent to the MME.
  • XRES** is calculated by the HSS.
  • XRES** is calculated by the MME.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to an LTE communication network.
  • the terminal device determines the RES** by the obtained location information of the terminal device, and transmits the RES** to the MME.
  • the MME determines the XRES** according to the location information reported by the base station, and determines whether the RES** and the XRES** are consistent, and can determine whether the location of the terminal device is misjudged, thereby improving the accuracy of determining the location of the terminal device.
  • FIG. 14 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 12 of the present application.
  • the method for determining the location of the terminal device provided in this embodiment may be applied to a 4G communication network or a 5G communication network.
  • the network element involved in this embodiment may include a terminal device, a base station, and a core network device.
  • the terminal device and the core network device can communicate with each other through the base station (here, the first base station).
  • the method for determining the location of the terminal device provided in this embodiment may include:
  • the core network device acquires location information reported by the first base station.
  • the core network device determines a non-access stratum integrity protection key according to the location information reported by the first base station.
  • the core network device is a mobility management network element
  • the non-access stratum integrity protection key is determined according to the location information reported by the first base station, and may include:
  • the core network device sends a non-access stratum security mode command message to the terminal device.
  • the non-access stratum security mode command message is integrity protected by using a non-access stratum integrity protection key.
  • the terminal device receives the non-access stratum security mode command message sent by the core network device.
  • the terminal device determines a non-access stratum integrity protection key according to the current location information of the terminal device.
  • the terminal device performs integrity verification on the non-access stratum security mode command message according to the non-access stratum integrity protection key.
  • the core network device determines the non-access stratum integrity protection key according to the location information reported by the base station, and uses the non-access stratum integrity protection key pair to non-access Layer security mode command messages are integrity protected.
  • the terminal device determines the non-access stratum integrity protection key according to the current location information of the terminal device, and performs integrity check on the non-access stratum security mode command message according to the non-access stratum integrity protection key. If the location information reported by the base station does not match the current location information of the terminal device, the integrity protection check cannot pass. If the location information reported by the base station matches the current location information of the terminal device, the integrity protection check may pass.
  • the method for determining a location of the terminal device may further include:
  • the terminal device fails the integrity check of the non-access stratum security mode command message according to the non-access stratum integrity protection key, the non-access stratum security mode reject message is sent to the core network device.
  • the core network may send the location information of the first base station to the terminal device by using a NAS SMC message.
  • the first base station packetizes the location information of the first base station and the NAS PDU to the terminal device.
  • the terminal device fails the integrity check of the non-access stratum security mode command (NAS SMC) message
  • the terminal device may compare the location information of the terminal device with the location information of the first base station, thereby determining the terminal device. Is the location incorrect?
  • the terminal device determines whether the location of the terminal device is incorrect according to the location information of the terminal device. For details, refer to the description of the embodiment shown in FIG. 3, and details are not described herein again. If the terminal device determines that the location information of the terminal device does not match the location information of the first base station, the security mode reject message of the non-access stratum may carry a cause value indicating that the location is inconsistent.
  • the non-access stratum security mode reject message may carry the cause value and the location information of the terminal device. Subsequently, the core network device can match whether the location information reported by the first base station matches the location information of the terminal device reported by the terminal device.
  • the method for determining a location of the terminal device may further include:
  • the core network device If the core network device receives the security mode command reject message sent by the terminal device, the device sends an attach reject or registration reject message to the terminal device.
  • the core network device may compare the location information of the first base station with the location information of the terminal device reported by the terminal device. If the core network device determines that the location information of the terminal device does not match the location information reported by the first base station, the attachment rejection message or the registration rejection message may carry a cause value indicating that the location information is inconsistent.
  • the location information of the terminal device reported by the terminal device may also be carried in the non-access stratum message before the S206, so that the location information of the terminal device is reported to the core network device.
  • An embodiment of the present application provides a method for determining a location of a terminal device, where the core network device obtains the location information reported by the first base station, and the core network device determines the non-access stratum integrity protection key according to the location information reported by the first base station.
  • the core network device sends a non-access stratum security mode command message to the terminal device, and the terminal device determines the non-access stratum integrity protection key according to the current location information of the terminal device, and non-accesses according to the non-access stratum integrity protection key pair.
  • the layer security mode command message is integrity checked.
  • the method for determining the location of the terminal device provided by the embodiment, by applying the location information reported by the base station and the current location information of the terminal device to the derivation process of the non-access stratum key, avoids the terminal device access when the location information does not match.
  • the network improves the security of communications.
  • FIG. 15 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 13 of the present application.
  • This embodiment provides a specific implementation manner of the location determining method of the terminal device on the basis of the embodiment shown in FIG.
  • the location determining method of the terminal device provided by this embodiment may be applied to a 5G communication system.
  • the network elements involved in the 5G communication system may include: a terminal device (UE), a base station (a first base station gNB1 and a second base station gNB2), a core network device (AMF), AUSE, and a UDM).
  • the first base station gNB1 and the second base station gNB2 may be the same base station.
  • the method for determining a location of a terminal device provided by the present application may include:
  • the UE establishes an RRC connection with gNB2.
  • the UE may acquire location information (represented by "Location Information-UE") of the terminal device from the gNB2.
  • the location information of the terminal device may be location information (eg, TAI) of gNB2.
  • the UE sends a registration request message (Registration Request) to the AMF through gNB1.
  • the registration request message is a NAS message.
  • the registration request message sent by gNB1 to the AMF includes the location information of gNB1 (indicated by "Location Information - gNB1").
  • the AMF derives the KAMF* by using the location information (location information - gNB1) reported by gNB1 as a parameter.
  • KAMF* can be determined by any of the following methods.
  • KAMF* KDF (KSEAF, SUPI, ABBA parameter, location information - gNB1).
  • KAMF* KDF (KDF (KSEAF, SUPI, ABBA parameter), position information - gNB1).
  • KAMF* indicates the key of the access and mobility management function (access and mobility management function) including location information
  • KSEAF indicates the key of the security anchor function Security Anchor Function
  • SUPI indicates that the user permanently identifies the subscriber permanent identifier.
  • ABBA parameter indicates the Anti-Bidding down Between Architectures parameter to prevent downgrade attacks.
  • NAS-int-alg represents the NAS integrity protection algorithm
  • Alg-ID represents the identifier of the algorithm
  • KNASint* represents the integrity protection key of the NAS layer containing the location information.
  • the AMF sends a non-access stratum security mode command message (NAS Security Mode Command) to the UE through gNB1.
  • NAS Security Mode Command non-access stratum security mode command message
  • the UE derives the location information (Location Information-UE) of the acquired terminal device as a parameter to derive KAMF.
  • KAMF can be determined by any of the following methods.
  • KAMF KDF (KSEAF, SUPI, ABBA parameter, location information - UE).
  • KAMF KDF (KDF (KSEAF, SUPI, ABBA parameter), location information - UE).
  • KAMF indicates the key used by AMF.
  • KDF KDF
  • KNASint represents the key of the integrity protection of the NAS layer.
  • the UE sends a non-access stratum security mode complete message (NAS Security Mode Complete) or a non-access stratum security mode reject message (NAS Security Mode Reject) to the AMF through gNB1.
  • NAS Security Mode Complete non-access stratum security mode complete message
  • NAS Security Mode Reject non-access stratum security mode reject message
  • step 6 the UE sends a NAS Security Mode Complete message to the AMF. If the verification fails in step 6, the UE sends a NAS Security Mode Reject message to the AMF.
  • the method for determining a location of the terminal device may further include:
  • the UE If the UE fails the integrity check of the non-access stratum security mode command message according to the non-access stratum integrity protection key, the UE sends a non-access stratum security mode reject message to the core network device.
  • the core network may send the location information of the first base station to the UE by using a NAS SMC message.
  • the first base station packetizes the location information of the first base station and the NAS PDU to the UE.
  • the UE fails the integrity check of the non-access stratum security mode command (NAS SMC) message
  • the UE may compare whether the location information of the UE matches the location information of the first base station, thereby determining whether the location of the UE is incorrect. .
  • the UE determines whether the location of the UE is incorrect according to the location information of the UE. For details, refer to the description of the embodiment shown in FIG. 3, and details are not described herein again. If the UE determines that the location information of the UE does not match the location information of the first base station, the security mode reject message of the non-access stratum may carry a cause value indicating that the location is inconsistent.
  • the non-access stratum security mode reject message may carry the cause value and the location information of the UE. Subsequently, the core network device can compare whether the location information reported by the first base station matches the location information of the UE reported by the UE.
  • the method for determining a location of the terminal device may further include:
  • the core network device receives the security mode command reject message sent by the UE, it sends an attach reject or registration reject message to the UE.
  • the core network device may compare the location information of the first base station with the location information of the UE reported by the UE. If the core network device determines that the location information of the UE does not match the location information reported by the first base station, the attach reject message or the registration reject message may carry a cause value indicating that the location information is inconsistent.
  • AUSF sends Kseaf to SEAF/AMF, which in turn derives Kamf from Kseaf and derives the NAS integrity protection key from Kamf.
  • the UE side derives the NAS integrity protection key by the same method as above, but the location information parameter is the location information-UE.
  • the AMF may also send the location information (location information - gNB1) reported by gNB1 to the AUSF, and the AUSF sends the location information - gNB1 to the UDM.
  • IK' KDF(CK
  • the UDM then sends the Kausf to the AUSF or CK', IK' to the AUSF (at which time the AUSF generates Kausf from CK', IK').
  • AUSF generates Kseaf based on Kausf.
  • AUSF sends Kseaf to SEAF/AMF, which in turn derives Kamf from Kseaf and derives the NAS integrity protection key from Kamf.
  • the UE side derives the NAS integrity protection key by the same method as above, but the location information parameter is the location information-UE.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to a 5G communication network.
  • the AMF can complete the derivation of the NAS integrity key and the integrity protection of the NAS message through the location information reported by the base station.
  • the terminal device can complete the derivation of the NAS integrity key and the NAS message by obtaining the location information of the terminal device. In the test, when the location information does not match, the terminal device is prevented from accessing the network, and the security performance of the communication is improved.
  • FIG. 16 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 14 of the present application.
  • This embodiment provides a specific implementation manner of the location determining method of the terminal device on the basis of the embodiment shown in FIG.
  • the location determining method of the terminal device provided by this embodiment may be applied to an LTE communication system.
  • the network elements involved in the LTE communication system may include: a terminal device (UE), a base station (a first base station eNB1 and a second base station eNB2), and a core network device (MME and HSS). It should be noted that in some scenarios, the first base station eNB1 and the second base station eNB2 may be the same base station.
  • the method for determining the location of the terminal device provided by the application may include:
  • the UE establishes an RRC connection with eNB2.
  • the UE may acquire location information (represented by "Location Information-UE") of the terminal device from the eNB2.
  • the location information of the terminal device may be location information (for example, TAI) of the eNB2.
  • the UE sends a registration request message (Registration Request) to the MME through the eNB1.
  • Registration Request a registration request message
  • the registration request message is a NAS message.
  • the registration request message transmitted by the eNB1 to the MME includes location information of the eNB1 (indicated by "Location Information - eNB1").
  • the MME sends an Authentication Data Request message to the HSS.
  • the authentication data request information includes location information reported by the eNB1.
  • the MME derives the location information (location information - gNB1) reported by gNB1 as a parameter to derive KASME*.
  • KASME* can be determined by any of the following methods.
  • a.KASME* KDF(SN id, SQN+AK, CK, IK, location information-eNB1)
  • b.KASME* KDF(KDF(SN id, SQN+AK, CK, IK), location information-eNB1)
  • KASME* indicates the access security management entity key containing the location information
  • SN id indicates the service network identity serving network identity
  • SQN indicates the sequence number sequence number
  • AK indicates the anonymous key anonymity key
  • CK indicates the encryption key cipher key.
  • IK represents the integrity protection key integrity key.
  • the HSS sends an Authentication Data Respose to the MME.
  • the authentication data response message includes AVs and KASME*.
  • AVs represents an authentication vector authorization vector.
  • KNASint* KDF (KASME*, NAS-int-alg, Alg-ID) and uses KNASint* to perform integrity protection on NAS SMC messages.
  • the MME sends a non-access stratum security mode command message (NAS Security Mode Command) to the UE through the eNB1.
  • NAS Security Mode Command non-access stratum security mode command message
  • the UE derives the KASME using the obtained location information (Location Information - UE) of the terminal device as a parameter.
  • the KASME can be determined by any of the following methods.
  • KASME KDF (SN id, SQN + AK, CK, IK, location information - UE).
  • KASME KDF (KDF (SN id, SQN + AK, CK, IK), location information - UE).
  • KDF KASME, NAS-int-alg, Alg-ID
  • KASME indicates access security management entity key, KNASintNAS layer integrity protection key representation.
  • the UE sends a non-access stratum security mode complete message (NAS Security Mode Complete) or a non-access stratum security mode reject message (NAS Security Mode Reject) to the MME through the eNB1.
  • NAS Security Mode Complete non-access stratum security mode complete message
  • NAS Security Mode Reject non-access stratum security mode reject message
  • step 8 the UE sends a NAS Security Mode Complete message to the MME. If the verification fails in step 8, the UE sends a NAS Security Mode Reject message to the MME.
  • the method for determining a location of the terminal device may further include:
  • the UE If the UE fails the integrity check of the non-access stratum security mode command message according to the non-access stratum integrity protection key, the UE sends a non-access stratum security mode reject message to the core network device.
  • the core network may send the location information of the first base station to the UE by using a NAS SMC message.
  • the first base station packetizes the location information of the first base station and the NAS PDU to the UE.
  • the UE fails the integrity check of the non-access stratum security mode command (NAS SMC) message
  • the UE may compare whether the location information of the UE matches the location information of the first base station, thereby determining whether the location of the UE is incorrect. .
  • the UE determines whether the location of the UE is incorrect according to the location information of the UE. For details, refer to the description of the embodiment shown in FIG. 3, and details are not described herein again. If the UE determines that the location information of the UE does not match the location information of the first base station, the security mode reject message of the non-access stratum may carry a cause value indicating that the location is inconsistent.
  • the non-access stratum security mode reject message may carry the cause value and the location information of the UE. Subsequently, the core network device can compare whether the location information reported by the first base station matches the location information of the UE reported by the UE.
  • the method for determining a location of the terminal device may further include:
  • the core network device receives the security mode command reject message sent by the UE, it sends an attach reject or registration reject message to the UE.
  • the core network device may compare the location information of the first base station with the location information of the UE reported by the UE. If the core network device determines that the location information of the UE does not match the location information reported by the first base station, the attach reject message or the registration reject message may carry a cause value indicating that the location information is inconsistent.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to an LTE communication network.
  • the HSS can obtain the KASME* through the location information reported by the base station, and the MME can complete the derivation of the NAS integrity key and integrity protection of the NAS message according to the KASME*.
  • the terminal device can complete the derivation of the NAS integrity key and verify the NAS message by obtaining the location information of the terminal device. When the location information does not match, the terminal device is prevented from accessing the network, and the security performance of the communication is improved.
  • FIG. 17 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 15 of the present application.
  • This embodiment provides a specific implementation manner of the location determining method of the terminal device on the basis of the embodiment shown in FIG.
  • the location determining method of the terminal device provided by this embodiment may be applied to an LTE communication system.
  • the network elements involved in the LTE communication system may include: a terminal device (UE), a base station (a first base station eNB1 and a second base station eNB2), and a core network device (MME and HSS). It should be noted that in some scenarios, the first base station eNB1 and the second base station eNB2 may be the same base station.
  • the method for determining a location of a terminal device provided by the present application may include:
  • the UE establishes an RRC connection with eNB2.
  • the UE may acquire location information (represented by "Location Information-UE") of the terminal device from the eNB2.
  • the location information of the terminal device may be location information (for example, TAI) of the eNB2.
  • the UE sends a registration request message (Registration Request) to the MME through the eNB1.
  • Registration Request a registration request message
  • the registration request message is a NAS message.
  • the registration request message transmitted by the eNB1 to the MME includes location information of the eNB1 (indicated by "Location Information - eNB1").
  • the MME derives KNASint* by using the location information reported by eNB1 - eNB1 as a parameter.
  • KNASint* can be determined by any of the following methods.
  • KNASint* KDF (KASME, NAS-int-alg, Alg-ID, location information - eNB1).
  • KNASint* KDF (KDF (KASME, NAS-int-alg, Alg-ID), location information - eNB1).
  • the MME initiates the NAS SMC process, and then uses KNASint* to perform integrity protection on the NAS SMC message.
  • the MME sends a non-access stratum security mode command message (NAS Security Mode Command) to the UE through the eNB1.
  • NAS Security Mode Command non-access stratum security mode command message
  • the UE derives KNASint with the obtained location information - UE as a parameter.
  • KNASint can be determined by any of the following methods.
  • KNASint KDF (KASME, NAS-int-alg, Alg-ID, Location Information - UE).
  • KNASint KDF (KDF (KASME, NAS-int-alg, Alg-ID), location information - UE).
  • the UE uses KNASint to perform integrity check on the NAS SMC message.
  • the UE sends a non-access stratum security mode complete message (NAS Security Mode Complete) or a non-access stratum security mode reject message (NAS Security Mode Reject) to the MME through the eNB1.
  • NAS Security Mode Complete non-access stratum security mode complete message
  • NAS Security Mode Reject non-access stratum security mode reject message
  • step 6 if the check in step 6 is passed, the UE sends a NAS Security Mode Complete message to the MME. If the verification fails in step 6, the UE sends a NAS Security Mode Reject message to the MME.
  • the method for determining a location of the terminal device may further include:
  • the UE If the UE fails the integrity check of the non-access stratum security mode command message according to the non-access stratum integrity protection key, the UE sends a non-access stratum security mode reject message to the core network device.
  • the core network may send the location information of the first base station to the UE by using a NAS SMC message.
  • the first base station packetizes the location information of the first base station and the NAS PDU to the UE.
  • the UE fails the integrity check of the non-access stratum security mode command (NAS SMC) message
  • the UE may compare whether the location information of the UE matches the location information of the first base station, thereby determining whether the location of the UE is incorrect. .
  • the UE determines whether the location of the UE is incorrect according to the location information of the UE. For details, refer to the description of the embodiment shown in FIG. 3, and details are not described herein again. If the UE determines that the location information of the UE does not match the location information of the first base station, the security mode reject message of the non-access stratum may carry a cause value indicating that the location is inconsistent.
  • the non-access stratum security mode reject message may carry the cause value and the location information of the UE. Subsequently, the core network device can compare whether the location information reported by the first base station matches the location information of the UE reported by the UE.
  • the method for determining a location of the terminal device may further include:
  • the core network device receives the security mode command reject message sent by the UE, it sends an attach reject or registration reject message to the UE.
  • the core network device may compare the location information of the first base station with the location information of the UE reported by the UE. If the core network device determines that the location information of the UE does not match the location information reported by the first base station, the attach reject message or the registration reject message may carry a cause value indicating that the location information is inconsistent.
  • the HSS calculates the KASME* according to the location information reported by the base station, and the MME performs the derivation of the NAS integrity key according to the KASME*.
  • the MME directly performs the derivation of the NAS integrity key according to the location information reported by the device.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to an LTE communication network.
  • the MME can complete the derivation of the NAS integrity key and integrity protection of the NAS message through the location information reported by the eNB.
  • the terminal device can complete the derivation of the NAS integrity key and verify the NAS message by obtaining the location information of the terminal device. When the location information does not match, the terminal device is prevented from accessing the network, and the security performance of the communication is improved.
  • FIG. 18 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 16 of the present application.
  • the method for determining the location of the terminal device provided in this embodiment may be applied to a 4G communication network or a 5G communication network.
  • the network element involved in this embodiment may include a terminal device, a base station, and a core network device.
  • the terminal device and the core network device can communicate with each other through the base station (here, the first base station).
  • the method for determining a location of a terminal device provided in this embodiment may include:
  • the core network device acquires location information reported by the first base station.
  • the core network device determines, according to location information reported by the first base station, a temporary key used by the first base station.
  • the core network device sends the temporary key used by the first base station to the first base station.
  • the first base station receives the temporary key used by the first base station sent by the core network device.
  • the first base station determines an access layer integrity protection key according to the temporary key used by the first base station.
  • the first base station sends an access layer security mode command message to the terminal device.
  • the access layer security mode command message is integrity protected by using an access layer integrity protection key.
  • the terminal device receives the access layer security mode command message sent by the first base station.
  • the terminal device determines an access layer integrity protection key according to the current location information of the terminal device.
  • the terminal device performs integrity check on the access layer security mode command message according to the access layer integrity protection key.
  • the core network device determines the temporary key used by the first base station according to the location information reported by the base station, and the first base station determines the access layer integrity according to the temporary key used by the first base station.
  • the key is protected and the access layer integrity protection key is used to integrity protect the access layer security mode command message.
  • the terminal device determines an access layer integrity protection key according to the current location information of the terminal device, and performs integrity verification on the access layer security mode command message according to the access layer integrity protection key. If the location information reported by the base station does not match the current location information of the terminal device, the integrity protection check cannot pass. If the location information reported by the base station matches the current location information of the terminal device, the integrity protection check may pass. Therefore, by applying the location information reported by the base station and the current location information of the terminal device to the derivation process of the key, when the location information does not match, the terminal device is prevented from accessing the network, and the security performance of the communication is improved.
  • the method for determining a location of the terminal device may further include:
  • the core network may send the location information of the first base station to the terminal device by using a NAS message.
  • the first base station packetizes the location information of the first base station and the NAS PDU to the terminal device.
  • the first base station may send the location information of the first base station to the terminal device by using an AS SMC message.
  • AS SMC access layer security mode command
  • the terminal device can compare the location information of the terminal device with the location information of the first base station, thereby determining the location of the terminal device. Is it wrong? Alternatively, the terminal device determines whether the location of the terminal device is incorrect according to the location information of the terminal device.
  • the security mode reject message of the access layer may carry a cause value indicating that the location is inconsistent.
  • the security mode reject message of the access layer may carry the cause value and the location information of the terminal device. Subsequently, the first base station can compare whether the location information reported by the first base station matches the location information of the terminal device reported by the terminal device.
  • the first base station may compare the location information of the terminal with the location information of the terminal device reported by the terminal device. If the first base station determines that the location information of the terminal device does not match the location information of the terminal device, the attachment rejection message or the registration rejection message may carry a cause value indicating that the location information is inconsistent.
  • the embodiment of the present invention provides a method for determining a location of a terminal device.
  • the location information reported by the base station and the current location information of the terminal device are applied to the derivation process of the access layer key.
  • the terminal device is avoided. Into the network, improve the security of communications.
  • FIG. 19 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 17 of the present application.
  • This embodiment provides a specific implementation manner of the location determining method of the terminal device on the basis of the embodiment shown in FIG. 18.
  • the location determining method of the terminal device provided by this embodiment may be applied to a 5G communication system.
  • the network elements involved in the 5G communication system may include: a terminal device (UE), a base station (a first base station gNB1 and a second base station gNB2), and a core network device (AMF, AUSE, and UDM). It should be noted that in some scenarios, the first base station gNB1 and the second base station gNB2 may be the same base station.
  • the method for determining a location of a terminal device provided by the present application may include:
  • the UE establishes an RRC connection with gNB2.
  • the UE may acquire location information (represented by "Location Information-UE") of the terminal device from the gNB2.
  • the location information of the terminal device may be location information (eg, TAI) of gNB2.
  • the UE sends a registration request message (Registration Request) to the AMF through gNB1.
  • the registration request message is a NAS message.
  • the registration request message sent by gNB1 to the AMF includes the location information of gNB1 (indicated by "Location Information - gNB1").
  • the AMF obtains the location information reported by gNB1 through the N2 interface.
  • the AMF deducts the location information (location information - gNB1) reported by gNB1 as a parameter to derive KgNB*.
  • KgNB* can be determined by any of the following methods.
  • KgNB* KDF (KAMF, NAS Uplink Count, location information - gNB1).
  • KgNB* KDF (KDF (KAMF, NAS Uplink Count), location information - gNB1).
  • KgNB* represents a key used by a 5G base station (gNB) including location information
  • NAS Uplink Count represents a NAS uplink message calculator.
  • the AMF sends an N2 message (N2massage) to gNB1.
  • KgNB* is included in the N2 message.
  • gNB initiates the AS SMC process.
  • gNB1 derives KRRCint* from KgNB* and performs integrity protection on AS SMC messages with KRRCint*.
  • KRRCint* KDF(KgNB*, RRC-int-alg, Alg-ID).
  • KRRCint* indicates a Radio Resource Control (RRC) integrity protection key including location information
  • RRC-int-alg indicates an RRC integrity protection algorithm
  • gNB1 sends an access layer security mode command message (AS Security Mode Command) to the UE.
  • AS Security Mode Command an access layer security mode command message
  • the UE derives the KgNB using the obtained location information of the terminal device (location information - UE as a parameter.
  • KgNB can be determined by any of the following methods.
  • KgNB KDF (KAMF, NAS Uplink Count, Location Information - UE).
  • KgNB KDF (KMF (KAMF, NAS Uplink Count), location information - UE).
  • KgNB represents a key used by a 5G base station (gNB)
  • KRRCint represents a Radio Resource Control (RRC) integrity protection key.
  • the UE sends an access layer security mode complete message (AS Security Mode Complete) or an access layer security mode reject message (AS Security Mode Reject) to gNB1.
  • AS Security Mode Complete an access layer security mode complete message
  • AS Security Mode Reject an access layer security mode reject message
  • step 8 the UE sends an AS Security Mode Complete message to gNB1. If the verification fails in step 8, the UE sends an AS Security Mode Reject message to gNB1.
  • the core network may send the location information of the first base station to the UE by using a NAS message.
  • the first base station packetizes the location information of the first base station and the NAS PDU to the UE.
  • the first base station may send the location information of the first base station to the UE by using an AS SMC message.
  • AS SMC access layer security mode command
  • the UE may compare whether the location information of the UE matches the location information of the first base station, thereby determining whether the location of the UE is incorrect.
  • the UE determines whether the location of the UE is incorrect according to the location information of the UE.
  • the security mode reject message of the access layer may carry a cause value indicating that the location is inconsistent.
  • the security mode reject message of the access layer may carry the cause value and the location information of the terminal device. Subsequently, the first base station can compare whether the location information reported by the first base station matches the location information of the terminal device reported by the terminal device.
  • the first base station may compare the location information of the terminal with the location information of the terminal device reported by the terminal device. If the first base station determines that the location information of the terminal device does not match the location information of the terminal device, the attachment rejection message or the registration rejection message may carry a cause value indicating that the location information is inconsistent.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to a 5G communication network, and is specifically applied to integrity protection of an AS message.
  • the AMF can obtain the KgNB* through the location information reported by the base station, and the base station can perform the deduction of the AS integrity key and the integrity protection of the AS message according to the KgNB*, and the terminal device completes the deduction of the AS integrity key according to the location information of the terminal device.
  • the integrity check of the AS message when the location information does not match, the terminal device is prevented from accessing the network, and the security performance of the communication is improved.
  • FIG. 20 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 18 of the present application.
  • This embodiment provides a specific implementation manner of the location determining method of the terminal device on the basis of the embodiment shown in FIG. 18.
  • the location determining method of the terminal device provided by this embodiment may be applied to an LTE communication system.
  • the network elements involved in the LTE communication system may include: a terminal device (UE), a base station (a first base station eNB1 and a second base station eNB2), and a core network device (MME and HSS). It should be noted that in some scenarios, the first base station eNB1 and the second base station eNB2 may be the same base station.
  • the method for determining a location of a terminal device provided by the present application may include:
  • the UE establishes an RRC connection with eNB2.
  • the UE may acquire location information (represented by "Location Information-UE") of the terminal device from the eNB2.
  • the location information of the terminal device may be location information (for example, TAI) of the eNB2.
  • the UE sends a registration request message (Registration Request) to the MME through the eNB1.
  • Registration Request a registration request message
  • the registration request message is a NAS message.
  • the registration request message transmitted by the eNB1 to the MME includes location information of the eNB1 (indicated by "Location Information - eNB1").
  • the MME derives the KeNB* from the location information (location information - eNB1) reported by the eNB1 as a parameter.
  • KeNB* can be determined by any of the following methods.
  • KeNB* KDF (KASME, NAS Uplink Count, location information - eNB1).
  • KeNB* KDF (KDF (KASME, NAS Uplink Count), location information - eNB1).
  • KeNB* represents an evolved base station key containing location information
  • NAS Uplink Count represents a NAS uplink message calculator
  • the MME sends an S1 message (S1massage) to eNB1.
  • the K1* is included in the S1 message.
  • eNB1 derives KRRCint* from KeNB* and performs integrity protection on the AS SMC message with KRRCint*.
  • KRRCint* KDF(KeNB*, RRC-int-alg, Alg-ID).
  • eNB1 sends an Access Layer Security Mode Command message (AS Security Mode Command) to the UE.
  • AS Security Mode Command Access Layer Security Mode Command
  • the UE derives the KeNB using the obtained location information (Location Information - UE) of the terminal device as a parameter.
  • the KeNB may be determined by any one of the following methods.
  • KeNB KDF (KASME, NAS Uplink Count, Location Information - UE).
  • KeNB KDF (KASME, NAS Uplink Count), location information-UE.
  • KRRCint KDF (KeNB, RRC-int-alg, Alg-ID) is derived by the KeNB, and the integrity check is performed on the AS SMC message by using KRRCint.
  • the UE sends an access layer security mode complete message (AS Security Mode Complete) or an access layer security mode reject message (AS Security Mode Reject) to the eNB1.
  • AS Security Mode Complete an access layer security mode complete message
  • AS Security Mode Reject an access layer security mode reject message
  • step 8 the UE sends a NAS Security Mode Complete message to the eNB1. If the verification fails in step 8, the UE sends a NAS Security Mode Reject message to eNB1.
  • KeNB*, KRRCint*, KeNB, and KRRCint are the same as the prior art except for KeNB*, KRRCint*, KeNB, and KRRCint.
  • the core network may send the location information of the first base station to the UE by using a NAS message.
  • the first base station packetizes the location information of the first base station and the NAS PDU to the UE.
  • the first base station may send the location information of the first base station to the UE by using an AS SMC message.
  • AS SMC access layer security mode command
  • the UE may compare whether the location information of the UE matches the location information of the first base station, thereby determining whether the location of the UE is incorrect.
  • the UE determines whether the location of the UE is incorrect according to the location information of the UE.
  • the security mode reject message of the access layer may carry a cause value indicating that the location is inconsistent.
  • the security mode reject message of the access layer may carry the cause value and the location information of the terminal device. Subsequently, the first base station can compare whether the location information reported by the first base station matches the location information of the terminal device reported by the terminal device.
  • the first base station may compare the location information of the terminal with the location information of the terminal device reported by the terminal device. If the first base station determines that the location information of the terminal device does not match the location information of the terminal device, the attachment rejection message or the registration rejection message may carry a cause value indicating that the location information is inconsistent.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to an LTE communication network.
  • the MME can obtain the KeNB* through the location information reported by the base station, and the base station can perform the deduction of the AS integrity key and integrity protection of the AS message according to the KeNB*.
  • the terminal device can complete the derivation of the AS integrity key and verify the AS message by obtaining the location information of the terminal device. When the location information does not match, the terminal device is prevented from accessing the network, and the security performance of the communication is improved.
  • FIG. 21 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 19 of the present application.
  • the method for determining the location of the terminal device provided in this embodiment may be applied to a 4G communication network or a 5G communication network.
  • the network element involved in this embodiment may include a terminal device, a base station, and a core network device.
  • the terminal device and the core network device can communicate with each other through the base station (here, the first base station).
  • the method for determining a location of a terminal device provided by this embodiment may include:
  • the base station determines an access layer integrity protection key according to the location information of the first base station.
  • the base station performs integrity protection on the access layer security mode command message according to the access layer integrity protection key.
  • the base station sends an access layer security mode command message to the terminal device.
  • the terminal device receives an access layer security mode command message sent by the base station.
  • the terminal device determines an access layer integrity protection key according to the current location information of the terminal device.
  • the terminal device performs integrity check on the access layer security mode command message according to the access layer integrity protection key.
  • the base station determines the access layer integrity protection key according to the location information, and uses the access layer integrity protection key to perform integrity on the access layer security mode command message. protection.
  • the terminal device determines an access layer integrity protection key according to the current location information of the terminal device, and performs integrity verification on the access layer security mode command message according to the access layer integrity protection key. If the location information of the base station does not match the current location information of the terminal device, the integrity protection check cannot pass. If the location information of the base station matches the current location information of the terminal device, the integrity protection check can pass. Therefore, by applying the location information reported by the base station and the current location information of the terminal device to the derivation process of the key, when the location information does not match, the terminal device is prevented from accessing the network, and the security performance of the communication is improved.
  • the method for determining a location of the terminal device may further include:
  • the core network may send the location information of the first base station to the terminal device by using a NAS message.
  • the first base station packetizes the location information of the first base station and the NAS PDU to the terminal device.
  • the first base station may send the location information of the first base station to the terminal device by using an AS SMC message.
  • AS SMC access layer security mode command
  • the terminal device can compare the location information of the terminal device with the location information of the first base station, thereby determining the location of the terminal device. Is it wrong? Alternatively, the terminal device determines whether the location of the terminal device is incorrect according to the location information of the terminal device.
  • the security mode reject message of the access layer may carry a cause value indicating that the location is inconsistent.
  • the security mode reject message of the access layer may carry the cause value and the location information of the terminal device. Subsequently, the first base station can compare whether the location information reported by the first base station matches the location information of the terminal device reported by the terminal device.
  • the first base station may compare the location information of the terminal with the location information of the terminal device reported by the terminal device. If the first base station determines that the location information of the terminal device does not match the location information of the first base station, the attach reject message or the registration reject message may carry a cause value indicating that the location information is inconsistent.
  • An embodiment of the present application provides a method for determining a location of a terminal device, by applying location information of a base station and current location information of a terminal device to a derivation process of an access layer key, and avoiding access of the terminal device when the location information does not match.
  • the network improves the security of communications.
  • FIG. 22 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 20 of the present application.
  • This embodiment provides a specific implementation manner of the location determining method of the terminal device on the basis of the embodiment shown in FIG. 21.
  • the location determining method of the terminal device provided by this embodiment may be applied to an LTE communication system.
  • the network elements involved in the LTE communication system may include: a terminal device (UE), a base station (a first base station eNB1 and a second base station eNB2), and a core network device (MME and HSS). It should be noted that in some scenarios, the first base station eNB1 and the second base station eNB2 may be the same base station.
  • the method for determining a location of a terminal device provided by the present application may include:
  • the UE establishes an RRC connection with eNB2.
  • the UE may acquire location information (represented by "Location Information-UE") of the terminal device from the eNB2.
  • the location information of the terminal device may be location information (for example, TAI) of the eNB2.
  • the UE sends a registration request message (Registration Request) to the MME through the eNB1.
  • Registration Request a registration request message
  • the MME transmits an S1 message (S1massage) to the eNB1.
  • the KeNB is included in the S1 message.
  • eNB1 derives the location information - eNB1 as a parameter to derive KRRCint*.
  • KRRCint* can be determined by any of the following methods.
  • KRRCint* KDF (KeNB, RRC-int-alg, Alg-ID, location information - eNB1).
  • KRRCint* KDF (KeNB, RRC-int-alg, Alg-ID), location information-eNB1).
  • eNB1 initiates the AS SMC process and uses KRRCint* to perform integrity protection on the AS SMC message.
  • eNB1 sends an Access Layer Security Mode Command message (AS Security Mode Command) to the UE.
  • AS Security Mode Command Access Layer Security Mode Command
  • the UE derives KRRCint with the obtained location information (Location Information - UE) of the terminal device as a parameter.
  • the KRRCint can be determined by any of the following methods.
  • KRRCint KDF (KeNB, RRC-int-alg, Alg-ID, Location Information-UE).
  • KRRCint KDF (KeNB, RRC-int-alg, Alg-ID), location information-UE.
  • the integrity check is performed on the AS SMC message with KRRCint.
  • the UE sends an access layer security mode complete message (AS Security Mode Complete) or an access layer security mode reject message (AS Security Mode Reject) to the eNB1.
  • AS Security Mode Complete an access layer security mode complete message
  • AS Security Mode Reject an access layer security mode reject message
  • step 8 the UE sends a NAS Security Mode Complete message to the eNB1. If the verification fails in step 8, the UE sends a NAS Security Mode Reject message to eNB1.
  • the core network may send the location information of the first base station to the UE by using a NAS message.
  • the first base station packetizes the location information of the first base station and the NAS PDU to the UE.
  • the first base station may send the location information of the first base station to the UE by using an AS SMC message.
  • AS SMC access layer security mode command
  • the UE may compare whether the location information of the UE matches the location information of the first base station, thereby determining whether the location of the UE is incorrect.
  • the UE determines whether the location of the UE is incorrect according to the location information of the UE.
  • the security mode reject message of the access layer may carry a cause value indicating that the location is inconsistent.
  • the security mode reject message of the access layer may carry the cause value and the location information of the terminal device. Subsequently, the first base station can compare whether the location information reported by the first base station matches the location information of the terminal device reported by the terminal device.
  • the first base station may compare the location information of the terminal with the location information of the terminal device reported by the terminal device. If the first base station determines that the location information of the terminal device does not match the location information of the first base station, the attachment rejection message or the registration rejection message may carry a cause value indicating that the location information is inconsistent.
  • This embodiment provides a method for determining a location of a terminal device, which can be applied to an LTE communication network.
  • the base station can perform the derivation of the AS integrity key and the integrity protection of the AS message according to the location information of the base station.
  • the terminal device can complete the derivation of the AS integrity key and verify the AS message by obtaining the location information of the terminal device. When the location information does not match, the terminal device is prevented from accessing the network, and the security performance of the communication is improved.
  • FIG. 23 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 21 of the present application.
  • the network element involved in this embodiment may include a terminal device (UE), a core network device (MME/AMF), and a base station (eNB/gNB).
  • the terminal device and the mobility management device communicate with each other through a base station (here, a first base station).
  • a base station here, a first base station.
  • the method for determining a location of a terminal device provided by this embodiment may include:
  • the core network device sends a location request message to the terminal device.
  • the terminal device receives the location request message sent by the core network device.
  • the MME/AMF may send a DL Positioning message to the UE by using the eNB/gNB according to the preset policy.
  • the preset policy is not limited in this embodiment, and may be set as needed.
  • the preset policy may include any one of the following:
  • the TAIs of multiple base stations (gNB/eNB) reported by the UE are inconsistent and the position difference is large.
  • the TAI position changes greatly during the preset time period.
  • a monitoring request for the terminal device is received from the monitoring center.
  • the terminal device sends a location response message to the core network device.
  • the location response message includes current location information of the terminal device.
  • the core network device receives the location response message sent by the terminal device.
  • the UE performs location measurement according to the location request message, and obtains current location information of the terminal device.
  • the current location information of the terminal device may include at least one of the following:
  • Second location information broadcast by the second base station is broadcast by the second base station.
  • the auxiliary location information indicates the geographical location where the terminal device is located.
  • the third location information broadcast by the third base station, and the third base station is a base station adjacent to the second base station.
  • the current location information of the terminal device may further include precise location information, where the location information is determined by the terminal device according to the signal measurement value between the terminal device and the second base station.
  • the signal measurement value may be a signal strength or a signal transmission delay.
  • the core network device determines whether the location information reported by the first base station and the location information reported by the terminal device match.
  • the core network device sends a deregistration message or a detach message to the terminal device.
  • the deregistration message or the detachment message may include a cause value indicating that the location is inconsistent.
  • the terminal device processes the value according to the reason value in the de-registering or detaching message.
  • the core network device may send an alarm message to the OM device.
  • the alert message indicates that the UE location information matches.
  • the MME/AMF compares the location information reported by the UE with the location information sent by the eNB/gNB, and the principles of the embodiment shown in FIG. 3 are similar, and details are not described herein again.
  • the core network device may locate the request message to the terminal device, and report the location information of the terminal device to the core network device by using the terminal device, and the core network device compares the location information reported by the terminal device with the base station. Whether the location information matches, whether the location of the terminal device is misjudged, the accuracy of determining the location of the terminal device is improved, and the security performance of the communication is improved.
  • FIG. 24 is a message interaction diagram of a method for determining a location of a terminal device according to Embodiment 22 of the present application.
  • the network elements involved in this embodiment may include a terminal device (UE), a base station (eNB/gNB), a mobility management device (MME/AMF), and a location management device (E-SMLC/LMF).
  • the terminal device and the mobility management device communicate with each other through a base station (here, a first base station).
  • a base station here, a first base station.
  • the method for determining a location of a terminal device provided by this embodiment may include:
  • the UE attaches to the network successfully.
  • the MME/AMF sends a location request message to the UE and/or the eNB/gNB according to a preset policy.
  • the MME/AMF may send a location request message (NAS Transport) to the UE by using an eNB/gNB according to a preset policy.
  • NAS Transport location request message
  • the MME/AMF may send a DL Positioning message to the eNB/gNB through the S1/N2 interface according to the preset policy.
  • the preset policy is not limited in this embodiment, and may be set as needed.
  • the preset policy may include any one of the following:
  • the TAIs of multiple base stations (gNB/eNB) reported by the UE are inconsistent and the position difference is large.
  • the TAI position changes greatly during the preset time period.
  • a monitoring request for the terminal device is received from the monitoring center.
  • the eNB/gNB sends a DL Positioning Message to the UE.
  • the UE performs location measurement according to the location request message, and obtains location information of the terminal device.
  • the UE performs location measurement according to the location request message, and obtains location information of the terminal device, which may include:
  • the UE receives the broadcast message sent by the second base station, and acquires the second location information of the second base station carried in the broadcast message.
  • the second base station is a base station that is accessed by the terminal device, and the terminal device is located within the coverage of the second base station.
  • the UE acquires the auxiliary location information.
  • the UE receives the broadcast message sent by the third base station, and acquires the third location information of the third base station carried in the broadcast message as the UE location information. Alternatively, the UE performs signal measurement on the third base station, and acquires third location information of the third base station.
  • the UE sends a location response message (UL Positioning Message) to the eNB/gNB, where the location response message includes the location information of the terminal device.
  • a location response message (UL Positioning Message)
  • the eNB/gNB sends a location response message (UL Positioning Message/NAS Transport) to the MME/AMF, where the location response message includes the location information of the terminal device.
  • a location response message (UL Positioning Message/NAS Transport)
  • the MME/AMF sends a request message to the E-SMLC/LMF.
  • the request message may include location information of the terminal device reported by the UE and location information reported by the eNB/gNB.
  • the E-SMLC/LMF compares the location information of the terminal device reported by the UE with the location information sent by the eNB/gNB, and obtains a comparison result.
  • the E-SMLC/LMF compares the location information of the terminal device reported by the UE and the location information sent by the eNB/gNB. For details, refer to the embodiment shown in Figure 3-7. The principle is similar and will not be described here.
  • the E-SMLC/LMF sends a response message to the MME/AMF.
  • the result of the comparison can be included in the response message.
  • the MME/AMF can determine subsequent processing according to a preset policy.
  • the main difference between this embodiment and the embodiment shown in FIG. 23 is that the location information reported by the UE is different from the execution body of the location information sent by the eNB/gNB.
  • the execution subject is a mobility management device.
  • the execution subject is a location management device. The principles of other solutions are similar. For details, refer to the embodiment shown in Figure 23, and details are not described here.
  • the mobile management device may send a location query request to the terminal device and the base station according to the preset policy, and the location management device compares the location information of the terminal device reported by the terminal device with the location information reported by the base station. Matching can determine whether the location of the terminal device is misjudged, improve the accuracy of the location determination of the terminal device, and improve the security performance of the communication.
  • the following describes the terminal device, the base station, and the core network device provided by the embodiment of the present application.
  • the device has a one-to-one correspondence with the foregoing method, and the method for determining the location of the terminal device provided by the foregoing method embodiment has the same technical features and The technical effects are not described in detail in the embodiments of the present application.
  • FIG. 25 is a schematic structural diagram of a terminal device according to an embodiment of the present disclosure.
  • the terminal device may include: a transceiver module 21 and a processing module 22.
  • the processing module 22 is configured to perform control management and execution on the actions of the terminal device.
  • the transceiver module 21 is configured to support communication between the terminal device and other devices.
  • the terminal device may further include a storage module for storing program codes and data of the terminal device.
  • FIG. 26 is a schematic structural diagram of a base station according to an embodiment of the present application.
  • the base station may include: a transceiver module 31 and a processing module 32.
  • the processing module 32 is configured to perform control management and execution on the actions of the base station.
  • the transceiver module 31 is used to support communication between the base station and other devices.
  • the base station may further include a storage module for storing program codes and data of the terminal device.
  • FIG. 27 is a schematic structural diagram of a core network device according to an embodiment of the present disclosure.
  • the core network device may include: a transceiver module 41 and a processing module 42.
  • the processing module 42 is configured to control and manage the actions of the core network device.
  • the transceiver module 41 is configured to support communication between the core network device and other devices.
  • the core network device may further include a storage module for storing program codes and data of the terminal device.
  • the core network device may include any one of the following: MME, HSS, E-SMLC, AMF, AUSF, UDM, and LMF.
  • the following is a description of another terminal device, a base station, and a core network device provided by the embodiment of the present application.
  • the device has a one-to-one correspondence with the foregoing method, and is used to implement the location determining method of the terminal device provided by the foregoing method embodiment, and has the same technical features.
  • the technical effects of the present application are not described herein again.
  • FIG. 28 is another schematic structural diagram of a terminal device according to an embodiment of the present disclosure.
  • the terminal device may include a processor 51, a memory 52, and a transceiver 53.
  • the transceiver 53 is configured to communicate with other devices, and the processor 51 is configured to execute instructions stored in the memory 52 to cause the terminal device to perform operations performed by the terminal device in the foregoing method embodiments.
  • FIG. 29 is another schematic structural diagram of a base station according to an embodiment of the present application.
  • the base station may include a processor 61, a memory 62, and a transceiver 63.
  • the transceiver 63 is configured to communicate with other devices, and the processor 61 is configured to execute instructions stored in the memory 62 to cause the base station to perform operations performed by a base station in the above method embodiments.
  • FIG. 30 is another schematic structural diagram of a core network device according to an embodiment of the present application.
  • the core network device may include a processor 71, a memory 72, and a transceiver 73.
  • the transceiver 73 is configured to communicate with other devices, and the processor 71 is configured to execute instructions stored in the memory 72 to cause the core network device to perform operations performed by the core network device in the foregoing method embodiments.
  • the core network device may include any one of the following: MME, HSS, E-SMLC, AMF, AUSF, UDM, and LMF.
  • the processor in the embodiment of the present application may be a central processing unit (CPU), a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or the like. Programming logic devices, transistor logic devices, hardware components, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)) or the like.
  • a magnetic medium eg, a floppy disk, a hard disk, a magnetic tape
  • an optical medium eg, a DVD
  • a semiconductor medium eg, a solid state disk (SSD)

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • General Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种终端设备的位置确定方法和设备。其中，终端设备的位置确定方法包括：核心网设备获取终端设备上报的终端设备的位置信息和第一基站上报的位置信息；核心网设备判断终端设备的位置信息与第一基站上报的位置信息是否匹配；若终端设备的位置信息与第一基站上报的位置信息不匹配，则核心网设备向终端设备发送拒绝消息。本申请实施例提供的终端设备的位置确定方法，通过比较终端设备上报的终端设备的位置信息与基站上报的位置信息是否匹配，可以确定终端设备的位置是否存在误判，提升了终端设备位置确定的准确性。

Description

终端设备的位置确定方法和设备
本申请要求于2018年3月27日提交中国国家知识产权局、申请号为201810260329.X、发明名称为“终端设备的位置确定方法和设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，尤其涉及一种终端设备的位置确定方法和设备。
背景技术
近期，第四代通信系统(the 4th Generation communication system，4G)被发现存在一个重大漏洞。攻击者可以利用这个漏洞进行虚假信息的编造和转发，让攻击者冒充受害者接入网络，谎报受害者的位置信息。
图1为一种攻击方式的消息交互图。如图1所示，当正常终端设备(User Equipment，UE)接入网络时，伪基站(malicious eNB)通过加大发射信号功率的方式引诱正常UE与该伪基站建立通信连接。伪基站与伪UE(malicious UE)横跨两个地域形成一个恶意网络。伪基站将正常UE的附着请求转发给远端的伪UE，伪UE通过远端的合法基站转发到远端的核心网设备。同样的，伪基站和伪UE再将核心网设备下发的响应消息转发给正常UE，使得正常UE可以通过伪基站和伪UE成功接入网络。这样，网络感知的用户位置和用户的实际位置会不一致。具体的，正常UE和伪基站在城市A，伪UE和合法基站在城市B。攻击者通过伪基站和伪UE转发消息可以使得正常UE接入位于城市B的合法基站，使得网络认为正常UE位于城市B。
上述的攻击方法，造成网络对终端设备的位置定位错误，合法UE可能被攻击者引导接入漫游网络，导致计费纠纷。
发明内容
本申请实施例提供一种终端设备的位置确定方法和设备，该方法中核心网设备通过比较基站提供的位置信息和终端设备提供的位置信息来确定终端设备的位置是否有误，从而避免因为位置信息的错误而导致计费纠纷。
第一方面，本申请实施例提供一种终端设备的位置确定方法，该方法包括：核心网设备获取终端设备上报的终端设备的位置信息和第一基站上报的位置信息；核心网设备判断终端设备的位置信息与第一基站上报的位置信息是否匹配；若终端设备的位置信息与第一基站上报的位置信息不匹配，则核心网设备向终端设备发送拒绝消息。
可选的，在第一方面的一种可能的实施方式中，核心网设备为移动管理设备，核心网设备获取终端设备上报的终端设备的位置信息，包括：移动管理设备通过非接入层的初始附着请求消息或注册请求消息或安全模式命令完成响应消息，获取终端设备上报的终端设备的位置信息。
可选的，在第一方面的一种可能的实施方式中，核心网设备为位置管理网元，核心网设备获取终端设备上报的终端设备的位置信息和第一基站上报的位置信息，包括：位置管理网 元接收移动管理设备发送的请求消息，请求消息中包括终端设备的位置信息和第一基站上报的位置信息。
可选的，在第一方面的一种可能的实施方式中，终端设备的位置信息包括下列中的至少一项：第二基站广播的位置信息，其中，第二基站为终端设备接入的基站；辅助位置信息，其中，辅助位置信息为辅助定位设备提供的信息，且辅助位置信息用于指示终端设备所在的位置；第三基站广播的位置信息，其中，第三基站为与第二基站的距离小于预设距离的基站。
第二方面，本申请实施例提供一种终端设备的位置确定方法，该方法包括：终端设备获取终端设备的位置信息，终端设备的位置信息用于指示终端设备的当前位置；终端设备向核心网设备发送终端设备的位置信息；若终端设备接收到核心网设备发送的拒绝消息，则根据拒绝消息中携带的原因值进行处理。
可选的，在第二方面的一种可能的实施方式中，终端设备向核心网设备发送终端设备的位置信息，包括：终端设备通过非接入层的初始附着请求消息或注册请求消息或安全模式命令完成响应消息，向核心网设备发送终端设备的位置信息。
可选的，在第二方面的一种可能的实施方式中，方法还包括：若原因值用于表示位置不一致，则终端设备在预设时间段后重新发起注册或重新发起附着。
可选的，在第二方面的一种可能的实施方式中，方法还包括：终端设备根据终端设备的位置信息判断终端设备的当前位置是否异常；若终端设备的当前位置异常，则终端设备进行提示。
可选的，在第二方面的一种可能的实施方式中，终端设备的位置信息包括下列中的至少一项：第二基站广播的位置信息，其中，第二基站为终端设备接入的基站；辅助位置信息，其中，辅助位置信息为辅助定位设备提供的信息，且辅助位置信息用于指示终端设备所在的位置；第三基站广播的位置信息，其中，第三基站为与第二基站的距离小于预设距离的基站终端设备终端设备。
第三方面，本申请实施例提供一种终端设备的位置确定方法，该方法包括：移动管理设备向终端设备发送定位请求消息；移动管理设备接收终端设备发送的定位响应消息，定位响应消息中包括终端设备上报的位置信息；移动管理设备判断第一基站上报的位置信息和终端设备上报的位置信息是否匹配；若第一基站上报的位置信息和终端设备上报的位置信息不匹配，则移动管理设备向终端设备发送去注册消息或去附着消息。
可选的，在第三方面的一种可能的实施方式中，移动管理设备判断第一基站上报的位置信息和终端设备上报的位置信息是否匹配终端设备，包括：移动管理设备向位置管理网元发送第一基站上报的位置信息和终端设备上报的位置信息；移动管理设备接收位置管理网元返回的位置匹配结果，位置匹配结果用于指示第一基站上报的位置信息和终端设备上报的位置信息是否匹配。
可选的，在第三方面的一种可能的实施方式中，终端设备上报的位置信息包括下列中的至少一项：第二基站广播的位置信息，其中，第二基站为终端设备接入的基站；辅助位置信息，其中，辅助位置信息为辅助定位设备提供的信息，且辅助位置信息用于指示终端设备所在的位置；第三基站广播的位置信息，其中，第三基站为与第二基站的距离小于预设距离的基站。
第四方面，本申请实施例提供一种终端设备的位置确定方法，该方法包括：终端设备接收核心网设备发送的定位请求消息；终端设备向核心网设备发送定位响应消息，定位响应消 息中包括终端设备的当前位置信息；若终端设备接收到核心网设备发送的去注册或去附着消息，则根据去注册或去附着消息中的原因值进行处理。
可选的，在第四方面的一种可能的实施方式中，终端设备的当前位置信息包括下列中的至少一项：第二基站广播的位置信息，其中，第二基站为终端设备接入的基站；辅助位置信息，其中，辅助位置信息为辅助定位设备提供的信息，且辅助位置信息用于指示终端设备所在的位置；第三基站广播的位置信息，其中，第三基站为与第二基站的距离小于预设距离的基站终端设备。
第五方面，本申请实施例提供一种终端设备的位置确定方法，该方法包括：核心网设备获取第一基站上报的位置信息；核心网设备根据第一基站上报的位置信息确定非接入层完整性保护密钥；核心网设备向终端设备发送非接入层安全模式命令消息；其中，非接入层安全模式命令消息是采用非接入层完整性保护密钥进行完整性保护的。
可选的，在第五方面的一种可能的实施方式中，方法还包括：若核心网设备接收到终端设备发送的安全模式命令拒绝消息，向终端设备发送附着拒绝或者注册拒绝消息。
可选的，在第五方面的一种可能的实施方式中，核心网设备为移动管理设备，核心网设备根据第一基站上报的位置信息确定非接入层完整性保护密钥，包括：移动管理设备向数据管理网元发送第一基站上报的位置信息；移动管理设备接收数据管理网元发送的接入安全管理实体密钥，其中，接入安全管理实体密钥是数据管理网元根据第一基站上报的位置信息确定的；移动管理设备根据接入安全管理实体密钥获取非接入层完整性保护密钥。
第六方面，本申请实施例提供一种终端设备的位置确定方法，该方法包括：终端设备接收核心网设备发送的非接入层安全模式命令消息；终端设备根据终端设备的当前位置信息确定非接入层完整性保护密钥；终端设备根据非接入层完整性保护密钥对非接入层安全模式命令消息进行完整性校验。
可选的，在第六方面的一种可能的实施方式中，还包括：若终端设备根据非接入层的完整性保护密钥对非接入层的安全模式命令消息进行完整性校验失败，则向核心网设备发送非接入层的安全模式拒绝消息，非接入层的安全模式拒绝消息中携带用于表示位置不一致的原因值。
第七方面，本申请实施例提供一种终端设备的位置确定方法，该方法包括：移动管理设备获取第一基站上报的位置信息；移动管理设备根据第一基站上报的位置信息确定第一基站使用的临时密钥；移动管理设备向第一基站发送第一基站使用的临时密钥。
第八方面，本申请实施例提供一种终端设备的位置确定方法，该方法包括：终端设备接收第一基站发送的接入层安全模式命令消息；终端设备根据终端设备的当前位置信息确定接入层完整性保护密钥；终端设备根据接入层完整性保护密钥对接入层安全模式命令消息进行完整性校验。
可选的，在第八方面的八种可能的实施方式中，还包括：若终端设备根据接入层完整性保护密钥对接入层安全模式命令消息进行完整性校验失败，则向第一基站发送接入层安全模式拒绝消息。
第九方面，本申请实施例提供一种终端设备的位置确定方法，该方法包括：第一基站根据第一基站的位置信息确定接入层完整性保护密钥；第一基站根据接入层完整性保护密钥对接入层安全模式命令消息进行完整性保护；第一基站向终端设备发送接入层安全模式命令消息。
第十方面，本申请实施例提供一种核心网设备，包括：收发模块，用于获取终端设备上报的终端设备的位置信息和第一基站上报的位置信息，处理模块，用于判断终端设备的位置信息与第一基站上报的位置信息是否匹配，收发模块还用于，若终端设备的位置信息与第一基站上报的位置信息不匹配，则向终端设备发送拒绝消息。
可选的，在第十方面的一种可能的实施方式中，核心网设备为移动管理设备，收发模块具体用于：通过非接入层的初始附着请求消息或注册请求消息或安全模式命令完成响应消息，获取终端设备上报的终端设备的位置信息。
可选的，在第十方面的一种可能的实施方式中，核心网设备为位置管理网元，收发模块具体用于：接收移动管理设备发送的请求消息，请求消息中包括终端设备的位置信息和第一基站上报的位置信息。
可选的，在第十方面的一种可能的实施方式中，终端设备的位置信息包括下列中的至少一项：第二基站广播的位置信息，其中，第二基站为终端设备接入的基站；辅助位置信息，其中，辅助位置信息为辅助定位设备提供的信息，且辅助位置信息用于指示终端设备所在的位置；第三基站广播的位置信息，其中，第三基站为与第二基站的距离小于预设距离的基站终端设备终端设备。
第十一方面，本申请实施例提供一种终端设备，包括：处理模块，用于获取终端设备的位置信息，终端设备的位置信息用于指示终端设备的当前位置，收发模块，用于向核心网设备发送终端设备的位置信息，处理模块还用于，若收发模块接收到核心网设备发送的拒绝消息，则根据拒绝消息中携带的原因值进行处理。
可选的，在第十一方面的一种可能的实施方式中，收发模块具体用于：通过非接入层的初始附着请求消息或注册请求消息或安全模式命令完成响应消息，向核心网设备发送终端设备的位置信息。
可选的，在第十一方面的一种可能的实施方式中，收发模块还用于：若原因值用于表示位置不一致，则在预设时间段后重新发起注册或重新发起附着。
可选的，在第十一方面的一种可能的实施方式中，处理模块还用于：根据终端设备的位置信息判断终端设备的当前位置是否异常，若终端设备的当前位置异常，则进行提示。
可选的，在第十一方面的一种可能的实施方式中，终端设备的位置信息包括下列中的至少一项：第二基站广播的位置信息，其中，第二基站为终端设备接入的基站；辅助位置信息，其中，辅助位置信息为辅助定位设备提供的信息，且辅助位置信息用于指示终端设备所在的位置；第三基站广播的位置信息，其中，第三基站为与第二基站的距离小于预设距离的基站终端设备终端设备。
第十二方面，本申请实施例提供一种移动管理设备，包括：收发模块，用于向终端设备发送定位请求消息，接收终端设备发送的定位响应消息，定位响应消息中包括终端设备上报的位置信息，处理模块，用于判断第一基站上报的位置信息和终端设备上报的位置信息是否匹配，收发模块还用于，若第一基站上报的位置信息和终端设备上报的位置信息不匹配，则向终端设备发送去注册消息或去附着消息。
可选的，在第十二方面的一种可能的实施方式中，收发模块具体用于：向位置管理网元发送第一基站上报的位置信息和终端设备上报的位置信息，接收位置管理网元返回的位置匹配结果，位置匹配结果用于指示第一基站上报的位置信息和终端设备上报的位置信息是否匹配。
可选的，在第十二方面的一种可能的实施方式中，终端设备的位置信息包括下列中的至少一项：第二基站广播的位置信息，其中，第二基站为终端设备接入的基站；辅助位置信息，其中，辅助位置信息为辅助定位设备提供的信息，且辅助位置信息用于指示终端设备所在的位置；第三基站广播的位置信息，其中，第三基站为与第二基站的距离小于预设距离的基站终端设备终端设备。
第十三方面，本申请实施例提供一种终端设备，包括：收发模块，用于接收核心网设备发送的定位请求消息，向核心网设备发送定位响应消息，定位响应消息中包括终端设备的当前位置信息，处理模块，用于若收发模块接收到核心网设备发送的去注册或去附着消息，则根据去注册或去附着消息中的原因值进行处理。
可选的，在第十三方面的一种可能的实施方式中，终端设备的位置信息包括下列中的至少一项：第二基站广播的位置信息，其中，第二基站为终端设备接入的基站；辅助位置信息，其中，辅助位置信息为辅助定位设备提供的信息，且辅助位置信息用于指示终端设备所在的位置；第三基站广播的位置信息，其中，第三基站为与第二基站的距离小于预设距离的基站终端设备终端设备。
第十四方面，本申请实施例提供一种核心网设备，包括：收发模块，用于获取第一基站上报的位置信息，处理模块，用于根据第一基站上报的位置信息确定非接入层完整性保护密钥，收发模块还用于，向终端设备发送非接入层安全模式命令消息，其中，非接入层安全模式命令消息是采用非接入层完整性保护密钥进行完整性保护的。
可选的，在第十四方面的一种可能的实施方式中，收发模块还用于：若接收到终端设备发送的安全模式命令拒绝消息，向终端设备发送附着拒绝或者注册拒绝消息。
可选的，在第十四方面的一种可能的实施方式中，核心网设备为移动管理网元，收发模块具体用于：向数据管理网元发送第一基站上报的位置信息；接收所数据管理网元发送的接入安全管理实体密钥，其中，接入安全管理实体密钥是数据管理网元根据第一基站上报的位置信息确定的；处理模块还用于，根据接入安全管理实体密钥获取非接入层完整性保护密钥。
第十五方面，本申请实施例提供一种终端设备，包括：收发模块，用于接收核心网设备发送的非接入层安全模式命令消息，处理模块，用于根据终端设备的当前位置信息确定非接入层完整性保护密钥，根据非接入层完整性保护密钥对非接入层安全模式命令消息进行完整性校验。
可选的，在第十五方面的一种可能的实施方式中，收发模块还用于：若根据非接入层的完整性保护密钥对非接入层的安全模式命令消息进行完整性校验失败，则向核心网设备发送非接入层的安全模式拒绝消息，非接入层的安全模式拒绝消息中携带用于表示位置不一致的原因值。
第十六方面，本申请实施例提供一种移动管理设备，包括：收发模块，用于获取第一基站上报的位置信息，处理模块，用于根据第一基站上报的位置信息确定第一基站使用的临时密钥，收发模块还用于，向第一基站发送第一基站使用的临时密钥。
第十七方面，本申请实施例提供一种终端设备，包括：收发模块，用于接收第一基站发送的接入层安全模式命令消息，处理模块，用于根据终端设备的当前位置信息确定接入层完整性保护密钥，根据接入层完整性保护密钥对接入层安全模式命令消息进行完整性校验。
可选的，在第十七方面的一种可能的实施方式中，收发模块还用于：若根据接入层完整性保护密钥对接入层安全模式命令消息进行完整性校验失败，则向第一基站发送接入层安全 模式拒绝消息。
第十八方面，本申请实施例提供一种基站，包括：处理模块，用于根据第一基站的位置信息确定接入层完整性保护密钥，根据接入层完整性保护密钥对接入层安全模式命令消息进行完整性保护，收发模块，用于向终端设备发送接入层安全模式命令消息。
第十九方面，本申请实施例提供一种核心网设备，包括：存储器、处理器、收发器以及计算机程序，所述计算机程序存储在所述存储器中，所述处理器运行所述计算机程序执行第一、三、五、七方面任一项所述的终端设备的位置确定方法。
第二十方面，本申请实施例提供一种终端设备，包括：存储器、处理器、收发器以及计算机程序，所述计算机程序存储在所述存储器中，所述处理器运行所述计算机程序执行第二四、六、八方面任一项所述的终端设备的位置确定方法。
第二十一方面，本申请实施例提供一种基站，包括：存储器、处理器、收发器以及计算机程序，所述计算机程序存储在所述存储器中，所述处理器运行所述计算机程序执行第九方面任一项所述的终端设备的位置确定方法。
第二十二方面，本申请实施例提供一种存储介质，包括：可读存储介质和计算机程序，所述计算机程序用于实现任一方面任一项所述的终端设备的位置确定方法。
本申请实施例提供一种终端设备的位置确定方法和设备。通过比较终端设备上报的终端设备的位置信息与基站上报的位置信息是否匹配，可以确定终端设备的位置是否存在误判，提升了终端设备位置确定的准确性，避免了计费纠纷。
附图说明
图1为一种攻击方式的消息交互图；
图2为本申请实施例适用的通信系统的网络架构图；
图3为本申请实施例一提供的终端设备的位置确定方法的消息交互图；
图4为本申请实施例二提供的终端设备的位置确定方法的消息交互图；
图5为本申请实施例三提供的终端设备的位置确定方法的消息交互图；
图6为本申请实施例四提供的终端设备的位置确定方法的消息交互图；
图7为本申请实施例五提供的终端设备的位置确定方法的消息交互图；
图8为本申请实施例六提供的终端设备的位置确定方法的消息交互图；
图9为本申请实施例七提供的终端设备的位置确定方法的消息交互图；
图10为本申请实施例八提供的终端设备的位置确定方法的消息交互图；
图11为本申请实施例九提供的终端设备的位置确定方法的消息交互图；
图12为本申请实施例十提供的终端设备的位置确定方法的消息交互图；
图13为本申请实施例十一提供的终端设备的位置确定方法的消息交互图；
图14为本申请实施例十二提供的终端设备的位置确定方法的消息交互图；
图15为本申请实施例十三提供的终端设备的位置确定方法的消息交互图；
图16为本申请实施例十四提供的终端设备的位置确定方法的消息交互图；
图17为本申请实施例十五提供的终端设备的位置确定方法的消息交互图；
图18为本申请实施例十六提供的终端设备的位置确定方法的消息交互图；
图19为本申请实施例十七提供的终端设备的位置确定方法的消息交互图；
图20为本申请实施例十八提供的终端设备的位置确定方法的消息交互图；
图21为本申请实施例十九提供的终端设备的位置确定方法的消息交互图；
图22为本申请实施例二十提供的终端设备的位置确定方法的消息交互图；
图23为本申请实施例二十一提供的终端设备的位置确定方法的消息交互图；
图24为本申请实施例二十二提供的终端设备的位置确定方法的消息交互图；
图25为本申请实施例提供的终端设备的结构示意图；
图26为本申请实施例提供的基站的结构示意图；
图27为本申请实施例提供的核心网设备的结构示意图；
图28为本申请实施例提供的终端设备的另一结构示意图；
图29为本申请实施例提供的基站的另一结构示意图；
图30为本申请实施例提供的核心网设备的另一结构示意图。
具体实施方式
本申请实施例提供的终端设备的位置确定方法和设备，可以应用于长期演进(long term evolution，LTE)通信系统及其后续演进通信系统、未来5G通信系统及其他通信系统。示例性的，图2为本申请实施例适用的通信系统的网络架构图。如图2所示，通信系统可以包括终端设备11、基站12和核心网设备13。终端设备11与基站12之间可以进行上下行通信。终端设备11可以通过基站12与核心网设备13之间进行上下行通信。
本申请实施例涉及的终端设备11，比如，具有无线连接功能的手机、平板电脑、手持设备、车载设备、可穿戴设备、计算设备，以及各种形式的移动台(mobile station，MS)及终端设备(terminal)等，本申请实施例不作限制。
本申请实施例涉及的基站12，可以为任一具有管理无线网络资源的设备，或者各种无线接入点。例如：LTE通信系统中的演进型基站(evolutional node B，eNB或eNodeB)、中继站或者接入点，未来5G通信系统中的5G基站(g node B，gNB)、无线收发设备(next node，NX)等，本申请实施例不作限制。
本申请实施例涉及的核心网设备13，例如可以包括应用于4G网络中的移动管理实体(Mobility Management Entity，MME)、归属用户服务器(home subscriber server，HSS)、演进的服务移动位置中心(EvolvedServing Mobile Location Centre，E-SMLC)等。又例如，可以包括应用于5G网络中的接入和移动性管理功能(Access and Mobility Management Function，AMF)、认证服务器功能(Authentication Server Function，AUSF)、统一数据管理(Unified Data Management，UDM)、位置管理功能(LocationManagement Function，LMF)等，本申请实施例不作限制。其中，MME和AMF也可以称为移动管理设备，E-SMLC和LMF也可以称为位置管理网元或者位置管理设备。HSS和UDM可以称为数据管理网元或者数据管理设备。
本申请实施例涉及的各个网元的功能描述请参见表1、表2和表3。
表1 终端设备功能说明
Figure PCTCN2019078310-appb-000001
Figure PCTCN2019078310-appb-000002
表2 基站功能说明
Figure PCTCN2019078310-appb-000003
表3 核心网设备功能说明
Figure PCTCN2019078310-appb-000004
下面对本申请实施例涉及的相关概念进行说明。
1.基站
本申请实施例涉及三类基站，可以分别称为第一基站、第二基站和第三基站。
1)第一基站
第一基站为与终端设备核心网设备连接的基站。终端设备可能位于第一基站的覆盖范围内，也可能不位于第一基站的覆盖范围内。
举例说明，如图1所示，正常UE对应的第一基站为位于城市B的合法基站。
2)第二基站
终端设备可以接入第二基站的小区。也就是说，终端设备位于第二基站的覆盖范围内。可以理解，第一基站与第二基站可能为同一基站，也可能是两个不同的基站。
举例说明，如图1所示，正常UE对应的第二基站为位于城市A的伪基站。此时，正常UE对应的第一基站和第二基站不同。
另外，需要指出的是，如果不存在恶意或非法基站的话，那么第一基站与第二基站为同一基站。如果存在恶意或非法基站的话，那么第二基站为恶意或非法基站，第一基站为合法基站，此时，第一基站与第二基站为不同基站。
3)第三基站
第三基站为与第二基站临近的基站。终端设备可以接收第三基站发射的信号。本申请实施例对于第三基站的数目不做限定。
举例来说，与第二基站的距离小于预设距离的基站被称为第三基站。比如该预设距离为500米。那么以第二基站为圆心，在500米为半径范围内的基站均为第三基站。在此不对预设距离做限定，可以是100米，200米，500米，1000米等等。
还以图1为例，第三基站可能是与伪基站在地理位置上临近的其他基站(未示出)。
2.基站上报的位置信息
在本申请实施例中，“基站的位置信息”和“基站上报的位置信息”在一些场景中含义相似，均可以理解为基站侧指示的终端设备的当前位置。
可选的，基站上报的位置信息可以为跟踪区标识信息(tracking area identity，TAI)。
3.终端设备的位置信息
在本申请实施例中，“终端设备的位置信息”、“终端设备的当前位置信息”和“终端设备上报的位置信息”在一些场景中含义相似，均可以理解为UE侧指示的终端设备的当前位置。
需要说明的是，UE可以将终端设备的位置信息通过NAS消息上报给核心网设备，也可以不上报给核心网设备。
可选的，在不同的实施方式中，终端设备的位置信息可以包括下列中的至少一项：
1)第二基站广播的位置信息。
举例说明，如图1所示，正常UE对应的第二基站为伪基站。终端设备的位置信息可以为伪基站广播的伪基站的位置信息。
在一种应用场景中，伪基站没有篡改其位置信息。伪基站的位置信息标记为TAI-A。此时，终端设备的位置信息为TAI-A。需要注意，正常UE对应的第一基站为位于城市B的合法基站。合法基站上报的位置信息标记为TAI-B。此时，终端设备的位置信息(TAI-A)与合法基站上报的位置信息(TAI-B)不一致。
在另一种应用场景中，伪基站可以篡改其位置信息。伪基站的位置信息可以由TAI-A篡改为TAI-B。此时，终端设备的位置信息为TAI-B。需要注意，正常UE对应的第一基站为位于城市B的合法基站。合法基站上报的位置信息标记为TAI-B。此时，终端设备的位置信息(TAI-B)与合法基站上报的位置信息(TAI-B)一致。
2)辅助位置信息。
其中，辅助位置信息为辅助定位设备提供的信息，且辅助位置信息用于指示终端设备所在的位置。
可选的，辅助位置信息可以包括：终端设备通过全球导航卫星系统(Global Navigation Satellite System，GNSS)得到的经纬度信息、终端设备通过无线局域网(wireless local area network，WLAN)得到的网络服务集标识符(network service set identifier，SSID)等。
可以理解，由于辅助位置信息指示了终端设备所在的地域，当第二基站广播的位置信息与辅助位置信息不匹配时，终端设备的当前位置可能异常。
例如，如果辅助位置信息指示了UE的当前位置为城市A，第二基站的位置信息指示了UE的当前位置为城市B，那么UE的当前位置可能异常。
3)第三基站广播的位置信息。
具体的，终端设备可以接收至少一个第三基站发送的广播消息，从而可以获得广播消息中携带的第三基站的位置信息。
可以理解，当第二基站广播的位置信息与第三基站广播的位置信息不一致时，终端设备的当前位置可能异常。
例如，如果第二基站广播的位置信息指示了UE的当前位置为城市B，第三基站广播的位置信息指示了UE的当前位置为城市A，那么UE的当前位置可能异常。
针对现有技术中终端设备的位置可能误判的技术问题，本申请实施例提供的终端设备的位置确定方法和设备，通过核心网设备判断终端设备上报的位置信息与基站上报的位置信息是否匹配，可以确定用户的位置是否异常，或者，在鉴权过程和完整性保护过程中的密钥推导中加入位置信息，可以在位置信息不匹配时避免终端设备接入网络，从而解决了终端设备的位置误判的技术问题。
下面以具体地实施例对本申请的技术方案以及本申请的技术方案如何解决上述技术问题进行详细说明。下面这几个具体的实施例可以相互结合，对于相同或相似的概念或过程可能在某些实施例中不再赘述。
图3为本申请实施例一提供的终端设备的位置确定方法的消息交互图。本实施例提供的终端设备的位置确定方法，可以应用于4G通信网络或者5G通信网络或其他通信网络。本实施例涉及的网元可以包括终端设备、基站和核心网设备。如图3所示，本实施例提供的终端设备的位置确定方法，可以包括：
S101、终端设备获取终端设备的位置信息。
其中，终端设备的位置信息用于指示终端设备的当前位置。
可选的，终端设备的位置信息可以包括下列中的至少一项：
第二基站广播的位置信息，其中，第二基站为终端设备接入的基站；
辅助位置信息，其中，辅助位置信息为辅助定位设备提供的信息，且辅助位置信息用于指示终端设备所在的位置；
第三基站广播的位置信息，其中，第三基站为与第二基站的距离小于预设距离的基站。
可选的，终端设备获取终端设备的位置信息，可以包括下列中的至少一项：
终端设备接收第二基站发送的广播消息，所述广播消息中携带所述第二基站的位置信息。
终端设备获取辅助位置信息。
终端设备接收第三基站发送的广播消息，所述广播消息中携带所述第三基站的位置信息。
S102、终端设备向核心网设备发送终端设备的位置信息。
相应的，核心网设备接收终端设备发送的终端设备的位置信息。
可选的，终端设备向核心网设备发送终端设备的位置信息，包括：
终端设备可以通过非接入层的初始附着请求消息或注册请求消息或安全模式命令完成响应消息，向核心网设备发送终端设备的位置信息。
通过初始附着请求消息或者注册请求消息向核心网设备发送所述终端设备的位置信息，核心网设备可以较早的确定终端设备的位置是否异常，从而减少了附着过程或者注册过程中的消息交互，节省了空口资源，提升了资源利用率。
通过非接入层安全模式命令完成响应消息将终端设备的位置信息发送至核心网设备，由于接入层安全模式命令完成响应消息进行了完整性保护，因此可以进一步提升确定终端设备的位置是否异常的准确性。
S103、核心网设备接收第一基站上报的位置信息。
需要说明的是，本实施例对于S102和S103的执行顺序不做限定。即，可以先执行S102，后执行S103。或者，可以先执行S103，后执行S102。或者，同时执行S102和S103。此时，终端设备的位置信息和第一基站上报的位置信息可以携带在一条消息中，也可以分别携带在不同的消息中。
可选的，核心网设备为移动管理设备，获取终端设备上报的终端设备的位置信息，可以包括：
移动管理设备通过非接入层的初始附着请求消息或注册请求消息或安全模式命令完成响应消息，获取终端设备上报的终端设备的位置信息。
可选的，终端设备通过非接入层的初始附着请求消息或注册请求消息向核心网设备发送终端设备的位置信息时，NAS消息中的NAS-PDU中携带终端设备的位置信息。第一基站接收到NAS消息后，可以将NAS-PDU(终端设备的位置信息)和第一基站上报的位置信息一起打包，通过S1/N2接口消息消息发送给核心网设备。
可选的，核心网设备为位置管理网元，获取终端设备上报的终端设备的位置信息和第一基站上报的位置信息，可以包括：
位置管理网元接收移动管理设备发送的请求消息，请求消息中包括终端设备的位置信息和第一基站上报的位置信息。其中该移动管理设备为AMF或MME。
S104、核心网设备判断终端设备的位置信息与第一基站上报的位置信息是否匹配。
当判断结果为匹配时，则正常进行后续流程。当判断结果为不匹配时，可以执行S105。
可选的，在一种实现方式中，若终端设备的位置信息包括第二基站广播的位置信息，则核心网设备判断终端设备的位置信息与第一基站上报的位置信息是否匹配，可以包括：
核心网设备判断第二基站广播的位置信息与第一基站上报的位置信息是否一致。
若一致，则判断终端设备的位置信息与第一基站上报的位置信息匹配，终端设备的当前位置正常。
若不一致，则判断终端设备的位置信息与第一基站上报的位置信息不匹配，终端设备的当前位置异常。
通过示例进行说明。如图1所示，伪基站没有篡改其位置信息，第二基站(伪基站)广播的位置信息为TAI-A，第一基站(合法基站)上报的位置信息为TAI-B。此时，两者不一致，可以确定终端设备的当前位置异常。
该种实现方式仅仅比较第二基站广播的位置信息与第一基站上报的位置信息是否一致即可，方法简单易行，提升了数据处理效率，避免了终端设备位置的误判。
可选的，在另一种实现方式中，若终端设备的位置信息包括辅助位置信息，则核心网设备判断终端设备的位置信息与第一基站上报的位置信息是否匹配，可以包括：
核心网设备判断辅助位置信息与第一基站上报的位置信息是否匹配是否匹配。
若匹配，则判断终端设备的位置信息与第一基站上报的位置信息匹配，终端设备的当前位置正常。
若不匹配，则判断终端设备的位置信息与第一基站上报的位置信息不匹配，终端设备的当前位置异常。
通过示例进行说明。如图1所示，辅助位置信息指示了UE在城市A，第一基站(合法基站)上报的位置信息为TAI-B，指示了城市B。此时，两者不一致，可以确定终端设备的当前位置异常。
在该种实现方式中，辅助位置信息和第一基站上报的位置信息为不同类型的信息，需要判断辅助位置信息指示的地域与第一基站上报的位置信息指示的地域是否一致。由于辅助位置信息指示了终端设备实际所在的地域，因此提升了终端设备位置确定的准确性，避免了终端设备位置的误判。
可选的，在又一种实现方式中，若终端设备的位置信息包括第三基站广播的位置信息，则核心网设备判断终端设备的位置信息与第一基站上报的位置信息是否匹配，可以包括：
核心网设备判断第三基站广播的位置信息与第一基站上报的位置信息是否一致。
若一致，则判断终端设备的位置信息与第一基站上报的位置信息匹配，终端设备的当前位置正常。
若不一致，则判断终端设备的位置信息与第一基站上报的位置信息不匹配，终端设备的当前位置异常。
通过示例进行说明。如图1所示，第三基站(伪基站的临近基站)广播的位置信息为TAI-A，第一基站(合法基站)上报的位置信息为TAI-B，指示了城市B。此时，两者不一致，可以确定终端设备的当前位置异常。
该种实现方式通过比较第三基站广播的位置信息与第一基站上报的位置信息是否一致，方法简单易行，提升了数据处理效率，避免了终端设备位置的误判。
可选的，在又一种实现方式中，若终端设备的位置信息包括第二基站广播的位置信息和辅助位置信息，则核心网设备判断终端设备的位置信息与第一基站上报的位置信息是否匹配，可以包括：
核心网设备判断第二基站广播的位置信息与第一基站上报的位置信息是否一致。
若不一致，则判断终端设备的位置信息与第一基站上报的位置信息不匹配，终端设备的当前位置异常。
若一致，则继续判断辅助位置信息与第一基站上报的位置信息是否匹配。
若不匹配，则判断终端设备的位置信息与第一基站上报的位置信息不匹配，终端设备的当前位置异常。
若匹配，则判断终端设备的位置信息与第一基站上报的位置信息匹配，终端设备的当前位置正常。
或者，
核心网设备判断辅助位置信息与第一基站上报的位置信息是否匹配。
若不匹配，则判断终端设备的位置信息与第一基站上报的位置信息不匹配，终端设备的 当前位置异常。
若匹配，则继续判断第二基站广播的位置信息与第一基站上报的位置信息是否一致。
若一致，则判断终端设备的位置信息与第一基站上报的位置信息匹配，终端设备的当前位置正常。
若不一致，则判断终端设备的位置信息与第一基站上报的位置信息不匹配，终端设备的当前位置异常。
需要说明的是，在其他的实现方式中，终端设备的位置信息可以包括第二基站广播的位置信息、辅助位置信息和第三基站广播的位置信息中的至少两种位置信息。核心网设备判断终端设备的位置信息与第一基站上报的位置信息是否匹配，可以针对终端设备的位置信息中的每种位置信息，分别判断与第一基站上报的位置信息是否匹配。本实施例对于每种位置信息的判断顺序不做限定。
S105、若终端设备的位置信息与第一基站上报的位置信息不匹配，则核心网设备向终端设备发送拒绝消息。
相应的，终端设备接收核心网发送的拒绝消息。
其中，拒绝消息中可以携带原因值，所述原因值用于指示位置不一致。
可选的，拒绝消息可以为附着拒绝消息或者注册拒绝消息。
可选的，若核心网设备为移动管理设备(MME或AMF)，还可以包括：
向操作维护(Operation and Maintenance，OM)设备上报异常事件，异常事件指示了终端设备的位置不一致。
S106、若终端设备接收到核心网发送的拒绝消息，则根据拒绝消息中携带的原因值进行处理。
可选的，若原因值用于表示位置不一致，则在预设时间段后终端设备可以重新发起注册或重新发起附着。
本实施例对于预设时间段的具体取值不做限定。
可见，本实施例提供的终端设备的位置确定方法，通过终端设备向核心网设备上报终端设备的位置信息，核心网设备比较终端设备上报的位置信息与第一基站上报的位置信息是否匹配，可以确定终端设备的位置是否存在误判，提升了终端设备位置确定的准确性。
需要说明的是，S105和S106，仅是终端设备的位置信息与第一基站上报的位置信息不匹配时，核心网设备和终端设备执行的一种处理方式。可以理解，若终端设备的位置信息与第一基站上报的位置信息不匹配，核心网设备还可以继续执行其他的流程，终端设备相应的执行其他的流程。例如，若终端设备的位置信息与第一基站上报的位置信息不匹配，核心网设备可以不发送消息。终端设备在一段时间后没有接收到核心网设备发送的消息，则可以对应执行现有流程。
可选的，本实施例提供的终端设备的位置确定方法，还可以包括：
终端设备根据终端设备的位置信息判断终端设备的当前位置是否异常。
若判断终端设备的当前位置异常，则进行提示。
具体的，用户设备可以通过获取的用户设备位置信息确定用户设备的当前位置是否异常。如果异常，则可以进行提示，提醒用户可能存在被攻击的风险，以使用户采取相应的措施提升安全性，避免费用纠纷。可选的，终端设备判断终端设备的当前位置异常后，可以不发起注册，或者根据预设策略在预设时间段后重新发起注册。本实施例对于提示的方式不做限定。 例如可以生成提示信息并显示提示信息。本实施例对于显示信息的具体内容和显示方式不做限定。例如，显示信息可以通过在用户设备的显示屏上弹出提示窗口的形式进行显示。或者，可以通过声音进行提示。
可选的，在一种实现方式中，若终端设备的位置信息包括第二基站广播的位置信息和辅助位置信息，终端设备根据终端设备的位置信息判断终端设备的当前位置是否异常，可以包括：
终端设备判断第二基站广播的位置信息与辅助位置信息是否匹配。
若不匹配，则判断终端设备的当前位置异常。
若匹配，则判断终端设备的当前位置正常。
通过示例进行说明。如图1所示，伪基站篡改其位置信息，将伪基站的位置信息由TAI-A篡改为TAI-B，指示了城市B。辅助位置信息指示了UE在城市A。此时，两者不一致，可以确定终端设备的当前位置异常。
在该种实现方式中，辅助位置信息和第二基站广播的位置信息为不同类型的信息，需要判断辅助位置信息指示的地域与第二基站广播的位置信息指示的地域是否一致。由于辅助位置信息指示了终端设备实际所在的地域，因此提升了终端设备位置确定的准确性，避免了终端设备位置的误判。
可选的，在另一种实现方式中，若终端设备的位置信息包括第二基站广播的位置信息和第三基站广播的位置信息，终端设备根据终端设备的位置信息判断终端设备的当前位置是否异常，可以包括：
终端设备判断第二基站广播的位置信息和第三基站广播的位置信息是否一致。
若一致，则判断终端设备的当前位置正常。
若不一致，则判断终端设备的当前位置异常。
通过示例进行说明。如图1所示，伪基站篡改其位置信息，将伪基站的位置信息由TAI-A篡改为TAI-B，指示了城市B。第三基站广播的位置信息为TAI-A。此时，第二基站广播的位置信息和第三基站广播的位置信息不一致，则可以确定终端设备的当前位置异常。
通过比较第二基站广播的位置信息和第三基站广播的位置信息是否一致，方法简单易行，避免了终端设备位置的误判。
可选的，本实施例提供的终端设备的位置确定方法，若终端设备完成附着或者注册，还可以包括：
终端设备接收核心网设备发送的定位请求消息。
终端设备根据定位请求消息获取终端设备的当前位置信息。
终端设备向核心网设备发送定位响应消息，定位响应消息中包括终端设备的当前位置信息。
核心网设备判断第一基站上报的第一位置信息和终端设备上报的当前位置信息是否匹配。
若第一基站上报的第一位置信息和终端设备上报的当前位置信息不匹配，则向终端设备发送去注册消息或去附着消息。
可以参见图23或图24所示实施例的说明，原理相似，此处不再赘述。
本实施例提供了一种终端设备的位置确定方法，包括：核心网设备获取终端设备上报的终端设备的位置信息和第一基站上报的位置信息，核心网设备判断终端设备的位置信息与第一基站上报的位置信息是否匹配，若判断终端设备的位置信息与第一基站上报的位置信息不 匹配，则核心网向终端设备发送拒绝消息，若终端设备接收到核心网发送的拒绝消息，则根据拒绝消息中携带的原因值进行处理。本实施例提供的终端设备的位置确定方法，通过终端设备向核心网设备上报终端设备的位置信息，核心网设备比较终端设备上报的终端设备的位置信息与基站上报的位置信息是否匹配，可以确定终端设备的位置是否存在误判，提升了终端设备位置确定的准确性，避免了计费纠纷。
图4为本申请实施例二提供的终端设备的位置确定方法的消息交互图。本实施例在图3所示实施例的基础上，提供了终端设备的位置确定方法的一种具体实现方式，可以应用于LTE通信系统或5G通信系统或其他通信。LTE通信系统涉及的网元可以包括：终端设备(UE)、基站eNB(第一基站eNB1、第二基站eNB2)和移动管理设备(MME)。5G通信系统涉及的网元可以包括：终端设备(UE)、基站gNB(第一基站gNB1、第二基站gNB2)和移动管理设备(AMF)。需要说明，在一些场景中，第一基站eNB1、第二基站eNB2可以为同一基站，第一基站gNB1、第二基站gNB2可以为同一基站。如图4所示，本申请提供的终端设备的位置确定方法，可以包括：
0.UE与eNB2/gNB2之间建立RRC连接。
在UE与eNB2/gNB2建立RRC连接后，UE可以从eNB2/gNB2获取终端设备的位置信息(用“位置信息-UE”表示)。
1.UE获取终端设备的位置信息(“位置信息-UE”)。
2.UE通过eNB1/gNB1向MME/AMF发送初始附着请求消息/注册请求消息(initial Attach/Registration)。
具体的，初始附着请求消息或者注册请求消息为NAS消息，其中的NAS-PDU可以携带终端设备的位置信息。
3.eNB1/gNB1通过S1/N2接口向MME/AMF转发初始附着请求消息/注册请求消息。
其中，eNB1/gNB1将NAS-PDU(位置信息-UE)和eNB1/gNB1上报的位置信息(用“位置信息-eNB1/gNB1”表示)一起打包，通过S1/N2接口发送至MME/AMF。
4.MME/AMF比较NAS层UE上报的终端设备的位置信息和eNB1/gNB1通过S1/N2接口上报的位置信息是否匹配。
然后，进行后续流程。
具体的，若MME/AMF确定UE上报的终端设备的位置信息和eNB1/gNB1通过S1/N2接口上报的位置信息不匹配，则可以向UE发送附着拒绝消息(attach reject)或者注册拒绝消息，其中携带的原因值指示了终端设备的位置不一致。
若MME/AMF确定UE上报的终端设备的位置信息和eNB1/gNB1通过S1/N2接口上报的位置信息匹配，则正常进行后续流程，UE可以接收到MME/AMF发送的正常响应消息。
本实施例提供了一种终端设备的位置确定方法，可以应用于LTE通信网络或者5G通信网络。终端设备通过初始附着请求消息或者注册请求消息将终端设备的位置信息上报给移动管理设备，移动管理设备比较终端设备上报的终端设备的位置信息与基站上报的位置信息是否匹配，可以确定终端设备的位置是否存在误判，提升了终端设备位置确定的准确性，避免了计费纠纷。
图5为本申请实施例三提供的终端设备的位置确定方法的消息交互图。本实施例在图3 所示实施例的基础上，提供了终端设备的位置确定方法的一种具体实现方式，可以应用于LTE通信系统和5G通信系统。LTE通信系统涉及的网元可以包括：终端设备(UE)、基站eNB(第一基站eNB1、第二基站eNB2)、移动管理设备(MME)和位置管理设备(E-SMLC)。5G通信系统涉及的网元可以包括：终端设备(UE)、基站gNB(第一基站gNB1、第二基站gNB2)、移动管理设备(AMF)和位置管理设备(LMF)。需要说明，在一些场景中，第一基站eNB1、第二基站eNB2可以为同一基站，第一基站gNB1、第二基站gNB2可以为同一基站。如图5所示，本申请提供的终端设备的位置确定方法，可以包括：
0.UE与eNB2/gNB2之间建立无线资源控制(Radio Resource Control，RRC)连接。
在UE与eNB2/gNB2建立RRC连接后，UE可以从eNB2/gNB2获取终端设备的位置信息(用“位置信息-UE”表示)。
1.UE获取终端设备的位置信息(“位置信息-UE”)。
2.UE通过eNB1/gNB1向MME/AMF发送初始附着请求消息/注册请求消息(initial Attach/Registration)。
具体的，初始附着请求消息或者注册请求消息为NAS消息，其中的NAS-PDU可以携带终端设备的位置信息。
3.eNB1/gNB1通过S1/N2接口向MME/AMF转发初始附着请求消息/注册请求消息。
其中，eNB1/gNB1将NAS-PDU(位置信息-UE)和eNB1/gNB1上报的位置信息(用“位置信息-eNB1/gNB1”表示)一起打包，通过S1/N2接口发送至MME/AMF。
4.MME/AMF向E-SMLC/LMF发送请求消息(request message)。
所述请求消息中携带UE上报的终端设备的位置信息和eNB1/gNB1上报的位置信息。
5.E-SMLC/LMF比较NAS层UE上报的终端设备的位置信息和eNB1/gNB1通过S1/N2接口上报的位置信息是否匹配。
6.E-SMLC/LMF向MME/AMF发送请求响应消息(response message)。
其中，请求响应消息可以携带位置比较结果，位置比较结果指示了UE上报的终端设备的位置信息和eNB1/gNB1上报的位置信息是否匹配。
然后，进行后续流程。
具体的，若位置比较结果指示了UE上报的终端设备的位置信息和eNB1/gNB1上报的位置信息不匹配，则MME/AMF可以向UE发送附着拒绝消息(attach reject)或者注册拒绝消息，其中携带的原因值指示了终端设备的位置不一致。
若位置比较结果指示了UE上报的终端设备的位置信息和eNB1/gNB1上报的位置信息匹配，则正常进行后续流程，UE可以接收到MME/AMF发送的正常消息。
本实施例提供了一种终端设备的位置确定方法，可以应用于LTE通信网络或者5G通信网络。终端设备通过初始附着请求消息或者注册请求消息将终端设备的位置信息上报给移动管理设备，移动管理设备将终端设备的位置信息和基站上报的位置信息传递至位置管理设备，位置管理设备比较终端设备上报的终端设备的位置信息与基站上报的位置信息是否匹配，可以确定终端设备的位置是否存在误判，提升了终端设备位置确定的准确性，避免了计费纠纷。
图6为本申请实施例四提供的终端设备的位置确定方法的消息交互图。本实施例在图3所示实施例的基础上，提供了终端设备的位置确定方法的另一种具体实现方式，可以应用于LTE通信系统和5G通信系统。LTE通信系统涉及的网元可以包括：终端设备(UE)、基站eNB (第一基站eNB1、第二基站eNB2)和移动管理设备(MME)。5G通信系统涉及的网元可以包括：终端设备(UE)、基站gNB(第一基站gNB1、第二基站gNB2)和移动管理设备(AMF)。需要说明，在一些场景中，第一基站eNB1、第二基站eNB2可以为同一基站，第一基站gNB1、第二基站gNB2可以为同一基站。如图6所示，本申请提供的终端设备的位置确定方法，可以包括：
0.UE与eNB2/gNB2之间建立无线资源控制(Radio Resource Control，RRC)连接。
在UE与eNB2/gNB2建立RRC连接后，UE可以从eNB2/gNB2获取终端设备的位置信息(用“位置信息-UE”表示)。
1.UE获取终端设备的位置信息。
2.UE通过eNB1/gNB1向MME/AMF发送初始附着请求消息/注册请求消息(initial Attach/Registration)。
3.eNB1/gNB1通过S1/N2接口向MME/AMF转发初始附着请求消息/注册请求消息。
其中，eNB1/gNB1通过S1/N2接口将eNB1/gNB1上报的位置信息(用“位置信息-eNB1/gNB1”表示)发送至MME/AMF。
4.MME/AMF保存eNB1/gNB1上报的位置信息。
5.鉴权流程。
与现有的鉴权流程原理相似，可以参见现有的鉴权流程。
6.MME/AMF向UE发送非接入层安全模式命令(NAS Security Mode command)消息。
7.UE向MME/AMF发送非接入层安全模式命令完成响应消息(NAS Security Mode complete)。
具体的，非接入层安全模式完成消息为NAS消息，其中的NAS PDU可以携带终端设备的位置信息。
8.MME/AMF比较NAS层UE上报的终端设备的位置信息和eNB1/gNB1通过S1/N2接口上报的位置信息是否匹配。
然后，进行后续流程。
具体的，若MME/AMF确定UE上报的终端设备的位置信息和eNB1/gNB1通过S1/N2接口上报的位置信息不匹配，则可以向UE发送附着拒绝消息(attach reject)或者注册拒绝消息，其中携带的原因值指示了终端设备的位置不一致。
若MME/AMF确定UE上报的终端设备的位置信息和eNB1/gNB1通过S1/N2接口上报的位置信息匹配，则正常进行后续流程，UE可以接收到MME/AMF发送的正常响应消息。
可选的，在步骤7中，非接入层安全模式命令完成响应消息还可以包括指示信息，所述指示信息用于指示非接入层安全模式命令完成响应消息中是否包括终端设备的位置信息。
需要说明的是，本实施例对于步骤1和步骤4的执行顺序不做限定。步骤1在步骤7之前执行即可，步骤4在步骤8之前执行即可。
需要说明的是，本实施例中eNB1/gNB1上报“位置信息-eNB1/gNB1”，还可以在步骤7中实现，也就是说，eNB1/gNB1可以在步骤1-7之间任何S1/N2消息中上报位置信息。
本实施例提供了一种终端设备的位置确定方法，可以应用于LTE通信网络或者5G通信网络。终端设备通过非接入层安全模式命令完成响应消息将终端设备的位置信息上报给移动管理设备，移动管理设备比较终端设备上报的终端设备的位置信息与基站上报的位置信息是否匹配，可以确定终端设备的位置是否存在误判，避免了计费纠纷。
图7为本申请实施例五提供的终端设备的位置确定方法的消息交互图。本实施例在图3所示实施例的基础上，提供了终端设备的位置确定方法的又一种具体实现方式，可以应用于LTE通信系统和5G通信系统。LTE通信系统涉及的网元可以包括：终端设备(UE)、基站eNB(第一基站eNB1、第二基站eNB2)、移动管理设备(MME)和位置管理设备(E-SMLC)。5G通信系统涉及的网元可以包括：终端设备(UE)、基站gNB(第一基站gNB1、第二基站gNB2)、移动管理设备(AMF)和位置管理设备(LMF)。需要说明，在一些场景中，第一基站eNB1、第二基站eNB2可以为同一基站，第一基站gNB1、第二基站gNB2可以为同一基站。如图7所示，本申请提供的终端设备的位置确定方法，可以包括：
0-7可以参见图6所示实施例，原理相似，此处不再赘述。
8.MME/AMF向E-SMLC/LMF发送请求消息(request message)。
所述请求消息中携带UE上报的终端设备的位置信息和eNB1/gNB1上报的位置信息。
9.E-SMLC/LMF比较NAS层UE上报的终端设备的位置信息和eNB1/gNB1通过S1/N2接口上报的位置信息是否匹配。
10.E-SMLC/LMF向MME/AMF发送请求响应消息(response message)。
其中，请求响应消息可以携带位置比较结果，位置比较结果指示了UE上报的终端设备的位置信息和eNB1/gNB1上报的位置信息是否匹配。
然后，进行后续流程。
具体的，若位置比较结果指示了UE上报的终端设备的位置信息和eNB1/gNB1上报的位置信息不匹配，则MME/AMF可以向UE发送附着拒绝消息(attach reject)或者注册拒绝消息，其中携带的原因值指示了终端设备的位置不一致。
若位置比较结果指示了UE上报的终端设备的位置信息和eNB1/gNB1上报的位置信息匹配，则正常进行后续流程，UE可以接收到MME/AMF发送的正常消息。
可选的，在步骤7中，非接入层安全模式命令完成响应消息还可以包括指示信息，所述指示信息用于指示非接入层安全模式命令完成响应消息中是否包括终端设备的位置信息。
需要说明的是，本实施例对于步骤1和步骤4的执行顺序不做限定。步骤1在步骤7之前执行即可，步骤4在步骤8之前执行即可。
需要说明的是，本实施例中eNB1/gNB1上报“位置信息-eNB1/gNB1”，还可以在步骤7中实现，也就是说，eNB1/gNB1可以在步骤1-7之间任何S1/N2消息中上报位置信息。
本实施例提供了一种终端设备的位置确定方法，可以应用于LTE通信网络或者5G通信网络。终端设备通过非接入层安全模式命令完成响应消息将终端设备的位置信息上报给移动管理设备，移动管理设备将终端设备的位置信息和基站上报的位置信息传递至位置管理设备，位置管理设备比较终端设备上报的终端设备的位置信息与基站上报的位置信息是否匹配，可以确定终端设备的位置是否存在误判，避免了计费纠纷。
图8为本申请实施例六提供的终端设备的位置确定方法的消息交互图。本实施例提供的终端设备的位置确定方法，可以应用于5G通信系统。5G通信系统涉及的网元可以包括：终端设备(UE)、基站(第一基站gNB1和第二基站gNB2)、核心网(AMF、AUSE和UDM)。需要说明，在一些场景中，第一基站gNB1和第二基站gNB2可以为同一基站。如图8所示，本申请提供的终端设备的位置确定方法，可以包括：
0.UE与gNB2建立RRC连接。
在UE与gNB2建立RRC连接后，UE可以从gNB2获取终端设备的位置信息(用“位置信息-UE”表示)。所述终端设备的位置信息可以为gNB2的位置信息(例如TAI)。
1.UE通过gNB1向AMF发送注册请求消息(Registration Request)。
其中，注册请求消息为NAS消息。gNB1向AMF发送的注册请求消息中包括gNB1的位置信息(用“位置信息-gNB1”表示)。
2.AMF向AUSF发送鉴权初始请求消息(Authentication Initiation Request)。鉴权初始请求消息中包括“位置信息-gNB1”。
3.AUSF向UDM发送鉴权信息请求消息(Authentication InformationRequest)。鉴权信息请求消息中包括“位置信息-gNB1”。
通过步骤1-3，UE发起注册流程。AMF通过N2接口获取gNB1上报的位置信息，然后，通过AUSF将gNB1上报的位置信息报给UDM。
4.UDM使用“位置信息-gNB1”计算XRES**＝KDF(XRES*,位置信息-gNB1)或者XRES**＝KDF(Ki，RAND，位置信息-gNB1)。
其中，XRES*表示用于5G的鉴权期望响应值(expected response)，KDF()表示密钥导出函数(key derivation function)，XRES**表示包含位置信息鉴权期望响应值，其中Ki为用户数据管理设备(如UDM)中保存用户的根密钥，RAND为随机数。
在本步骤中，UDM根据gNB1上报的位置信息可以确定鉴权参数XRES**。
可选的，可以设置标识，所述标识用于表示要求UE使用位置信息-UE计算RES**。在一种实现方式中，所述标识可以设置在AUTN中。在另一种实现方式中，所述标志可以专门通过一个参数携带，并通过AUSF/AMF传递给UE。
5.UDM向AUSF发送鉴权信息响应消息(Authentication Information Response)。鉴权信息响应消息中包括RAND，AUTN，Kausf，XRES**。
其中，RAND表示随机数，AUTN表示鉴权令牌(authentication token)，Kausf表示AUSF的密钥(Keys for AUSF)。
6.AUSF向AMF发送鉴权初始响应消息(Authentication InitiationResponse)。鉴权初始响应消息中包括RAND，AUTN，Kausf，HXRES*(期望响应的摘要值Hash eXpected RESponse)。
7.AMF通过gNB1向UE发送鉴权请求消息(Authentication Request)。鉴权请求消息中包括RAND，AUTN。
8.UE使用“位置信息-UE”计算RES**＝KDF(RES*,位置信息-UE)或者RES**＝KDF(Ki，RAND，位置信息-gNB1)。
其中，RES*表示鉴权响应值(response)，RES**表示包含位置信息鉴权期望响应值，其中Ki为用户USIM上中保存用户的根密钥，RAND为随机数。
在本步骤中，UE根据获得的终端设备的位置信息可以确定鉴权参数RES**。
可选的，UE还可以根据网络侧发来的标志决定是否使用位置信息-UE计算RES**。如果UE计算了RES**，则发送RES**给AMF。否则发送RES*给AMF。
9.UE通过gNB1向AMF发送鉴权响应消息(Authentication response)。鉴权响应消息中包括RES**。
10.AMF根据RES**计算HRES**，并与HRES*比较。
其中，HRES**表示(包含位置信息的响应的摘要值)，HRES*(响应的摘要值Hash RESponse) 表示。
11.进行后续流程。
具体的，若HRES**与HRES*不一致，则AMF可以通过gNB1向UE发送鉴权拒绝消息。
可选的，AMF还可以比较UE上报的终端设备的位置信息和gNB1上报的位置信息是否一致。若UE上报的终端设备的位置信息和gNB1上报的位置信息一致，则鉴权拒绝消息中可以携带原因值。所述原因值指示了用户设备的位置不一致。其中，UE上报的终端设备的位置信息可以在步骤10之前的非接入层消息中携带，从而将UE上报的终端设备的位置信息发送给AMF。
若HRES**与HRES*一致，则进行后续正常流程。
需要说明的是，步骤5-7、9-10可以参考现有的鉴权流程，涉及的消息(Authentication Information Response、Authentication InitiationResponse、Authentication Request、Authentication response)以及相关参数(RAND，AUTN，Kausf)与现有的鉴权流程相似。不同之处在于，XRES**为UDM根据位置信息-gNB1确定的，RES**为UE根据位置信息-UE确定的。
本实施例提供了一种终端设备的位置确定方法，可以应用于5G通信网络。终端设备通过获得的终端设备的位置信息确定RES**，并将RES**发送给AMF。UDM根据基站上报的位置信息确定XRES**，AMF根据XRES**确定HRES*，并与根据RES**确定的HRES**进行比较，判断HRES*与HRES**是否一致，可以确定终端设备的位置是否存在误判，提升了终端设备位置确定的准确性。
图9为本申请实施例七提供的终端设备的位置确定方法的消息交互图。本实施例提供的终端设备的位置确定方法可以应用于5G通信系统。5G通信系统涉及的网元可以包括：终端设备(UE)、基站(第一基站gNB1和第二基站gNB2)、核心网设备(AMF、AUSE和UDM)。需要说明，在一些场景中，第一基站gNB1和第二基站gNB2可以为同一基站。如图9所示，本申请提供的终端设备的位置确定方法，可以包括：
步骤0-9。与图8所示实施例中的步骤0-9相似，此处不再赘述。
10.AMF向AUSF发送鉴权确认请求消息(Authentication Confirmation Request)。鉴权确认请求消息中包括UE上报的RES**。
11.AUSF比较RES**与XRES**，判断RES**与XRES**是否一致。
12.进行后续流程。
具体的，若RES**与XRES**不一致，则AUSF可以向AMF发送鉴权拒绝消息。
可选的，AUSF或者AMF还可以比较UE上报的终端设备的位置信息和gNB1上报的位置信息是否一致。若UE上报的终端设备的位置信息和gNB1上报的位置信息一致，则鉴权拒绝消息中可以携带原因值。所述原因值指示了用户设备的位置不一致。其中，UE上报的终端设备的位置信息可以在步骤11之前的非接入层消息中携带，从而将UE上报的终端设备的位置信息发送给AUSF或者AMF。
若RES**与XRES**一致，则进行后续正常流程。AUSF可以向AMF发送鉴权确认响应消息(Authentication Confirmation Response)。
本实施例与图8所示实施例的区别在于：在图8中，由AMF比较HRES**与HRES*是否一致。本实施例中，由AUSF比较RES**与XRES**是否一致。
本实施例提供了一种终端设备的位置确定方法，可以应用于5G通信网络。终端设备通过获得的终端设备的位置信息确定RES**，并将RES**通过AMF发送给AUSF。UDM根据基站上报的位置信息确定XRES**，AUSF比较RES**与XRES**是否一致，可以确定终端设备的位置是否存在误判，提升了终端设备位置确定的准确性。
图10为本申请实施例八提供的终端设备的位置确定方法的消息交互图。本实施例提供的终端设备的位置确定方法可以应用于LTE通信系统。LTE通信系统涉及的网元可以包括：终端设备(UE)、基站(第一基站eNB1和第二基站eNB2)、核心网设备(MME和HSS)。需要说明，在一些场景中，第一基站eNB1和第二基站eNB2可以为同一基站。如图10所示，本申请提供的终端设备的位置确定方法，可以包括：
0.UE与eNB2建立RRC连接。
在UE与eNB2建立RRC连接后，UE可以从eNB2获取终端设备的位置信息(用“位置信息-UE”表示)。所述终端设备的位置信息可以为eNB2的位置信息(例如TAI)。
1.UE通过eNB1向MME发送注册请求消息(Registration Request)。
其中，注册请求消息为NAS消息。eNB1向MME发送的注册请求消息中包括eNB1的位置信息(用“位置信息-eNB1”表示)。
2.MME向HSS发送鉴权信息请求消息(Authentication InformationRequest)。鉴权信息请求消息中包括“位置信息-eNB1”。
通过步骤1-2，UE发起注册流程。MME通过S1接口获取eNB1上报的位置信息，然后，将eNB1上报的位置信息报给HSS。
3.HSS使用“位置信息-eNB1”计算XRES**＝KDF(XRES,位置信息-eNB1)或者XRES**＝KDF(Ki，RAND，位置信息-gNB1)。
其中，XRES表示用于4G的鉴权期望响应值(expected response)，Ki为HSS和USIM卡中保存相同的根密钥，RAND为随机数。
在本步骤中，HSS根据eNB1上报的位置信息可以确定鉴权参数XRES**。
可选的，可以设置标识，所述标识用于表示要求UE使用位置信息-UE计算RES**。在一种实现方式中，所述标识可以设置在AUTN中。在另一种实现方式中，所述标志可以专门通过一个参数携带，并通过MME传递给UE。
4.HSS向MME发送鉴权信息响应消息(Authentication Information Response)。鉴权信息响应消息中包括RAND，AUTN，Kasme，XRES**。
其中，Kasme表示接入安全管理实体Access Security Management Entity的密钥。
5.MME通过eNB1向UE发送鉴权请求消息(Authentication Request)。鉴权请求消息中包括RAND，AUTN。
6.UE使用“位置信息-UE”计算RES**＝KDF(RES,位置信息-UE)或者RES**＝KDF(Ki，RAND，位置信息-UE)。
其中，RES表示鉴权响应值(response)，RES**表示包含位置信息鉴权期望响应值，Ki为用户SIM上中保存用户的根密钥，RAND为随机数。
在本步骤中，UE根据获得的终端设备的位置信息可以确定鉴权参数RES**。
可选的，UE还可以根据网络侧发来的标志决定是否使用位置信息-UE计算RES**。如果UE计算了RES**，则发送RES**给MME。否则发送RES给MME。
7.UE通过eNB1向MME发送鉴权响应消息(Authentication response)。鉴权响应消息中包括RES**。
8.MME比较RES**与XRES**，判断RES**与XRES**是否一致。
9.进行后续流程。
具体的，若RES**与XRES**不一致，则MME可以通过eNB1向UE发送鉴权拒绝消息。
可选的，MME还可以比较UE上报的终端设备的位置信息和eNB1上报的位置信息是否一致。若UE上报的终端设备的位置信息和eNB1上报的位置信息一致，则鉴权拒绝消息中可以携带原因值。所述原因值指示了用户设备的位置不一致。其中，UE上报的终端设备的位置信息可以在步骤8之前的非接入层消息中携带，从而将UE上报的终端设备的位置信息发送给MME。
若RES**与XRES**一致，则进行后续正常流程。
需要说明的是，步骤4-5、7可以参考现有的鉴权流程，涉及的消息(Authentication Information Response、Authentication Request、Authentication response)以及相关参数(RAND，AUTN，Kasme)与现有的鉴权流程相似。不同之处在于，XRES**为HSS根据位置信息-eNB1确定的，RES**为UE根据位置信息-UE确定的。
本实施例提供了一种终端设备的位置确定方法，可以应用于LTE通信网络。终端设备通过获得的终端设备的位置信息确定RES**，并将RES**发送给MME。HSS根据基站上报的位置信息确定XRES**，MME判断RES**与XRES**是否一致，可以确定终端设备的位置是否存在误判，提升了终端设备位置确定的准确性。
图11为本申请实施例九提供的终端设备的位置确定方法的消息交互图。本实施例提供的终端设备的位置确定方法可以应用于5G通信系统。5G通信系统涉及的网元可以包括：终端设备(UE)、基站(第一基站gNB1和第二基站gNB2)、核心网设备(AMF、AUSE和UDM)。需要说明，在一些场景中，第一基站gNB1和第二基站gNB2可以为同一基站。如图11所示，本申请提供的终端设备的位置确定方法，可以包括：
0.UE与gNB2建立RRC连接。
在UE与gNB2建立RRC连接后，UE可以从gNB2获取终端设备的位置信息(用“位置信息-UE”表示)。所述终端设备的位置信息可以为gNB2的位置信息(例如TAI)。
1.UE通过gNB1向AMF发送注册请求消息(Registration Request)。
其中，注册请求消息为NAS消息。gNB1向AMF发送的注册请求消息中包括gNB1的位置信息(用“位置信息-gNB1”表示)。
2.AMF向AUSF发送鉴权初始请求消息(Authentication Initiation Request)。鉴权初始请求消息中包括“位置信息-gNB1”。
3.AUSF向UDM发送鉴权信息请求消息(Authentication InformationRequest)。
4.UDM向AUSF发送鉴权信息响应消息(Authentication Information Response)。鉴权信息响应消息中包括RAND，AUTN，Kausf，XRES*。
5.AUSF使用“位置信息-gNB1”计算XRES**＝KDF(XRES*,位置信息-gNB1)，进而根据XRES**计算HXRES**。
在本步骤中，AUSF根据gNB1上报的位置信息可以确定鉴权参数XRES**和HXRES**。
其中，HXRES**表示包含位置信息的期望响应的摘要值。
可选的，AUSF可以设置标识，所述标识用于表示要求UE使用位置信息-UE计算RES**。在一种实现方式中，所述标识可以设置在AUTN中。在另一种实现方式中，所述标志可以专门通过一个参数携带，并通过AMF传递给UE。
6.AUSF向AMF发送鉴权初始响应消息(Authentication InitiationResponse)。鉴权初始响应消息中包括RAND，AUTN，Kausf，HXRES**。
7.AMF通过gNB1向UE发送鉴权请求消息(Authentication Request)。鉴权请求消息中包括RAND，AUTN。
8.UE使用“位置信息-UE”计算RES**＝KDF(RES*,位置信息-UE)。
在本步骤中，UE根据获得的终端设备的位置信息可以确定鉴权参数RES**。
可选的，UE还可以根据网络侧发来的标志决定是否使用位置信息-UE计算RES**。如果UE计算了RES**，则发送RES**给AMF。否则发送RES*给AMF。
9.UE通过gNB1向AMF发送鉴权响应消息(Authentication response)。鉴权响应消息中包括RES**。
10.AMF根据RES**计算HRES**，并与HXRES**比较。
11.进行后续流程。
具体的，若HXRES**与HRES*不一致，则AMF可以通过gNB1向UE发送鉴权拒绝消息。
可选的，AMF还可以比较UE上报的终端设备的位置信息和gNB1上报的位置信息是否一致。若UE上报的终端设备的位置信息和gNB1上报的位置信息一致，则鉴权拒绝消息中可以携带原因值。所述原因值指示了用户设备的位置不一致。其中，UE上报的终端设备的位置信息可以在步骤10之前的非接入层消息中携带，从而将UE上报的终端设备的位置信息发送给AMF。
若HXRES**与HRES*一致，则进行后续正常流程。
本实施例中的步骤0-2、7-9与图8所示实施例中步骤0-2、7-9相似。
本实施例与图8所示实施例的区别在于：在图8中，由UDM计算XRES**，由AUSF计算HXRES*。本实施例中，由AUSF计算XRES**和HXRES**。
本实施例提供了一种终端设备的位置确定方法，可以应用于5G通信网络。终端设备通过获得的终端设备的位置信息确定RES**，并将RES**发送给AMF。AUSF根据基站上报的位置信息确定XRES**和HXRES**，AMF判断根据RES**确定的HRES**与HXRES**是否一致，可以确定终端设备的位置是否存在误判，提升了终端设备位置确定的准确性。
图12为本申请实施例十提供的终端设备的位置确定方法的消息交互图。本实施例提供的终端设备的位置确定方法可以应用于5G通信系统。5G通信系统涉及的网元可以包括：终端设备(UE)、基站(第一基站gNB1和第二基站gNB2)、核心网设备(AMF、AUSE和UDM)。需要说明，在一些场景中，第一基站gNB1和第二基站gNB2可以为同一基站。如图12所示，本申请提供的终端设备的位置确定方法，可以包括：
步骤0-9。与图11所示实施例中的步骤0-9相似，此处不再赘述。
10.AMF向AUSF发送鉴权确认请求消息(Authentication Confirmation Request)。鉴权确认请求消息中包括UE上报的RES**。
11.AUSF比较RES**与XRES**，判断RES**与XRES**是否一致。
12.进行后续流程。
具体的，若RES**与XRES**不一致，则AUSF可以向AMF发送鉴权拒绝消息。
可选的，AUSF或者AMF还可以比较UE上报的终端设备的位置信息和gNB1上报的位置信息是否一致。若UE上报的终端设备的位置信息和gNB1上报的位置信息一致，则鉴权拒绝消息中可以携带原因值。所述原因值指示了用户设备的位置不一致。其中，UE上报的终端设备的位置信息可以在步骤11之前的非接入层消息中携带，从而将UE上报的终端设备的位置信息发送给AUSF或者AMF。
若RES**与XRES**一致，则进行后续正常流程。AUSF可以向AMF发送鉴权确认响应消息(Authentication Confirmation Response)。
本实施例与图11所示实施例的区别在于：在图11中，由AMF比较HXRES**与HRES*是否一致。本实施例中，由AUSF比较RES**与XRES**是否一致。
本实施例提供了一种终端设备的位置确定方法，可以应用于5G通信网络。终端设备通过获得的终端设备的位置信息确定RES**，并将RES**通过AMF发送给AUSF。AUSF根据基站上报的位置信息确定XRES**，AUSF比较RES**与XRES**是否一致，可以确定终端设备的位置是否存在误判，提升了终端设备位置确定的准确性。
图13为本申请实施例十一提供的终端设备的位置确定方法的消息交互图。本实施例提供的终端设备的位置确定方法可以应用于LTE通信系统。LTE通信系统涉及的网元可以包括：终端设备(UE)、基站(第一基站eNB1和第二基站eNB2)、核心网设备(MME和HSS)。需要说明，在一些场景中，第一基站eNB1和第二基站eNB2可以为同一基站。如图13所示，本申请提供的终端设备的位置确定方法，可以包括：
0.UE与eNB2建立RRC连接。
在UE与eNB2建立RRC连接后，UE可以从eNB2获取终端设备的位置信息(用“位置信息-UE”表示)。所述终端设备的位置信息可以为eNB2的位置信息(例如TAI)。
1.UE通过eNB1向MME发送注册请求消息(Registration Request)。
其中，注册请求消息为NAS消息。eNB1向MME发送的注册请求消息中包括eNB1的位置信息(用“位置信息-eNB1”表示)。
2.MME向HSS发送鉴权信息请求消息(Authentication InformationRequest)。
3.HSS向MME发送鉴权信息响应消息(Authentication Information Response)。鉴权信息响应消息中包括RAND，AUTN，Kasme，XRES。
4.MME使用“位置信息-eNB1”计算XRES**＝KDF(XRES,位置信息-eNB1)。
在本步骤中，MME根据eNB1上报的位置信息可以确定鉴权参数XRES**。
可选的，可以设置标识，所述标识用于表示要求UE使用位置信息-UE计算RES**。在一种实现方式中，所述标识可以设置在AUTN中。在另一种实现方式中，所述标志可以专门通过一个参数携带，传递给UE。
5.MME通过eNB1向UE发送鉴权请求消息(Authentication Request)。鉴权请求消息中包括RAND，AUTN。
6.UE使用“位置信息-UE”计算RES**＝KDF(RES,位置信息-UE)。
在本步骤中，UE根据获得的终端设备的位置信息可以确定鉴权参数RES**。
可选的，UE还可以根据网络侧发来的标志决定是否使用位置信息-UE计算RES**。如果UE计算了RES**，则发送RES**给MME。否则发送RES给MME。
7.UE通过eNB1向MME发送鉴权响应消息(Authentication response)。鉴权响应消息中包括RES**。
8.MME比较RES**与XRES**，判断RES**与XRES**是否一致。
9.进行后续流程。
具体的，若HRES**与HRES*不一致，则MME可以通过eNB1向UE发送鉴权拒绝消息。
可选的，MME还可以比较UE上报的终端设备的位置信息和eNB1上报的位置信息是否一致。若UE上报的终端设备的位置信息和eNB1上报的位置信息一致，则鉴权拒绝消息中可以携带原因值。所述原因值指示了用户设备的位置不一致。其中，UE上报的终端设备的位置信息可以在步骤8之前的非接入层消息中携带，从而将UE上报的终端设备的位置信息发送给MME。
若HRES**与HRES*一致，则进行后续正常流程。
本实施例与图10所示实施例的区别在于：在图10中，由HSS计算XRES**。本实施例中，由MME计算XRES**。
本实施例提供了一种终端设备的位置确定方法，可以应用于LTE通信网络。终端设备通过获得的终端设备的位置信息确定RES**，并将RES**发送给MME。MME根据基站上报的位置信息确定XRES**，并判断RES**与XRES**是否一致，可以确定终端设备的位置是否存在误判，提升了终端设备位置确定的准确性。
图14为本申请实施例十二提供的终端设备的位置确定方法的消息交互图。本实施例提供的终端设备的位置确定方法，可以应用于4G通信网络或者5G通信网络。本实施例涉及的网元可以包括终端设备、基站和核心网设备。其中，终端设备与核心网设备之间可以通过基站(此处为第一基站)进行通信。如图14所示，本实施例提供的终端设备的位置确定方法，可以包括：
S201、核心网设备获取第一基站上报的位置信息。
S202、核心网设备根据第一基站上报的位置信息确定非接入层完整性保护密钥。
可选的，核心网设备为移动管理网元，根据第一基站上报的位置信息确定非接入层完整性保护密钥，可以包括：
将第一基站上报的位置信息发送给数据管理网元。
接收所数据管理网元发送的接入安全管理实体密钥，其中接入安全管理实体密钥是用户数据管理网元根据第一基站上报的位置信息确定的。
S203、核心网设备向终端设备发送非接入层安全模式命令消息。
其中，非接入层安全模式命令消息是采用非接入层完整性保护密钥进行完整性保护的。
相应的，终端设备接收核心网设备发送的非接入层安全模式命令消息。
S204、终端设备根据终端设备的当前位置信息确定非接入层完整性保护密钥。
S205、终端设备根据非接入层完整性保护密钥对非接入层安全模式命令消息进行完整性校验。
可见，本实施例提供的终端设备的位置确定方法，核心网设备根据基站上报的位置信息确定非接入层完整性保护密钥，并采用该非接入层完整性保护密钥对非接入层安全模式命令消息进行完整性保护。终端设备根据终端设备的当前位置信息确定非接入层完整性保护密钥，并根据该非接入层完整性保护密钥对非接入层安全模式命令消息进行完整性校验。如果基站 上报的位置信息和终端设备的当前位置信息不匹配，则完整性保护校验无法通过。如果基站上报的位置信息和终端设备的当前位置信息匹配，则完整性保护校验可以通过。因此，通过将基站上报的位置信息和终端设备的当前位置信息应用于密钥的推演过程，可以确定终端设备的位置是否存在误判，当位置信息不匹配时避免了终端设备接入网络，提升了通信的安全性能。
可选的，本实施例提供的终端设备的位置确定方法，还可以包括：
S206、若终端设备根据非接入层的完整性保护密钥对非接入层的安全模式命令消息进行完整性校验失败，则向核心网设备发送非接入层的安全模式拒绝消息。
可选的，核心网可以通过NAS SMC消息把第一基站的位置信息发送给终端设备。或者，第一基站接收到核心网发送给终端设备的NAS SMC消息后，将第一基站的位置信息与NAS PDU打包发送给终端设备。当终端设备对非接入层的安全模式命令(NAS SMC)消息进行完整性校验失败时，终端设备可以比对终端设备的位置信息与第一基站的位置信息是否匹配，从而确定终端设备的位置是否有误。或者，终端设备根据终端设备的位置信息确定终端设备的位置是否有误。可以参见图3所示实施例的说明，此处不再赘述。如果终端设备确定终端设备的位置信息与第一基站的位置信息不匹配，则非接入层的安全模式拒绝消息中可以携带指示位置不一致的原因值。
可选的，非接入层的安全模式拒绝消息可以携带原因值和终端设备的位置信息。后续，核心网设备可以比对第一基站上报的位置信息与终端设备上报的终端设备的位置信息是否匹配。
可选的，本实施例提供的终端设备的位置确定方法，还可以包括：
若核心网设备接收到终端设备发送的安全模式命令拒绝消息，向终端设备发送附着拒绝或者注册拒绝消息。
可选的，若非接入层的安全模式拒绝消息包括终端设备的位置信息，核心网设备可以比对第一基站的位置信息与终端设备上报的终端设备的位置信息是否匹配。如果核心网设备确定终端设备的位置信息和第一基站上报的位置信息不匹配，则附着拒绝消息或者注册拒绝消息中可以携带指示位置信息不一致的原因值。
需要说明的是，终端设备上报的终端设备的位置信息还可以携带在S206之前的非接入层消息中，从而将终端设备的位置信息上报给核心网设备。
本申请实施例提供一种终端设备的位置确定方法，包括：核心网设备获取第一基站上报的位置信息，核心网设备根据第一基站上报的位置信息确定非接入层完整性保护密钥，核心网设备向终端设备发送非接入层安全模式命令消息，终端设备根据终端设备的当前位置信息确定非接入层完整性保护密钥，根据非接入层完整性保护密钥对非接入层安全模式命令消息进行完整性校验。本实施例提供的终端设备的位置确定方法，通过将基站上报的位置信息和终端设备的当前位置信息应用于非接入层密钥的推演过程，当位置信息不匹配时避免了终端设备接入网络，提升了通信的安全性能。
图15为本申请实施例十三提供的终端设备的位置确定方法的消息交互图。本实施例在图14所示实施例的基础上，提供了终端设备的位置确定方法的一种具体实现方式。本实施例提供的终端设备的位置确定方法可以应用于5G通信系统。5G通信系统涉及的网元可以包括：终端设备(UE)、基站(第一基站gNB1和第二基站gNB2)、核心网设备(AMF)、AUSE和UDM)。 需要说明，在一些场景中，第一基站gNB1和第二基站gNB2可以为同一基站。如图15所示，本申请提供的终端设备的位置确定方法，可以包括：
0.UE与gNB2建立RRC连接。
在UE与gNB2建立RRC连接后，UE可以从gNB2获取终端设备的位置信息(用“位置信息-UE”表示)。所述终端设备的位置信息可以为gNB2的位置信息(例如TAI)。
1.UE通过gNB1向AMF发送注册请求消息(Registration Request)。
其中，注册请求消息为NAS消息。gNB1向AMF发送的注册请求消息中包括gNB1的位置信息(用“位置信息-gNB1”表示)。
2.鉴权流程。
与现有的鉴权流程相似，可以参见现有的鉴权流程。
3.AMF将gNB1上报的位置信息(位置信息-gNB1)作为参数推演出KAMF*。
可选的，可以通过下列中的任意一种方式确定KAMF*。
a.KAMF*＝KDF(KSEAF,SUPI，ABBA parameter，位置信息-gNB1)。
b.KAMF*＝KDF(KDF(KSEAF,SUPI，ABBA parameter),位置信息-gNB1)。
其中，KAMF*表示包含位置信息的接入和移动性管理功能(接入和移动性管理功能)的密钥，KSEAF表示安全锚点功能Security Anchor Function的密钥，SUPI表示用户永久标识subscriber permanent identifier，ABBA parameter表示防止降级攻击的参数The Anti-Bidding down Between Architectures。
4.AMF由KAMF*推演出KNASint*＝KDF(KAMF*,NAS-int-alg,Alg-ID)。然后，AMF发起NAS SMC流程，并用KNASint*对NAS SMC消息做完整性保护。
其中，NAS-int-alg表示NAS完整性保护算法，Alg-ID表示算法的标识，KNASint*表示包含位置信息的NAS层的完整性保护密钥。
5.AMF通过gNB1向UE发送非接入层安全模式命令消息(NAS Security Mode Command)。
6.UE将获取的终端设备的位置信息(位置信息-UE)作为参数推演出KAMF。
可选的，可以通过下列中的任意一种方式确定KAMF。
a.KAMF＝KDF(KSEAF,SUPI，ABBA parameter，位置信息-UE)。
b.KAMF＝KDF(KDF(KSEAF,SUPI，ABBA parameter),位置信息-UE)。
其中，KAMF表示AMF使用的密钥。
UE由KAMF推演出KNASint＝KDF(KAMF,NAS-int-alg,Alg-ID)，并用KNASint对NAS SMC消息做完整性校验。
其中，KNASint表示NAS层的完整性保护的密钥。
7.根据步骤6中的校验结果，UE通过gNB1向AMF发送非接入层安全模式完成消息(NAS Security Mode Complete)或者非接入层安全模式拒绝消息(NAS Security Mode Reject)。
具体的，若步骤6中校验通过，则UE向AMF发送NAS Security Mode Complete消息。若步骤6中校验失败，则UE向AMF发送NAS Security Mode Reject消息。
需要说明的是，本实施例中涉及的参数和参数的获取方式，除了KAMF*和KAMF之外，其他参数均与现有技术相同。
可选的，本实施例提供的终端设备的位置确定方法，还可以包括：
若UE根据非接入层的完整性保护密钥对非接入层的安全模式命令消息进行完整性校验失败，则向核心网设备发送非接入层的安全模式拒绝消息。
可选的，核心网可以通过NAS SMC消息把第一基站的位置信息发送给UE。或者，第一基站接收到核心网发送给UE的NAS SMC消息后，将第一基站的位置信息与NAS PDU打包发送给UE。当UE对非接入层的安全模式命令(NAS SMC)消息进行完整性校验失败时，UE可以比对UE的位置信息与第一基站的位置信息是否匹配，从而确定UE的位置是否有误。或者，UE根据UE的位置信息确定UE的位置是否有误。可以参见图3所示实施例的说明，此处不再赘述。如果UE确定UE的位置信息与第一基站的位置信息不匹配，则非接入层的安全模式拒绝消息中可以携带指示位置不一致的原因值。
可选的，非接入层的安全模式拒绝消息可以携带原因值和UE的位置信息。后续，核心网设备可以比对第一基站上报的位置信息与UE上报的UE的位置信息是否匹配。
可选的，本实施例提供的终端设备的位置确定方法，还可以包括：
若核心网设备接收到UE发送的安全模式命令拒绝消息，向UE发送附着拒绝或者注册拒绝消息。
可选的，若非接入层的安全模式拒绝消息包括UE的位置信息，核心网设备可以比对第一基站的位置信息与UE上报的UE的位置信息是否匹配。如果核心网设备确定UE的位置信息和第一基站上报的位置信息不匹配，则附着拒绝消息或者注册拒绝消息中可以携带指示位置信息不一致的原因值。
本实施例还有另外一种形式，AMF也可以把gNB1上报的位置信息(位置信息-gNB1)发给AUSF，AUSF根据位置信息-gNB1生成Kseaf＝KDF(Kausf,位置信息-gNB1,…)或者Kseaf＝KDF(CK’||IK’,位置信息-gNB1,…)。AUSF把Kseaf发给SEAF/AMF，AMF再根据Kseaf推导Kamf，进而根据Kamf推导NAS完整性保护密钥。
UE侧采用上述相同的方法推导NAS完整性保护密钥，不过其中的位置信息参数是位置信息-UE。
本实施例还有另外一种形式，AMF也可以把gNB1上报的位置信息(位置信息-gNB1)发给AUSF，AUSF把位置信息-gNB1发给UDM。UDM根据位置信息-gNB1生成Kausf＝KDF(CK||IK,位置信息-gNB1,…)，或者CK’||IK’＝KDF(CK||IK,位置信息-gNB1,…)。然后UDM把Kausf发给AUSF或者CK’，IK’发给AUSF(此时AUSF再根据CK’，IK’生成Kausf)。AUSF根据Kausf生成Kseaf。AUSF把Kseaf发给SEAF/AMF，AMF再根据Kseaf推导Kamf，进而根据Kamf推导NAS完整性保护密钥。
UE侧采用上述相同的方法推导NAS完整性保护密钥，不过其中的位置信息参数是位置信息-UE。
本实施例提供了一种终端设备的位置确定方法，可以应用于5G通信网络。AMF通过基站上报的位置信息可以完成NAS完整性密钥的推演和对NAS消息进行完整性保护，终端设备通过获得的终端设备的位置信息可以完成NAS完整性密钥的推演和对NAS消息进行校验，当位置信息不匹配时避免了终端设备接入网络，提升了通信的安全性能。
图16为本申请实施例十四提供的终端设备的位置确定方法的消息交互图。本实施例在图14所示实施例的基础上，提供了终端设备的位置确定方法的一种具体实现方式。本实施例提供的终端设备的位置确定方法可以应用于LTE通信系统。LTE通信系统涉及的网元可以包括：终端设备(UE)、基站(第一基站eNB1和第二基站eNB2)、核心网设备(MME和HSS)。需要说明，在一些场景中，第一基站eNB1和第二基站eNB2可以为同一基站。如图16所示，本申 请提供的终端设备的位置确定方法，可以包括：
0.UE与eNB2建立RRC连接。
在UE与eNB2建立RRC连接后，UE可以从eNB2获取终端设备的位置信息(用“位置信息-UE”表示)。所述终端设备的位置信息可以为eNB2的位置信息(例如TAI)。
1.UE通过eNB1向MME发送注册请求消息(Registration Request)。
其中，注册请求消息为NAS消息。eNB1向MME发送的注册请求消息中包括eNB1的位置信息(用“位置信息-eNB1”表示)。
2.MME向HSS发送鉴权数据请求信息(Authentication Data Request)。鉴权数据请求信息中包括eNB1上报的位置信息。
3.MME将gNB1上报的位置信息(位置信息-gNB1)作为参数推演出KASME*。
可选的，可以通过下列中的任意一种方式确定KASME*。
a.KASME*＝KDF(SN id,SQN+AK,CK,IK,位置信息-eNB1)
b.KASME*＝KDF(KDF(SN id,SQN+AK,CK,IK),位置信息-eNB1)
其中，KASME*表示包含位置信息的接入安全管理实体密钥，SN id表示服务网络标识serving network identity，SQN表示序列号sequence number，AK表示匿名密钥anonymity key，CK表示加密密钥cipher key，IK表示完整性保护密钥integrity key。
4.HSS向MME发送鉴权数据响应消息(Authentication Data Respose)。鉴权数据响应消息中包括AVs和KASME*。
其中，AVs表示鉴权向量authorization vector。
5.剩余鉴权流程。
与现有的鉴权流程相似，可以参见现有的鉴权流程。
6.MME推演KNASint*＝KDF(KASME*,NAS-int-alg,Alg-ID)，并用KNASint*对NAS SMC消息做完整性保护。
7.MME通过eNB1向UE发送非接入层安全模式命令消息(NAS Security Mode Command)。
8.UE用获得的终端设备的位置信息(位置信息-UE)作为参数推演KASME。
可选的，可以通过下列中的任意一种方式确定KASME。
a.KASME＝KDF(SN id,SQN+AK,CK,IK,位置信息-UE)。
b.KASME＝KDF(KDF(SN id,SQN+AK,CK,IK),位置信息-UE)。
UE由KASME推演出KNASint＝KDF(KASME,NAS-int-alg,Alg-ID)，并用KNASint对NAS SMC消息做完整性校验。
其中，KASME表示接入安全管理实体密钥，KNASintNAS层完整性保护密钥表示。
9.根据步骤8中的校验结果，UE通过eNB1向MME发送非接入层安全模式完成消息(NAS Security Mode Complete)或者非接入层安全模式拒绝消息(NAS Security Mode Reject)。
具体的，若步骤8中校验通过，则UE向MME发送NAS Security Mode Complete消息。若步骤8中校验失败，则UE向MME发送NAS Security Mode Reject消息。
需要说明的是，本实施例中涉及的参数和参数的获取方式，除了KASME*和KASME之外，其他参数均与现有技术相同。
可选的，本实施例提供的终端设备的位置确定方法，还可以包括：
若UE根据非接入层的完整性保护密钥对非接入层的安全模式命令消息进行完整性校验失败，则向核心网设备发送非接入层的安全模式拒绝消息。
可选的，核心网可以通过NAS SMC消息把第一基站的位置信息发送给UE。或者，第一基站接收到核心网发送给UE的NAS SMC消息后，将第一基站的位置信息与NAS PDU打包发送给UE。当UE对非接入层的安全模式命令(NAS SMC)消息进行完整性校验失败时，UE可以比对UE的位置信息与第一基站的位置信息是否匹配，从而确定UE的位置是否有误。或者，UE根据UE的位置信息确定UE的位置是否有误。可以参见图3所示实施例的说明，此处不再赘述。如果UE确定UE的位置信息与第一基站的位置信息不匹配，则非接入层的安全模式拒绝消息中可以携带指示位置不一致的原因值。
可选的，非接入层的安全模式拒绝消息可以携带原因值和UE的位置信息。后续，核心网设备可以比对第一基站上报的位置信息与UE上报的UE的位置信息是否匹配。
可选的，本实施例提供的终端设备的位置确定方法，还可以包括：
若核心网设备接收到UE发送的安全模式命令拒绝消息，向UE发送附着拒绝或者注册拒绝消息。
可选的，若非接入层的安全模式拒绝消息包括UE的位置信息，核心网设备可以比对第一基站的位置信息与UE上报的UE的位置信息是否匹配。如果核心网设备确定UE的位置信息和第一基站上报的位置信息不匹配，则附着拒绝消息或者注册拒绝消息中可以携带指示位置信息不一致的原因值。
本实施例提供了一种终端设备的位置确定方法，可以应用于LTE通信网络。HSS通过基站上报的位置信息可以获得KASME*，MME可以根据KASME*完成NAS完整性密钥的推演和对NAS消息进行完整性保护。终端设备通过获得的终端设备的位置信息可以完成NAS完整性密钥的推演和对NAS消息进行校验，当位置信息不匹配时避免了终端设备接入网络，提升了通信的安全性能。
图17为本申请实施例十五提供的终端设备的位置确定方法的消息交互图。本实施例在图14所示实施例的基础上，提供了终端设备的位置确定方法的一种具体实现方式。本实施例提供的终端设备的位置确定方法可以应用于LTE通信系统。LTE通信系统涉及的网元可以包括：终端设备(UE)、基站(第一基站eNB1和第二基站eNB2)、核心网设备(MME和HSS)。需要说明，在一些场景中，第一基站eNB1和第二基站eNB2可以为同一基站。如图17所示，本申请提供的终端设备的位置确定方法，可以包括：
0.UE与eNB2建立RRC连接。
在UE与eNB2建立RRC连接后，UE可以从eNB2获取终端设备的位置信息(用“位置信息-UE”表示)。所述终端设备的位置信息可以为eNB2的位置信息(例如TAI)。
1.UE通过eNB1向MME发送注册请求消息(Registration Request)。
其中，注册请求消息为NAS消息。eNB1向MME发送的注册请求消息中包括eNB1的位置信息(用“位置信息-eNB1”表示)。
2.鉴权流程。
与现有的鉴权流程相似，可以参见现有的鉴权流程。
3.MME用eNB1上报的位置信息-eNB1作参数推演出KNASint*。
可选的，可以通过下列中的任意一种方式确定KNASint*。
a.KNASint*＝KDF(KASME,NAS-int-alg,Alg-ID,位置信息-eNB1)。
b.KNASint*＝KDF(KDF(KASME,NAS-int-alg,Alg-ID),位置信息-eNB1)。
4.MME发起NAS SMC流程，然后用KNASint*对NAS SMC消息做完整性保护。
5.MME通过eNB1向UE发送非接入层安全模式命令消息(NAS Security Mode Command)。
6.UE用获得的位置信息-UE作为参数推演KNASint。
可选的，可以通过下列中的任意一种方式确定KNASint。
a.KNASint＝KDF(KASME,NAS-int-alg,Alg-ID,位置信息-UE)。
b.KNASint＝KDF(KDF(KASME,NAS-int-alg,Alg-ID),位置信息-UE)。
然后，UE用KNASint对NAS SMC消息做完整性校验。
7.根据步骤6中的校验结果，UE通过eNB1向MME发送非接入层安全模式完成消息(NAS Security Mode Complete)或者非接入层安全模式拒绝消息(NAS Security Mode Reject)。
具体的，若步骤6中校验通过，则UE向MME发送NAS Security Mode Complete消息。若步骤6中校验失败，则UE向MME发送NAS Security Mode Reject消息。
需要说明的是，本实施例中涉及的参数和参数的获取方式，除了KNASint*和KNASint之外，其他参数均与现有技术相同。
可选的，本实施例提供的终端设备的位置确定方法，还可以包括：
若UE根据非接入层的完整性保护密钥对非接入层的安全模式命令消息进行完整性校验失败，则向核心网设备发送非接入层的安全模式拒绝消息。
可选的，核心网可以通过NAS SMC消息把第一基站的位置信息发送给UE。或者，第一基站接收到核心网发送给UE的NAS SMC消息后，将第一基站的位置信息与NAS PDU打包发送给UE。当UE对非接入层的安全模式命令(NAS SMC)消息进行完整性校验失败时，UE可以比对UE的位置信息与第一基站的位置信息是否匹配，从而确定UE的位置是否有误。或者，UE根据UE的位置信息确定UE的位置是否有误。可以参见图3所示实施例的说明，此处不再赘述。如果UE确定UE的位置信息与第一基站的位置信息不匹配，则非接入层的安全模式拒绝消息中可以携带指示位置不一致的原因值。
可选的，非接入层的安全模式拒绝消息可以携带原因值和UE的位置信息。后续，核心网设备可以比对第一基站上报的位置信息与UE上报的UE的位置信息是否匹配。
可选的，本实施例提供的终端设备的位置确定方法，还可以包括：
若核心网设备接收到UE发送的安全模式命令拒绝消息，向UE发送附着拒绝或者注册拒绝消息。
可选的，若非接入层的安全模式拒绝消息包括UE的位置信息，核心网设备可以比对第一基站的位置信息与UE上报的UE的位置信息是否匹配。如果核心网设备确定UE的位置信息和第一基站上报的位置信息不匹配，则附着拒绝消息或者注册拒绝消息中可以携带指示位置信息不一致的原因值。
本实施例与图16所示实施例的区别在于：在图16中，由HSS根据基站上报的位置信息计算KASME*，由MME根据KASME*进行NAS完整性密钥的推演。本实施例中，由MME直接根据设备上报的位置信息进行NAS完整性密钥的推演。
本实施例提供了一种终端设备的位置确定方法，可以应用于LTE通信网络。MME通过基站上报的位置信息可以完成NAS完整性密钥的推演和对NAS消息进行完整性保护。终端设备通过获得的终端设备的位置信息可以完成NAS完整性密钥的推演和对NAS消息进行校验，当位置信息不匹配时避免了终端设备接入网络，提升了通信的安全性能。
图18为本申请实施例十六提供的终端设备的位置确定方法的消息交互图。本实施例提供的终端设备的位置确定方法，可以应用于4G通信网络或者5G通信网络。本实施例涉及的网元可以包括终端设备、基站和核心网设备。其中，终端设备与核心网设备之间可以通过基站(此处为第一基站)进行通信。如图18所示，本实施例提供的终端设备的位置确定方法，可以包括：
S301、核心网设备获取第一基站上报的位置信息。
S302、核心网设备根据第一基站上报的位置信息确定第一基站使用的临时密钥。
S303、核心网设备向第一基站发送第一基站使用的临时密钥。
相应的，第一基站接收核心网设备发送的第一基站使用的临时密钥。
S304、第一基站根据第一基站使用的临时密钥确定接入层完整性保护密钥。
S305、第一基站向终端设备发送接入层安全模式命令消息。
其中，接入层安全模式命令消息是采用接入层完整性保护密钥进行完整性保护的。
响应的，终端设备接收第一基站发送的接入层安全模式命令消息。
S306、终端设备根据终端设备的当前位置信息确定接入层完整性保护密钥。
S307、终端设备根据接入层完整性保护密钥对接入层安全模式命令消息进行完整性校验。
可见，本实施例提供的终端设备的位置确定方法，核心网设备根据基站上报的位置信息确定第一基站使用的临时密钥，第一基站根据第一基站使用的临时密钥确定接入层完整性保护密钥，并采用该接入层完整性保护密钥对接入层安全模式命令消息进行完整性保护。终端设备根据终端设备的当前位置信息确定接入层完整性保护密钥，并根据该接入层完整性保护密钥对接入层安全模式命令消息进行完整性校验。如果基站上报的位置信息和终端设备的当前位置信息不匹配，则完整性保护校验无法通过。如果基站上报的位置信息和终端设备的当前位置信息匹配，则完整性保护校验可以通过。因此，通过将基站上报的位置信息和终端设备的当前位置信息应用于密钥的推演过程，当位置信息不匹配时避免了终端设备接入网络，提升了通信的安全性能。
可选的，本实施例提供的终端设备的位置确定方法，还可以包括：
S308、若终端设备根据接入层的完整性保护密钥对接入层的安全模式命令消息进行完整性校验失败，则向第一基站发送接入层安全模式拒绝消息。
可选的，核心网可以通过NAS消息把第一基站的位置信息发送给终端设备。或者，第一基站接收到核心网发送给终端设备的NAS消息后，将第一基站的位置信息与NAS PDU打包发送给终端设备。或者，第一基站可以通过AS SMC消息把第一基站的位置信息发送给终端设备。当终端设备对接入层的安全模式命令(AS SMC)消息进行完整性校验失败时，终端设备可以比对终端设备的位置信息与第一基站的位置信息是否匹配，从而确定终端设备的位置是否有误。或者，终端设备根据终端设备的位置信息确定终端设备的位置是否有误。可以参见图3所示实施例的说明，此处不再赘述。如果终端设备确定终端设备的位置信息与第一基站的位置信息不匹配，则接入层的安全模式拒绝消息中可以携带指示位置不一致的原因值。
可选的，接入层的安全模式拒绝消息可以携带原因值和终端设备的位置信息。后续，第一基站可以比对第一基站上报的位置信息与终端设备上报的终端设备的位置信息是否匹配。
可选的，若接入层的安全模式拒绝消息包括终端设备的位置信息，第一基站可以比对自己的位置信息与终端设备上报的终端设备的位置信息是否匹配。如果第一基站确定终端设备的位置信息和自己的位置信息不匹配，则附着拒绝消息或者注册拒绝消息中可以携带指示位 置信息不一致的原因值。
本申请实施例提供一种终端设备的位置确定方法，通过将基站上报的位置信息和终端设备的当前位置信息应用于接入层密钥的推演过程，当位置信息不匹配时避免了终端设备接入网络，提升了通信的安全性能。
图19为本申请实施例十七提供的终端设备的位置确定方法的消息交互图。本实施例在图18所示实施例的基础上，提供了终端设备的位置确定方法的一种具体实现方式。本实施例提供的终端设备的位置确定方法可以应用于5G通信系统。5G通信系统涉及的网元可以包括：终端设备(UE)、基站(第一基站gNB1和第二基站gNB2)、核心网设备(AMF、AUSE和UDM)。需要说明，在一些场景中，第一基站gNB1和第二基站gNB2可以为同一基站。如图19所示，本申请提供的终端设备的位置确定方法，可以包括：
0.UE与gNB2建立RRC连接。
在UE与gNB2建立RRC连接后，UE可以从gNB2获取终端设备的位置信息(用“位置信息-UE”表示)。所述终端设备的位置信息可以为gNB2的位置信息(例如TAI)。
1.UE通过gNB1向AMF发送注册请求消息(Registration Request)。
其中，注册请求消息为NAS消息。gNB1向AMF发送的注册请求消息中包括gNB1的位置信息(用“位置信息-gNB1”表示)。相应的，AMF通过N2接口获取gNB1上报的位置信息。
2.鉴权流程。
与现有的鉴权流程相似，可以参见现有的鉴权流程。
3.AMF将gNB1上报的位置信息(位置信息-gNB1)作为参数推演KgNB*。
可选的，可以通过下列中的任意一种方式确定KgNB*。
a.KgNB*＝KDF(KAMF,NAS Uplink Count，位置信息-gNB1)。
b.KgNB*＝KDF(KDF(KAMF,NAS Uplink Count),位置信息-gNB1)。
其中，KgNB*表示包含位置信息的5G基站(gNB)使用的密钥，NAS Uplink Count表示NAS上行消息计算器。
4.NAS SMC流程。
与现有的NAS SMC相似，可以参见现有的NAS SMC。
5.AMF向gNB1发送N2消息(N2massage)。N2消息中包括KgNB*。
6.gNB发起AS SMC流程。gNB1由KgNB*推演出KRRCint*，并用KRRCint*对AS SMC消息做完整性保护。
其中，KRRCint*＝KDF(KgNB*,RRC-int-alg,Alg-ID)。
其中，KRRCint*表示包含位置信息的无线资源控制(RRC)完整性保护密钥，RRC-int-alg表示RRC完整性保护算法。
7.gNB1向UE发送接入层安全模式命令消息(AS Security Mode Command)。
8.UE用获得的终端设备的位置信息(位置信息-UE作为参数推演KgNB。
可选的，可以通过下列中的任意一种方式确定KgNB。
a.KgNB＝KDF(KAMF,NAS Uplink Count，位置信息-UE)。
b.KgNB＝KDF(KDF(KAMF,NAS Uplink Count),位置信息-UE)。
UE由KgNB推演出KRRCint＝KDF(KgNB,RRC-int-alg,Alg-ID)，并用KRRCint对AS SMC消息做完整性校验。
其中，KgNB表示5G基站(gNB)使用的密钥，KRRCint表示无线资源控制(RRC)完整性保护密钥。
9.根据步骤8中的校验结果，UE向gNB1发送接入层安全模式完成消息(AS Security Mode Complete)或者接入层安全模式拒绝消息(AS Security Mode Reject)。
具体的，若步骤8中校验通过，则UE向gNB1发送AS Security Mode Complete消息。若步骤8中校验失败，则UE向gNB1发送AS Security Mode Reject消息。
需要说明的是，本实施例中涉及的参数和参数的获取方式，除了KgNB*、KRRCint*、KgNB和KgNB之外，其他参数均与现有技术相同。
可选的，核心网可以通过NAS消息把第一基站的位置信息发送给UE。或者，第一基站接收到核心网发送给UE的NAS消息后，将第一基站的位置信息与NAS PDU打包发送给UE。或者，第一基站可以通过AS SMC消息把第一基站的位置信息发送给UE。当UE对接入层的安全模式命令(AS SMC)消息进行完整性校验失败时，UE可以比对UE的位置信息与第一基站的位置信息是否匹配，从而确定UE的位置是否有误。或者，UE根据UE的位置信息确定UE的位置是否有误。可以参见图3所示实施例的说明，此处不再赘述。如果UE确定UE的位置信息与第一基站的位置信息不匹配，则接入层的安全模式拒绝消息中可以携带指示位置不一致的原因值。
可选的，接入层的安全模式拒绝消息可以携带原因值和终端设备的位置信息。后续，第一基站可以比对第一基站上报的位置信息与终端设备上报的终端设备的位置信息是否匹配。
可选的，若接入层的安全模式拒绝消息包括终端设备的位置信息，第一基站可以比对自己的位置信息与终端设备上报的终端设备的位置信息是否匹配。如果第一基站确定终端设备的位置信息和自己的位置信息不匹配，则附着拒绝消息或者注册拒绝消息中可以携带指示位置信息不一致的原因值。
本实施例提供了一种终端设备的位置确定方法，可以应用于5G通信网络，具体应用于AS消息的完整性保护。AMF通过基站上报的位置信息可以获得KgNB*，基站根据KgNB*可以完成AS完整性密钥的推演和对AS消息进行完整性保护，终端设备根据终端设备的位置信息完成AS完整性密钥的推演和对AS消息进行完整性校验，当位置信息不匹配时避免了终端设备接入网络，提升了通信的安全性能。
图20为本申请实施例十八提供的终端设备的位置确定方法的消息交互图。本实施例在图18所示实施例的基础上，提供了终端设备的位置确定方法的一种具体实现方式。本实施例提供的终端设备的位置确定方法可以应用于LTE通信系统。LTE通信系统涉及的网元可以包括：终端设备(UE)、基站(第一基站eNB1和第二基站eNB2)、核心网设备(MME和HSS)。需要说明，在一些场景中，第一基站eNB1和第二基站eNB2可以为同一基站。如图20所示，本申请提供的终端设备的位置确定方法，可以包括：
0.UE与eNB2建立RRC连接。
在UE与eNB2建立RRC连接后，UE可以从eNB2获取终端设备的位置信息(用“位置信息-UE”表示)。所述终端设备的位置信息可以为eNB2的位置信息(例如TAI)。
1.UE通过eNB1向MME发送注册请求消息(Registration Request)。
其中，注册请求消息为NAS消息。eNB1向MME发送的注册请求消息中包括eNB1的位置信息(用“位置信息-eNB1”表示)。
2.鉴权流程。
与现有的鉴权流程相似，可以参见现有的鉴权流程。
3.MME将eNB1上报的位置信息(位置信息-eNB1)作为参数推演KeNB*。
可选的，可以通过下列中的任意一种方式确定KeNB*。
a.KeNB*＝KDF(KASME,NAS Uplink Count，位置信息-eNB1)。
b.KeNB*＝KDF(KDF(KASME,NAS Uplink Count),位置信息-eNB1)。
其中，KeNB*表示包含位置信息的演进型基站密钥，NAS Uplink Count表示NAS上行消息计算器。
4.NAS SMC流程。
与现有的NAS SMC相似，可以参见现有的NAS SMC。
5.MME向eNB1发送S1消息(S1massage)。S1消息中包括KeNB*。
6.eNB1由KeNB*推演出KRRCint*，并用KRRCint*对AS SMC消息做完整性保护。
其中，KRRCint*＝KDF(KeNB*,RRC-int-alg,Alg-ID)。
7.eNB1向UE发送接入层安全模式命令消息(AS Security Mode Command)。
8.UE用获得的终端设备的位置信息(位置信息-UE)作为参数推演KeNB。
可选的，可以通过下列中的任意一种方式确定KeNB。
a.KeNB＝KDF(KASME,NAS Uplink Count，位置信息-UE)。
b.KeNB＝KDF(KDF(KASME,NAS Uplink Count),位置信息-UE)。
由KeNB推演出KRRCint＝KDF(KeNB,RRC-int-alg,Alg-ID)，并用KRRCint对AS SMC消息做完整性校验。
9.根据步骤8中的校验结果，UE向eNB1发送接入层安全模式完成消息(AS Security Mode Complete)或者接入层安全模式拒绝消息(AS Security Mode Reject)。
具体的，若步骤8中校验通过，则UE向eNB1发送NAS Security Mode Complete消息。若步骤8中校验失败，则UE向eNB1发送NAS Security Mode Reject消息。
需要说明的是，本实施例中涉及的参数和参数的获取方式，除了KeNB*、KRRCint*、KeNB和KRRCint之外，其他参数均与现有技术相同。
可选的，核心网可以通过NAS消息把第一基站的位置信息发送给UE。或者，第一基站接收到核心网发送给UE的NAS消息后，将第一基站的位置信息与NAS PDU打包发送给UE。或者，第一基站可以通过AS SMC消息把第一基站的位置信息发送给UE。当UE对接入层的安全模式命令(AS SMC)消息进行完整性校验失败时，UE可以比对UE的位置信息与第一基站的位置信息是否匹配，从而确定UE的位置是否有误。或者，UE根据UE的位置信息确定UE的位置是否有误。可以参见图3所示实施例的说明，此处不再赘述。如果UE确定UE的位置信息与第一基站的位置信息不匹配，则接入层的安全模式拒绝消息中可以携带指示位置不一致的原因值。
可选的，接入层的安全模式拒绝消息可以携带原因值和终端设备的位置信息。后续，第一基站可以比对第一基站上报的位置信息与终端设备上报的终端设备的位置信息是否匹配。
可选的，若接入层的安全模式拒绝消息包括终端设备的位置信息，第一基站可以比对自己的位置信息与终端设备上报的终端设备的位置信息是否匹配。如果第一基站确定终端设备的位置信息和自己的位置信息不匹配，则附着拒绝消息或者注册拒绝消息中可以携带指示位置信息不一致的原因值。
本实施例提供了一种终端设备的位置确定方法，可以应用于LTE通信网络。MME通过基站上报的位置信息可以获得KeNB*，基站根据KeNB*可以完成AS完整性密钥的推演和对AS消息进行完整性保护。终端设备通过获得的终端设备的位置信息可以完成AS完整性密钥的推演和对AS消息进行校验，当位置信息不匹配时避免了终端设备接入网络，提升了通信的安全性能。
图21为本申请实施例十九提供的终端设备的位置确定方法的消息交互图。本实施例提供的终端设备的位置确定方法，可以应用于4G通信网络或者5G通信网络。本实施例涉及的网元可以包括终端设备、基站和核心网设备。其中，终端设备与核心网设备之间可以通过基站(此处为第一基站)进行通信。如图21所示，本实施例提供的终端设备的位置确定方法，可以包括：
S401、基站根据第一基站的位置信息确定接入层完整性保护密钥。
S402、基站根据接入层完整性保护密钥对接入层安全模式命令消息进行完整性保护。
S403、基站向终端设备发送接入层安全模式命令消息。
相应的，终端设备接收基站发送的接入层安全模式命令消息。
S404、终端设备根据终端设备的当前位置信息确定接入层完整性保护密钥。
S405、终端设备根据接入层完整性保护密钥对接入层安全模式命令消息进行完整性校验。
可见，本实施例提供的终端设备的位置确定方法，基站根据位置信息确定接入层完整性保护密钥，并采用该接入层完整性保护密钥对接入层安全模式命令消息进行完整性保护。终端设备根据终端设备的当前位置信息确定接入层完整性保护密钥，并根据该接入层完整性保护密钥对接入层安全模式命令消息进行完整性校验。如果基站的位置信息和终端设备的当前位置信息不匹配，则完整性保护校验无法通过。如果基站的位置信息和终端设备的当前位置信息匹配，则完整性保护校验可以通过。因此，通过将基站上报的位置信息和终端设备的当前位置信息应用于密钥的推演过程，当位置信息不匹配时避免了终端设备接入网络，提升了通信的安全性能。
可选的，本实施例提供的终端设备的位置确定方法，还可以包括：
S406、若终端设备根据接入层的完整性保护密钥对接入层的安全模式命令消息进行完整性校验失败，则向第一基站发送接入层安全模式拒绝消息。
可选的，核心网可以通过NAS消息把第一基站的位置信息发送给终端设备。或者，第一基站接收到核心网发送给终端设备的NAS消息后，将第一基站的位置信息与NAS PDU打包发送给终端设备。或者，第一基站可以通过AS SMC消息把第一基站的位置信息发送给终端设备。当终端设备对接入层的安全模式命令(AS SMC)消息进行完整性校验失败时，终端设备可以比对终端设备的位置信息与第一基站的位置信息是否匹配，从而确定终端设备的位置是否有误。或者，终端设备根据终端设备的位置信息确定终端设备的位置是否有误。可以参见图3所示实施例的说明，此处不再赘述。如果终端设备确定终端设备的位置信息与第一基站的位置信息不匹配，则接入层的安全模式拒绝消息中可以携带指示位置不一致的原因值。
可选的，接入层的安全模式拒绝消息可以携带原因值和终端设备的位置信息。后续，第一基站可以比对第一基站上报的位置信息与终端设备上报的终端设备的位置信息是否匹配。
可选的，若接入层的安全模式拒绝消息包括终端设备的位置信息，第一基站可以比对自己的位置信息与终端设备上报的终端设备的位置信息是否匹配。如果第一基站确定终端设备 的位置信息和第一基站的位置信息不匹配，则附着拒绝消息或者注册拒绝消息中可以携带指示位置信息不一致的原因值。
本申请实施例提供一种终端设备的位置确定方法，通过将基站的位置信息和终端设备的当前位置信息应用于接入层密钥的推演过程，当位置信息不匹配时避免了终端设备接入网络，提升了通信的安全性能。
图22为本申请实施例二十提供的终端设备的位置确定方法的消息交互图。本实施例在图21所示实施例的基础上，提供了终端设备的位置确定方法的一种具体实现方式。本实施例提供的终端设备的位置确定方法可以应用于LTE通信系统。LTE通信系统涉及的网元可以包括：终端设备(UE)、基站(第一基站eNB1和第二基站eNB2)、核心网设备(MME和HSS)。需要说明，在一些场景中，第一基站eNB1和第二基站eNB2可以为同一基站。如图22所示，本申请提供的终端设备的位置确定方法，可以包括：
0.UE与eNB2建立RRC连接。
在UE与eNB2建立RRC连接后，UE可以从eNB2获取终端设备的位置信息(用“位置信息-UE”表示)。所述终端设备的位置信息可以为eNB2的位置信息(例如TAI)。
1.UE通过eNB1向MME发送注册请求消息(Registration Request)。
2.鉴权流程。
与现有的鉴权流程相似，可以参见现有的鉴权流程。
3.NAS SMC流程。
与现有的NAS SMC相似，可以参见现有的NAS SMC。
4.MME向eNB1发送S1消息(S1massage)。S1消息中包括KeNB。
5.eNB1将位置信息-eNB1作为参数推演出KRRCint*。
可选的，可以通过下列中的任意一种方式确定KRRCint*。
a.KRRCint*＝KDF(KeNB,RRC-int-alg,Alg-ID,位置信息-eNB1)。
b.KRRCint*＝KDF(KDF(KeNB,RRC-int-alg,Alg-ID),位置信息-eNB1)。
6.eNB1发起AS SMC流程，用KRRCint*对AS SMC消息做完整性保护。
7.eNB1向UE发送接入层安全模式命令消息(AS Security Mode Command)。
8.UE用获得的终端设备的位置信息(位置信息-UE)作为参数推演KRRCint。
可选的，可以通过下列中的任意一种方式确定KRRCint。
a.KRRCint＝KDF(KeNB,RRC-int-alg,Alg-ID,位置信息-UE)。
b.KRRCint＝KDF(KDF(KeNB,RRC-int-alg,Alg-ID),位置信息-UE)。
用KRRCint对AS SMC消息做完整性校验。
9.根据步骤8中的校验结果，UE向eNB1发送接入层安全模式完成消息(AS Security Mode Complete)或者接入层安全模式拒绝消息(AS Security Mode Reject)。
具体的，若步骤8中校验通过，则UE向eNB1发送NAS Security Mode Complete消息。若步骤8中校验失败，则UE向eNB1发送NAS Security Mode Reject消息。
需要说明的是，本实施例中涉及的参数和参数的获取方式，除了KRRCint*和KRRCint之外，其他参数均与现有技术相同。
可选的，核心网可以通过NAS消息把第一基站的位置信息发送给UE。或者，第一基站接收到核心网发送给UE的NAS消息后，将第一基站的位置信息与NAS PDU打包发送给UE。或 者，第一基站可以通过AS SMC消息把第一基站的位置信息发送给UE。当UE对接入层的安全模式命令(AS SMC)消息进行完整性校验失败时，UE可以比对UE的位置信息与第一基站的位置信息是否匹配，从而确定UE的位置是否有误。或者，UE根据UE的位置信息确定UE的位置是否有误。可以参见图3所示实施例的说明，此处不再赘述。如果UE确定UE的位置信息与第一基站的位置信息不匹配，则接入层的安全模式拒绝消息中可以携带指示位置不一致的原因值。
可选的，接入层的安全模式拒绝消息可以携带原因值和终端设备的位置信息。后续，第一基站可以比对第一基站上报的位置信息与终端设备上报的终端设备的位置信息是否匹配。
可选的，若接入层的安全模式拒绝消息包括终端设备的位置信息，第一基站可以比对自己的位置信息与终端设备上报的终端设备的位置信息是否匹配。如果第一基站确定终端设备的位置信息和第一基站的位置信息不匹配，则附着拒绝消息或者注册拒绝消息中可以携带指示位置信息不一致的原因值。
本实施例提供了一种终端设备的位置确定方法，可以应用于LTE通信网络。基站根据基站的位置信息可以完成AS完整性密钥的推演和对AS消息进行完整性保护。终端设备通过获得的终端设备的位置信息可以完成AS完整性密钥的推演和对AS消息进行校验，当位置信息不匹配时避免了终端设备接入网络，提升了通信的安全性能。
图23为本申请实施例二十一提供的终端设备的位置确定方法的消息交互图。本实施例涉及的网元可以包括终端设备(UE)、核心网设备(MME/AMF)和基站(eNB/gNB)。其中，终端设备与移动管理设备之间通过基站(此处为第一基站)进行通信。如图23所示，本实施例提供的终端设备的位置确定方法，可以包括：
0.终端设备附着网络成功。
1.核心网设备向终端设备发送定位请求消息。
相应的，终端设备接收核心网设备发送的定位请求消息。
可选的，MME/AMF可以根据预设策略通过eNB/gNB向UE发送定位请求消息(DL Positioning Message)。
其中，本实施例对于预设策略不做限定，可以根据需要进行设置。
可选的，预设策略可以包括下列中的任意一项：
UE上报的多个基站(gNB/eNB)的TAI不一致、且位置差异较大。
预设时间段内TAI位置变化较大。
从监控中心接收到对终端设备的监听请求。
2.终端设备向核心网设备发送定位响应消息。
其中，定位响应消息中包括终端设备的当前位置信息。
相应的，核心网设备接收终端设备发送的定位响应消息。
具体的，UE根据定位请求消息进行位置测量，获得终端设备的当前位置信息。
可选的，终端设备的当前位置信息可以包括下列中的至少一项：
第二基站广播的第二位置信息。
辅助位置信息，辅助位置信息指示了终端设备所在的地域。
第三基站广播的第三位置信息，第三基站为与第二基站临近的基站。
可选的，终端设备的当前位置信息还可以包括精确位置信息，精确位置信息为终端设备 根据终端设备与第二基站之间的信号测量值确定的。其中，信号测量值可以为信号强度或者信号传输时延。
3.核心网设备判断第一基站上报的位置信息和终端设备上报的位置信息是否匹配。
可选的，如果第一基站上报的位置信息和终端设备上报的位置信息不匹配，则核心网设备向终端设备发送去注册消息或去附着消息。
其中，去注册消息或去附着消息中可以包括原因值，指示位置不一致。
可选的，终端设备若接收到核心网设备发送的去注册或去附着消息，则终端设备根据去注册或去附着消息中的原因值进行处理。
可选的，如果第一基站上报的位置信息和终端设备上报的位置信息不匹配，核心网设备可以向OM设备发送告警消息。所述告警消息指示了UE位置信息匹配。
需要说明的是，MME/AMF比较UE上报的位置信息和eNB/gNB发送的位置信息，可以参见图3所示实施例原理相似，此处不再赘述。
本实施例提供的终端设备的位置确定方法，核心网设备可以向终端设备定位请求消息，通过终端设备向核心网设备上报终端设备的位置信息，核心网设备比较终端设备上报的位置信息与基站上报的位置信息是否匹配，可以确定终端设备的位置是否存在误判，提升了终端设备位置确定的准确性，提升了通信的安全性能。
图24为本申请实施例二十二提供的终端设备的位置确定方法的消息交互图。本实施例涉及的网元可以包括终端设备(UE)、基站(eNB/gNB)、移动管理设备(MME/AMF)和位置管理设备(E-SMLC/LMF)。其中，终端设备与移动管理设备之间通过基站(此处为第一基站)进行通信。如图24所示，本实施例提供的终端设备的位置确定方法，可以包括：
0.UE附着网络成功。
1.MME/AMF根据预设策略向UE和/或eNB/gNB发送定位请求消息。
可选的，MME/AMF可以根据预设策略通过eNB/gNB向UE发送定位请求消息(NAS Transport)。
可选的，MME/AMF可以根据预设策略通过S1/N2接口向eNB/gNB发送定位请求消息(DL Positioning Message)。
其中，本实施例对于预设策略不做限定，可以根据需要进行设置。
可选的，预设策略可以包括下列中的任意一项：
UE上报的多个基站(gNB/eNB)的TAI不一致、且位置差异较大。
预设时间段内TAI位置变化较大。
从监控中心接收到对终端设备的监听请求。
2.eNB/gNB向UE发送定位请求消息(DL Positioning Message)。
3.UE根据定位请求消息进行位置测量，获得终端设备的位置信息。
可选的，UE根据定位请求消息进行位置测量，获得终端设备的位置信息，可以包括：
UE接收第二基站发送的广播消息，获取所述广播消息中携带的第二基站的第二位置信息。其中，第二基站为终端设备接入的基站，且终端设备位于第二基站的覆盖范围内。
UE获取辅助位置信息。
UE接收第三基站发送的广播消息，获取所述广播消息中携带的第三基站的第三位置信息为UE位置信息。或者，UE对第三基站进行信号测量，获取第三基站的第三位置信息。
4.UE向eNB/gNB发送定位响应消息(UL Positioning Message)，定位响应消息中包括终端设备的位置信息。
5.eNB/gNB向MME/AMF发送定位响应消息(UL Positioning Message/NAS Transport)，定位响应消息中包括终端设备的位置信息。
6.MME/AMF向E-SMLC/LMF发送请求消息(request message)。请求消息可以包括UE上报的终端设备的位置信息和eNB/gNB上报的位置信息。
7.E-SMLC/LMF比较UE上报的终端设备的位置信息和eNB/gNB发送的位置信息，获得比较结果。
其中，E-SMLC/LMF比较UE上报的终端设备的位置信息和eNB/gNB发送的位置信息，可以参见图3-7所示实施例，原理相似，此处不再赘述。
8.E-SMLC/LMF向MME/AMF发送响应消息(response message)。响应消息中可以包括比较结果。后续，MME/AMF可以根据预设的策略决定后续的处理。
本实施例与图23所示实施例的主要区别在于，比较UE上报的位置信息和eNB/gNB发送的位置信息的执行主体不同。在图23所示实施例中，执行主体为移动管理设备，在本实施例中，执行主体为位置管理设备。其他方案原理相似，可以参见图23所示实施例，此处不再赘述。
本实施例提供的终端设备的位置确定方法，移动管理设备可以根据预设策略向终端设备和基站发送位置查询请求，位置管理设备比较终端设备上报的终端设备的位置信息与基站上报的位置信息是否匹配，可以确定终端设备的位置是否存在误判，提升了终端设备位置确定的准确性，提升了通信的安全性能。
下面介绍本申请实施例提供的一种终端设备、基站和核心网设备，该设备与上述方法一一对应，用以实现上述方法实施例提供的终端设备的位置确定方法，具有相同的技术特征和技术效果，本申请实施例对此不再赘述。
图25为本申请实施例提供的终端设备的结构示意图。如图25所示，终端设备可以包括：收发模块21和处理模块22。处理模块22用于对终端设备的动作进行控制管理和执行。收发模块21用于支持终端设备与其他设备之间的通信。终端设备还可以包括存储模块，用于存储终端设备的程序代码和数据。
图26为本申请实施例提供的基站的结构示意图。如图26所示，基站可以包括：收发模块31和处理模块32。处理模块32用于对基站的动作进行控制管理和执行。收发模块31用于支持基站与其他设备之间的通信。基站还可以包括存储模块，用于存储终端设备的程序代码和数据。
图27为本申请实施例提供的核心网设备的结构示意图。如图27所示，核心网设备可以包括：收发模块41和处理模块42。处理模块42用于对核心网设备的动作进行控制管理和执行。收发模块41用于支持核心网设备与其他设备之间的通信。核心网设备还可以包括存储模块，用于存储终端设备的程序代码和数据。
其中，核心网设备可以包括下列中的任意一种：MME、HSS、E-SMLC、AMF、AUSF、UDM和LMF。
下面介绍本申请实施例提供的另一种终端设备、基站和核心网设备，该设备与上述方法 一一对应，用以实现上述方法实施例提供的终端设备的位置确定方法，具有相同的技术特征和技术效果，本申请实施例对此不再赘述。
图28为本申请实施例提供的终端设备的另一结构示意图。如图28所示，终端设备可以包括：处理器51、存储器52和收发器53。所述收发器53用于和其他设备通信，所述处理器51用于执行所述存储器52中存储的指令，以使所述终端设备执行上述方法实施例中终端设备执行的操作。
图29为本申请实施例提供的基站的另一结构示意图。如图29所示，基站可以包括：处理器61、存储器62和收发器63。所述收发器63用于和其他设备通信，所述处理器61用于执行所述存储器62中存储的指令，以使所述基站执行上述方法实施例中基站执行的操作。
图30为本申请实施例提供的核心网设备的另一结构示意图。如图30所示，核心网设备可以包括：处理器71、存储器72和收发器73。所述收发器73用于和其他设备通信，所述处理器71用于执行所述存储器72中存储的指令，以使所述核心网设备执行上述方法实施例中核心网设备执行的操作。
其中，核心网设备可以包括下列中的任意一种：MME、HSS、E-SMLC、AMF、AUSF、UDM和LMF。
可以理解，本申请实施例中的处理器可以是中央处理器(CPU)，通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)，现场可编程门阵列(FPGA)或者其他可编程逻辑器件、晶体管逻辑器件，硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘solid state disk(SSD))等。

Claims (46)

  1. 一种终端设备的位置确定方法，其特征在于，包括：
    核心网设备获取终端设备上报的所述终端设备的位置信息和第一基站上报的位置信息；
    所述核心网设备判断所述终端设备的位置信息与所述第一基站上报的位置信息是否匹配；
    若所述终端设备的位置信息与所述第一基站上报的位置信息不匹配，则所述核心网设备向所述终端设备发送拒绝消息。
  2. 根据权利要求1所述的方法，其特征在于，所述核心网设备为移动管理设备，所述核心网设备获取终端设备上报的所述终端设备的位置信息，包括：
    所述移动管理设备通过非接入层的初始附着请求消息或注册请求消息或安全模式命令完成响应消息，获取所述终端设备上报的所述终端设备的位置信息。
  3. 根据权利要求1所述的方法，其特征在于，所述核心网设备为位置管理网元，所述核心网设备获取终端设备上报的所述终端设备的位置信息和第一基站上报的位置信息，包括：
    所述位置管理网元接收移动管理设备发送的请求消息，所述请求消息中包括所述终端设备的位置信息和所述第一基站上报的位置信息。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述终端设备的位置信息包括下列中的至少一项：
    第二基站广播的位置信息，其中，所述第二基站为所述终端设备接入的基站；
    辅助位置信息，其中，所述辅助位置信息为辅助定位设备提供的信息，且所述辅助位置信息用于指示所述终端设备所在的位置；
    第三基站广播的位置信息，其中，所述第三基站为与所述第二基站的距离小于预设距离的基站。
  5. 一种终端设备的位置确定方法，其特征在于，包括：
    终端设备获取所述终端设备的位置信息，所述终端设备的位置信息用于指示所述终端设备的当前位置；
    所述终端设备向核心网设备发送所述终端设备的位置信息；
    若所述终端设备接收到所述核心网设备发送的拒绝消息，则根据所述拒绝消息中携带的原因值进行处理。
  6. 根据权利要求5所述的方法，其特征在于，所述终端设备向核心网设备发送所述终端设备的位置信息，包括：
    所述终端设备通过非接入层的初始附着请求消息或注册请求消息或安全模式命令完成响应消息，向所述核心网设备发送所述终端设备的位置信息。
  7. 根据权利要求5或6所述的方法，其特征在于，所述方法还包括：
    若所述原因值用于表示位置不一致，则所述终端设备在预设时间段后重新发起注册或重新发起附着。
  8. 根据权利要求5-7任一项所述的方法，其特征在于，所述方法还包括：
    所述终端设备根据所述终端设备的位置信息判断所述终端设备的当前位置是否异常；
    若所述终端设备的当前位置异常，则所述终端设备进行提示。
  9. 根据权利要求5-8任一项所述的方法，其特征在于，所述终端设备的位置信息包括下列中的至少一项：
    第二基站广播的位置信息，其中，所述第二基站为所述终端设备接入的基站；
    辅助位置信息，其中，所述辅助位置信息为辅助定位设备提供的信息，且所述辅助位置信息用于指示所述终端设备所在的位置；
    第三基站广播的位置信息，其中，所述第三基站为与所述第二基站的距离小于预设距离的基站终端设备终端设备。
  10. 一种终端设备的位置确定方法，其特征在于，包括：
    移动管理设备向终端设备发送定位请求消息；
    所述移动管理设备接收所述终端设备发送的定位响应消息，所述定位响应消息中包括所述终端设备上报的位置信息；
    所述移动管理设备判断第一基站上报的位置信息和所述终端设备上报的位置信息是否匹配；
    若所述第一基站上报的位置信息和所述终端设备上报的位置信息不匹配，则所述移动管理设备向所述终端设备发送去注册消息或去附着消息。
  11. 根据权利要求10所述的方法，其特征在于，所述移动管理设备判断第一基站上报的位置信息和所述终端设备上报的位置信息是否匹配，包括：
    所述移动管理设备向位置管理网元发送所述第一基站上报的位置信息和所述终端设备上报的位置信息；
    所述移动管理设备接收所述位置管理网元返回的位置匹配结果，所述位置匹配结果用于指示所述第一基站上报的位置信息和所述终端设备上报的位置信息是否匹配。
  12. 根据权利要求10或11所述的方法，其特征在于，所述终端设备上报的位置信息包括下列中的至少一项：
    第二基站广播的位置信息，其中，所述第二基站为所述终端设备接入的基站；
    辅助位置信息，其中，所述辅助位置信息为辅助定位设备提供的信息，且所述辅助位置信息用于指示所述终端设备所在的位置；
    第三基站广播的位置信息，其中，所述第三基站为与所述第二基站的距离小于预设距离的基站。
  13. 一种终端设备的位置确定方法，其特征在于，包括：
    终端设备接收核心网设备发送的定位请求消息；
    所述终端设备向所述核心网设备发送定位响应消息，所述定位响应消息中包括所述终端设备的当前位置信息；
    若所述终端设备接收到所述核心网设备发送的去注册或去附着消息，则根据所述去注册或去附着消息中的原因值进行处理。
  14. 根据权利要求13所述的方法，其特征在于，所述终端设备的当前位置信息包括下列中的至少一项：
    第二基站广播的位置信息，其中，所述第二基站为所述终端设备接入的基站；
    辅助位置信息，其中，所述辅助位置信息为辅助定位设备提供的信息，且所述辅助位置信息用于指示所述终端设备所在的位置；
    第三基站广播的位置信息，其中，所述第三基站为与所述第二基站的距离小于预设距离的基站终端设备。
  15. 一种终端设备的位置确定方法，其特征在于，包括：
    核心网设备获取第一基站上报的位置信息；
    所述核心网设备根据所述第一基站上报的位置信息确定非接入层完整性保护密钥；
    所述核心网设备向所述终端设备发送所述非接入层安全模式命令消息；其中，所述非接入层安全模式命令消息是采用所述非接入层完整性保护密钥进行完整性保护的。
  16. 根据权利要求15所述的方法，其特征在于，所述方法还包括：
    若所述核心网设备接收到所述终端设备发送的安全模式命令拒绝消息，向所述终端设备发送附着拒绝或者注册拒绝消息。
  17. 根据权利要求15或16所述的方法，其特征在于，所述核心网设备为移动管理设备，所述核心网设备根据所述第一基站上报的位置信息确定非接入层完整性保护密钥，包括：
    所述移动管理设备向数据管理网元发送所述第一基站上报的位置信息；
    所述移动管理设备接收所述数据管理网元发送的接入安全管理实体密钥，其中，所述接入安全管理实体密钥是所述数据管理网元根据所述第一基站上报的位置信息确定的；
    所述移动管理设备根据所述接入安全管理实体密钥获取所述非接入层完整性保护密钥。
  18. 一种终端设备的位置确定方法，其特征在于，包括：
    终端设备接收核心网设备发送的非接入层安全模式命令消息；
    所述终端设备根据所述终端设备的当前位置信息确定非接入层完整性保护密钥；
    所述终端设备根据所述非接入层完整性保护密钥对所述非接入层安全模式命令消息进行完整性校验。
  19. 根据权利要求18所述的方法，其特征在于，还包括：
    若所述终端设备根据所述非接入层的完整性保护密钥对所述非接入层的安全模式命令消息进行完整性校验失败，则向所述核心网设备发送非接入层的安全模式拒绝消息。
  20. 一种终端设备的位置确定方法，其特征在于，包括：
    移动管理设备获取第一基站上报的位置信息；
    所述移动管理设备根据所述第一基站上报的位置信息确定所述第一基站使用的临时密钥；
    所述移动管理设备向所述第一基站发送所述第一基站使用的临时密钥。
  21. 一种终端设备的位置确定方法，其特征在于，包括：
    终端设备接收第一基站发送的接入层安全模式命令消息；
    所述终端设备根据所述终端设备的当前位置信息确定接入层完整性保护密钥；
    所述终端设备根据所述接入层完整性保护密钥对所述接入层安全模式命令消息进行完整性校验。
  22. 根据权利要求21所述的方法，其特征在于，还包括：
    若所述终端设备根据所述接入层完整性保护密钥对所述接入层安全模式命令消息进行完整性校验失败，则向所述第一基站发送接入层安全模式拒绝消息。
  23. 一种终端设备的位置确定方法，其特征在于，包括：
    第一基站根据所述第一基站的位置信息确定接入层完整性保护密钥；
    所述第一基站根据所述接入层完整性保护密钥对接入层安全模式命令消息进行完整性保护；
    所述第一基站向终端设备发送所述接入层安全模式命令消息。
  24. 一种核心网设备，其特征在于，包括：
    收发模块，用于获取终端设备上报的所述终端设备的位置信息和第一基站上报的位置信 息；
    处理模块，用于判断所述终端设备的位置信息与所述第一基站上报的位置信息是否匹配；
    所述收发模块还用于，若所述终端设备的位置信息与所述第一基站上报的位置信息不匹配，则向所述终端设备发送拒绝消息。
  25. 根据权利要求24所述的核心网设备，其特征在于，所述核心网设备为移动管理设备，所述收发模块具体用于：
    通过非接入层的初始附着请求消息或注册请求消息或安全模式命令完成响应消息，获取所述终端设备上报的所述终端设备的位置信息。
  26. 根据权利要求24所述的核心网设备，其特征在于，所述核心网设备为位置管理网元，所述收发模块具体用于：
    接收移动管理设备发送的请求消息，所述请求消息中包括所述终端设备的位置信息和所述第一基站上报的位置信息。
  27. 根据权利要求24-26任一项所述的核心网设备，其特征在于，所述终端设备的位置信息包括下列中的至少一项：
    第二基站广播的位置信息，其中，所述第二基站为所述终端设备接入的基站；
    辅助位置信息，其中，所述辅助位置信息为辅助定位设备提供的信息，且所述辅助位置信息用于指示所述终端设备所在的位置；
    第三基站广播的位置信息，其中，所述第三基站为与所述第二基站的距离小于预设距离的基站。
  28. 一种终端设备，其特征在于，包括：
    处理模块，用于获取所述终端设备的位置信息，所述终端设备的位置信息用于指示所述终端设备的当前位置；
    收发模块，用于向核心网设备发送所述终端设备的位置信息；
    所述处理模块还用于，若所述收发模块接收到所述核心网设备发送的拒绝消息，则根据所述拒绝消息中携带的原因值进行处理。
  29. 根据权利要求28所述的终端设备，其特征在于，所述收发模块具体用于：
    通过非接入层的初始附着请求消息或注册请求消息或安全模式命令完成响应消息，向所述核心网设备发送所述终端设备的位置信息。
  30. 根据权利要求28或29所述的终端设备，其特征在于，所述收发模块还用于：
    若所述原因值用于表示位置不一致，则在预设时间段后重新发起注册或重新发起附着。
  31. 根据权利要求28-30任一项所述的终端设备，其特征在于，所述处理模块还用于：
    根据所述终端设备的位置信息判断所述终端设备的当前位置是否异常；
    若所述终端设备的当前位置异常，则进行提示。
  32. 根据权利要求28-31任一项所述的终端设备，其特征在于，所述终端设备的位置信息包括下列中的至少一项：
    第二基站广播的位置信息，其中，所述第二基站为所述终端设备接入的基站；
    辅助位置信息，其中，所述辅助位置信息为辅助定位设备提供的信息，且所述辅助位置信息用于指示所述终端设备所在的位置；
    第三基站广播的位置信息，其中，所述第三基站为与所述第二基站的距离小于预设距离的基站终端设备终端设备。
  33. 一种移动管理设备，其特征在于，包括：
    收发模块，用于向终端设备发送定位请求消息；接收所述终端设备发送的定位响应消息，所述定位响应消息中包括所述终端设备上报的位置信息；
    处理模块，用于判断第一基站上报的位置信息和所述终端设备上报的位置信息是否匹配；
    所述收发模块还用于，若所述第一基站上报的位置信息和所述终端设备上报的位置信息不匹配，则向所述终端设备发送去注册消息或去附着消息。
  34. 根据权利要求33所述的移动管理设备，其特征在于，所述收发模块具体用于：
    向位置管理网元发送所述第一基站上报的位置信息和所述终端设备上报的位置信息；
    接收所述位置管理网元返回的位置匹配结果，所述位置匹配结果用于指示所述第一基站上报的位置信息和所述终端设备上报的位置信息是否匹配。
  35. 根据权利要求33或34所述的移动管理设备，其特征在于，所述终端设备上报的位置信息包括下列中的至少一项：
    第二基站广播的位置信息，其中，所述第二基站为所述终端设备接入的基站；
    辅助位置信息，其中，所述辅助位置信息为辅助定位设备提供的信息，且所述辅助位置信息用于指示所述终端设备所在的位置；
    第三基站广播的位置信息，其中，所述第三基站为与所述第二基站的距离小于预设距离的基站。
  36. 一种终端设备，其特征在于，包括：
    收发模块，用于接收核心网设备发送的定位请求消息；向所述核心网设备发送定位响应消息，所述定位响应消息中包括所述终端设备的当前位置信息；
    处理模块，用于若所述收发模块接收到所述核心网设备发送的去注册或去附着消息，则根据所述去注册或去附着消息中的原因值进行处理。
  37. 根据权利要求36所述的终端设备，其特征在于，所述终端设备的当前位置信息包括下列中的至少一项：
    第二基站广播的位置信息，其中，所述第二基站为所述终端设备接入的基站；
    辅助位置信息，其中，所述辅助位置信息为辅助定位设备提供的信息，且所述辅助位置信息用于指示所述终端设备所在的位置；
    第三基站广播的位置信息，其中，所述第三基站为与所述第二基站的距离小于预设距离的基站终端设备。
  38. 一种核心网设备，其特征在于，包括：
    收发模块，用于获取第一基站上报的位置信息；
    处理模块，用于根据所述第一基站上报的位置信息确定非接入层完整性保护密钥；
    所述收发模块还用于，向终端设备发送所述非接入层安全模式命令消息；其中，所述非接入层安全模式命令消息是采用所述非接入层完整性保护密钥进行完整性保护的。
  39. 根据权利要求38所述的核心网设备，其特征在于，所述收发模块还用于：
    若接收到所述终端设备发送的安全模式命令拒绝消息，向所述终端设备发送附着拒绝或者注册拒绝消息。
  40. 根据权利要求38或39所述的核心网设备，其特征在于，所述核心网设备为移动管理网元，所述收发模块具体用于：
    向数据管理网元发送所述第一基站上报的位置信息；
    接收所数据管理网元发送的接入安全管理实体密钥，其中，所述接入安全管理实体密钥是所述数据管理网元根据所述第一基站上报的位置信息确定的；
    所述处理模块还用于，根据所述接入安全管理实体密钥获取所述非接入层完整性保护密钥。
  41. 一种终端设备，其特征在于，包括：
    收发模块，用于接收核心网设备发送的非接入层安全模式命令消息；
    处理模块，用于根据所述终端设备的当前位置信息确定非接入层完整性保护密钥；根据所述非接入层完整性保护密钥对所述非接入层安全模式命令消息进行完整性校验。
  42. 根据权利要求41所述的终端设备，其特征在于，所述收发模块还用于：
    若根据所述非接入层的完整性保护密钥对所述非接入层的安全模式命令消息进行完整性校验失败，则向所述核心网设备发送非接入层的安全模式拒绝消息。
  43. 一种移动管理设备，其特征在于，包括：
    收发模块，用于获取第一基站上报的位置信息；
    处理模块，用于根据所述第一基站上报的位置信息确定所述第一基站使用的临时密钥；
    所述收发模块还用于，向所述第一基站发送所述第一基站使用的临时密钥。
  44. 一种终端设备，其特征在于，包括：
    收发模块，用于接收第一基站发送的接入层安全模式命令消息；
    处理模块，用于根据所述终端设备的当前位置信息确定接入层完整性保护密钥；根据所述接入层完整性保护密钥对所述接入层安全模式命令消息进行完整性校验。
  45. 根据权利要求44所述的终端设备，其特征在于，所述收发模块还用于：
    若根据所述接入层完整性保护密钥对所述接入层安全模式命令消息进行完整性校验失败，则向所述第一基站发送接入层安全模式拒绝消息。
  46. 一种基站，其特征在于，包括：
    处理模块，用于根据第一基站的位置信息确定接入层完整性保护密钥；根据所述接入层完整性保护密钥对接入层安全模式命令消息进行完整性保护；
    收发模块，用于向终端设备发送所述接入层安全模式命令消息。
PCT/CN2019/078310 2018-03-27 2019-03-15 终端设备的位置确定方法和设备 WO2019184728A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19777491.2A EP3745787A4 (en) 2018-03-27 2019-03-15 METHOD AND DEVICE FOR DETERMINING THE POSITION OF A TERMINAL DEVICE
US17/004,171 US11096142B2 (en) 2018-03-27 2020-08-27 Terminal device location determining method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810260329.XA CN110312305B (zh) 2018-03-27 2018-03-27 终端设备的位置确定方法和设备
CN201810260329.X 2018-03-27

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/004,171 Continuation US11096142B2 (en) 2018-03-27 2020-08-27 Terminal device location determining method and device

Publications (1)

Publication Number Publication Date
WO2019184728A1 true WO2019184728A1 (zh) 2019-10-03

Family

ID=68060882

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/078310 WO2019184728A1 (zh) 2018-03-27 2019-03-15 终端设备的位置确定方法和设备

Country Status (4)

Country Link
US (1) US11096142B2 (zh)
EP (1) EP3745787A4 (zh)
CN (1) CN110312305B (zh)
WO (1) WO2019184728A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021115614A1 (en) * 2019-12-13 2021-06-17 Huawei Technologies Duesseldorf Gmbh Network node and method for anonymization of user sensitive data in a communication network

Families Citing this family (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11265699B2 (en) 2018-02-23 2022-03-01 T-Mobile Usa, Inc. Identifier-based access control in mobile networks
US10637858B2 (en) * 2018-02-23 2020-04-28 T-Mobile Usa, Inc. Key-derivation verification in telecommunications network
US11589187B2 (en) * 2019-09-13 2023-02-21 Troverlo, Inc. Passive sensor tracking using observations of Wi-Fi access points
CN111064748A (zh) * 2019-12-30 2020-04-24 四川长虹电器股份有限公司 基于网络结构探测的跨区域定位数据反欺骗系统
WO2021243617A1 (zh) * 2020-06-03 2021-12-09 Oppo广东移动通信有限公司 完好性配置方法及相关装置
CN113873492B (zh) * 2020-06-15 2022-12-30 华为技术有限公司 一种通信方法以及相关装置
CN116134839A (zh) * 2020-10-14 2023-05-16 Oppo广东移动通信有限公司 一种通信方法及相关设备
CN112822674A (zh) * 2020-12-29 2021-05-18 联想未来通信科技(重庆)有限公司 一种nas消息的解密方法和装置
US11963125B2 (en) * 2021-01-08 2024-04-16 Samsung Electronics Co., Ltd. Method and apparatus for measurement of TAI updates in an NTN
CN113098589B (zh) * 2021-04-08 2022-02-01 广州爱浦路网络技术有限公司 对卫星终端的寻呼方法、核心网、计算机装置和存储介质
CN113328779A (zh) * 2021-05-17 2021-08-31 广州爱浦路网络技术有限公司 地面与卫星融合移动网络的核心网接入方法及系统
CN113328785B (zh) * 2021-05-27 2022-03-18 广州爱浦路网络技术有限公司 卫星通信中对终端的寻呼方法和用于卫星通信的核心网
WO2023216034A1 (zh) * 2022-05-07 2023-11-16 北京小米移动软件有限公司 一种校验位置信息的方法及其装置
CN117255305A (zh) * 2022-06-09 2023-12-19 展讯通信（上海）有限公司 终端位置确定方法及装置、计算机可读存储介质
WO2024000586A1 (zh) * 2022-07-01 2024-01-04 北京小米移动软件有限公司 无线通信方法、装置、设备、存储介质、芯片及程序产品
WO2024060215A1 (en) * 2022-09-23 2024-03-28 Lenovo (Beijing) Limited Methods and apparatuses for rat-dependent positioning integrity
CN118525560A (zh) * 2022-12-20 2024-08-20 北京小米移动软件有限公司 一种用户位置信息的可信确定方法及其装置
JP7343729B1 (ja) * 2023-06-08 2023-09-12 株式会社インターネットイニシアティブ モバイル通信システムおよび通信制御方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104244281A (zh) * 2014-10-11 2014-12-24 北京网秦天下科技有限公司 基站的检测方法和装置
CN105764059A (zh) * 2014-12-15 2016-07-13 北京新讯世纪信息技术有限公司 一种基于终端位置信息来识别伪基站的方法
CN106792710A (zh) * 2017-01-16 2017-05-31 北京奇虎科技有限公司 基于用户终端位置识别伪基站的方法及装置
CN107241729A (zh) * 2016-03-29 2017-10-10 努比亚技术有限公司 伪基站识别方法及装置

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101442788A (zh) * 2008-12-29 2009-05-27 华为技术有限公司 一种位置检测的方法、系统及设备
CN102045688B (zh) * 2009-10-15 2014-03-12 中兴通讯股份有限公司 用户设备被非法使用的检测方法及检测装置
CN103179504B (zh) * 2011-12-23 2015-10-21 中兴通讯股份有限公司 用户合法性判断方法及装置、用户接入信箱的方法和系统
US9584528B2 (en) * 2012-09-06 2017-02-28 Qualcomm Incorporated Securing databases against piracy attacks
CN106912052A (zh) * 2015-12-23 2017-06-30 大唐半导体设计有限公司 一种定位伪基站的方法及装置、终端
CN108574934B (zh) * 2017-03-10 2020-09-08 中国移动通信集团福建有限公司 一种伪基站定位方法和装置
CN107071779A (zh) * 2017-04-13 2017-08-18 广东欧珀移动通信有限公司 伪基站识别方法、装置及终端
CN107295520B (zh) * 2017-06-20 2019-08-20 成都点阵科技有限公司 红外辅助查找伪基站的方法
CN110012435B (zh) * 2018-01-04 2021-06-25 中兴通讯股份有限公司 伪基站定位方法、终端及计算机可读存储介质
CN109275146A (zh) * 2018-10-25 2019-01-25 努比亚技术有限公司 一种伪基站检测方法、终端及计算机可读存储介质
CN109495838A (zh) * 2018-11-08 2019-03-19 武汉虹信通信技术有限责任公司 基于pusch和srs联合功率测量的定位方法
CN110809316A (zh) * 2019-09-27 2020-02-18 联创汽车电子有限公司 伪基站检测定位方法及其检测定位系统
CN112055384B (zh) * 2020-09-09 2023-05-16 周伟 一种宽带自适应信号屏蔽方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104244281A (zh) * 2014-10-11 2014-12-24 北京网秦天下科技有限公司 基站的检测方法和装置
CN105764059A (zh) * 2014-12-15 2016-07-13 北京新讯世纪信息技术有限公司 一种基于终端位置信息来识别伪基站的方法
CN107241729A (zh) * 2016-03-29 2017-10-10 努比亚技术有限公司 伪基站识别方法及装置
CN106792710A (zh) * 2017-01-16 2017-05-31 北京奇虎科技有限公司 基于用户终端位置识别伪基站的方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3745787A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021115614A1 (en) * 2019-12-13 2021-06-17 Huawei Technologies Duesseldorf Gmbh Network node and method for anonymization of user sensitive data in a communication network

Also Published As

Publication number Publication date
US20200396711A1 (en) 2020-12-17
EP3745787A4 (en) 2021-04-14
CN110312305A (zh) 2019-10-08
EP3745787A1 (en) 2020-12-02
US11096142B2 (en) 2021-08-17
CN110312305B (zh) 2021-12-31

Similar Documents

Publication Publication Date Title
WO2019184728A1 (zh) 终端设备的位置确定方法和设备
US11829774B2 (en) Machine-to-machine bootstrapping
US10194320B1 (en) Method and apparatus for assignment of subscription electronic SIM credentials via local service brokers
CN109587688B (zh) 系统间移动性中的安全性
US9402177B2 (en) Authentication in secure user plane location (SUPL) systems
CN114268943B (zh) 授权方法及装置
US10588015B2 (en) Terminal authenticating method, apparatus, and system
CN109922474B (zh) 触发网络鉴权的方法及相关设备
US11997078B2 (en) Secured authenticated communication between an initiator and a responder
CN112512045B (zh) 一种通信系统、方法及装置
CN110351725B (zh) 通信方法和装置
CN110366175B (zh) 安全协商方法、终端设备和网络设备
JP6651613B2 (ja) ワイヤレス通信
WO2021233286A1 (zh) 数据处理方法、装置、网络设备及终端
US10492056B2 (en) Enhanced mobile subscriber privacy in telecommunications networks
US8606228B2 (en) Method, user network equipment and management system thereof for secure data transmission
WO2021195816A1 (zh) 一种通信方法、装置及系统
WO2024061207A1 (zh) 用户级数据的管理方法、装置、通信设备及可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19777491

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019777491

Country of ref document: EP

Effective date: 20200826

NENP Non-entry into the national phase

Ref country code: DE