WO2019223769A1 - 一种寻呼处理方法及装置 - Google Patents

一种寻呼处理方法及装置 Download PDF

Info

Publication number
WO2019223769A1
WO2019223769A1 PCT/CN2019/088203 CN2019088203W WO2019223769A1 WO 2019223769 A1 WO2019223769 A1 WO 2019223769A1 CN 2019088203 W CN2019088203 W CN 2019088203W WO 2019223769 A1 WO2019223769 A1 WO 2019223769A1
Authority
WO
WIPO (PCT)
Prior art keywords
paging
terminal device
identifier
paging message
message
Prior art date
Application number
PCT/CN2019/088203
Other languages
English (en)
French (fr)
Inventor
李洪
舒林
刘涛
金文君
卓超
陈洪强
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201910047972.9A external-priority patent/CN110536290B/zh
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19808078.0A priority Critical patent/EP3817421A4/en
Publication of WO2019223769A1 publication Critical patent/WO2019223769A1/zh
Priority to US17/100,351 priority patent/US20210076353A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]

Definitions

  • the present application relates to the field of wireless communication technologies, and in particular, to a method and device for paging processing.
  • the paging channel used by a base station when paging a terminal device is a common channel.
  • the information carried on the paging channel is transmitted in plain text (without security protection), so the terminal device cannot distinguish the paging message as a fake network. It is sent by the real base station, and it will respond normally after receiving the paging message.
  • the pseudo network can increase the transmission energy of the pseudo network to attract the terminal equipment to reside in the pseudo network, and obtain the paging identification of the terminal equipment.
  • the pseudo network can obtain the system information of the real base station through the terminal equipment, and perform the system information of the real base station. The analysis and calculation are combined with the obtained paging identifier to obtain the time domain information of the paging message sent by the real base station.
  • the pseudo network has the functions of a base station and a mobile management network element. After obtaining the time domain information of the paging message sent by the real base station and the paging identification of the terminal device, the pseudo network can disguise itself as a real base station, and frequently initiates to the terminal device in the time domain where the real base station sends the paging message to the terminal device.
  • the paging message performs a paging attack on the terminal device and affects the normal communication between the terminal device and the network side.
  • the present application provides a paging processing method and device to solve the problem that terminal devices in the prior art are susceptible to paging attacks on pseudo networks.
  • this application provides a paging processing method.
  • the method includes: a terminal device receiving a first paging message, where the first paging message carries a first paging identifier and first indication information, and The first instruction information is used to indicate that the first paging identifier is a security-protected paging identifier; and the terminal device uses the security context negotiated with the mobile management network element to the first paging identifier according to the first instruction information.
  • the paging identity is subjected to de-security protection processing to obtain a second paging identity, and the first paging message is processed according to the second paging identity and the identity of the terminal device.
  • the terminal device when the terminal device receives the first paging message, the terminal device performs security protection processing on the first paging identifier using a security context negotiated with the mobile management network element, and obtains a second paging identifier, and Processing the first paging message according to the second paging identifier and the identity of the terminal device, instead of responding after receiving the paging message, thereby avoiding a paging attack on the terminal device by a pseudo network .
  • the mobility management network element may be a mobility management entity MME; in a 5G network, the mobility management network element may be an access and mobility management function AMF entity.
  • the terminal device specifically processes the first paging message by using the following methods:
  • the terminal device determines that the second paging identifier is consistent with the identity identifier of the terminal device, responding to the first paging message;
  • the terminal device determines that the second paging identifier is inconsistent with the identity identifier of the terminal device, it ignores the first paging message.
  • the terminal device Since the pseudo network cannot obtain the security context negotiated between the terminal device and the mobile management network element, the terminal device responds to the first paging when the second paging identifier is consistent with the identity of the terminal device. Message, when the second paging identifier is inconsistent with the identity identifier of the terminal device, ignoring the first paging message can effectively avoid a paging attack on the terminal device by a pseudo network.
  • the terminal device may further receive a second paging message, and the second paging message does not carry the first indication information; the terminal device ignores the second paging message; or,
  • the terminal device may also receive a second paging message, where the second paging message carries a third paging identifier and second indication information, and the second indication information is used to indicate the third paging identifier Is plain text; the terminal device ignores the second paging message.
  • the terminal device ignores the second paging message, which can avoid a paging attack on the terminal device by a pseudo network, thereby enabling the terminal device to normally communicate with a real base station.
  • the terminal device before the terminal device receives the first paging message, it is further determined that the mobile management network element supports a paging message carrying a security-protected paging identifier.
  • the terminal device specifically determines that the mobile management network element supports a paging message carrying a security-protected paging identifier through the following steps:
  • the terminal device sends a registration request to the mobile management network element, where the registration request carries third instruction information, and the third instruction information is used to indicate that the terminal device supports paging with a security-protected paging identifier.
  • the terminal device determines, according to the fourth instruction information, that the mobility management network element supports a paging message carrying a paging identifier for security protection.
  • the registration request may be an attach request or a tracking area update request (TAU request); in a 5G network, it is a registration request. Accordingly, when the registration request is an attach request, the registration acceptance message is an attach accept message, and when the registration request is a tracking area update request, the registration acceptance message is a tracking area update accept ( TAU (accept) message, when the registration request is a registration request, the registration acceptance message is a registration accept message.
  • TAU tracking area update accept
  • the present application provides a paging processing method.
  • the method includes: using a security context negotiated between the mobile management network element and a terminal device to secure the paging identity of the terminal device. Protection, obtain a securely protected paging identifier, and send a paging message to the base station, where the paging message includes the paging identifier of the terminal device and the securely protected paging identifier.
  • the mobile management network element uses the security context negotiated with the terminal device to securely protect the paging identifier of the terminal device, obtains the securely protected paging identifier, and sends the paging identifier carrying the terminal device to the base station.
  • the paging identifier and the paging message of the security-protected paging identifier enable the base station to send the paging message carrying the security-protected paging identifier to the terminal device, which can increase the number of calls received by the terminal device.
  • the security of the call message can further avoid paging attacks on the terminal device by the pseudo network.
  • the mobility management network element may be a mobility management entity MME; in a 5G network, the mobility management network element may be an access and mobility management function AMF entity.
  • the mobility management network element may secure the paging identity of the terminal device in the following manner: the mobility management network element uses the security context negotiated between the mobility management network element and the terminal device , Encrypting the paging identification of the terminal device, or performing integrity protection, or performing encryption and integrity protection, or performing integrity protection and anti-replay processing, or performing encryption, integrity protection, and anti-replay processing .
  • the mobile management network element uses the security context negotiated with the terminal device by the mobile management network element to securely protect the paging identity of the terminal device, it is further determined that the terminal device supports carrying The paging message of the security-protected paging identifier; and the indication information of the paging message that the mobile management network element supports to carry the paging identifier of the security protection is sent to the terminal device.
  • the mobility management network element determines that the terminal device supports a paging message carrying a security-protected paging identifier through the following steps: receiving a registration request sent by the terminal device, where the registration request carries The terminal device supports indication information of a paging message carrying a security-protected paging identifier; and according to the indication information carried in the registration request, determining that the terminal device supports a paging message carrying a security-protected paging identifier .
  • the mobile management network element sends the registration acceptance message to the terminal device, and sends the mobile terminal information indicating that the mobile management network element supports a paging message carrying a security protection paging identifier to the terminal device, where:
  • the registration acceptance message carries indication information of a paging message that the mobility management network element supports to carry a paging identifier for security protection.
  • the registration request may be an attach request or a tracking area update request (TAU request); in a 5G network, it is a registration request. Accordingly, when the registration request is an attach request, the registration acceptance message is an attach accept message, and when the registration request is a tracking area update request, the registration acceptance message is a tracking area update accept ( TAU (accept) message, when the registration request is a registration request, the registration acceptance message is a registration accept message.
  • TAU tracking area update accept
  • the present application provides a paging processing method.
  • the method includes: a base station receiving a first paging message sent by a mobile management network element, where the first paging message carries a first paging identifier and a second A paging identifier, where the first paging identifier is obtained after the mobile management network element uses the security context negotiated by the mobile management network element with a terminal device to perform security protection on the second paging identifier, and
  • the second paging identifier is the paging identifier of the terminal device; the base station sends a second paging message to the terminal device, and the second paging message carries the first paging identifier and the first indication information ,
  • the first indication information is used to indicate that the first paging identifier is a paging identifier protected by security.
  • the base station receives the first paging message sent by the mobile management network element, determines the terminal device to be paged according to the second paging identifier in the first paging message, and sends the terminal device to the terminal device.
  • Send a second paging message where the second call message carries the first paging identifier and first indication information, and the first indication information is used to indicate that the first paging identifier is a security-protected page
  • the identification can increase the security of the second paging message received by the terminal device, and can further prevent a paging attack on the terminal device by a pseudo network.
  • the mobility management network element may be a mobility management entity MME; in a 5G network, the mobility management network element may be an access and mobility management function AMF entity.
  • the present application provides a paging processing method.
  • the method includes: receiving, by a terminal device, a first paging message sent by a first network device, where the first paging message carries a first paging identifier and First indication information, where the first indication information is used to indicate that the first paging identifier is a security-protected paging identifier; a state of a communication link between the terminal device and the first network device is inactive When in the state, the terminal device performs security protection processing on the first paging identifier using the security context negotiated with the first network device according to the first instruction information, and obtains a second paging identifier, and The second paging identifier and the identity of the terminal device process the first paging message.
  • the communication link between the terminal device and the first network device is in an inactive state, according to the first instruction information in the first paging message sent by the first network device, Use the security context negotiated with the first network device to perform security protection processing on the first paging identifier in the first paging message to obtain a second paging identifier, and according to the second paging identifier and The identity of the terminal device processes the first paging message, and only responds to the first paging message if the second paging identity is consistent with the identity of the terminal device, otherwise, Ignoring the paging message, instead of responding after receiving the paging message, a paging attack on the terminal device by a pseudo network can be avoided.
  • the terminal device may process the first paging message by using the following method: when the terminal device determines that the second paging identifier is consistent with the identity identifier of the terminal device, it responds to The first paging message; or when the terminal device determines that the second paging identifier is inconsistent with the identity of the terminal device, it ignores the first paging message.
  • the terminal device responds to the first paging when the second paging identifier is consistent with the identity identifier of the terminal device. Message, when the second paging identifier is inconsistent with the identity identifier of the terminal device, ignoring the first paging message can effectively avoid a paging attack on the terminal device by a pseudo network.
  • the method further includes: the terminal device receives a second paging message, and the second paging message does not carry the first indication information; the terminal device ignores the second paging message A paging message; or the terminal device receives a second paging message, where the second paging message carries a third paging identifier and second indication information, and the second indication information is used to indicate the first
  • the three paging identification is plain text; the terminal device ignores the second paging message.
  • the terminal device ignores the second paging message, which can avoid a paging attack on the terminal device by a pseudo network, so that the terminal device can normally communicate with the real network.
  • the terminal device determines that the second network device supports a paging message that carries a paging identifier for security protection.
  • the terminal device may determine that the second network device supports a paging message carrying a paging identifier of security protection by the following method: the terminal device sends a registration request to the second network device, and the The registration request carries third instruction information, and the third instruction information is used to indicate that the terminal device supports a paging message carrying a paging identifier for security protection; the terminal device receives a registration acceptance sent by the second network device Message, the registration acceptance message carries fourth indication information, and the fourth indication information is used to indicate that the second network device supports a paging message carrying a paging identifier for security protection; the terminal device is configured according to the first Four indication information, it is determined that the second network device supports a paging message carrying a paging identifier of security protection.
  • the present application provides a paging processing method, which includes: after receiving a downlink data packet or a downlink signaling packet by a first network device, using the security context negotiated between the first network device and a terminal device , Performing security protection on the paging identifier of the terminal device to obtain the paging identifier for security protection, and sending a paging message to the terminal device, where the paging message carries the paging identifier for security protection and is used to indicate The paging identifier carried is indication information of a security-protected paging identifier.
  • the first network device uses the security context negotiated with the terminal device to secure the paging identity of the terminal device. Protection, obtain a securely protected paging identifier, and send a paging message carrying the paging identifier of the terminal device and the securely protected paging identifier to the terminal device, which can increase the number of calls received by the terminal device.
  • the security of the call message can further avoid paging attacks on the terminal device by the pseudo network.
  • the first network device may secure the paging identity of the terminal device in the following manner: the first network device uses the security context negotiated with the terminal device by the first network device , Encrypting the paging identification of the terminal device, or performing integrity protection, or performing encryption and integrity protection, or performing integrity protection and anti-replay processing, or performing encryption, integrity protection, and anti-replay processing .
  • the terminal device and the second network device before the first network device receives a downlink data packet or a downlink signaling packet, it is further determined that the terminal device and the second network device support a paging message carrying a paging identifier of security protection.
  • the first network device specifically determines that the terminal device and the second network device support a paging message carrying a paging identifier for security protection by the following steps: the first network device receives the paging message Instruction information sent by a second network device, where the instruction information sent by the second network device is used to indicate that the second network device and the terminal device support a paging message carrying a paging identifier for security protection; the first The network device determines, according to the instruction information sent by the second network device, that the terminal device and the second network device support a paging message that carries a paging identifier for security protection.
  • the present application provides a paging processing method.
  • the method includes: the terminal device counts the number of times that a paging message is received within a first set period of time, and determines that the number of times that the paging message is counted is greater than When it is equal to the first threshold, a data packet or a signaling packet for maintaining a communication connection with the base station is sent to the base station.
  • the terminal device counts the number of times of paging messages received within the first set duration, and when it is determined that the counted number of times of the paging messages is greater than or equal to the first threshold, it sends to the base station for maintaining and A data packet or a signaling packet of a communication connection between the base stations makes the terminal device in a connected state, and since the terminal device does not respond to a paging message when the terminal device is in a connected state, it is possible to avoid a false network to the terminal device. Paging attack.
  • the terminal device sends a data packet or a signaling packet for maintaining a communication connection with the base station to the base station in the following manner: the terminal device is within a second set duration Sending a data packet or a signaling packet to the base station for maintaining a communication connection with the base station according to a set period; wherein the set period is less than a second threshold value, and the second threshold value is the The duration for which the communication connection between the terminal device and the base station is maintained.
  • the terminal device sends a data packet or a signaling packet for maintaining a communication connection with the base station to the base station according to a set period, so that the terminal device is in the second time period.
  • the terminal device does not respond to the paging message when it is in the connected state, a paging attack on the terminal device by a pseudo network can be avoided.
  • the paging message carries a fixed paging identifier, or the paging message carries a temporary paging identifier.
  • the paging message includes a first type of paging message and a second type of paging message, the first type of paging message carries a fixed paging identifier, and the second type of paging message It carries a temporary paging identifier; the number of times of paging messages counted by the terminal device is the sum of the number of times of the first type of paging message and the number of times of the second type of paging message received within the first set time period.
  • the terminal device separately counts the number of times of paging messages received from different base stations within the first set time period, and the terminal device determines the number of times of paging messages received from any one base station. When it is greater than or equal to the first threshold, a data packet or a signaling packet for maintaining a communication connection with the base station is sent to the base station.
  • the present application provides a paging processing method.
  • the method includes: the terminal device counts the number of times a paging message carrying a temporary paging identifier is received within a set period of time, and determines the statistics of the paging.
  • the mobile terminal sends indication information for requesting allocation of a globally unique temporary identifier GUTI to the mobile management network element; the terminal device receives the GUTI sent by the mobile management network element, and according to the received GUTI To process the paging message carrying the temporary paging identifier.
  • the terminal device counts the number of times that the paging message carrying the temporary paging identifier is received within a set period of time, and when it is determined that the counted number of times of the paging message is greater than or equal to a set threshold, the mobile device reports
  • the network element sends instruction information for requesting a global unique temporary identification GUTI, and receives the GUTI allocated by the mobile management network element, and processes the paging message carrying the temporary paging identification according to the GUTI allocated by the mobile network element.
  • the pseudo network cannot obtain the mobile management network element to assign a GUTI to the terminal device according to the instruction information, that is, the paging message sent by the pseudo network to the terminal device does not carry the mobile management network element for all
  • the new GUTI allocated by the terminal device is described, so after the terminal device obtains the new GUTI allocated by the mobile management network element for the terminal device, it will not respond to the paging message sent by the pseudo network, which can prevent the pseudo network from Paging attacks on end devices.
  • the mobility management network element may be a mobility management entity MME; in a 5G network, the mobility management network element may be an access and mobility management function AMF entity.
  • the terminal device sends instruction information for requesting allocation of a GUTI to a mobile management network element in the following manner: the terminal device sends a location update request to the mobile management network element, and the location update request The instruction information for requesting allocation of GUTI is carried.
  • the terminal device receives the GUTI sent by the mobility management network element in the following manner: the terminal device receives a location update acceptance message sent by the mobility management network element, and the location update acceptance message carries the mobile A GUTI allocated by the management network element to the terminal device.
  • the location update request is a tracking area update request (TAU request); in a 5G network, the location update request is a registration request.
  • the location update accept message is a tracking area update accept (TAU) accept message, and when the location update request is a registration request, the location update accept message Accept the message for the registration.
  • the terminal device receives the GUTI sent by the mobile management network element in the following manner:
  • the terminal device receives a configuration update message sent by the mobility management network element, where the configuration update message carries a GUTI allocated by the mobility management network element to the terminal device.
  • the terminal device specifically processes the paging message carrying the temporary paging identifier through the following steps: the terminal device determines the current temporary paging identifier of the terminal device according to the received GUTI; when the terminal device When the temporary paging identification carried in the paging message received by the terminal device is consistent with the current temporary paging identification of the terminal device, the terminal device responds to the paging message, and when the terminal device receives the When the temporary paging identifier carried in the paging message is inconsistent with the current temporary paging identifier of the terminal device, the terminal device ignores the paging message.
  • the present application provides a paging processing method, which includes: receiving, by a mobile management network element, instruction information sent by a terminal device for requesting a global unique temporary identifier GUTI, and according to the instruction information, provide The terminal device allocates a GUTI, and sends the GUTI to the terminal device.
  • the mobility management network element may allocate the GUTI to the terminal device according to the instruction information sent by the terminal device and used to request the assignment of a globally unique temporary identifier GUTI, and send the GUTI to the terminal device. So that the terminal device can process the paging message carrying the temporary paging identifier according to the GUTI allocated by the mobility management network element. Because the pseudo network cannot obtain the GUTI allocated by the mobile management network element to the terminal device, that is, the paging message sent by the pseudo network to the terminal device does not carry the new allocation of the mobile device by the mobile management network element to the terminal device. GUTI, so after obtaining the new GUTI allocated by the mobile management network element to the terminal device, the terminal device will not respond to the paging message sent by the pseudo network, which can avoid paging attacks on the terminal device by the pseudo network .
  • the mobility management network element may be a mobility management entity MME; in a 5G network, the mobility management network element may be an access and mobility management function AMF entity.
  • the mobility management network element receives the indication information sent by the terminal device for requesting allocation of a globally unique temporary identifier GUTI in the following manner: the mobility management network element receives a location update request sent by the terminal device , The location update request carries the indication information for requesting allocation of a GUTI. At this time, the mobility management network element sends the GUTI to the terminal device in the following manner: the mobility management network element sends a location update acceptance message to the terminal device, and the location update acceptance message carries the GUTI.
  • the location update request is a tracking area update request (TAU request); in a 5G network, the location update request is a registration request.
  • the location update accept message is a tracking area update accept (TAU) accept message, and when the location update request is a registration request, the location update accept message Accept the message for the registration.
  • the mobility management network element sends the GUTI to the terminal device in the following manner: the mobility management network element sends a GUTI reallocation message to the terminal device, and the GUTI reallocation message Carrying the GUTI; or the mobility management network element sends a configuration update message to the terminal device, where the configuration update message carries the GUTI.
  • the present application provides a terminal device, which has a function of implementing the behavior of the terminal device in the method example of the first aspect.
  • the functions may be implemented by hardware, and may also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the structure of the terminal device includes a receiving unit, a sending unit, and a processing unit, and these units may perform corresponding functions in the method example of the first aspect described above.
  • a receiving unit a sending unit
  • a processing unit a processing unit
  • the structure of the terminal device includes a transmitter, a receiver, a controller / processor, and a modem processor, and the controller / processor is configured to support execution by the terminal device.
  • the controller / processor is configured to support execution by the terminal device.
  • the memory is coupled to the controller / processor, and it stores program instructions and data necessary for the terminal device.
  • the present application provides a mobility management network element, which has the function of implementing the behavior of the mobility management network element in the method example of the second aspect.
  • the functions may be implemented by hardware, and may also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the structure of the mobility management network element includes a receiving unit, a sending unit, and a processing unit, and these units may perform corresponding functions in the method example of the second aspect described above.
  • a receiving unit a sending unit
  • a processing unit a processing unit
  • the structure of the mobility management network element includes a receiver / receiver, a controller / processor, a memory, and a communication unit, and the controller / processor is configured to support the mobility management
  • the network element performs a corresponding function in the method provided in the second aspect.
  • the memory is coupled to the controller / processor, and it stores program instructions and data necessary for the mobility management network element.
  • the present application provides a base station that has a function of implementing the behavior of the base station in the method example of the third aspect.
  • the functions may be implemented by hardware, and may also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the structure of the base station includes a receiving unit and a sending unit, and these units may perform corresponding functions in the method example of the third aspect described above.
  • these units may perform corresponding functions in the method example of the third aspect described above.
  • the structure of the base station includes a receiving unit and a sending unit, and these units may perform corresponding functions in the method example of the third aspect described above.
  • the structure of the base station includes a receiving unit and a sending unit, and these units may perform corresponding functions in the method example of the third aspect described above.
  • these units may perform corresponding functions in the method example of the third aspect described above.
  • the structure of the base station includes a receiver / receiver, a controller / processor, a memory, and a communication unit, and the controller / processor is configured to support execution of the mobility management network element.
  • the controller / processor is configured to support execution of the mobility management network element.
  • the memory is coupled to the controller / processor, and it stores program instructions and data necessary for the base station.
  • the present application provides a terminal device that has a function of implementing the behavior of the terminal device in the method example of the fourth aspect.
  • the functions may be implemented by hardware, and may also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the structure of the terminal device includes a receiving unit and a processing unit, and these units can perform corresponding functions in the method example of the fourth aspect described above.
  • these units can perform corresponding functions in the method example of the fourth aspect described above.
  • the structure of the terminal device includes a receiving unit and a processing unit, and these units can perform corresponding functions in the method example of the fourth aspect described above.
  • these units can perform corresponding functions in the method example of the fourth aspect described above.
  • the structure of the terminal device includes a receiving unit and a processing unit, and these units can perform corresponding functions in the method example of the fourth aspect described above.
  • the structure of the terminal device includes a receiving unit and a processing unit, and these units can perform corresponding functions in the method example of the fourth aspect described above.
  • the detailed description in the method example To repeat.
  • the structure of the terminal device includes a transmitter, a receiver, a controller / processor, and a modem processor, and the controller / processor is configured to support execution by the terminal device.
  • the controller / processor is configured to support execution by the terminal device.
  • the memory is coupled to the controller / processor, and it stores program instructions and data necessary for the terminal device.
  • the present application provides a network device that has a function of implementing the behavior of the first network device in the method example of the fifth aspect.
  • the functions may be implemented by hardware, and may also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the structure of the network device includes a receiving unit, a processing unit, and a sending unit, and these units may perform corresponding functions in the method example of the fifth aspect described above.
  • the structure of the network device includes a receiving unit, a processing unit, and a sending unit, and these units may perform corresponding functions in the method example of the fifth aspect described above.
  • these units may perform corresponding functions in the method example of the fifth aspect described above.
  • the structure of the network device includes a receiving unit, a processing unit, and a sending unit, and these units may perform corresponding functions in the method example of the fifth aspect described above.
  • the structure of the network device includes a receiving unit, a processing unit, and a sending unit, and these units may perform corresponding functions in the method example of the fifth aspect described above.
  • the structure of the network device includes a receiver / receiver, a controller / processor, a memory, and a communication unit, and the controller / processor is configured to support the network device to execute the foregoing.
  • the memory is coupled to the controller / processor, and it stores program instructions and data necessary for the network device.
  • the present application provides a terminal device having the function of implementing the behavior of the terminal device in the method example of the sixth aspect.
  • the functions may be implemented by hardware, and may also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the structure of the terminal device includes a receiving unit and a processing unit, and these units can perform corresponding functions in the method example of the sixth aspect described above.
  • these units can perform corresponding functions in the method example of the sixth aspect described above.
  • the structure of the terminal device includes a receiving unit and a processing unit, and these units can perform corresponding functions in the method example of the sixth aspect described above.
  • these units can perform corresponding functions in the method example of the sixth aspect described above.
  • the structure of the terminal device includes a receiving unit and a processing unit, and these units can perform corresponding functions in the method example of the sixth aspect described above.
  • the structure of the terminal device includes a receiving unit and a processing unit, and these units can perform corresponding functions in the method example of the sixth aspect described above.
  • the detailed description in the method example To repeat.
  • the structure of the terminal device includes a transmitter, a receiver, a controller / processor, and a modem processor, and the controller / processor is configured to support execution by the terminal device.
  • the controller / processor is configured to support execution by the terminal device.
  • the memory is coupled to the controller / processor, and it stores program instructions and data necessary for the terminal device.
  • the present application provides a terminal device that has a function of implementing the behavior of the terminal device in the method example in the seventh aspect.
  • the functions may be implemented by hardware, and may also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the structure of the terminal device includes a receiving unit, a sending unit, and a processing unit, and these units may perform corresponding functions in the method example of the seventh aspect described above.
  • the structure of the terminal device includes a receiving unit, a sending unit, and a processing unit, and these units may perform corresponding functions in the method example of the seventh aspect described above.
  • these units may perform corresponding functions in the method example of the seventh aspect described above.
  • the structure of the terminal device includes a receiving unit, a sending unit, and a processing unit, and these units may perform corresponding functions in the method example of the seventh aspect described above.
  • the structure of the terminal device includes a receiving unit, a sending unit, and a processing unit, and these units may perform corresponding functions in the method example of the seventh aspect described above.
  • the structure of the terminal device includes a transmitter, a receiver, a controller / processor, and a modem processor, and the controller / processor is configured to support execution by the terminal device.
  • the controller / processor is configured to support execution by the terminal device.
  • the memory is coupled to the controller / processor, and it stores program instructions and data necessary for the terminal device.
  • the present application provides a mobility management network element, which has a function of implementing the behavior of the mobility management network element in the method example of the eighth aspect.
  • the functions may be implemented by hardware, and may also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the structure of the mobility management network element includes a receiving unit, a sending unit, and an allocating unit, and these units may perform corresponding functions in the method example of the eighth aspect described above.
  • the structure of the mobility management network element includes a receiving unit, a sending unit, and an allocating unit, and these units may perform corresponding functions in the method example of the eighth aspect described above.
  • the method example Description refer to details in the method example Description, not repeated here.
  • the structure of the mobility management network element includes a receiver / receiver, a controller / processor, a memory, and a communication unit, and the controller / processor is configured to support the mobility management
  • the network element performs a corresponding function in the method provided in the eighth aspect.
  • the memory is coupled to the controller / processor, and it stores program instructions and data necessary for the mobility management network element.
  • the present application provides a communication system including the terminal device according to the first aspect, the mobility management network element according to the second aspect, and the base station according to the third aspect. .
  • the present application provides a communication system including the terminal device according to the first aspect, the mobility management network element according to the fourth aspect, and the network according to the fifth aspect. device.
  • the present application further provides a communication system including the terminal device according to the seventh aspect and the mobility management network element according to the eighth aspect.
  • the present application also provides a computer-readable storage medium, where the computer storage medium stores computer-executable instructions, and when the instructions are run on a computer, the computer is caused to execute any of the foregoing aspects.
  • the present application also provides a computer program product containing instructions, which when executed on a computer, cause the computer to execute any one of the methods described above.
  • FIG. 1 is a schematic diagram of a 4G network architecture according to an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a 5G network architecture according to an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of a first paging processing method according to an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of a method according to a first embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a method according to a second embodiment of the present application.
  • FIG. 6 is a schematic flowchart of a second paging processing method according to an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of a third paging processing method according to an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of a method according to a third embodiment of the present application.
  • FIG. 9 is a schematic flowchart of a method according to a fourth embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a paging processing apparatus according to an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of a paging processing apparatus according to an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of a paging processing apparatus according to an embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of a paging processing apparatus according to an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of a paging processing apparatus according to an embodiment of the present application.
  • FIG. 15 is a schematic structural diagram of a paging processing apparatus according to an embodiment of the present application.
  • FIG. 16 is a schematic structural diagram of a terminal device according to an embodiment of the present application.
  • FIG. 17 is a schematic structural diagram of a mobility management network element according to an embodiment of the present application.
  • FIG. 18 is a schematic structural diagram of a base station according to an embodiment of the present application.
  • FIG. 19 is a schematic flowchart of a fourth paging processing method according to an embodiment of the present application.
  • FIG. 21 is a schematic structural diagram of a paging processing apparatus according to an embodiment of the present application.
  • FIG. 22 is a schematic structural diagram of a paging processing apparatus according to an embodiment of the present application.
  • FIG. 23 is a schematic structural diagram of a terminal device according to an embodiment of the present application.
  • FIG. 24 is a schematic structural diagram of a first network device according to an embodiment of the present application.
  • the terminal device cannot distinguish whether the paging message is sent by a pseudo network or a real base station. After receiving the paging message, it will respond normally.
  • the terminal device When the paging message received by the terminal device carries the international mobile subscriber identity mobile subscriber identity (IMSI), the terminal device first performs local registration and then reattaches.
  • the terminal device When the paging message received by the terminal device carries a temporary mobile subscriber identity (S-TMSI), the terminal device reports to The mobility management network element initiates a service process.
  • IMSI international mobile subscriber identity mobile subscriber identity
  • S-TMSI temporary mobile subscriber identity
  • a pseudo network When a pseudo network frequently sends a paging message carrying an IMSI to a terminal device, the terminal device frequently performs local de-registration and re-attachment, resulting in users being unable to obtain normal services.
  • a pseudo network When a pseudo network frequently sends a paging message carrying S-TMSI to a terminal device, the terminal device frequently switches between idle and connected states, increasing the power consumption of the terminal device, reducing the endurance of the terminal device, and then affecting user experience.
  • the present application provides a paging processing method and device.
  • the method and device described in this application are based on the same inventive concept. Since the method and the device solve the problem of similar principles, the implementation of the device and method can be referred to each other, and duplicates are not described again.
  • IMSI is a mark that distinguishes a mobile user, and is stored in a subscriber identity module (SIM) card or a universal subscriber identity module (USIM) card.
  • SIM subscriber identity module
  • USIM universal subscriber identity module
  • the IMSI is composed of a mobile country code (MCC), a mobile network code (MNC), and a mobile subscriber identification number (MSIN).
  • MCC mobile country code
  • MNC mobile network code
  • MSIN mobile subscriber identification number
  • MCC International Telecommunication Union
  • ITU International Telecommunication Union
  • MNC is used to identify the mobile communication network to which a mobile user belongs.
  • PLMN public land mobile networks
  • MSIN is used to identify mobile users in a certain mobile communication network.
  • GUITI global unique temporary identity
  • CN core network
  • the registration request refers to an attachment request or a tracking area update request (TAU request) in a 4th-generation (4G) network; in a 5th-generation (4th-generation, 4G) network, In a 5G) network, this is a registration request.
  • TAU request tracking area update request
  • Security protection including encryption, integrity protection, combination of encryption and integrity protection, integration of integrity protection and anti-replay processing, or combination of encryption and integrity protection and anti-replay processing.
  • the sending end or the receiving end performs security protection processing on the data according to the security context agreed upon by both parties, so that the opposite end performs unsecure protection processing on the obtained data through the agreed security context, and verifies the security of the obtained data to increase the data. Transmission security.
  • Decrypt security protection including decryption, integrity verification, decryption and integrity verification, integrity verification and anti-replay verification, or decryption, integrity verification and anti-replay verification, etc. For verifying the security of the protected data.
  • the location update request refers to a TAU request in a 4G network and a registration request in a 5G network.
  • association relationship of the association objects indicating that there can be three kinds of relationships.
  • a and / or B can indicate: there are three cases of A alone, A and B, and B alone.
  • the character "/" generally indicates that the related objects are an "or" relationship.
  • the paging processing method provided in this application is applicable to both a 4G network architecture and a 5G network architecture, as well as future evolution communication networks.
  • a possible network architecture applicable to this application is shown in FIG. 1, which is a 4G network architecture.
  • the network elements in the 4G network architecture include a terminal device and a mobility management entity (MME).
  • the terminal device is a user equipment (UE).
  • the network architecture also includes a serving GPRS support node (serving GPRS support node (SGSN), a home subscription server (HSS), a serving gateway (S-GW), and a packet data network gateway (PDN). gateway (P-GW), policy and charging rules function (PCRF) entity, evolved universal terrestrial wireless access network (evolved universal terrestrial radio access network, E-TURAN), etc.
  • serving GPRS support node serving GPRS support node (SGSN), a home subscription server (HSS), a serving gateway (S-GW), and a packet data network gateway (PDN).
  • P-GW policy
  • E-UTRAN consists of multiple evolved base stations (evolved nodeB, eNodeB).
  • the eNodeBs are interconnected with each other through the X2 interface.
  • the eNodeB and the evolved packet core (EPC) interact through the S1 interface, while the eNodeB and the UE communicate with each other through the S1 interface.
  • Long term evolution (LTE) -Uu interconnection LTE-Uu interconnection.
  • the main function of the MME is to support non-access stratum (NAS) signaling and its security, management of the track area (TA) list, selection of P-GW and S-GW, and cross-MME handover. Selection of MME, selection of SGSN during handover to 2G / 3G access system, user authentication, roaming control and bearer management, 3rd Generation Partnership Project (3GPP) different access networks Mobility management between core network nodes.
  • NAS non-access stratum
  • TA track area
  • P-GW and S-GW selection of P-GW and S-GW
  • 3GPP 3rd Generation Partnership Project
  • the S-GW is a gateway that terminates on the E-UTRAN interface. Its main functions include: serving as a local anchor point when assisting in handover between base stations, and assisting in completing the reordering function of the base station; as a mobile when switching between 3GPP different access systems Anchor points; perform legal interception functions; route and forward data packets; mark packets on the uplink and downlink transport layers; and be used for billing between operators.
  • the P-GW is a gateway facing the PDN terminating on the SGi interface. If the UE accesses multiple PDNs, the UE will correspond to one or more P-GWs.
  • the main functions of P-GW include user-based packet filtering function, lawful interception function, Internet Protocol (IP) address allocation function of the UE's network, packet transfer level marking in the uplink, Perform uplink and downlink service level charging and control of service level thresholds, and control of uplink and downlink rates based on services.
  • IP Internet Protocol
  • the HSS is a database used to store user subscription information.
  • the home network may contain one or more HSSs.
  • the HSS is responsible for storing user-related information, such as user identification, number and routing information, security information, location information, and profile information.
  • SGSN can be used for signaling interaction when moving between 2G / 3G and E-UTRAN 3GPP access networks, including the selection of P-GW and S-GW, and for users who switch to E-UTRAN 3GPP access networks. Choice of MME.
  • the PCRF entity terminates on the Rx interface and the Gx interface.
  • the non-roaming scenario there is only one PCRF in the HPLMN and one IP-connectivity access network of the UE, and the IP-CAN session is related.
  • the roaming scenario and services When the flow is locally groomed, there may be two PCRFs related to the IP-CAN session of a UE.
  • the network architecture is a 5G network architecture.
  • the network elements in the 5G network architecture include a terminal device and an access and mobility management function (AMF) entity.
  • the terminal device is used as an example of the UE.
  • the network architecture also includes a radio access network (RAN), a user plane function (UPF) entity, a data network (DN), a session management function (SMF) entity, and authentication.
  • RAN radio access network
  • UPF user plane function
  • DN data network
  • SMF session management function
  • Service function entity authentication server function (AUSF), unified data management (UDM) entity, policy control function (PCF) entity (not shown in Figure 2), application function (AF ) Entities (not shown in FIG. 2), authentication credential storage and processing function (ARPF) entities (not shown in FIG. 2), and the like.
  • the main function of RAN is to control users to access the mobile communication network through wireless access.
  • the RAN is part of a mobile communication system. It implements a wireless access technology. Conceptually, it resides between a device (such as a mobile phone, a computer, or any remote control machine) and provides a connection to its core network.
  • RAN equipment includes, but is not limited to: 5G (gnodeB, gNB), eNodeB, radio network controller (RNC), node B (nodeB, NB), base station controller (BSC) , Base transceiver station (BTS), home base station (e.g., home nodeB, or home node B, HNB), baseband unit (BBU), transmission point (receiving point, TRP), transmission Point (TP), mobile switching center, etc.
  • 5G gnodeB, gNB
  • eNodeB radio network controller
  • nodeB nodeB
  • BSC base station controller
  • BTS Base transceiver station
  • home base station e.g., home nodeB, or home node B, HNB
  • BBU baseband unit
  • TRP transmission point
  • TP transmission Point
  • mobile switching center etc.
  • AP wireless fidelity access point
  • the AMF entity is responsible for the access management and mobility management of the terminal. In practical applications, it includes the mobility management function in the MME in the network framework in LTE, and adds the access management function.
  • the SMF entity is responsible for session management, such as user session establishment.
  • the UPF entity is a functional network element of the user plane and is mainly responsible for connecting to external networks. It includes the related functions of the LTE serving gateway (SGW) and public data network gateway (GateWay, PDN-GW).
  • SGW LTE serving gateway
  • PDN-GW public data network gateway
  • the DN is responsible for the network that provides services to the terminal. For example, some DNs provide Internet access for the terminal, other DNs provide SMS function for the terminal, and so on.
  • the SEAF entity is used to complete the authentication process for the UE. In 5G, the function of the SEAF can be incorporated into the AMF entity.
  • the AUSF entity has an authentication service function for terminating the authentication function of the SEAF request.
  • the AMF network element is responsible for the access management and mobility management of the terminal. In actual applications, it includes the mobility management function of the MME in LTE, and adds the access management function.
  • ARPF entities have authentication credential storage and processing functions, which are used to store users' long-term authentication credentials, such as permanent key K and so on.
  • ARPF functions can be incorporated into UDM entities.
  • the UDM entity can store the user's subscription information and implement a back end similar to the HSS in 4G.
  • the terminal device in this application is a device with a wireless transceiver function, which can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on the water (such as a ship, etc.); it can also be deployed in the air ( Such as airplanes, balloons, and satellites).
  • the terminal device may be a mobile phone, a tablet, a computer with a wireless transmitting and receiving function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, or an industrial control. ), Wireless terminal in self-driving, wireless terminal in remote medical, wireless terminal in smart grid, wireless terminal in transportation safety , Wireless terminals in smart cities, wireless terminals in smart homes, and so on.
  • the first paging processing method provided in this application is applied to a scenario where a network-side device needs to communicate with a terminal device when the terminal device is in an idle state, and is applicable to the 4G shown in FIG. 1 above.
  • Communication system and the 5G communication system shown in FIG. 2. The method includes the following steps:
  • the mobility management network element uses the security context negotiated between the mobility management network element and the terminal device to perform security protection on the paging identity of the terminal device to obtain a first paging identity.
  • the paging identity (UE identity or UE identity) of the terminal device may be a fixed paging identity (ie, a fixed paging identity), such as IMSI in a 4G network and a permanent user identity in a 5G network. (subscription, permanent identifier, SUPI) or user hidden identifier (SUCI); the paging identifier of the terminal device may also be a temporary paging identifier allocated by the mobile management network element, such as S- in a 4G network TMSI, 5G-S-TMSI in 5G networks.
  • the mobility management network element may be an MME in a 4G network, an AMF entity in a 5G network, or a future communication network. Network element with mobility management.
  • the mobility management network element sends a first paging message to the base station, where the first paging message includes a paging identifier of the terminal device and the first paging identifier.
  • the base station in the 4G network may be an eNB, a macro base station, a micro base station (also referred to as a "small base station"), a pico base station, an AP, a TP, a BSC, a BTS, a BBU, an RNC, a home base station, or a mobile switching center.
  • the base station may be any device in the above 4G network, and may also be gNB or TRP.
  • the base station may also be a base station in a future network.
  • the base station receives a first paging message sent by the mobility management network element.
  • the base station sends a second paging message to the terminal device, where the second paging message carries the first paging identifier and first indication information, and the first indication information is used to indicate the first A paging identifier is a paging identifier protected by security.
  • the terminal device receives the second paging message.
  • the second paging message carrying the first indication information may also be sent by a pseudo network.
  • the first paging identifier is that the pseudo network uses a certain security context (because the pseudo network cannot obtain the terminal device to negotiate with the mobile management network element , The security context used by the pseudo network and the security context negotiated between the terminal device and the mobile management network element are different), obtained by performing security protection on the paging identity of the terminal device.
  • the terminal device performs security protection processing on the first paging identifier using a security context negotiated with a mobile management network element to obtain a second paging identifier.
  • the terminal device processes the second paging message according to the second paging identifier and the identity of the terminal device.
  • the terminal device may further receive a third paging message, wherein the third paging message does not carry the first indication information, or the third paging message carries a first paging message.
  • the terminal device may further receive a third paging message, wherein the third paging message does not carry the first indication information, or the third paging message carries a first paging message.
  • Three paging identifiers and second indication information, and the second indication information is used to indicate that the third paging identifier is in plain text; the terminal device ignores the second paging message.
  • the terminal device ignores the third paging message, which can avoid a paging attack on the terminal device by a pseudo network, thereby enabling the terminal device to normally communicate with a real base station.
  • the mobility management network element before step S301 is performed, the mobility management network element further needs to determine that the terminal device supports a paging message carrying a security-protected paging identifier, and support that the mobility management network element carries security.
  • the indication information of the paging message of the protected paging identifier is sent to the terminal device, so that the terminal device can determine, according to the instruction information sent by the mobility management network element, that the mobility management network element supports security protection. Paging message with paging identification.
  • the method for the mobile management network element and the terminal device to mutually determine that the other party supports a paging message carrying a security-protected paging identifier specifically includes the following steps:
  • the terminal device sends a registration request to the mobile management network element, where the registration request carries third instruction information, and the third instruction information is used to indicate that the terminal device supports a paging identifier that carries security protection. Paging message.
  • the mobility management network element receives a registration request sent by the terminal device.
  • the registration request may be an attach request or a tracking area update request (TAU request, where TAU is an abbreviation of trace area update); in a 5G network, it is a registration request.
  • TAU request a tracking area update request
  • 5G network it is a registration request.
  • the embodiment of the present application does not limit the specific format of the third indication information in the registration request, and the third indication information may carry a pre-existing information element of the registration request.
  • the third indication information may be carried in a reserved item of a UE network capability cell; or the third indication information may also be carried in the New cell in registration request.
  • the mobile management network element determines, according to the registration request, that the terminal device supports a paging message carrying a paging identifier for security protection.
  • the mobility management network element sends a registration acceptance message to the terminal device, wherein the registration acceptance message carries fourth indication information, and the fourth indication information is used to indicate that the mobility management network element supports carrying security
  • the paging message of the protected paging identifier, and the registration acceptance message is a response message to the registration request.
  • the terminal device receives a registration acceptance message sent by the mobility management network element.
  • the registration acceptance message is an attach accept message
  • the registration request is a TAU request
  • the registration accept message is a TAU accept message
  • the registration acceptance message is a registration accept message
  • the embodiment of the present application does not limit the specific format of the fourth indication information in the registration request, and the fourth indication information may be carried in the existing cell in the registration acceptance message.
  • the fourth indication information may be carried in the reserved item of the EPS network feature support cell; or, the fourth indication information may also be carried in The registration accept message is in a new cell.
  • the terminal device determines, according to the fourth instruction information, that the mobility management network element supports a paging message carrying a paging identifier for security protection.
  • the mobility management network element may perform security protection on the paging identity of the terminal device in the following five ways, but is not limited to:
  • the mobility management network element uses the security context negotiated between the mobility management network element and the terminal device to encrypt the paging identity of the terminal device.
  • Manner b The mobility management network element uses the security context negotiated between the mobility management network element and the terminal device to perform integrity protection on the paging identity of the terminal device.
  • Manner c The mobility management network element uses the security context negotiated by the mobility management network element and the terminal device to encrypt the paging identifier of the terminal device, and then protects the integrity of the encrypted paging identifier.
  • the mobility management network element uses the security context negotiated by the mobility management network element and the terminal device to perform integrity protection on the paging identity of the terminal device and perform anti-replay processing.
  • the mobility management network element uses the security context negotiated between the mobility management network element and the terminal device to encrypt the paging identifier of the terminal device, and then performs integrity protection on the encrypted paging identifier, and performs Anti-replay processing.
  • the security context includes a key required for encrypting and / or integrity protection of the paging identity of the terminal device and a corresponding encryption algorithm.
  • the terminal device may perform security protection processing on the first paging identifier in the following manner, but is not limited to obtaining the second paging identifier:
  • Method A When the mobility management network element uses the foregoing method a to secure the paging identity of the terminal device, the terminal device uses the security context agreed with the mobility management network element to the first The paging identifier is decrypted to obtain the second paging identifier.
  • Method B When the mobility management network element uses the foregoing method b to securely protect the paging identity of the terminal device, the terminal device uses the security context agreed with the mobility management network element to protect the first The paging identifier is subjected to integrity verification to obtain the second paging identifier.
  • Method C When the mobility management network element uses the foregoing method c to secure the paging identity of the terminal device, the terminal device uses the security context agreed with the mobility management network element to the first The paging identification is verified and decrypted to obtain the second paging identification.
  • Method D When the mobility management network element uses the foregoing method d to securely protect the paging identity of the terminal device, the terminal device uses the security context agreed with the mobility management network element to protect the first The paging identity is verified for integrity, the second paging identity is obtained, and anti-replay verification is performed.
  • Manner E When the mobility management network element uses the foregoing manner e to secure the paging identity of the terminal device, the terminal device uses the security context agreed with the mobility management network element to the first The paging identification is verified and decrypted to obtain the second paging identification, and anti-replay verification is performed.
  • the terminal device may specifically process the first paging message in any of the following ways:
  • Method 10 When the terminal device determines that the second paging identifier is consistent with the identity identifier of the terminal device, that is, when the terminal device determines that the second paging message is a paging message sent by a real base station, In response to the second paging message.
  • the terminal device when the second paging identifier is a fixed paging identifier and the second paging identifier is consistent with the identity identifier of the terminal device, the terminal device performs local registration and re-registers the process; When the second paging identifier is a temporary paging identifier, and the second paging identifier is consistent with the identity identifier of the terminal device, the terminal device sends a service request (service request) to the mobility management network element. ) To complete the service process.
  • service request service request
  • Method 2 ⁇ When the terminal device determines that the second paging identifier does not match the identity of the terminal device, that is, when the terminal device determines that the second paging message is not a paging message sent by a real base station, Ignore the second paging message.
  • the terminal device may not respond to the second paging message or directly discard the second paging message. Message.
  • the terminal device responds to the second paging when the second paging identifier is consistent with the identity of the terminal device. Message, when the second paging identifier is inconsistent with the identity identifier of the terminal device, ignoring the second paging message can effectively avoid a paging attack on the terminal device by a pseudo network.
  • the terminal device when the terminal device receives the second paging message carrying the first indication information, uses the security context negotiated with the mobility management network element to the second paging message.
  • the first paging identifier in the security protection processing is obtained to obtain a second paging identifier, and the second paging message is processed according to the second paging identifier and the identity of the terminal device. Only when the paging identifier is consistent with the identity of the terminal device, the second paging message is responded; otherwise, the paging message is ignored instead of responding after receiving the paging message, thereby avoiding false A paging attack on the terminal device by the network.
  • the mobility management network element is an AMF entity
  • the terminal device uses UE as an example.
  • the method includes the following steps:
  • the UE sends a registration request to the AMF entity.
  • the registration request includes third indication information, and the third indication information is used to indicate that the UE supports a paging message carrying a paging identifier for security protection.
  • the AMF entity receives the registration request.
  • the AMF entity determines, according to the third indication information in the registration request, that the UE supports a paging message carrying a paging identifier for security protection.
  • the AMF entity sends a registration message to the UE, where the registration message carries fourth indication information, and the fourth indication information is used to indicate that the AMF entity supports a paging identifier that carries security protection. Paging message.
  • the UE receives the registration message.
  • the UE may further send a registration complete message to the AMF entity.
  • S404 The UE determines, according to the fourth indication information in the registration, that the AMF entity supports a paging message that carries a paging identifier for security protection.
  • the UE determines that the AMF entity supports a paging message carrying a security-protected paging identifier, and the AMF entity determines that the UE supports a paging message that carries a security-protected paging identifier, Furthermore, the AMF entity can page the UE through a paging message carrying a paging identifier of security protection.
  • S405 When the AMF entity determines that it needs to communicate with the UE, use the security context negotiated with the UE to perform security protection on the paging identity of the UE to obtain a first paging identity;
  • the AMF entity sends a first paging message to the base station, where the first paging message includes the paging identifier of the UE and the first paging identifier.
  • the base station receives the first paging message.
  • the base station sends a second paging message to the UE, where the second paging message carries the first paging identifier and first indication information, and the first indication information is used to instruct the first
  • the paging ID is a security-protected paging ID.
  • the UE receives the second paging message.
  • the UE performs security protection processing on the first paging identifier using a security context negotiated with the AMF entity to obtain a second paging identifier.
  • S409 The UE determines whether the second paging identifier is consistent with the identity identifier of the UE. If yes, execute S410a, otherwise execute S410b.
  • S410a The UE responds to the second paging message.
  • S410b The UE ignores the second paging message.
  • step S411 may also be directly performed: the pseudo network sends a third paging message to the UE, and the third paging message does not carry the first indication information.
  • the UE After receiving the third paging message, the UE directly performs S412: ignore the third paging message.
  • the mobile management network element is an MME
  • the terminal device uses a UE as an example
  • the registration request sent by the UE uses an attach request as an example.
  • the method includes the following steps:
  • the UE sends an attach request to the MME.
  • the attachment request carries third indication information, and the third indication information is used to indicate that the UE supports a paging message carrying a paging identifier for security protection.
  • the MME receives the attach request.
  • the MME determines, according to the third indication information in the attach request, that the UE supports a paging message carrying a paging identifier for security protection.
  • the MME sends an attach message to the UE, where the attach message carries fourth indication information, and the fourth indication information is used to indicate that the MME supports a search for a paging identifier that carries security protection. Call message.
  • the UE receives the attach accept message sent by the MME.
  • the UE determines, according to the fourth indication information in the attach message, that the MME supports a paging message that carries a paging identifier for security protection.
  • the UE determines that the MME supports a paging message carrying a security-protected paging identifier, and the MME determines that the UE supports a paging message that carries a security-protected paging identifier, so that The MME may page the UE through a paging message carrying a paging identifier for security protection.
  • S505 The UE sends an attach complete message to the MME.
  • the MME receives the attach complete message.
  • S506 When the MME determines that it needs to communicate with the UE, it uses the security context negotiated with the UE to perform security protection on the paging identity of the UE to obtain a first paging identity.
  • the paging identifier of the UE may be IMSI or S-TMSI.
  • the MME sends a first paging message to the base station, where the first paging message includes the paging identifier of the UE and the first paging identifier.
  • the base station sends a second paging message to the UE, where the second paging message carries the first paging identifier and first indication information, and the first indication information is used to indicate the first
  • the paging ID is a security-protected paging ID.
  • the UE receives the second paging message.
  • the UE performs security protection processing on the first paging identifier by using a security context negotiated with the MME to obtain a second paging identifier.
  • S510 The UE determines whether the second paging identifier is consistent with the identity identifier of the UE. If yes, execute S511a, otherwise execute S511b.
  • S511a The UE responds to the second paging message.
  • S511b The UE ignores the second paging message.
  • step S512 may also be directly performed: the pseudo network sends a third paging message to the UE, and the third paging message does not carry the first indication information.
  • the UE After receiving the third paging message, the UE directly performs S513: ignore the third paging message.
  • the second paging processing method provided in this application can be applied to a scenario in which a network-side device needs to communicate with a terminal device when the terminal device is in an idle state.
  • the method includes the following steps:
  • S601 The terminal device counts the number of times a paging message is received within a first set time period.
  • S602 When the terminal device determines that the counted number of times of the paging message is greater than or equal to a first threshold, sending a data packet or a signaling packet to a base station for maintaining a communication connection with the base station.
  • the communication connection may be a signaling connection for transmitting signaling, or a data connection for transmitting data packets.
  • the terminal device when the terminal device receives the paging message and determines that the counted number of times of the paging message is less than the first threshold, the terminal device responds to the paging request. For example, when the paging message received by the terminal device carries an IMSI, and it is determined that the counted number of times of the paging message is less than the first threshold, the terminal device performs local registration and re-attaches the attach process, as in another example When the paging message received by the terminal device carries an S-TMSI, and when it is determined that the counted number of times of the paging message is less than the first threshold, the terminal device sends a service request to the MME to perform a service process.
  • the terminal device may determine that the number of times that the paging message is counted is greater than or equal to the first threshold in any of the following ways:
  • Method 1 When the paging message carries a fixed paging identifier, that is, when the paging message is a first-type paging message, the terminal device counts the number of times that the first-type paging message is received, It is determined that the counted number of times of the first type of paging message is greater than or equal to the first threshold.
  • the terminal device When the paging message carries a temporary paging identifier, that is, the paging message is a second-type paging message, the terminal device counts the number of times that the second-type paging message is received, It is determined that the counted number of times of the second type of paging message is greater than or equal to the first threshold.
  • the terminal device may separately count the number of times the first-type paging message is received and The number of times of the second type of paging message received, it is determined that the counted number of times of the first type of paging message is greater than or equal to the first threshold, and the number of times of the second type of paging message is greater than or equal to The first threshold; or the terminal device may count the sum of the number of times of the first type of paging message received and the number of times of the second type of paging message received to determine the statistics of the paging message The sum of the number of times is greater than or equal to the first threshold.
  • Manner 4 The terminal device counts the number of paging messages received from different base stations within the first set period of time, and determines that the number of paging messages received from any one base station is greater than or equal to the first threshold.
  • the terminal device sends a data packet or a signaling packet to the base station for maintaining a communication connection with the base station through the following steps: the terminal device is within a second set duration Sending a data packet or a signaling packet to the base station for maintaining a communication connection with the base station according to a set period, the set period is less than a second threshold, and the second threshold is the terminal device The length of time a communication connection with the base station is maintained.
  • the second threshold may be a timing duration of a UE inactivity timer of a base station specified by a protocol.
  • the terminal device sends a data packet or a signaling packet for maintaining a communication connection with the base station to the base station according to a set period, so that the terminal device is in a connected state for the second duration.
  • the terminal device When the terminal device is in a connected state, it will not respond to a paging message, so a paging attack on the terminal device by a pseudo network can be avoided.
  • the terminal device counts the number of times that the paging message is received within the first set time period, and when it is determined that the number of times of the counted paging message is greater than or equal to the first threshold, the terminal device sends a message to the base station.
  • the terminal device frequently sends a paging message, it does not respond to the paging message, which can avoid a paging attack on the terminal device by a pseudo network.
  • the third paging processing method provided in this application can be applied to a scenario in which a network-side device needs to communicate with a terminal device when the terminal device is in an idle state.
  • the method includes the following steps:
  • S701 The terminal device counts the number of times that the paging message carrying the temporary paging identifier is received within a set duration.
  • the terminal device may count the number of times a paging message carrying a temporary paging identifier is received within a timing period corresponding to the paging count timer.
  • the timing duration corresponding to the counting timer is the set duration.
  • the terminal device may start the paging count timer when receiving the first paging message carrying a temporary paging identifier, or start the paging count timer according to a preset period.
  • the mobility management network element receives the indication information sent by the terminal device for requesting allocation of a globally unique temporary identifier GUTI.
  • the mobility management network element allocates a GUTI to the terminal device according to the instruction information.
  • the mobile management network element assigning a GUTI to the terminal device is different from a temporary paging identifier carried in a paging message currently received by the terminal device.
  • the mobility management network element sends the GUTI to the terminal device.
  • the terminal device receives a GUTI sent by the mobility management network element.
  • the terminal device processes the paging message carrying the temporary paging identifier according to the received GUTI.
  • the terminal device when the terminal device receives the paging message carrying a temporary paging identifier, and determines that the number of times that the statistics of the paging message is less than the set threshold, the terminal device responds to the Paging request. For example, when the paging message received by the terminal device carries an S-TMSI, and it is determined that the number of times that the paging message counted is less than the set threshold, the terminal device sends a service request to the MME to perform a service process.
  • S-TMSI S-TMSI
  • the terminal device may obtain, through, but not limited to, any of the following methods, the indication information sent by the mobility management network element for requesting GUTI allocation:
  • Manner 1 The terminal device sends a location update request to the mobile management network element, and the location update request carries the instruction information for requesting allocation of a GUTI; after the mobile management network element receives the location update request Sending a location update acceptance message to the terminal device, where the location update acceptance message carries the allocated GUTI; the terminal device receives the location update acceptance message, and obtains the mobility management from the location update message The GUTI allocated by the network element to the terminal device.
  • the location update request is a TAU request
  • the corresponding location update acceptance message is a TAU accept message
  • the location update request is a registration request
  • the corresponding location update accept The message is a registration message.
  • the embodiment of the present application does not specifically carry the indication information for requesting allocation of GUTI in the location update request, and the GUTI allocated by the mobility management network element is in the location update acceptance message.
  • the specific carrying method is limited.
  • the indication information for requesting allocation of GUTI may be carried in a reserved item of an existing cell in the location update request, for example, the indication information for requesting allocation of GUTI is carried in EPS update in TAU request Type (EPS) update type cells; or, the indication information for requesting allocation of a GUTI may also be carried in a new cell of the location update request.
  • EPS TAU request Type
  • the GUTI allocated by the mobility management network element may be carried in the existing cell in the location update acceptance message, For example, the GUTI cell of the TAU / accept message and the 5G GUTI cell of the registration / accept message; when no cell for carrying the GUTI exists in the existing cell of the location update acceptance message, the mobile management network
  • the meta-assigned GUTI may be carried in a reserved item of an existing cell in the location update acceptance message, or the GUTI used for mobility management network element allocation may also be carried in a new location of the location update acceptance message. In the cell.
  • Manner 2 The mobile management network element sends a GUTI reallocation command to the terminal device, and the GUTI reallocation message carries the GUTI.
  • the terminal device receives the GUTI reallocation message sent by the mobile management network element, and obtains the GUTI allocated by the mobile management network element to the terminal device from the GUTI reallocation message.
  • Manner 3 The mobility management network element sends a configuration update (generic UE configuration update) message to the terminal device, and the configuration update message carries the GUTI.
  • the terminal device receives a configuration update message sent by the mobile management network element, and obtains, from the configuration update message, a GUTI allocated by the mobile management network element to the terminal device.
  • step S705 the processing, by the terminal device, the paging message carrying the temporary paging identifier according to the received GUTI specifically includes: determining, by the terminal device, the terminal device according to the received GUTI. The current temporary paging identifier; when the temporary paging identifier carried in the paging message received by the terminal device is consistent with the current temporary paging identifier of the terminal device, the terminal device responds to the paging message When the temporary paging identifier carried in the paging message received by the terminal device is inconsistent with the current temporary paging identifier of the terminal device, the terminal device ignores the paging message.
  • the terminal device when the temporary paging identifier carried in the paging message received by the terminal device is inconsistent with the current temporary paging identifier of the terminal device, the terminal device does not respond to the paging message or directly Discard the paging message.
  • the terminal device counts the number of times a paging message carrying a temporary paging identifier is received within a set period of time, and when it is determined that the counted number of times of the paging message is greater than or equal to a set threshold, Sending instruction information to a mobile management network element for requesting a global unique temporary identifier GUTI; after receiving the instruction information, the mobile management network element allocates a GUTI to the terminal device according to the instruction information, and The GUTI is sent to the terminal device, and the terminal device processes the paging message carrying the temporary paging identifier according to the GUTI allocated by the mobile network element.
  • the pseudo network cannot obtain the mobile management network element to assign a GUTI to the terminal device according to the instruction information, that is, the paging message sent by the pseudo network to the terminal device does not carry the mobile management network element for all
  • the paging identifier corresponding to the new GUTI allocated by the terminal device is described. Therefore, after obtaining the new GUTI allocated by the mobile management network element for the terminal device, the terminal device will not respond to the paging message sent by the pseudo network, which can be avoided.
  • the mobility management network element is an AMF entity
  • the terminal device uses UE as an example. As shown in FIG. 8, the method includes the following steps:
  • S801 The UE starts a paging count timer, and counts paging messages received within a timing period corresponding to the paging count timer, and the paging message carries a temporary paging identifier;
  • S802 The UE judges whether the counted number of paging messages is greater than or equal to the set threshold. If not, step 803 is performed, otherwise S805 is performed.
  • S803 The UE sends a service request to the AMF entity.
  • the AMF entity After receiving the service request, the AMF entity sends a service accept message to the UE to complete the service process.
  • S805 The UE sends a registration request to the AMF entity, and the registration request carries instruction information for requesting allocation of a GUTI.
  • S806 The AMF entity allocates a GUTI to the UE according to the indication information in the registration request for requesting a GUTI allocation.
  • the AMF entity sends a registration message to the UE, and the registration message carries the GUTI allocated by the AMF entity.
  • the UE After receiving the registration message, the UE processes the received paging message carrying the temporary paging identifier according to the GUTI allocated by the AMF entity.
  • the UE may further send a registration complete message to the AMF entity.
  • the mobile management network element is an MME
  • the terminal device is a UE.
  • the method includes the following steps:
  • S901 The UE starts a paging count timer, and counts paging messages received within a timing period corresponding to the paging count timer, and the paging message carries an S-TMSI;
  • S902 The UE judges whether the counted number of paging messages is greater than or equal to the set threshold. If not, step 903 is performed, otherwise S905 is performed.
  • S903 The UE sends a service request to the MME.
  • the MME After receiving the service request, the MME sends a service accept message to the UE to complete the service process.
  • the UE sends a TAU request to the MME, and the TAU request carries instruction information for requesting allocation of a GUTI.
  • the MME After receiving the TAU request, the MME allocates a GUTI to the UE according to the indication information in the TAU request for requesting a GUTI allocation.
  • the MME sends a TAU accept message to the UE, where the TAU accept message carries a GUTI allocated by the MME.
  • the UE After receiving the TAU accept message, the UE processes the received paging message carrying the S-TMSI according to the GUTI allocated by the MME.
  • the UE may further send a TAU complete message to the MME.
  • An embodiment of the present application provides a paging processing apparatus, and the terminal device is configured to implement functions of the terminal device in the paging processing method shown in FIG. 3 to FIG. 5.
  • the terminal device 1000 includes: a receiving unit 1001 and a processing unit 1002.
  • the receiving unit 1001 is configured to receive a first paging message, where the first paging message carries a first paging identifier and first indication information, and the first indication information is used to indicate the first paging message.
  • the identity is a security-protected paging identity.
  • the processing unit 1002 is configured to perform security protection processing on the first paging identifier according to the first instruction information using a security context negotiated with a mobile management network element to obtain a second paging identifier; and The second paging identifier and the identity of the terminal device process the first paging message.
  • the processing unit 1002 is specifically configured to: when it is determined that the second paging identifier is consistent with the identity of the terminal device, respond to the first paging message; or, determine the first paging message When the second paging identifier is inconsistent with the identity identifier of the terminal device, the first paging message is ignored.
  • the receiving unit 1001 is further configured to: receive a second paging message, and the second paging message does not carry the first indication information; and the processing unit 1002 is further configured to ignore all Said second paging message;
  • the receiving unit 1001 is further configured to receive a second paging message, where the second paging message carries a third paging identifier and second indication information, and the second indication information is used to indicate the The third paging identifier is plain text; the processing unit 1002 is further configured to ignore the second paging message.
  • the processing unit 1002 is further configured to determine that the mobility management network element supports a paging message carrying a security-protected paging identifier.
  • the paging processing device 1000 further includes a sending unit 1003, configured to send a registration request to the mobility management network element, where the registration request carries third instruction information, and the third instruction The information is used to indicate that the terminal device supports a paging message carrying a paging identifier of security protection;
  • the receiving unit 1001 is further configured to receive a registration acceptance message sent by the mobility management network element, where the registration acceptance message carries fourth indication information, and the fourth indication information is used to indicate that the mobility management network element supports A paging message carrying a paging identifier for security protection;
  • the processing unit 1002 is specifically configured to determine, according to the fourth instruction information, that the mobile management network element supports a paging message carrying a paging identifier for security protection.
  • the physical device corresponding to the receiving unit 1001 may be a receiver
  • the physical device corresponding to the processing unit 1002 may be a processor
  • the physical device corresponding to the sending unit 1003 may be a transmitter.
  • An embodiment of the present application provides a paging processing device that can use a security context negotiated with the mobility management network element when receiving a second paging message carrying the first indication information. , Performing security protection processing on the first paging identifier in the second paging message to obtain a second paging identifier, and processing the first paging identifier according to the second paging identifier and the identity identifier of the terminal device.
  • a second paging message and only when the second paging identifier is consistent with the identity of the terminal device, respond to the second paging message; otherwise, the paging message is ignored instead of receiving a search request
  • the call message responds, so that a paging attack on the paging processing device by a pseudo network can be avoided.
  • the paging processing device 1100 includes a processing unit 1101 and a sending unit 1102.
  • the processing unit 1101 is configured to use the security context negotiated with the terminal device to perform security protection on the paging identifier of the terminal device to obtain a security-protected paging identifier.
  • the sending unit 1102 is configured to send a paging message to a base station, where the paging message includes a paging identifier of the terminal device and the paging identifier of the security protection.
  • the processing unit 1101 before the processing unit 1101 uses the security context negotiated by the mobile management network element and a terminal device to securely protect the paging identity of the terminal device, it is further configured to determine the terminal The device supports paging messages that carry the paging identification of security protection;
  • the sending unit 1102 is further configured to send to the terminal device indication information of a paging message supported by the mobile management network element that carries a paging identifier of security protection.
  • the paging processing apparatus 1100 further includes a receiving unit 1103, configured to receive a registration request sent by the terminal device, where the registration request carries a paging that the terminal device supports security protection. Indication information of the identified paging message;
  • the processing unit 1101 is specifically configured to determine, according to the instruction information carried in the registration request, that the terminal device supports a paging message carrying a paging identifier for security protection;
  • the sending unit 1102 is specifically configured to send a registration acceptance message to the terminal device, where the registration acceptance message carries indication information of a paging message that the mobile management network element supports to carry a paging identifier for security protection.
  • the physical device corresponding to the processing unit 1101 may be a processor, the physical device corresponding to the sending unit 1102 may be a transmitter, and the physical device corresponding to the receiving unit 1103 may be a receiver.
  • An embodiment of the present application provides a paging processing apparatus that can use a security context negotiated with a terminal device to perform security protection on a paging identifier of the terminal device, and obtain a security-protected paging identifier. And sending a paging message to the base station, where the paging message includes the paging identifier of the terminal device and the paging identifier of the security protection, and the base station sends a search message carrying the security protection to the terminal device through the base station.
  • the paging message of the call identifier enables the terminal device to perform security protection processing on the security-protected paging identifier in the paging message after receiving the paging message sent by the base station.
  • the paging identifier of the terminal device and the identity identifier of the terminal device process the paging message sent by the base station, and respond only when the paging identifier after the desecurity protection processing is consistent with the identity identifier of the terminal device.
  • the paging message sent by the base station otherwise, the paging message sent by the base station is ignored instead of responding after receiving the paging message, so To avoid a paging attack on the terminal device by a pseudo network.
  • the paging processing device 1200 includes a receiving unit 1201, a processing unit 1202, and a sending unit 1203.
  • the receiving unit 1201 is configured to receive a first paging message sent by a mobile management network element, where the first paging message carries a first paging identifier and a second paging identifier, and the first paging identifier is The mobile management network element is obtained by performing security protection on the second paging identifier using a security context negotiated between the mobile management network element and a terminal device, and the second paging identifier is a paging of the terminal device. Identification
  • the processing unit 1202 is configured to determine the terminal device to be paged by the mobile management network element according to the second paging identifier
  • the sending unit 1203 is configured to send a second paging message to the terminal device, where the second paging message carries the first paging identifier and first indication information, and the first indication information is used to indicate The first paging identifier is a security-protected paging identifier.
  • the physical device corresponding to the receiving unit 1201 may be a receiver
  • the physical device corresponding to the processing unit 1202 may be a processor
  • the physical device corresponding to the sending unit 1203 may be a transmitter.
  • An embodiment of the present application provides a paging processing device.
  • the paging processing device can receive a first paging message sent by a mobile management network element, where the first paging message carries a first paging identifier and a second search message. Call identifier, and send a second paging message to the terminal device, the second paging message carrying the first paging identifier and first indication information, the first indication information is used to indicate the first
  • the paging identifier is a security-protected paging identifier, so that after receiving the second paging message, the terminal device performs security protection processing on the first paging identifier in the second paging message.
  • the second paging message is processed, and when the paging identifier after security protection processing is consistent with the identity identifier of the terminal device, Then, the second paging message is only responded; otherwise, the second paging message is ignored instead of responding after receiving the paging message, so that a paging attack on the terminal device by a pseudo network can be avoided.
  • the paging processing apparatus is configured to implement the paging processing method shown in FIG. 6.
  • the paging processing device 1300 includes a receiving unit 1301, a processing unit 1302, and a sending unit 1303.
  • the receiving unit 1301 is configured to receive a paging message.
  • the processing unit 1302 is configured to count the number of times of the paging message received within the first set duration; and determine that the number of times of the paging message counted is greater than or equal to the first threshold.
  • the sending unit 1303 is configured to send a data packet for maintaining a communication connection with the base station to the base station when the processing unit 1302 determines that the counted number of times of the paging message is greater than or equal to a first threshold. Or signaling packets.
  • the sending unit 1302 is specifically configured to: within a second set period of time, send a data packet or a message to the base station according to a set period to maintain a communication connection with the base station.
  • a command packet wherein the set period is less than a second threshold value, and the second threshold value is a duration for which a communication connection between the terminal device and the base station is maintained.
  • the paging message carries a fixed paging identifier, or the paging message carries a temporary paging identifier.
  • the paging message includes a first type of paging message and a second type of paging message, the first type of paging message carries a fixed paging identifier, and the second type of paging message It carries a temporary paging identifier; the number of times of paging messages counted by the terminal device is the sum of the number of times of the first type of paging message and the number of times of the second type of paging message received within the first set time period.
  • the processing unit 1302 separately counts the number of times a paging message is received from a different base station within the first set duration; and determines that the number of times a paging message is received from any one base station is greater than or Is equal to the first threshold.
  • the physical device corresponding to the receiving unit 1301 may be a receiver
  • the physical device corresponding to the processing unit 1302 may be a processor
  • the physical device corresponding to the sending unit 1303 may be a transmitter.
  • a paging processing device In the embodiment of the present application, a paging processing device is provided.
  • the paging processing device can count the number of times that a paging message is received within a first set period of time. When it is equal to the first threshold, a data packet or a signaling packet for maintaining a communication connection with the base station is sent to the base station, so that the paging processing device is in a connected state, because when the paging processing device is in a connection, It will not respond to the paging message during the state, so it can avoid paging attacks on the paging processing device by the pseudo network.
  • the paging processing apparatus is configured to implement a function of a terminal device in the paging processing method shown in FIG. 7 to FIG. 9.
  • the paging processing device 1400 includes a receiving unit 1401, a processing unit 1402, and a sending unit 1403.
  • the receiving unit 1401 is configured to receive a paging message carrying a temporary paging identifier.
  • the processing unit 1402 is configured to count the number of times a paging message carrying a temporary paging identifier is received within a set duration; and determine that the number of times of the paging message counted is greater than or equal to a set threshold.
  • the sending unit 1403 is configured to: when the processing unit 1402 determines that the counted number of times of the paging message is greater than or equal to a set threshold, send the instruction information to the mobile management network element for requesting a global unique temporary identifier GUTI .
  • the receiving unit 1401 is further configured to receive a GUTI sent by the mobility management network element.
  • the processing unit 1402 is further configured to process a paging message carrying a temporary paging identifier according to the GUTI received by the receiving unit 1401.
  • the sending unit 1403 is specifically configured to send a location update request to the mobility management network element, where the location update request carries the instruction information for requesting allocation of a GUTI;
  • the receiving unit 1401 is specifically configured to receive a location update acceptance message sent by the mobility management network element, where the location update acceptance message carries a GUTI allocated by the mobility management network element to the terminal device.
  • the receiving unit 1401 is specifically configured to receive a GUTI reallocation message sent by the mobile management network element, where the GUTI reallocation message carries the mobile management network element as the terminal GUTI allocated by the device; or receiving a configuration update message sent by the mobility management network element, where the configuration update message carries the GUTI allocated by the mobility management network element to the terminal device.
  • the physical device corresponding to the receiving unit 1401 may be a receiver
  • the physical device corresponding to the processing unit 1402 may be a processor
  • the physical device corresponding to the sending unit 1403 may be a transmitter.
  • An embodiment of the present application provides a paging processing device capable of counting the number of times a paging message carrying a temporary paging identifier is received within a set duration, and determining the statistics of the paging message.
  • the mobile terminal sends instruction information for requesting allocation of a globally unique temporary identifier GUTI to the mobile management network element.
  • the paging processing device After receiving the GUTI sent by the mobile management network element, the paging processing device The GUTI sent by the mobile network element processes a paging message carrying a temporary paging identity.
  • the pseudo network cannot obtain the mobile management network element to assign a GUTI to the terminal device according to the instruction information, that is, the paging message sent by the pseudo network to the terminal device does not carry the mobile management network element for all
  • the paging identifier corresponding to the new GUTI allocated by the terminal device is described. Therefore, after the call processing apparatus obtains the new GUTI sent by the mobile management network element, it will not respond to the paging message sent by the pseudo network, which can prevent the pseudo network from The paging attack of the call processing device is described.
  • An embodiment of the present application further provides a call processing apparatus, which is used to implement the paging processing method shown in FIG. 7 to FIG. 9.
  • the call processing apparatus 1500 includes: a receiving unit 1501, an allocating unit 1502, and a sending unit 1503.
  • the receiving unit 1501 is configured to receive instruction information sent by a terminal device and used to request allocation of a globally unique temporary identifier GUTI.
  • the allocating unit 1502 is used for the indication information to allocate a GUTI to the terminal device.
  • the sending unit 1503 is configured to send the GUTI to the terminal device.
  • the receiving unit 1501 is specifically configured to receive a location update request sent by the terminal device, where the location update request carries the instruction information for requesting allocation of a GUTI;
  • the sending unit 1503 is specifically configured to send a location update acceptance message to the terminal device, where the location update acceptance message carries the GUTI.
  • the sending unit 1503 is specifically configured to: send a GUTI reallocation message to the terminal device, where the GUTI reallocation message carries the GUTI; or send a configuration update to the terminal device Message, the configuration update message carries the GUTI.
  • the physical device corresponding to the receiving unit 1501 may be a receiver, the physical device corresponding to the allocation unit 1502 may be a processor, and the physical device corresponding to the sending unit 1503 may be a transmitter.
  • An embodiment of the present application provides a paging processing apparatus capable of receiving instruction information sent by a terminal device for requesting allocation of a globally unique temporary identifier GUTI, and allocating the terminal device according to the instruction information.
  • GUTI and send the allocated GUTI to the terminal device, so that the terminal device processes a paging message carrying a temporary paging identifier according to the GUTI allocated by the mobile network element.
  • the pseudo network cannot obtain the paging processing device to assign a GUTI to the terminal device according to the instruction information, that is, the paging message sent by the pseudo network to the terminal device does not carry the paging processing device as the destination.
  • the paging identifier corresponding to the new GUTI allocated by the terminal device is described. Therefore, after obtaining the new GUTI allocated by the paging processing device for the terminal device, the terminal device will not respond to the paging message sent by the pseudo network, which can be avoided.
  • the division of the units in the embodiments of the present application is schematic, and is only a logical function division. In actual implementation, there may be another division manner.
  • the functional modules in the embodiments of the present application may be integrated in one processing unit, or each unit may exist separately physically, or two or more units may be integrated in one unit.
  • the above integrated unit may be implemented in the form of hardware or in the form of software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially a part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium , Including a number of instructions for causing a computer device (which may be a personal computer, a server, or a network device) or a processor to perform all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage media include: U disks, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks, and other media that can store program codes .
  • FIG. 16 shows a simplified schematic diagram of a possible design structure of the terminal device involved in the foregoing embodiment.
  • the terminal device includes a transmitter 1601, a receiver 1602, a controller / processor 1603, a memory 1604, and a modem processor 1605.
  • the transmitter 1601 adjusts (for example, analog conversion, filtering, amplification, upconversion, etc.) the output samples and generates an uplink signal, which is transmitted to the base station described in the above embodiment via an antenna.
  • the antenna receives the downlink signal transmitted by the base station in the above embodiment.
  • the receiver 1602 conditions (eg, filters, amplifies, downconverts, and digitizes, etc.) a signal received from an antenna and provides input samples.
  • the encoder 1606 receives service data and signaling messages to be transmitted on the uplink, and processes (e.g., formats, encodes, and interleaves) the service data and signaling messages. .
  • the modulator 1607 further processes (e.g., symbol maps and modulates) the encoded service data and signaling messages and provides output samples.
  • a demodulator 1609 processes (e.g., demodulates) the input samples and provides symbol estimates.
  • a decoder 1608 processes (e.g., deinterleaves and decodes) the symbol estimates and provides decoded data and signaling messages sent to the UE.
  • the encoder 1606, the modulator 1607, the demodulator 1609, and the decoder 1608 may be implemented by a synthetic modem processor 1605. These units process according to the radio access technology (for example, the access technology of LTE and other evolved systems) adopted by the radio access network.
  • the controller / processor 1603 controls and manages the actions of the terminal device, and is configured to execute the processing performed by the terminal device in the foregoing embodiment. For example, it is used to control the terminal device to perform security protection processing on the first paging identifier according to the first instruction information carried in the second paging message, using the security context negotiated with the mobile management network element, to obtain a second search request.
  • the call identity processes the second paging message and / or other processes of the technology described in the present invention according to the second paging identity and the identity of the terminal device.
  • the controller / processor 1603 is used to support the terminal device to perform steps S304 and S305 in FIG. 3, steps S404, S408 to S410a (or S410b), and S412 in FIG.
  • steps S504, S504 in FIG. 5 S509 to S511a (or S511b) and S513, steps S601 and S602 in FIG. 6, steps S701, S702, and S705 in FIG. 7, steps S801, S802, S805, and S808 in FIG. 8, steps S901, S901 in FIG. 9, S902, S905, and S908.
  • the memory 1604 is configured to store program code and data related to the terminal device 1600.
  • the terminal device 1600 provided in the embodiment of the present application is used to implement the paging processing method shown in FIG. 3 to FIG. 5, or the paging processing method shown in FIG. 6, or the paging processing method shown in FIG. 7 to FIG. 9.
  • the functions of the terminal equipment in the illustrated paging processing method are described here only for the connection relationships between the various modules in the terminal equipment 1600.
  • the specific scheme and specific actions performed by the terminal equipment 1600 for processing paging messages Refer to the related description in the foregoing method embodiments, and details are not described herein again.
  • FIG. 17 shows a schematic diagram of a possible structure of a mobility management network element involved in the foregoing embodiment.
  • the mobile management network element 1700 includes a transmitter / receiver 1701, a controller / processor 1702, and a memory 1703.
  • the transmitter / receiver 1701 is configured to support transmitting and receiving information between a mobile management network element and the terminal device described in the foregoing embodiment, and to support radio communication between the terminal device and other terminal devices.
  • the controller / processor 1702 performs various functions for communicating with a terminal device.
  • the uplink signal from the terminal device is received via the antenna, mediated by the receiver 1701, and further processed by the controller / processor 1702 to recover the service data and information sent by the terminal device. ⁇ ⁇ Order information.
  • service data and signaling messages are processed by the controller / processor 1702 and mediated by the transmitter 1701 to generate a downlink signal and transmitted to the terminal device via the antenna.
  • the controller / processor 1702 also executes the processing processes related to the mobile management network element in FIG. 3 to FIG. 5 and FIG. 7 to FIG. 9 and / or other processes for the technology described in this application.
  • the memory 1703 is configured to store program code and data of a mobile management network element.
  • the mobility management network element 1700 may further include a communication unit 1704, which is configured to support the mobility management network element to communicate with other network entities. For example, it is used to support communication between the mobile management network element and other communication network entities shown in FIG. 1 (or FIG. 2), such as the SGSN, SGW, or PGW in FIG. 1, and the AUSF entity in FIG. 2 or SMF, etc.
  • the mobility management network element 1700 provided in the embodiment of the present application is used to implement the paging processing method shown in FIG. 3 to FIG. 5 or the mobility management network element in the paging processing method shown in FIGS. 7 to 9.
  • the functions of the mobile management network element 1700 are described here.
  • FIG. 18 shows a possible structural diagram of a base station involved in the foregoing embodiment.
  • the base station 1800 includes a transmitter / receiver 1801, a controller / processor 1802, and a memory 1803.
  • the transmitter / receiver 1801 is configured to support transmitting and receiving information between the mobile management network element and the terminal device described in the foregoing embodiment, and to support radio communication between the terminal device and other terminal devices.
  • the controller / processor 1802 performs various functions for communicating with a terminal device.
  • the uplink signal from the terminal device is received via the antenna, mediated by the receiver 1801, and further processed by the controller / processor 1802 to recover the service data and information sent by the terminal device. ⁇ ⁇ Order information.
  • service data and signaling messages are processed by the controller / processor 1802, and mediated by the transmitter 1801 to generate downlink signals, and transmitted to the terminal device via the antenna.
  • the controller / processor 1802 also executes the processing processes related to the mobile management network element in FIG. 3 to FIG. 5 and / or other processes for the technology described in this application.
  • the memory 1803 is configured to store program code and data of a mobile management network element.
  • the base station 1800 may further include a communication unit 1804.
  • the communication unit 1804 is configured to support a mobile management network element to communicate with other network entities. For example, it is used to support communication between the mobile management network element and other communication network entities shown in FIG. 1 (or FIG. 2), such as the SGSN, SGW, or PGW in FIG. 1, and the AUSF entity in FIG. 2 or SMF, etc.
  • the base station 1800 provided in the embodiment of the present application is used to implement the functions of the base station in the paging processing method shown in FIG. 3 to FIG. 5, and only the connections between the modules in the base station 1800 are performed here. The relationship is described.
  • the specific scheme of the base station 1800 for processing the paging message and the specific actions to be performed refer to the related description in the foregoing method embodiment, and details are not described herein again.
  • a fourth paging processing method is applied to a communication link between a terminal device and a first network device (access network device) in an inactive state, and the first When the communication link between the network device and the second network device (core network device) is in a connected state, that is, the terminal device and the access network device are in a radio resource control (radio resource control (RRC) INACTIVE) state,
  • RRC radio resource control
  • the first network device After the first network device receives the downlink data packet or the downlink signaling packet, it uses the security context negotiated by the first network device and the terminal device to securely protect the paging identifier of the terminal device to obtain the first paging identifier. .
  • the first network device may specifically be a base station (gNB) or TRP in a 5G network, or may be a base station in a future network.
  • the device that sends the downlink signaling packet or downlink data packet is a core network device.
  • the device that sends the downlink signaling packet may be a mobile management network element, such as an AMF entity in a 5G network, and the device that sends the downlink data packet. It can be a user plane management network element, such as a UPF entity in a 5G network.
  • the fact that the first network device can receive a downlink data packet or a downlink signaling packet indicates that the communication link between the first network device and the core network device is in a connected state at this time.
  • the paging identifier of the terminal device may be an inactive-radio network temporary identifier (I-RNTI) in an inactive state.
  • I-RNTI inactive-radio network temporary identifier
  • the first network device sends a first paging message to the terminal device, where the first paging message carries the first paging identifier and first indication information, and the first indication information is used to indicate The first paging identifier is a security-protected paging identifier.
  • the communication link between the first network device and the terminal device is in an inactive state.
  • the security context negotiated between the terminal device and the first network device is the security context of the RRC layer, and can be passed through the security context of the non-access stratum (NAS) (that is, the terminal device and mobile management
  • NAS non-access stratum
  • the terminal device receives the first paging message sent by the first network device.
  • S1903 When the state of the communication link between the terminal device and the first network device is inactive, the terminal device uses the security context negotiated with the first network device according to the first instruction information. De-secure and protect the first paging identifier to obtain a second paging identifier.
  • the terminal device and the first network device are in an RRC INACTIV state.
  • the terminal device processes the first paging message according to the second paging identifier and the identity of the terminal device.
  • the terminal device may further receive a second paging message, and the second paging message does not carry the first indication information; the terminal device ignores the second paging message; or The terminal device receives a second paging message, the second paging message carries a third paging identifier and second instruction information, and the second instruction information is used to indicate that the third paging identifier is in plain text; The terminal device ignores the second paging message.
  • the terminal device ignores the second paging message, which can avoid a paging attack on the terminal device by a pseudo network, so that the terminal device can normally communicate with the real network.
  • the first network device before receiving the downlink data packet or the downlink signaling packet, the first network device must also determine that both the terminal device and the second network device support a paging message that carries a paging identifier for security protection.
  • the determining, by the first network device, that the terminal device and the second network device both support a paging message carrying a paging identifier for security protection includes:
  • Step A The second network device sends instruction information to the first network device, and the instruction information sent by the second network device is used to indicate that the second network device and the terminal device support search for security protection. Calling paging message.
  • the first network device receives the indication information sent by the second network device.
  • Step B The first network device determines, according to the instruction information sent by the second network device, that the terminal device and the second network device support a paging message that carries a paging identifier for security protection.
  • the second network device Before the second network device sends instruction information to the first network device, the second network device also needs to determine that the terminal device supports a paging message that carries a paging identifier for security protection. After the second network device further determines that the terminal device supports a paging message that carries a security-protected paging identifier, and indicates that the second network device supports a paging message that carries a security-protected paging identifier, Sending to the terminal device, so that the terminal device can determine, according to the instruction information sent by the second network device, that the second network device supports a paging message carrying a paging identifier for security protection.
  • the method for the second network device and the terminal device to mutually determine that the other party supports a paging message carrying a paging identifier for security protection specifically includes the following steps:
  • the terminal device sends a registration request to the second network device, where the registration request carries third instruction information, and the third instruction information is used to indicate that the terminal device supports a paging identifier that carries security protection.
  • the second network device receives a registration request sent by the terminal device.
  • the registration request in the 5G network may be a registration request registration request message.
  • the embodiment of the present application does not limit the specific format of the third indication information in the registration request, and the third indication information may carry a pre-existing information element of the registration request. Leave item.
  • the second network device determines, according to the registration request, that the terminal device supports a paging message carrying a paging identifier for security protection.
  • the second network device may further send the first network device to indicate the second network device and the terminal.
  • the device supports indication information of a paging message carrying a paging identifier of security protection, so that the first network device determines that the terminal device and the second network device both support the paging message carrying a paging identifier of security protection.
  • the second network device may request an initial UE context setup request message through an initial user context establishment request, which will be used for
  • the indication information indicating that the second network device and the terminal device support a paging message carrying a paging identifier of security protection is sent to the first network device.
  • the second network device sends a registration acceptance message to the terminal device, where the registration acceptance message carries fourth instruction information, and the fourth instruction information is used to indicate that the second network device supports security protection. Paging message with paging identification.
  • the terminal device receives a registration acceptance message sent by the second network device.
  • the registration acceptance message is a registration accept message.
  • the embodiment of the present application does not limit the specific format of the fourth indication information in the registration request, and the fourth indication information may be carried in the existing cell in the registration acceptance message. Reserved.
  • the fourth indication information may be carried in a reserved item of a 5GS network feature support cell.
  • the terminal device determines, according to the fourth indication information, that the second network device supports a paging message carrying a paging identifier for security protection.
  • the first network device may perform security protection on the paging identity of the terminal device in any of the following ways:
  • Manner 1 The first network device uses the security context negotiated between the first network device and the terminal device to encrypt the paging identity of the terminal device; or
  • the first network device uses the security context negotiated by the first network device and a terminal device to perform integrity protection on the paging identity of the terminal device; or,
  • Manner 3 The first network device uses the security context negotiated by the first network device and the terminal device to encrypt the paging identifier of the terminal device, and then protects the integrity of the encrypted paging identifier; or
  • the first network device uses the security context negotiated by the first network device and the terminal device to perform integrity protection on the paging identity of the terminal device and perform anti-replay processing; or,
  • the first network device uses the security context negotiated between the first network device and the terminal device to encrypt the paging identification of the terminal device, and then performs integrity protection on the encrypted paging identification, and performs Anti-replay processing.
  • the security context includes a key required for encrypting and / or integrity protection of the paging identity of the terminal device and a corresponding encryption algorithm.
  • the terminal device may perform security protection processing on the first paging identifier by using, but not limited to, the following methods to obtain a second paging identifier:
  • Method 1 When the first network device adopts the foregoing method 1 to perform security protection on the paging identity of the terminal device, the terminal device uses the security context agreed with the first network device to protect the first network device. Decrypt the paging identifier to obtain the second paging identifier; or
  • Manner 2 When the first network device uses the above Manner 2 to secure the paging identity of the terminal device, the terminal device uses the security context agreed with the first network device to protect the first network device. Perform integrity verification on the paging identifier to obtain the second paging identifier; or
  • Manner 3 When the first network device uses the above Manner 3 to secure the paging identity of the terminal device, the terminal device uses the security context agreed with the first network device to the first network device. Performing paging identification integrity verification and decryption to obtain the second paging identification; or
  • Manner 4 When the first network device uses the above Manner 4 to secure the paging identity of the terminal device, the terminal device uses the security context agreed with the first network device to the first network device. Perform paging identification integrity verification, obtain the second paging identification, and perform anti-replay verification; or,
  • Manner 5 When the first network device uses the above Manner 5 to secure the paging identity of the terminal device, the terminal device uses the security context agreed with the first network device to the first network device. Perform integrity verification and decryption on the paging identifier, obtain the second paging identifier, and perform anti-replay verification; or
  • the terminal device may specifically process the first paging message in any of the following ways:
  • Method I When the terminal device determines that the first paging identifier is consistent with the identity identifier of the terminal device, that is, when the terminal device determines that the first paging message is a paging message sent by a real network, it responds The first paging message; or
  • Method II When the terminal device determines that the first paging identifier is inconsistent with the identity identifier of the terminal device, that is, when the terminal device determines that the first paging message is not a paging message sent by a real network, the terminal device ignores The first paging message.
  • the terminal device may not respond to the first paging message or directly discard the first paging message. Message.
  • the terminal device Since the pseudo network cannot obtain the security context negotiated between the terminal device and the first network device, the terminal device responds to the first when the second paging identifier is consistent with the identity identifier of the terminal device. When the paging message is inconsistent with the identity identifier of the terminal device, ignoring the first paging message can effectively avoid a paging attack on the terminal device by a pseudo network.
  • the terminal device receives a first paging message sent by a first network device, where the first paging message carries a first paging identifier and is used to indicate that the first paging identifier is security-protected.
  • First indication information of a paging identifier if a communication link between the terminal device and a first network device is in an inactive state, the terminal device uses a security context negotiated with the first network device to The first paging identifier in the first paging message is subjected to de-security protection processing to obtain a second paging identifier, and the first paging message is processed according to the second paging identifier and the identity identifier of the terminal device.
  • the first network device is a gNB
  • the second network device is an AMF entity
  • the terminal device UE is taken as an example.
  • the method includes the following steps:
  • the UE sends a registration request message to the AMF entity.
  • the registration request message carries third indication information, and the third indication information is used to indicate that the UE supports a paging message carrying a paging identifier for security protection.
  • the AMF entity receives the registration request message.
  • the AMF entity determines, according to the third indication information in the registration request message, that the UE supports a paging message carrying a paging identifier for security protection.
  • the AMF sends an initial UE context setup request message to the gNB.
  • the initial user context establishment request initial UE context setup request message carries a paging identifier used to indicate that the AMF and the UE support security protection. Instructions for the paging message.
  • the gNB receives the initial UE context setup request message.
  • the gNB determines, according to the indication information carried in the initial UE context and setup request message, the AMF and the paging message that the UE supports to carry a paging identifier for security protection.
  • the AMF entity sends a registration message to the UE, where the registration message carries fourth indication information, and the fourth indication information is used to indicate that the AMF entity supports a paging identifier that carries security protection. Paging message.
  • the UE receives the registration message.
  • a protocol data unit (PDU) session is established between the UE and the network side to enable data transmission.
  • PDU protocol data unit
  • the UE may further send a registration complete message to the AMF entity.
  • the UE determines, according to the fourth indication information in the registration, that the AMF entity supports a paging message that carries a paging identifier for security protection.
  • the UE determines that the AMF entity supports a paging message carrying a security-protected paging identifier, and the AMF entity determines that the UE supports a paging message that carries a security-protected paging identifier,
  • the gNB may determine that the AMF and the UE support a paging message carrying a security-protected paging identifier, so that the gNB is in an inactive state when a communication link between the gNB and the UE is in an inactive state,
  • the UE may be paged through a paging message carrying a paging identifier for security protection.
  • the UPF entity sends a downlink data packet to the gNB.
  • the gNB receives a downlink data packet sent by the UPF.
  • S2008 The gNB uses the security context negotiated with the UE to perform security protection on the paging identifier of the UE to obtain a first paging identifier.
  • the gNB sends a first paging message to the UE, where the first paging message carries the first paging identifier and first indication information.
  • the UE receives the first paging message.
  • S2010 When the communication link between the UE and the gNB is in an inactive state, the UE uses the security context negotiated with the gNB to identify the first paging identifier according to the first instruction information. The security protection processing is performed to obtain a second paging identifier.
  • S2011 The UE determines whether the second paging identifier is consistent with the identity identifier of the UE. If yes, execute S2012a, otherwise execute S2012b.
  • S2012a The UE responds to the first paging message.
  • step S2013 may also be directly performed: the pseudo network sends a second paging message to the UE, and the second paging message does not carry the first indication information.
  • the UE After receiving the second paging message, the UE directly performs S2014: ignoring the second paging message.
  • each network element such as a terminal device and a first network device, includes a hardware structure corresponding to each function and / Or software modules.
  • this application can be implemented in hardware or a combination of hardware and computer software. Whether a certain function is performed by hardware or computer software-driven hardware depends on the specific application and design constraints of the technical solution. A professional technician can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.
  • the functional modules of the terminal device and the first network device may be divided according to the foregoing method example.
  • each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or software functional modules. It should be noted that the division of the modules in the embodiments of the present application is schematic, and is only a logical function division. In actual implementation, there may be another division manner.
  • FIG. 21 shows a possible composition example of the paging processing apparatus involved in the foregoing and embodiments.
  • FIG. 1 shows that the paging processing apparatus can execute the fourth part of the present application. Steps performed by the terminal device in any possible implementation manner of the method embodiment.
  • the paging processing device is a terminal device or a paging processing device that supports the terminal device to implement the method provided in the fourth method embodiment.
  • the paging processing device may be a chip system.
  • the paging processing apparatus may include a receiving unit 2101 and a processing unit 2102.
  • the receiving unit 2101 is configured to support a paging processing apparatus to execute a method described in a fourth method embodiment of the present application.
  • the receiving unit 2101 is configured to execute or support a paging processing device to perform S1902 in the paging processing method shown in FIG. 19 and S2005, S2009, and S2013 in the paging processing method shown in FIG. 20.
  • the processing unit 2102 is configured to support the paging processing device to execute S1903 and S1904 in the paging processing method in FIG. 19 and S2006, S2010, S2011, S2012a, S2012b, and S2014 in the paging processing method shown in FIG. 20.
  • the paging processing apparatus may further include a sending unit 2103.
  • the sending unit 2103 is configured to support the paging processing apparatus to execute S2001 in the paging processing method shown in FIG. 20.
  • the paging processing device provided in the embodiment of the present application is configured to execute the method in any of the foregoing embodiments, and thus can achieve the same effect as the method in the foregoing embodiment.
  • the physical device corresponding to the receiving unit may be a receiver, the physical device corresponding to the sending unit may be a transmitter, and the physical device corresponding to the processing unit may be a processor.
  • FIG. 22 shows a possible composition example of the paging processing apparatus involved in the foregoing and embodiments.
  • FIG. 2 shows that the paging processing can execute the fourth type of the present application. Steps performed by the first network device in any possible implementation manner of the method embodiment.
  • the paging processing device is a first network device or a paging processing device that supports the first network device to implement the method provided in the fourth method embodiment.
  • the paging processing device may be a chip system.
  • the paging processing apparatus may include a receiving unit 2201, a processing unit 2202, and a sending unit 2203.
  • the receiving unit 2201 is configured to support a paging processing apparatus to execute a method described in a fourth method embodiment of the present application.
  • the receiving unit 2201 is configured to execute or support a paging processing device to perform S1901 in the paging processing method shown in FIG. 19 and S2003 and S2007 in the paging processing method shown in FIG. 20.
  • the processing unit 2202 is configured to support the paging processing device to execute S1901 in the paging processing method in FIG. 19 and S2004 and S2008 in the paging processing method shown in FIG. 20.
  • the sending unit 2203 is configured to support the paging processing device to execute S1902 in the paging processing method of FIG. 19 and S2009 in the paging processing method shown in FIG. 20.
  • the paging processing device provided in the embodiment of the present application is configured to execute the method in any of the foregoing embodiments, and thus can achieve the same effect as the method in the foregoing embodiment.
  • the physical device corresponding to the receiving unit may be a receiver, the physical device corresponding to the sending unit may be a transmitter, and the physical device corresponding to the processing unit may be a processor.
  • FIG. 23 shows a simplified schematic diagram of a possible design structure of a terminal device involved in the foregoing fourth method embodiment.
  • the terminal device includes a transmitter 2301, a receiver 2302, a controller / processor 2303, a memory 2304, and a modem processor 2305.
  • the transmitter 2301 adjusts (for example, analog conversion, filtering, amplification, up-conversion, etc.) the output samples and generates an uplink signal, which is transmitted to the base station described in the above embodiment via an antenna.
  • the antenna receives the downlink signal transmitted by the base station in the above embodiment.
  • the receiver 2302 conditions (eg, filters, amplifies, downconverts, and digitizes, etc.) a signal received from an antenna and provides input samples.
  • the encoder 2306 receives service data and signaling messages to be transmitted on the uplink, and processes (e.g., formats, encodes, and interleaves) the service data and signaling messages. .
  • the modulator 2307 further processes (e.g., symbol maps and modulates) the encoded service data and signaling messages and provides output samples.
  • a demodulator 2309 processes (e.g., demodulates) the input samples and provides symbol estimates.
  • a decoder 2308 processes (e.g., deinterleaves and decodes) the symbol estimates and provides decoded data and signaling messages sent to the UE.
  • the encoder 2306, the modulator 2307, the demodulator 2309, and the decoder 2308 may be implemented by a synthetic modem processor 2305. These units process according to the radio access technology (for example, the access technology of LTE and other evolved systems) adopted by the radio access network.
  • the controller / processor 2303 controls and manages the actions of the terminal device, and is configured to execute the processing performed by the terminal device in the foregoing embodiment. For example, it is used to control the terminal device to perform security protection processing on the first paging identifier according to the first instruction information carried in the second paging message, using the security context negotiated with the mobile management network element, to obtain a second search request.
  • the call identity processes the second paging message and / or other processes of the technology described in the present invention according to the second paging identity and the identity of the terminal device.
  • the controller / processor 2303 is configured to support the terminal device to perform steps S1903 and S1904 in FIG. 19 and steps S2006, S2010, S2011, S2012a, S2012b, and S2014 in FIG. 20.
  • the memory 2304 is configured to store program code and data related to the terminal device 2300.
  • terminal device 2300 provided in the embodiment of the present application is used to implement the functions of the terminal device in the paging handler shown in FIG. 19 and FIG. 20, and only the modules of the terminal device 2300 are described here. The connection relationship between them is described.
  • the specific scheme of the terminal device 2300 for processing the paging message and the specific actions to be performed refer to the related description in the foregoing method embodiment, and details are not described herein again.
  • FIG. 24 shows a possible structure diagram of the first network device involved in the foregoing embodiment.
  • the first network device 2400 includes a transmitter / receiver 2401, a controller / processor 2402, and a memory 2403.
  • the transmitter / receiver 2401 is configured to support sending and receiving information between the first network device and the terminal device described in the foregoing embodiment, and to support radio communication between the terminal device and other terminal devices.
  • the controller / processor 2402 performs various functions for communicating with a terminal device.
  • the uplink signal from the terminal device is received via the antenna, mediated by the receiver 2401, and further processed by the controller / processor 2402 to recover the service data and information sent by the terminal device. ⁇ ⁇ Order information.
  • the service data and signaling messages are processed by the controller / processor 2402, and mediated by the transmitter 2401 to generate a downlink signal, and transmitted to the terminal device via the antenna.
  • the controller / processor 2402 also executes the processing processes related to the first network device in FIG. 19 and FIG. 20 and / or other processes for the technology described in this application.
  • the memory 2403 is configured to store program code and data of the first network device.
  • the first network device 2400 may further include a communication unit 2404.
  • the communication unit 2404 is configured to support the first network device to communicate with other network entities. For example, it is used to support communication between the first network device and other communication network entities shown in FIG. 2, such as an AUSF entity or an SMF in FIG. 2.
  • the first network device 2400 provided in the embodiment of the present application is used to implement the function of the first network device in the paging processing method shown in FIG. 19 and FIG. 20, and only the first network is provided here.
  • the connection relationship between the various modules in the device 2400 is described.
  • the example of the present application provides a paging processing method and device.
  • the key information paging identifier in the paging message is protected by security, or after the terminal device frequently receives the paging message,
  • the device stays connected for a certain period of time, or obtains a new GUTI from the mobile management network element, to increase the difficulty of the paging attack of the pseudo network on the center device, which can avoid the paging attack of the pseudo device on the terminal device and reduce the terminal
  • the unnecessary power consumption of the device improves the user experience.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to work in a specific manner such that the instructions stored in the computer-readable memory produce a manufactured article including an instruction device, the instructions
  • the device implements the functions specified in one or more flowcharts and / or one or more blocks of the block diagram.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of steps can be performed on the computer or other programmable device to produce a computer-implemented process, which can be executed on the computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more flowcharts and / or one or more blocks of the block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供了一种寻呼处理方法及装置，以解决现有技术中终端设备容易受到伪网络的寻呼攻击的问题。所述方法包括：移动管理网元使用与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行安全保护，得到第一寻呼标识，向基站发送第一寻呼消息；所述基站向所述终端设备发送第二寻呼消息，所述第二寻呼消息携带所述第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识；所述终端设备根据所述第一指示信息，使用所述安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识，根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第二寻呼消息。

Description

一种寻呼处理方法及装置
本申请要求于2018年5月24日提交中国专利局、申请号为201810510941.8、申请名称为“一种寻呼处理方法及装置”的中国专利申请的优先权，以及于2019年1月18日提交中国专利局、申请号为201910047972.9、申请名称为“一种寻呼处理方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及无线通信技术领域，尤其涉及一种寻呼处理方法及装置。
背景技术
基站寻呼(paging)终端设备时所使用的寻呼信道是公共信道，寻呼信道上承载的信息都是以明文(未进行安全保护)方式传输，因此终端设备无法区分寻呼消息是伪网络发送的还是真实基站发送的，在接收到寻呼消息之后都会正常响应。
伪网络通过提高自身的发射能量，吸引终端设备驻留到伪网络后，能够获取到终端设备的寻呼标识，并且伪网络可以通过终端设备获取真实基站的系统信息，对真实基站的系统信息进行分析计算，并结合获取到的寻呼标识，得到真实基站发送寻呼消息的时域信息，其中，伪网络具有基站以及移动管理网元的功能。伪网络获得真实基站发送寻呼消息的时域信息以及终端设备的寻呼标识后，能够将自己伪装成真实基站，在真实基站向终端设备发送寻呼消息的时域上，频繁向终端设备发起寻呼消息，对终端设备进行寻呼攻击，影响终端设备与网络侧的正常通信。
发明内容
本申请提供一种寻呼处理方法及装置，以解决现有技术中终端设备容易受到伪网络的寻呼攻击的问题。
第一方面，本申请提供了一种寻呼处理方法，所述方法包括：终端设备接收第一寻呼消息，所述第一寻呼消息中携带第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识；所述终端设备根据所述第一指示信息，使用与移动管理网元协商的安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识，并根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第一寻呼消息。
通过上述方法，所述终端设备在接收到第一寻呼消息时，使用与移动管理网元协商的安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识，并根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第一寻呼消息，而不是接收到寻呼消息就响应，因而可以避免伪网络对所述终端设备的寻呼攻击。
一个可能的实施方式中，在4G网络中，所述移动管理网元可以是移动管理实体MME；在5G网络中，所述移动管理网元可以是接入与移动管理功能AMF实体。
一个可能的实施方式中，所述终端设备具体通过以下方法处理所述第一寻呼消息：
所述终端设备确定所述第二寻呼标识与所述终端设备的身份标识一致时，响应所述第 一寻呼消息；或者，
所述终端设备确定所述第二寻呼标识与所述终端设备的身份标识不一致时，忽略所述第一寻呼消息。
由于伪网络无法获得所述终端设备与移动管理网元协商的安全上下文，因此所述终端设备在所述第二寻呼标识与所述终端设备的身份标识一致时，响应所述第一寻呼消息，在所述第二寻呼标识与所述终端设备的身份标识不一致时，忽略所述第一寻呼消息，可以有效避免伪网络对所述终端设备的寻呼攻击。
一个可能的实施方式中，所述终端设备还可以接收第二寻呼消息，所述第二寻呼消息中没有携带所述第一指示信息；所述终端设备忽略所述第二寻呼消息；或者，
所述终端设备还可以接收第二寻呼消息，所述第二寻呼消息中携带第三寻呼标识和第二指示信息，且所述第二指示信息用于指示所述第三寻呼标识为明文；所述终端设备忽略所述第二寻呼消息。
由于伪网络发送给的寻呼消息中携带的寻呼标识通常不会进行安全保护处理，也不会携带所述第一指示信息，即伪网络发送的寻呼消息通常为所述第二寻呼消息，因此，所述终端设备忽略所述第二寻呼消息，可以避免伪网络对所述终端设备的寻呼攻击，进而使得所述终端设备可以与真实基站正常通信。
一个可能的实施方式中，所述终端设备接收第一寻呼消息之前，还确定所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息。
一个可能的实施方式中，所述终端设备具体通过以下步骤确定所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息：
所述终端设备向所述移动管理网元发送注册请求，所述注册请求中携带第三指示信息，所述第三指示信息用于指示所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
所述终端设备接收所述移动管理网元发送的注册接受消息，所述注册接受消息中携带第四指示信息，所述第四指示信息用于指示所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息；
所述终端设备根据所述第四指示信息，确定所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息。
一个可能的实施方式中，在4G网络中，所述注册请求可以为附着请求(attach request)或跟踪区域更新请求(TAU request)；在5G网络中为registration request。相应地，当所述注册请求为附着请求时，所述注册接受消息为附着接收(attach accept)消息，当所述注册请求为跟踪区域更新请求时，所述注册接受消息为跟踪区域更新接受(TAU accept)消息，当所述注册请求为registration request时，所述注册接受消息为registration accept消息。
第二方面，本申请提供了一种寻呼处理方法，所述方法包括：移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行安全保护，得到安全保护的寻呼标识，并向基站发送寻呼消息，所述寻呼消息中包括所述终端设备的寻呼标识以及所述安全保护的寻呼标识。
通过上述方法，所述移动管理网元使用与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行安全保护，得到安全保护的寻呼标识，并向基站发送携带所述终端设备的寻呼标识以及所述安全保护的寻呼标识的寻呼消息，使得所述基站可以向所述终端设备发送携带安全保护的寻呼标识的寻呼消息，可以增加所述终端设备接收到的寻呼消息的安 全性，进而可以避免伪网络对所述终端设备的寻呼攻击。
一个可能的实施方式中，在4G网络中，所述移动管理网元可以是移动管理实体MME；在5G网络中，所述移动管理网元可以是接入与移动管理功能AMF实体。
一个可能的实施方式中，所述移动管理网元可以通过以下方式对所述终端设备的寻呼标识进行安全保护：所述移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行加密，或者进行完整性保护，或者进行加密以及完整性保护，或者进行完整性保护以及抗重放处理，或者进行加密、完整性保护以及抗重放处理。
一个可能的实施方式中，所述移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行安全保护之前，还确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息；将所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息的指示信息，发送给所述终端设备。
一个可能的实施方式中，所述移动管理网元通过以下步骤确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息：接收所述终端设备发送的注册请求，所述注册请求中携带所述终端设备支持携带安全保护的寻呼标识的寻呼消息的指示信息；根据所述注册请求中携带的所述指示信息，确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息。此时，所述移动管理网元通过向所述终端设备发送注册接受消息，将移动管理网元支持携带安全保护的寻呼标识的寻呼消息的指示信息，发送给所述终端设备，其中，所述注册接受消息中携带所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息的指示信息。
一个可能的实施方式中，在4G网络中，所述注册请求可以为附着请求(attach request)或跟踪区域更新请求(TAU request)；在5G网络中为registration request。相应地，当所述注册请求为附着请求时，所述注册接受消息为附着接收(attach accept)消息，当所述注册请求为跟踪区域更新请求时，所述注册接受消息为跟踪区域更新接受(TAU accept)消息，当所述注册请求为registration request时，所述注册接受消息为registration accept消息。
第三方面，本申请提供了一种寻呼处理方法，所述方法包括：基站接收移动管理网元发送的第一寻呼消息，所述第一寻呼消息携带第一寻呼标识以及第二寻呼标识，所述第一寻呼标识为所述移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述第二寻呼标识进行安全保护后得到的，所述第二寻呼标识为所述终端设备的寻呼标识；所述基站向所述终端设备发送第二寻呼消息，所述第二寻呼消息携带所述第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识。
通过上述方法，所述基站接收移动管理网元发送的第一寻呼消息，根据所述第一寻呼消息中的第二寻呼标识，确定所要寻呼的终端设备，并向所述终端设备发送第二寻呼消息，所述第二呼消息中携带所述第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识，可以增加所述终端设备接收到的第二寻呼消息的安全性，进而可以避免伪网络对所述终端设备的寻呼攻击。
一个可能的实施方式中，在4G网络中，所述移动管理网元可以是移动管理实体MME；在5G网络中，所述移动管理网元可以是接入与移动管理功能AMF实体。
第四方面，本申请提供了一种寻呼处理方法，所述方法包括：终端设备接收第一网络设备发送的第一寻呼消息，所述第一寻呼消息中携带第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识；所述终端设备与所述 第一网络设备之间通信链路的状态为未激活态时，所述终端设备根据所述第一指示信息，使用与所述第一网络设备协商的安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识，并根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第一寻呼消息。
通过上述方法，终端设备接在所述终端设备与第一网络设备之间的通信链路为未激活态时，根据所述第一网络设备发送的第一寻呼消息中的第一指示信息，使用与所述第一网络设备协商的安全上下文，对所述第一寻呼消息中的第一寻呼标识进行解安全保护处理，得到第二寻呼标识，根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第一寻呼消息，在所述第二寻呼标识与所述终端设备的身份标识一致的情况下，才响应所述第一寻呼消息，否则，忽略所述寻呼消息，而不是接收到寻呼消息就响应，因而可以避免伪网络对所述终端设备的寻呼攻击。
一个可能的实施方式中，所述终端设备可以通过以下方法处理所述第一寻呼消息，：所述终端设备确定所述第二寻呼标识与所述终端设备的身份标识一致时，响应所述第一寻呼消息；或者，所述终端设备确定所述第二寻呼标识与所述终端设备的身份标识不一致时，忽略所述第一寻呼消息。
由于伪网络无法获得所述终端设备与第一网络设备协商的安全上下文，因此所述终端设备在所述第二寻呼标识与所述终端设备的身份标识一致时，响应所述第一寻呼消息，在所述第二寻呼标识与所述终端设备的身份标识不一致时，忽略所述第一寻呼消息，可以有效避免伪网络对所述终端设备的寻呼攻击。
一个可能的实施方式中，所述方法还包括：所述终端设备接收第二寻呼消息，所述第二寻呼消息中没有携带所述第一指示信息；所述终端设备忽略所述第二寻呼消息；或者，所述终端设备接收第二寻呼消息，所述第二寻呼消息中携带第三寻呼标识和第二指示信息，且所述第二指示信息用于指示所述第三寻呼标识为明文；所述终端设备忽略所述第二寻呼消息。
由于伪网络发送给的寻呼消息中携带的寻呼标识通常不会进行安全保护处理，也不会携带所述第一指示信息，即伪网络发送的寻呼消息通常为所述第二寻呼消息，因此，所述终端设备忽略所述第二寻呼消息，可以避免伪网络对所述终端设备的寻呼攻击，进而使得所述终端设备可以与真实网络正常通信。
一个可能的实施方式中，所述终端设备接收第一寻呼消息之前，还所述终端设备确定第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
一个可能的实施方式中，所述终端设备可以通过以下方法确定第二网络设备支持携带安全保护的寻呼标识的寻呼消息：所述终端设备向所述第二网络设备发送注册请求，所述注册请求中携带第三指示信息，所述第三指示信息用于指示所述终端设备支持携带安全保护的寻呼标识的寻呼消息；所述终端设备接收所述第二网络设备发送的注册接受消息，所述注册接受消息中携带第四指示信息，所述第四指示信息用于指示所述第二网络设备支持携带安全保护的寻呼标识的寻呼消息；所述终端设备根据所述第四指示信息，确定所述第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
第五方面，本申请提供了一种寻呼处理方法，所述方法包括：第一网络设备接收到下行数据包或者下行信令包后，使用所述第一网络设备与终端设备协商的安全上下文，对终端设备的寻呼标识进行安全保护，得到安全保护的寻呼标识，并向所述终端设备发送寻呼 消息，所述寻呼消息携带所述安全保护的寻呼标识以及用于指示所述携带的寻呼标识为安全保护的寻呼标识的指示信息。
通过上述方法，在第一网络设备与终端设备之间的通信链路处于未激活态时，所述第一网络设备使用与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行安全保护，得到安全保护的寻呼标识，并向所述终端设备发送携带所述终端设备的寻呼标识以及所述安全保护的寻呼标识的寻呼消息，可以增加所述终端设备接收到的寻呼消息的安全性，进而可以避免伪网络对所述终端设备的寻呼攻击。
一个可能的实施方式中，所述第一网络设备可以通过以下方式对所述终端设备的寻呼标识进行安全保护：所述第一网络设备使用所述第一网络设备与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行加密，或者进行完整性保护，或者进行加密以及完整性保护，或者进行完整性保护以及抗重放处理，或者进行加密、完整性保护以及抗重放处理。
一种可能的实施方式中，所述第一网络设备接收到下行数据包或者下行信令包之前，还确定所述终端设备以及第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
一种可能的实施方式中，所述第一网络设备具体通过以下步骤确定所述终端设备以及第二网络设备支持携带安全保护的寻呼标识的寻呼消息：所述第一网络设备接收所述第二网络设备发送的指示信息，所述第二网络设备发送的指示信息用于指示所述第二网络设备以及所述终端设备支持携带安全保护的寻呼标识的寻呼消息；所述第一网络设备根据所述第二网络设备发送的指示信息，确定所述终端设备以及第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
第六方面，本申请提供了一种寻呼处理方法，所述方法包括：终端设备统计在第一设定时长内接收的寻呼消息的次数，在确定统计的所述寻呼消息的次数大于或等于第一阈值时，向基站发送用于维持与所述基站之间的通信连接的数据包或信令包。
通过上述方法，所述终端设备统计在第一设定时长内接收的寻呼消息的次数，在确定统计的所述寻呼消息的次数大于或等于第一阈值时，向基站发送用于维持与所述基站之间的通信连接的数据包或信令包，使得所述终端设备处于连接态，由于终端设备处于连接态时不会响应寻呼消息，因此可以避免伪网络对所述终端设备的寻呼攻击。
一个可能的实施方式中，所述终端设备通过以下方式向所述基站发送用于维持与所述基站之间的通信连接的数据包或信令包：所述终端设备在第二设定时长内，按照设定周期向所述基站发送用于维持与所述基站之间的通信连接的数据包或信令包；其中，所述设定周期小于第二阈值，所述第二阈值为所述终端设备与所述基站之间的通信连接维持的时长。
通过上述方法，所述终端设备按照设定周期向所述基站发送用于维持与所述基站之间的通信连接的数据包或信令包，使得所述终端设备在所述第二时长内处于连接态，由于终端设备处于连接态时不会响应寻呼消息，因此，可以避免伪网络对所述终端设备的寻呼攻击。
一个可能的实施方式中，所述寻呼消息中携带固定寻呼标识，或者所述寻呼消息中携带临时寻呼标识。
一个可能的实施方式中，所述寻呼消息包括第一类寻呼消息和第二类寻呼消息，所述第一类寻呼消息中携带固定寻呼标识，所述第二类寻呼消息中携带临时寻呼标识；所述终 端设备统计的寻呼消息的次数为在所述第一设定时长内接收的第一类寻呼消息的次数以及第二类寻呼消息的次数之和。
一个可能的实施方式中，所述终端设备分别统计在所述第一设定时长内从不同基站接收的寻呼消息的次数，所述终端设备在确定从任意一个基站接收的寻呼消息的次数大于或等于所述第一阈值时，向所述基站发送用于维持与所述基站之间的通信连接的数据包或信令包。
第七方面，本申请提供了一种寻呼处理方法，所述方法包括：终端设备统计在设定时长内接收的携带临时寻呼标识的寻呼消息的次数，在确定统计的所述寻呼消息的次数大于或等于设定阈值时，向移动管理网元发送用于请求分配全球唯一临时标识GUTI的指示信息；所述终端设备接收所述移动管理网元发送的GUTI，根据接收到的GUTI，处理携带临时寻呼标识的寻呼消息。
通过上述方法，所述终端设备统计在设定时长内接收的携带临时寻呼标识的寻呼消息的次数，在确定统计的所述寻呼消息的次数大于或等于设定阈值时，向移动管理网元发送用于请求分配全球唯一临时标识GUTI的指示信息，并接收所述移动管理网元分配的GUTI，根据所述移动网元分配的GUTI，处理携带临时寻呼标识的寻呼消息。由于伪网络无法获得所述移动管理网元根据所述指示信息，为所述终端设备分配GUTI，即伪网络发送给所述终端设备的寻呼消息中不会携带所述移动管理网元为所述终端设备分配的新GUTI，因此所述终端设备获得所述移动管理网元为所述终端设备分配的新GUTI后，不会响应伪网络发送的寻呼消息，进而可以避免伪网络对所述终端设备的寻呼攻击。
一个可能的实施方式中，在4G网络中，所述移动管理网元可以是移动管理实体MME；在5G网络中，所述移动管理网元可以是接入与移动管理功能AMF实体。
一个可能的实施方式中，所述终端设备向移动管理网元通过以下方式发送用于请求分配GUTI的指示信息：所述终端设备向所述移动管理网元发送位置更新请求，所述位置更新请求中携带所述用于请求分配GUTI的指示信息。此时，所述终端设备通过以下方式接收所述移动管理网元发送的GUTI：所述终端设备接收所述移动管理网元发送的位置更新接受消息，所述位置更新接受消息中携带所述移动管理网元为所述终端设备分配的GUTI。
一个可能的实施方式中，在4G网络中，所述位置更新请求为跟踪区域更新请求(TAU request)；在5G网络中，所述位置更新请求为registration request。相应地，当所述位置更新请求为跟踪区域更新请求时，所述位置更新接受消息为跟踪区域更新接受(TAU accept)消息，当所述位置更新请求为registration request时，所述位置更新接受消息为registration accept消息。
一个可能的实施方式中，所述终端设备通过以下方式接收所述移动管理网元发送的GUTI：
所述终端设备接收所述移动管理网元发送的GUTI重分配消息，其中，所述GUTI重分配消息中携带所述移动管理网元为所述终端设备分配的GUTI；或者，
所述终端设备接收所述移动管理网元发送的配置更新消息，其中，所述配置更新消息中携带所述移动管理网元为所述终端设备分配的GUTI。
一个可能的实施方式中，所述终端设备具体通过以下步骤处理携带临时寻呼标识的寻呼消息：所述终端设备根据接收到的GUTI，确定所述终端设备当前的临时寻呼标识；当所述终端设备接收到的寻呼消息中携带的临时寻呼标识，与所述终端设备当前的临时寻呼 标识一致时，所述终端设备响应所述寻呼消息，当所述终端设备接收到的寻呼消息中携带的临时寻呼标识，与所述终端设备当前的临时寻呼标识不一致时，所述终端设备忽略所述寻呼消息。
第八方面，本申请提供了一种寻呼处理方法，所述方法包括：移动管理网元接收终端设备发送的用于请求分配全球唯一临时标识GUTI的指示信息，根据所述指示信息，为所述终端设备分配GUTI，并将所述GUTI发送给所述终端设备。
通过上述方法，所述移动管理网元可以根据所述终端设备发送的用于请求分配全球唯一临时标识GUTI的指示信息，为所述终端设备分配GUTI，并将所述GUTI发送给所述终端设备，使得所述终端设备可以根据所述移动管理网元分配的GUTI，处理携带临时寻呼标识的寻呼消息。由于伪网络无法获得所述移动管理网元为所述终端设备分配GUTI，即伪网络发送给所述终端设备的寻呼消息中不会携带所述移动管理网元为所述终端设备分配的新GUTI，因此所述终端设备获得所述移动管理网元为所述终端设备分配的新GUTI后，不会响应伪网络发送的寻呼消息，进而可以避免伪网络对所述终端设备的寻呼攻击。
一个可能的实施方式中，在4G网络中，所述移动管理网元可以是移动管理实体MME；在5G网络中，所述移动管理网元可以是接入与移动管理功能AMF实体。
一个可能的实施方式中，所述移动管理网元通过以下方式接收终端设备发送的用于请求分配全球唯一临时标识GUTI的指示信息：所述移动管理网元接收所述终端设备发送的位置更新请求，所述位置更新请求中携带所述用于请求分配GUTI的指示信息。此时，所述移动管理网元通过以下方式将所述GUTI发送给所述终端设备：所述移动管理网元向所述终端设备发送位置更新接受消息，所述位置更新接受消息中携带所述GUTI。
一个可能的实施方式中，在4G网络中，所述位置更新请求为跟踪区域更新请求(TAU request)；在5G网络中，所述位置更新请求为registration request。相应地，当所述位置更新请求为跟踪区域更新请求时，所述位置更新接受消息为跟踪区域更新接受(TAU accept)消息，当所述位置更新请求为registration request时，所述位置更新接受消息为registration accept消息。
一个可能的实施方式中，所述移动管理网元通过以下方式将所述GUTI发送给所述终端设备：所述移动管理网元向所述终端设备发送GUTI重分配消息，所述GUTI重分配消息中携带所述GUTI；或者，所述移动管理网元向所述终端设备发送配置更新消息，所述配置更新消息中携带所述GUTI。
第九方面，本申请提供了一种终端设备，所述终端设备具有实现上述第一方面方法实例中终端设备行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
一种可能的实施方式中，所述终端设备的结构中包括接收单元、发送单元和处理单元，这些单元可以执行上述第一方面的方法示例中的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
一种可能的实施方式中，所述终端设备的结构中包括发射器、接收器、控制器/处理器和调制解调处理器，所述控制器/处理器被配置为支持所述终端设备执行上述第一方面提供的方法中相应的功能。所述存储器与所述控制器/处理器耦合，其保存所述终端设备必要的程序指令和数据。
第十方面，本申请提供了一种移动管理网元，所述移动管理网元具有实现上述第二方 面方法实例移动管理网元行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
一种可能的实施方式中，所述移动管理网元的结构中包括接收单元、发送单元和处理单元，这些单元可以执行上述第二方面的方法示例中的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
一种可能的实施方式中，所述移动管理网元的结构中包括接收器/接收器、控制器/处理器、存储器以及通信单元，所述控制器/处理器被配置为支持所述移动管理网元执行上述第二方面提供的方法中相应的功能。所述存储器与所述控制器/处理器耦合，其保存所述移动管理网元必要的程序指令和数据。
第十一方面，本申请提供了一种基站，所述基站具有实现上述第三方面方法实例基站行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
一种可能的实施方式中，所述基站的结构中包括接收单元和发送单元，这些单元可以执行上述第三方面的方法示例中的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
一种可能的实施方式中，所述基站的结构中包括接收器/接收器、控制器/处理器、存储器以及通信单元，所述控制器/处理器被配置为支持所述移动管理网元执行上述第三方面提供的方法中相应的功能。所述存储器与所述控制器/处理器耦合，其保存所述基站必要的程序指令和数据。
第十二方面，本申请提供了一种终端设备，所述终端设备具有实现上述第四方面方法实例中终端设备行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
一种可能的实施方式中，所述终端设备的结构中包括接收单元和处理单元，这些单元可以执行上述第四方面的方法示例中的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
一种可能的实施方式中，所述终端设备的结构中包括发射器、接收器、控制器/处理器和调制解调处理器，所述控制器/处理器被配置为支持所述终端设备执行上述第四方面提供的方法中相应的功能。所述存储器与所述控制器/处理器耦合，其保存所述终端设备必要的程序指令和数据。
第十三方面，本申请提供了一种网络设备，所述网络设备具有实现上述第五方面方法实例第一网络设备行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
一种可能的实施方式中，所述网络设备的结构中包括接收单元、处理单元和发送单元，这些单元可以执行上述第五方面的方法示例中的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
一种可能的实施方式中，所述网络设备的结构中包括接收器/接收器、控制器/处理器、存储器以及通信单元，所述控制器/处理器被配置为支持所述网络设备执行上述第五方面提供的方法中相应的功能。所述存储器与所述控制器/处理器耦合，其保存所述网络设备必要的程序指令和数据。
第十四方面，本申请提供了一种终端设备，所述终端设备具有实现上述第六方面方法 实例中终端设备行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
一种可能的实施方式中，所述终端设备的结构中包括接收单元和处理单元，这些单元可以执行上述第六方面的方法示例中的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
一种可能的实施方式中，所述终端设备的结构中包括发射器、接收器、控制器/处理器和调制解调处理器，所述控制器/处理器被配置为支持所述终端设备执行上述第六方面提供的方法中相应的功能。所述存储器与所述控制器/处理器耦合，其保存所述终端设备必要的程序指令和数据。
第十五方面，本申请提供了一种终端设备，所述终端设备具有实现上述第七方面方法实例中终端设备行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
一种可能的实施方式中，所述终端设备的结构中包括接收单元、发送单元和处理单元，这些单元可以执行上述第七方面的方法示例中的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
一种可能的实施方式中，所述终端设备的结构中包括发射器、接收器、控制器/处理器和调制解调处理器，所述控制器/处理器被配置为支持所述终端设备执行上述第七方面提供的方法中相应的功能。所述存储器与所述控制器/处理器耦合，其保存所述终端设备必要的程序指令和数据。
第十六方面，本申请提供了一种移动管理网元，所述移动管理网元具有实现上述第八方面方法实例移动管理网元行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
一种可能的实施方式中，所述移动管理网元的结构中包括接收单元、发送单元和分配单元，这些单元可以执行上述第八方面的方法示例中的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
一种可能的实施方式中，所述移动管理网元的结构中包括接收器/接收器、控制器/处理器、存储器以及通信单元，所述控制器/处理器被配置为支持所述移动管理网元执行上述第八方面提供的方法中相应的功能。所述存储器与所述控制器/处理器耦合，其保存所述移动管理网元必要的程序指令和数据。
第十七方面，本申请提供了一种通信系统，所述通信系统包括上述第一方面所述的终端设备、上述第二方面所述的移动管理网元以及所述第三方面所述的基站。
第十八方面，本申请提供了一种通信系统，所述通信系统包括上述第一方面所述的终端设备、上述第四方面所述的移动管理网元以及所述第五方面所述的网络设备。
第十九方面，本申请还提供了一种通信系统，所述通信系统包括上述第七方面所述的终端设备以及所述第八方面所述的移动管理网元。
第二十方面，本申请还提供一种计算机可读存储介质，所述计算机存储介质上存储有计算机可执行指令，当所述指令在计算机上运行时，使得所述计算机执行上述任一方面的任意一种实施方式提供的方法。
第二十一方面，本申请还提供了一种包含指令的计算机程序产品，当所述指令在计算机上运行时，使得计算机执行上述任一方面中的任一种方法。
附图说明
图1为本申请实施例提供的4G网络架构的示意图；
图2为本申请实施例提供的5G网络架构的示意图；
图3为本申请实施例提供的第一种寻呼处理方法的流程示意图；
图4为本申请具体实施例一的方法流程示意图；
图5为本申请具体实施例二的方法流程示意图；
图6为本申请实施例提供的第二种寻呼处理方法的流程示意图；
图7为本申请实施例提供的第三种寻呼处理方法的流程示意图；
图8为本申请具体实施例三的方法流程示意图；
图9为本申请具体实施例四的方法流程示意图；
图10为本申请实施例提供的一种寻呼处理装置的结构示意图；
图11为本申请实施例提供的一种寻呼处理装置的结构示意图；
图12为本申请实施例提供的一种寻呼处理装置的结构示意图；
图13为本申请实施例提供的一种寻呼处理装置的结构示意图；
图14为本申请实施例提供的一种寻呼处理装置的结构示意图；
图15为本申请实施例提供的一种寻呼处理装置的结构示意图；
图16为本申请实施例提供的一种终端设备的结构示意图；
图17为本申请实施例提供的一种移动管理网元的结构示意图；
图18为本申请实施例提供的一种基站的结构示意图；
图19为本申请实施例提供的第四种寻呼处理方法的流程示意图；
图20为本申请具体实施例五的方法流程示意图；
图21为本申请实施例提供的一种寻呼处理装置的结构示意图；
图22为本申请实施例提供的一种寻呼处理装置的结构示意图；
图23为本申请实施例提供的一种终端设备的结构示意图；
图24为本申请实施例提供的一种第一网络设备的结构示意图。
具体实施方式
现有技术中终端设备无法区分寻呼消息是伪网络发送的还是真实基站发送的，在接收到寻呼消息之后都会正常响应，当终端设备接收到的寻呼消息中携带国际移动用户标识(international mobile subscriber identity，IMSI)时，终端设备先进行本地注册，再重新附着，当终端设备接收到的寻呼消息中携带临时移动用户标识(temporary international mobile subscriber identity，S-TMSI)时，终端设备向移动管理网元发起业务(service)流程。
当伪网络频繁向终端设备发送携带IMSI的寻呼消息时，终端设备就会频繁地进行本地去注册以及重新附着，导致用户无法获得正常服务。当伪网络频繁向终端设备发送携带S-TMSI的寻呼消息时，终端设备就会频繁地在空闲态和连接态之间切换，增加终端设备的功耗，降低终端设备的续航能力，进而影响用户体验。
为了解决现有技术中存在的上述问题，本申请提供一种寻呼处理方法及装置。其中，本申请所述方法和装置基于同一发明构思，由于所述方法和所述装置解决问题的原理相似，因此所述装置与方法的实施可以相互参见，重复之处不再赘述。
以下，对本申请实施例涉及部分用语进行解释说明，以便于本领域技术人员理解。
(1)IMSI，是区别移动用户的标志，储存在用户识别模块(subscriber identity module，SIM)卡或者全球用户身份模块(universal subscriber identity module，USIM)卡中。IMSI由移动国家码(mobile country code，MCC)、移动网络号码(mobile network code，MNC)和移动用户识别号码(mobile subscriber identification number，MSIN)组成。
其中，MCC的资源由国际电信联盟(international telecommunication union，ITU)在全世界范围内统一分配和管理，唯一识别移动用户所属的国家。MNC用于识别移动用户所归属的移动通信网。在同一个国家内，如果有多个公共陆地移动网(public land mobile network，PLMN)，一般某个国家的一个运营商对应一个PLMN，可以通过MNC来进行区别，即每一个PLMN都要分配唯一的MNC。MSIN用于识别某一移动通信网中的移动用户。
(2)全球唯一临时标识(global unique temporary identity，GUTI)，由核心网(core network，CN)分配，在网络中唯一标识终端设备，可以减少IMSI或IMEI等用户私有参数暴露在网络传输中。
(3)注册请求，在第四代移动通信技术(4th-generation，4G)网络中指附着请求(attach request)或跟踪区域更新请求(TAU request)；在第五代移动通信技术(5th-generation，5G)网络中，即为注册请求(registration request)。
(4)安全保护，包括加密，完整性保护，加密与完整性保护相结合，完整性保护与抗重放处理相结合，或者加密与完整性保护、抗重放处理相结合等方式。发送端或者接收端按照双方约定的安全上下文对数据进行安全保护处理，使得对端通过所述约定的安全上下文对获得数据进行解安全保护处理，对获得的数据的安全性进行验证，以增加数据传输的安全性。
(5)解安全保护，包括解密，完整性验证，解密和完整性验证、完整性验证和抗重放验证，或者解密、完整性验证和抗重放验证等，为安全保护的逆过程，用于验证安全保护的数据的安全性。
(6)位置更新请求，在4G网络中指TAU request，在5G网络中指registration request。
(7)和/或，描述关联对象的关联关系，表示可以存在三种关系。例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
另外，需要理解的是，在本申请的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。
本申请提供的寻呼处理方法既适用于4G网络架构，也适用于5G网络架构，以及未来的演进通信网络中。本申请适用的一种可能的网络架构，如图1所示，该网络架构为4G网络架构。该4G网络架构中的网元包括终端设备和移动管理实体(mobility management entity，MME)，图1中以终端设备为用户设备(user equipment，UE)为例。网络架构还包括服务GPRS支持节点(serving GPRS support node，SGSN)、归属签约服务器(home subscriber server，HSS)、服务网关(serving gateway，S-GW)、分组数据网络网关(packet data network gateway，PDN gateway，P-GW)、策略与计费规则功能(policy and charging rules function，PCRF)实体、演进的通用陆基无线接入网(evolved universal terrestrial radio access network，E-TURAN)等。
E-UTRAN由多个演进基站(evolved nodeB，eNodeB)组成，eNodeB之间通过X2接口 彼此互联，eNodeB与演进分组核心网(evolved packet core，EPC)之间通过S1接口交互，而eNodeB与UE通过长期演进(long term evolution，LTE)-Uu互联。
MME的主要功能是支持非接入层(non access stratum，NAS)信令及其安全、跟踪区域(track area，TA)列表的管理、P-GW和S-GW的选择、跨MME切换时进行MME的选择、在向2G/3G接入系统切换过程中进行SGSN的选择、用户的鉴权、漫游控制以及承载管理、第三代合作伙伴计划(3rd generation partnership project，3GPP)不同接入网络的核心网络节点之间的移动性管理。
S-GW是终止于E-UTRAN接口的网关，其主要功能包括：进行基站间切换时，作为本地锚定点，并协助完成基站的重排序功能；在3GPP不同接入系统间切换时，作为移动性锚点；执行合法侦听功能；进行数据包的路由和前转；在上行和下行传输层进行分组标记；用于运营商间的计费等。
P-GW是面向PDN终结于SGi接口的网关，如果UE访问多个PDN，UE将对应一个或多个P-GW。P-GW的主要功能包括基于用户的包过滤功能、合法侦听功能、UE的网络之间互连的协议(internet protocol，IP)地址分配功能、在上行链路中进行数据包传送级标记、进行上下行服务等级计费以及服务水平门限的控制、进行基于业务的上下行速率的控制等。
HSS是用于存储用户签约信息的数据库，归属网络中可以包含一个或多个HSS。HSS负责保存跟用户相关的信息，例如用户标识、编号和路由信息、安全信息、位置信息、概要(Profile)信息等。
SGSN可以用于2G/3G和E-UTRAN 3GPP接入网间移动时，进行信令交互，包括对P-GW和S-GW的选择，同时为切换到E-UTRAN 3GPP接入网的用户进行MME的选择。
PCRF实体终结于Rx接口和Gx接口，非漫游场景时，在HPLMN中只有一个PCRF跟UE的一个IP连通性接入网络(ip-connectivity access network)，IP-CAN会话相关；在漫游场景并且业务流是本地疏导时，可能会有两个PCRF跟一个UE的IP-CAN会话相关。
本申请适用的另一种可能的网络架构示意图，如图2所示，该网络架构为5G网络架构。该5G网络架构中的网元包括终端设备以及接入与移动管理功能(access and mobility management function，AMF)实体，图2中以终端设备为UE为例。网络架构还包括无线接入网(radio access network，RAN)、用户面功能(user plane function，UPF)实体、数据网络(data network，DN)、会话管理功能(session management function，SMF)实体、认证服务功能实体(authentication server function，AUSF)、统一数据管理(unified data management，UDM)实体、策略控制功能(policy control function，PCF)实体(图2中未示出)、应用功能(application function，AF)实体(图2中未示出)以及认证信任状存储和处理功能(authentication credential repository and processing function，ARPF)实体(图2中未示出)等。
RAN的主要功能是控制用户通过无线接入到移动通信网络。RAN是移动通信系统的一部分。它实现了一种无线接入技术。从概念上讲，它驻留某个设备之间(如移动电话、一台计算机，或任何远程控制机)，并提供与其核心网的连接。RAN设备包括但不限于：5G中的(g nodeB，gNB)、eNodeB、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元 (baseband unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、移动交换中心等，此外，还可以包括无线保真(wireless fidelity，wifi)接入点(access point，AP)等。
AMF实体负责终端的接入管理和移动性管理，在实际应用中，其包括了LTE中网络框架中MME里的移动性管理功能，并加入了接入管理功能。
SMF实体负责会话管理，如用户的会话建立等。
UPF实体是用户面的功能网元，主要负责连接外部网络，其包括了LTE的服务网关(serving gateway，SGW)和公用数据网网关(public data network GateWay，PDN-GW)的相关功能。
DN负责为终端提供服务的网络，如一些DN为终端提供上网功能，另一些DN为终端提供短信功能等等。SEAF实体用于完成对UE的认证过程，在5G中，SEAF的功能可以合并到AMF实体中。
AUSF实体具有鉴权服务功能，用于终结SEAF请求的认证功能。AMF网元负责终端的接入管理和移动性管理，在实际应用中，其包括了LTE中MME的移动性管理功能，并加入了接入管理功能。
ARPF实体具有认证凭证存储和处理功能，用于存储用户的长期认证凭证，如永久密钥K等。在5G中，ARPF的功能可以合并到UDM实体中。
UDM实体可存储用户的签约信息，实现类似于4G中的HSS的后端。
本申请中的终端设备，是一种具有无线收发功能的设备，可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。所述终端设备可以是手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。
如图3所示，本申请提供的第一种寻呼处理方法，应用于在终端设备处于空闲态时，网络侧设备需要与终端设备进行通信的场景下，适用于上述图1所示的4G通信系统以及图2所示的5G通信系统。所述方法包括以下步骤：
S301：移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行安全保护，得到第一寻呼标识。
其中，所述终端设备的寻呼标识(paging UE identity或者UE paging identity)可以是固定寻呼标识(即固定不变的寻呼标识)，例如4G网络中的IMSI，5G网络中的用户永久标识(subscription permanent identifier，SUPI)或用户隐藏标识(subscription concealed identifier，SUCI)；所述终端设备的寻呼标识也可以是所述移动管理网元分配的临时寻呼标识，例如4G网络中的S-TMSI，5G网络中的5G-S-TMSI。
需要说明的是，本申请并不对所述移动管理网元进行限定，所述移动管理网元可以是4G网络中的MME，也可以是5G网络中的AMF实体，还可以是未来通信网络中的具有移动管理功能的网元。
S302：所述移动管理网元向基站发送第一寻呼消息，所述第一寻呼消息中包括所述终 端设备的寻呼标识以及所述第一寻呼标识。
其中，在4G网络中所述基站可以是eNB、宏基站、微基站(也称为“小基站”)、微微基站、AP、TP、BSC、BTS、BBU、RNC、家庭基站或移动交换中心等，在5G网络中所述基站可以是上述4G网络中的任意一个设备，也可以是gNB或TRP等。所述基站也可以是未来网络中的基站。
相应地，所述基站接收所述移动管理网元发送的第一寻呼消息。
S303：所述基站向所述终端设备发送第二寻呼消息，所述第二寻呼消息携带所述第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识。
相应地，所述终端设备接收所述第二寻呼消息。
一个可能的实施方式中，携带所述第一指示信息的第二寻呼消息也可以是伪网络发送的。当所述第一寻呼消息是伪网络发送的时，所述第一寻呼标识是所述伪网络使用某种安全上下文(由于所述伪网络无法获得所述终端设备与移动管理网元协商的安全上下文，因此伪网络所使用的安全上下文和所述终端设备与所述移动管理网元协商的安全上下文不同)，对所述终端设备的寻呼标识进行安全保护得到的。
S304：所述终端设备根据所述第一指示信息，使用与移动管理网元协商的安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识。
S305：所述终端设备根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第二寻呼消息。
一个可能的实施方式中，所述终端设备还可以接收第三寻呼消息，其中，所述第三寻呼消息中没有携带所述第一指示信息，或者所述第三寻呼消息中携带第三寻呼标识和第二指示信息，且所述第二指示信息用于指示所述第三寻呼标识为明文；所述终端设备忽略所述第二寻呼消息。
由于伪网络发送给的寻呼消息中携带的寻呼标识通常不会进行安全保护处理，也不会携带所述第一指示信息，即伪网络发送的寻呼消息通常为所述第三寻呼消息，因此，所述终端设备忽略所述第三寻呼消息，可以避免伪网络对所述终端设备的寻呼攻击，进而使得所述终端设备可以与真实基站正常通信。
一个可能的实施方式中，在执行步骤S301之前，所述移动管理网元还要确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息，并将所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息的指示信息，发送给所述终端设备，使得所述终端设备能够根据所述移动管理网元发送的指示信息，确定所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息。
其中，所述移动管理网元与所述终端设备互相确定对方支持携带安全保护的寻呼标识的寻呼消息的方法具体包括以下步骤：
i、所述终端设备向所述移动管理网元发送注册请求，所述注册请求中携带第三指示信息，所述第三指示信息用于指示所述终端设备支持携带安全保护的寻呼标识的寻呼消息。
相应地，所述移动管理网元接收所述终端设备发送的注册请求。
其中，在4G网络中，所述注册请求可以是附着请求(attach request)或跟踪区域更新请求(TAU request，其中TAU为trace area update的缩写)；在5G网络中为registration request。
需要说明的是，本申请实施例并不对所述第三指示信息在所述注册请求中的具体格式 进行限定，所述第三指示信息可以携带在所述注册请求中现有的信元的预留项中，例如，当所述注册请求为attach request时，所述第三指示信息可以携带在UE network capability信元的预留项中；或者，所述第三指示信息也可以携带在所述注册请求的新信元中。
ii、所述移动管理网元根据所述注册请求，确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息。
iii、所述移动管理网元向所述终端设备发送注册接受消息，其中，所述注册接受消息中携带第四指示信息，所述第四指示信息用于指示所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息，所述注册接受消息为所述注册请求的响应消息。
相应地，所述终端设备接收所述移动管理网元发送的注册接受消息。
其中，当所述注册请求为attach request时，所述注册接受消息为附着接受(attach accept)消息，当所述注册请求为TAU request时，所述注册接受消息为TAU接受(TAU accept)消息，当所述注册请求为registration request时，所述注册接受消息为registration accept消息。
需要说明的是，本申请实施例并不对所述第四指示信息在所述注册请求中的具体格式进行限定，所述第四指示信息可以携带在所述注册接受消息中现有的信元的预留项中，例如，当所述注册请求为attach accept时，所述第四指示信息可以携带在EPS network feature support信元的预留项中；或者，所述第四指示信息也可以携带在所述注册接受消息的新信元中。
iv、所述终端设备根据所述第四指示信息，确定所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息。
一个可能的实施方式中，在执行步骤301时，所述移动管理网元可以通过但不限于以下五种方式对所述终端设备的寻呼标识进行安全保护：
方式a、所述移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行加密。
方式b、所述移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行完整性保护。
方式c、所述移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行加密，然后对加密的寻呼标识进行完整性保护。
方式d、所述移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行完整性保护，并进行抗重放处理。
方式e、所述移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行加密，然后对加密的寻呼标识进行完整性保护，并进行抗重放处理。
在上述五种方式中，所述安全上下文中包括对所述终端设备的寻呼标识进行加密和/或完整性保护所需的密钥以及相应的加密算法。
相应地，在执行步骤304时，所述终端设备可以通过但不限于以下方式对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识：
方式A、当所述移动管理网元采用上述方式a对所述终端设备的寻呼标识进行安全保护时，所述终端设备使用与所述移动管理网元约定的安全上下文，对所述第一寻呼标识进行解密，得到所述第二寻呼标识。
方式B、当所述移动管理网元采用上述方式b对所述终端设备的寻呼标识进行安全保护 时，所述终端设备使用与所述移动管理网元约定的安全上下文，对所述第一寻呼标识进行完整性验证，得到所述第二寻呼标识。
方式C、当所述移动管理网元采用上述方式c对所述终端设备的寻呼标识进行安全保护时，所述终端设备使用与所述移动管理网元约定的安全上下文，对所述第一寻呼标识进行完整性验证以及解密，得到所述第二寻呼标识。
方式D、当所述移动管理网元采用上述方式d对所述终端设备的寻呼标识进行安全保护时，所述终端设备使用与所述移动管理网元约定的安全上下文，对所述第一寻呼标识进行完整性验证，得到所述第二寻呼标识，并进行抗重放验证。
方式E、当所述移动管理网元采用上述方式e对所述终端设备的寻呼标识进行安全保护时，所述终端设备使用与所述移动管理网元约定的安全上下文，对所述第一寻呼标识进行完整性验证以及解密，得到所述第二寻呼标识，并进行抗重放验证。
一个具体的实施方式中，在执行步骤305时，所述终端设备具体可以通过以下任一方式处理所述第一寻呼消息：
方式1○：所述终端设备确定所述第二寻呼标识与所述终端设备的身份标识一致时，即所述终端设备确定所述第二寻呼消息为真实基站发送的寻呼消息时，响应所述第二寻呼消息。
具体地，当所述第二寻呼标识为固定寻呼标识，且所述第二寻呼标识与所述终端设备的身份标识一致时，所述终端设备进行本地注册，并重新进行注册流程；当所述第二寻呼标识为临时寻呼标识，且所述第二寻呼标识与所述终端设备的身份标识一致时，所述终端设备向所述移动管理网元发送业务请求(service request)，完成service流程。
方式2○：所述终端设备确定所述第二寻呼标识与所述终端设备的身份标识不一致时，即所述终端设备确定所述第二寻呼消息不是真实基站发送的寻呼消息时，忽略所述第二寻呼消息。
具体地，所述终端设备确定所述第二寻呼标识与所述终端设备的身份标识不一致时，所述终端设备可以不响应所述第二寻呼消息，或者直接丢弃所述第二寻呼消息。
由于伪网络无法获得所述终端设备与移动管理网元协商的安全上下文，因此所述终端设备在所述第二寻呼标识与所述终端设备的身份标识一致时，响应所述第二寻呼消息，在所述第二寻呼标识与所述终端设备的身份标识不一致时，忽略所述第二寻呼消息，可以有效避免伪网络对所述终端设备的寻呼攻击。
在本申请实施例中，所述终端设备在接收到携带所述第一指示信息的第二寻呼消息时，使用与所述移动管理网元协商的安全上下文，对所述第二寻呼消息中的第一寻呼标识进行解安全保护处理，得到第二寻呼标识，根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第二寻呼消息，在所述第二寻呼标识与所述终端设备的身份标识一致的情况下，才响应所述第二寻呼消息，否则，忽略所述寻呼消息，而不是接收到寻呼消息就响应，因而可以避免伪网络对所述终端设备的寻呼攻击。
下面通过具体实施例一对本申请实施例提供的第一种寻呼处理方法应用在5G网络下的场景，进行详细说明。其中，所述移动管理网元为AMF实体，所述终端设备以UE为例。如图4所示，所述方法包括以下步骤：
S401：UE向AMF实体发送registration request。其中，所述registration request中携带第三指示信息，所述第三指示信息用于指示所述UE支持携带安全保护的寻呼标识的寻呼消 息。
相应地，所述AMF实体接收所述registration request。
S402：所述AMF实体根据所述registration request中的第三指示信息，确定所述UE支持携带安全保护的寻呼标识的寻呼消息。
S403：所述AMF实体向所述UE发送registration accept消息，其中，所述registration accept消息中携带第四指示信息，所述第四指示信息用于指示所述AMF实体支持携带安全保护的寻呼标识的寻呼消息。
相应地，所述UE接收所述registration accept消息。
可选地，所述UE接收所述registration accept消息之后，还可以向所述AMF实体发送注册完成(registration complete)消息。
S404：所述UE根据所述registration accept中的第四指示信息，确定所述AMF实体支持携带安全保护的寻呼标识的寻呼消息。
通过上述步骤S401至步骤S404，所述UE确定所述AMF实体支持携带安全保护的寻呼标识的寻呼消息，所述AMF实体确定所述UE支持携带安全保护的寻呼标识的寻呼消息，进而使得所述AMF实体可以通过携带安全保护的寻呼标识的寻呼消息寻呼所述UE。
S405：所述AMF实体确定需要与所述UE通信时，使用与所述UE协商的安全上下文，对所述UE的寻呼标识进行安全保护，得到第一寻呼标识；
S406：所述AMF实体向基站发送第一寻呼消息，所述第一寻呼消息中包括所述UE的寻呼标识以及所述第一寻呼标识。
相应地，所述基站接收所述第一寻呼消息。
S407：所述基站向所述UE发送第二寻呼消息，所述第二寻呼消息携带所述第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识。
相应地，所述UE接收所述第二寻呼消息。
S408：所述UE根据所述第一指示信息，使用与所述AMF实体协商的安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识。
S409：所述UE判断所述第二寻呼标识与所述UE的身份标识是否一致，若是，执行S410a，否则执行S410b。
S410a：所述UE响应所述第二寻呼消息。
S410b：所述UE忽略所述第二寻呼消息。
可选地，在所述UE执行S404之后，还可以直接执行步骤S411：伪网络向所述UE发送第三寻呼消息，所述第三寻呼消息中不携带所述第一指示信息。所述UE接收所述第三寻呼消息后，直接执行S412：忽略所述第三寻呼消息。
下面通过具体实施例二对本申请实施例提供的第一种寻呼处理方法应用在4G网络下的场景，进行详细说明。其中，所述移动管理网元为MME，所述终端设备以UE为例，所述UE发送的注册请求以attach request为例。如图5所示，所述方法包括以下步骤：
S501：UE向MME发送attach request。其中，所述attach request中携带第三指示信息，所述第三指示信息用于指示所述UE支持携带安全保护的寻呼标识的寻呼消息。
相应地，所述MME接收所述attach request。
S502：所述MME根据所述attach request中的第三指示信息，确定所述UE支持携带安全 保护的寻呼标识的寻呼消息。
S503：所述MME向所述UE发送attach accept消息，其中，所述attach accept消息中携带第四指示信息，所述第四指示信息用于指示所述MME支持携带安全保护的寻呼标识的寻呼消息。
相应地，所述UE接收所述MME发送的所述attach accept消息。
S504：所述UE根据所述attach accept消息中的第四指示信息，确定所述MME支持携带安全保护的寻呼标识的寻呼消息。
通过上述步骤S501至步骤S504，所述UE确定所述MME支持携带安全保护的寻呼标识的寻呼消息，所述MME确定所述UE支持携带安全保护的寻呼标识的寻呼消息，进而使得所述MME可以通过携带安全保护的寻呼标识的寻呼消息寻呼所述UE。
S505：所述UE向所述MME发送attach complete消息。
相应地，所述MME接收所述attach complete消息。
S506：所述MME确定需要与所述UE通信时，使用与所述UE协商的安全上下文，对所述UE的寻呼标识进行安全保护，得到第一寻呼标识。
其中，所述UE的寻呼标识可以是IMSI或者S-TMSI。
S507：所述MME向基站发送第一寻呼消息，所述第一寻呼消息中包括所述UE的寻呼标识以及所述第一寻呼标识。
S508：所述基站向所述UE发送第二寻呼消息，所述第二寻呼消息携带所述第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识。
相应地，所述UE接收所述第二寻呼消息。
S509：所述UE根据所述第一指示信息，使用与所述MME协商的安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识。
S510：所述UE判断所述第二寻呼标识与所述UE的身份标识是否一致，若是，执行S511a，否则执行S511b。
S511a：所述UE响应所述第二寻呼消息。
S511b：所述UE忽略所述第二寻呼消息。
可选地，在所述UE执行S504之后，还可以直接执行步骤S512：伪网络向所述UE发送第三寻呼消息，所述第三寻呼消息中不携带所述第一指示信息。所述UE接收所述第三寻呼消息后，直接执行S513：忽略所述第三寻呼消息。
如图6所示，本申请提供的第二种寻呼处理方法，可以应用于在终端设备处于空闲态时，网络侧设备需要与终端设备进行通信的场景下。所述方法包括以下步骤：
S601：终端设备统计在第一设定时长内接收的寻呼消息的次数。
S602：所述终端设备确定统计的所述寻呼消息的次数大于或等于第一阈值时，向基站发送用于维持与所述基站之间的通信连接的数据包或信令包。
其中，所述通信连接可以是用于传输信令的信令连接，也可以是用于传输数据包的数据连接。
一个可能的实施方式中，所述终端设备接收所述寻呼消息，并确定统计的所述寻呼消息的次数小于所述第一阈值时，所述终端设备响应所述寻呼请求。例如，所述终端设备接收的寻呼消息中携带IMSI，并确定统计的所述寻呼消息的次数小于所述第一阈值时，所述 终端设备进行本地注册，并重新进行attach流程，又如，所述终端设备接收的寻呼消息中携带S-TMSI，并确定统计的所述寻呼消息的次数小于所述第一阈值时，所述终端设备向MME发送service request，进行service流程。
一个可能的实施方式中，所述终端设备可以通过但不限于以下几种方式中的任一种确定统计的所述寻呼消息的次数大于或等于第一阈值：
方式一、当所述寻呼消息中携带固定寻呼标识，即所述寻呼消息为第一类寻呼消息时，所述终端设备统计接收到的所述第一类寻呼消息的次数，确定统计的所述第一类寻呼消息的次数大于或等于所述第一阈值。
方式二、当所述寻呼消息中携带临时寻呼标识，即所述寻呼消息为第二类寻呼消息时，所述终端设备统计接收到的所述第二类寻呼消息的次数，确定统计的所述第二类寻呼消息的次数大于或等于所述第一阈值。
方式三、当所述寻呼消息包括所述第一类寻呼消息以及所述第二类寻呼消息时，所述终端设备可以分别统计接收到的所述第一类寻呼消息的次数以及接收到的所述第二类寻呼消息的次数，确定统计的所述第一类寻呼消息的次数大于或等于所述第一阈值，且所述第二类寻呼消息的次数大于或等于所述第一阈值；或者，所述终端设备可以统计接收到的所述第一类寻呼消息的次数与接收到的所述第二类寻呼消息的次数之和，确定统计的寻呼消息的次数之和大于或等于所述第一阈值。
方式四、所述终端设备分别统计在所述第一设定时长内从不同基站接收的寻呼消息的次数，确定从任意一个基站接收的寻呼消息的次数大于或等于所述第一阈值。
一个具体的实施方式中，所述终端设备通过以下步骤向所述基站发送用于维持与所述基站之间的通信连接的数据包或信令包：所述终端设备在第二设定时长内，按照设定周期向所述基站发送用于维持与所述基站之间的通信连接的数据包或信令包，所述设定周期小于第二阈值，所述第二阈值为所述终端设备与所述基站之间的通信连接维持的时长。例如，所述第二阈值可以为协议规定的基站的UE不活动定时器的定时时长。
所述终端设备按照设定周期向所述基站发送用于维持与所述基站之间的通信连接的数据包或信令包，使得所述终端设备在所述第二时长内处于连接态，由于所述终端设备处于连接态时不会响应寻呼消息，因此可以避免伪网络对所述终端设备的寻呼攻击。
在本申请实施例中，所述终端设备统计在第一设定时长内接收的寻呼消息的次数，在确定统计的所述寻呼消息的次数大于或等于第一阈值时，向基站发送用于维持与所述基站之间的通信连接的数据包或信令包，使得所述终端设备处于连接态，而所述终端设备处于连接态时不会响应寻呼消息，因此，在伪网络向所述终端设备频繁发送寻呼消息时，不响应寻呼消息，可以避免伪网络对所述终端设备的寻呼攻击。
如图7所示，本申请提供的第三种寻呼处理方法，可以应用于在终端设备处于空闲态时，网络侧设备需要与终端设备进行通信的场景下。所述方法包括以下步骤：
S701：终端设备统计在设定时长内接收的携带临时寻呼标识的寻呼消息的次数。
具体地，所述终端设备可以在设置的寻呼计数定时器启动后，统计所述寻呼计数定时器对应的定时时长内接收的携带临时寻呼标识的寻呼消息的次数，所述寻呼计数定时器对应的定时时长为所述设定时长。其中，所述终端设备可以在接收到首个携带临时寻呼标识的寻呼消息时，启动所述寻呼计数定时器，或者按照预设周期启动所述寻呼计数定时器。
S702：所述终端设备确定统计的所述寻呼消息的次数大于或等于设定阈值时，向移动 管理网元发送用于请求分配全球唯一临时标识GUTI的指示信息；
相应地，所述移动管理网元接收终端设备发送的用于请求分配全球唯一临时标识GUTI的指示信息。
S703：所述移动管理网元根据所述指示信息，为所述终端设备分配GUTI。
其中，所述移动管理网元为所述终端设备分配GUTI与所述终端设备当前接收到的寻呼消息中携带的临时寻呼标识不同。
S704：所述移动管理网元将所述GUTI发送给所述终端设备。
相应地，所述终端设备接收所述移动管理网元发送的GUTI。
S705：所述终端设备根据接收到的GUTI，处理携带临时寻呼标识的寻呼消息。
一个可能的实施方式中，所述终端设备接收所述携带临时寻呼标识的寻呼消息，并确定统计的所述寻呼消息的次数小于所述设定阈值时，所述终端设备响应所述寻呼请求。例如，所述终端设备接收的寻呼消息中携带S-TMSI，并确定统计的所述寻呼消息的次数小于所述设定阈值时，所述终端设备向MME发送service request，进行service流程。
一个可能的实施方式中，在步骤S702-S704中，所述终端设备可以通过但不限于以下任一方式获得所述移动管理网元发送用于请求分配GUTI的指示信息：
方式1、所述终端设备向所述移动管理网元发送位置更新请求，所述位置更新请求中携带所述用于请求分配GUTI的指示信息；所述移动管理网元接收所述位置更新请求后，向所述终端设备发送位置更新接受消息，所述位置更新接受消息中携带所述分配的GUTI；所述终端设备接收所述位置更新接受消息，从所述位置更新消息中获取所述移动管理网元为所述终端设备分配的GUTI。
其中，在4G网络中，所述位置更新请求为TAU request，相应的所述位置更新接受消息为TAU accept消息；在5G网络中，所述位置更新请求为registration request，相应的所述位置更新接受消息为registration accept消息。
需要说明的是，本申请实施例并不对所述用于请求分配GUTI的指示信息在所述位置更新请求中的具体携带方式以及所述移动管理网元分配的GUTI在所述位置更新接受消息中的具体携带方式进行限定。所述用于请求分配GUTI的指示信息可以携带在所述位置更新请求中现有的信元的预留项中，例如，所述用于请求分配GUTI的指示信息携带在TAU request中的EPS更新类型(EPS update type)信元中；或者，所述用于请求分配GUTI的指示信息也可以携带在所述位置更新请求的新信元中。当所述位置更新接受消息的现有的信元中存在用于携带GUTI的信元时，所述移动管理网元分配的GUTI可以携带在所述位置更新接受消息中现有的信元中，例如，TAU accept消息的GUTI信元，registration accept消息的5G GUTI信元中；当所述位置更新接受消息的现有的信元中不存在用于携带GUTI的信元时，所述移动管理网元分配的GUTI可以携带在所述位置更新接受消息中现有的信元的预留项中，或者，所述用于移动管理网元分配的GUTI也可以携带在所述位置更新接受消息的新信元中。
方式2、所述移动管理网元向所述终端设备发送GUTI重分配(GUTI reallocation command)消息，所述GUTI重分配消息中携带所述GUTI。
相应地，所述终端设备接收所述移动管理网元发送的GUTI重分配消息，从所述GUTI重分配消息中获取所述移动管理网元为所述终端设备分配的GUTI。
方式3、所述移动管理网元向所述终端设备发送配置更新(generic UE configuration update)消息，所述配置更新消息中携带所述GUTI。
相应地，所述终端设备接收所述移动管理网元发送的配置更新消息，从所述配置更新消息中获取所述移动管理网元为所述终端设备分配的GUTI。
一个可能的实施方式中，在步骤S705中，所述终端设备根据接收到的GUTI，处理携带临时寻呼标识的寻呼消息具体包括：所述终端设备根据接收到的GUTI，确定所述终端设备当前的临时寻呼标识；当所述终端设备接收到的寻呼消息中携带的临时寻呼标识，与所述终端设备当前的临时寻呼标识一致时，所述终端设备响应所述寻呼消息，当所述终端设备接收到的寻呼消息中携带的临时寻呼标识，与所述终端设备当前的临时寻呼标识不一致时，所述终端设备忽略所述寻呼消息。
具体地，当所述终端设备接收到的寻呼消息中携带的临时寻呼标识，与所述终端设备当前的临时寻呼标识不一致时，所述终端设备不响应所述寻呼消息，或者直接丢弃所述寻呼消息。
在本申请实施例中，所述终端设备统计在设定时长内接收的携带临时寻呼标识的寻呼消息的次数，在确定统计的所述寻呼消息的次数大于或等于设定阈值时，向移动管理网元发送用于请求分配全球唯一临时标识GUTI的指示信息；所述移动管理网元接收所述指示信息后，根据所述指示信息，为所述终端设备分配GUTI，并将分配的GUTI发送给所述终端设备，所述终端设备根据所述移动网元分配的GUTI，处理携带临时寻呼标识的寻呼消息。由于伪网络无法获得所述移动管理网元根据所述指示信息，为所述终端设备分配GUTI，即伪网络发送给所述终端设备的寻呼消息中不会携带所述移动管理网元为所述终端设备分配的新GUTI对应的寻呼标识，因此所述终端设备获得所述移动管理网元为所述终端设备分配的新GUTI后，不会响应伪网络发送的寻呼消息，进而可以避免伪网络对所述终端设备的寻呼攻击。
下面通过具体实施例三对本申请实施例提供的第三种寻呼处理方法应用在5G网络下的场景，进行详细说明。其中，所述移动管理网元为AMF实体，所述终端设备以UE为例。如图8所示，所述方法包括以下步骤：
S801：UE启动寻呼计数定时器，统计所述寻呼计数定时器对应的定时时长内接收到的寻呼消息，该寻呼消息中携带临时寻呼标识；
S802：所述UE判断统计的寻呼消息的次数是否大于或等于所述设定阈值，若不是，执行步骤803，否则执行S805。
S803：所述UE向AMF实体发送service request。
S804：所述AMF实体接收所述service request后，向所述UE发送业务接受(service accept)消息，完成service流程。
S805：所述UE向AMF实体发送registration request，所述registration request中携带用于请求分配GUTI的指示信息。
S806：所述AMF实体根据registration request中的用于请求分配GUTI的指示信息，为所述UE分配GUTI。
S807：所述AMF实体向所述UE发送registration accept消息，所述registration accept消息中携带所述AMF实体分配的GUTI。
S808：所述UE接收所述registration accept消息后，根据所述AMF实体分配的GUTI，处理接收到的携带临时寻呼标识的寻呼消息。
其中，所述UE接收所述registration accept消息之后，还可以向所述AMF实体发送 registration complete消息。
下面通过具体实施例四对本申请实施例提供的第三种寻呼处理方法应用在4G网络下的场景，进行详细说明。其中，所述移动管理网元为MME，所述终端设备以UE为例。如图9所示，所述方法包括以下步骤：
S901：UE启动寻呼计数定时器，统计所述寻呼计数定时器对应的定时时长内接收到的寻呼消息，该寻呼消息中携带S-TMSI；
S902：所述UE判断统计的寻呼消息的次数是否大于或等于所述设定阈值，若不是，执行步骤903，否则执行S905。
S903：所述UE向MME发送service request。
S904：所述MME接收所述service request后，向所述UE发送service accept消息，完成service流程。
S905：所述UE向MME发送TAU request，所述TAU request中携带用于请求分配GUTI的指示信息。
S906：所述MME接收所述TAU request后，根据所述TAU request中的用于请求分配GUTI的指示信息，为所述UE分配GUTI。
S907：所述MME向所述UE发送TAU accept消息，所述TAU accept消息中携带所述MME分配的GUTI。
S908：所述UE接收所述TAU accept消息后，根据所述MME分配的GUTI，处理接收到的携带S-TMSI的寻呼消息。
其中，所述UE接收所述TAU accept消息之后，还可以向所述MME发送跟踪区域更新完成(TAU complete)消息。
本申请实施例提供了一种寻呼处理装置，所述终端设备用于实现如图3至图5所示的寻呼处理方法中终端设备的功能。如图10所示，所述终端设备1000中包括：接收单元1001和处理单元1002。
所述接收单元1001，用于接收第一寻呼消息，所述第一寻呼消息中携带第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识。
所述处理单元1002，用于根据所述第一指示信息，使用与移动管理网元协商的安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识；以及，根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第一寻呼消息。
一个可能的实施方式中，所述处理单元1002具体用于：确定所述第二寻呼标识与所述终端设备的身份标识一致时，响应所述第一寻呼消息；或者，确定所述第二寻呼标识与所述终端设备的身份标识不一致时，忽略所述第一寻呼消息。
一个可能的实施方式中，所述接收单元1001还用于：接收第二寻呼消息，所述第二寻呼消息中没有携带所述第一指示信息；所述处理单元1002还用于忽略所述第二寻呼消息；
或者，所述接收单元1001还用于：接收第二寻呼消息，所述第二寻呼消息中携带第三寻呼标识和第二指示信息，且所述第二指示信息用于指示所述第三寻呼标识为明文；所述处理单元1002还用于忽略所述第二寻呼消息。
一个可能的实施方式中，在所述接收单元1001接收第一寻呼消息之前，所述处理单元1002还用于：确定所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息。
一个可能的实施方式中，所述寻呼处理装置1000还包括发送单元1003，用于：向所述移动管理网元发送注册请求，所述注册请求中携带第三指示信息，所述第三指示信息用于指示所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
所述接收单元1001还用于：接收所述移动管理网元发送的注册接受消息，所述注册接受消息中携带第四指示信息，所述第四指示信息用于指示所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息；
所述处理单元1002具体用于：根据所述第四指示信息，确定所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息。
其中，所述接收单元1001对应的实体设备可以为接收器，所述处理单元1002对应的实体设备可以为处理器，所述发送单元1003对应的实体设备可以为发射器。
本申请实施例提供了一种寻呼处理装置，所述寻呼处理装置能够在接收到携带所述第一指示信息的第二寻呼消息时，使用与所述移动管理网元协商的安全上下文，对所述第二寻呼消息中的第一寻呼标识进行解安全保护处理，得到第二寻呼标识，根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第二寻呼消息，在所述第二寻呼标识与所述终端设备的身份标识一致的情况下，才响应所述第二寻呼消息，否则，忽略所述寻呼消息，而不是接收到寻呼消息就响应，因而可以避免伪网络对所述寻呼处理装置的寻呼攻击。
本申请实施例提供了一种寻呼处理装置，所述寻呼处理装置用于实现如图3至图5所示的寻呼处理方法。如图11所示，所述寻呼处理装置1100中包括：处理单元1101和发送单元1102。
所述处理单元1101，用于使用与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行安全保护，得到安全保护的寻呼标识。
所述发送单元1102，用于向基站发送寻呼消息，所述寻呼消息中包括所述终端设备的寻呼标识以及所述安全保护的寻呼标识。
一个可能的实施方式中，所述处理单元1101在使用所述移动管理网元与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行安全保护之前，还用于：确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
所述发送单元1102还用于：将所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息的指示信息，发送给所述终端设备。
一个可能的实施方式中，所述寻呼处理装置1100还包括接收单元1103，用于：接收所述终端设备发送的注册请求，所述注册请求中携带所述终端设备支持携带安全保护的寻呼标识的寻呼消息的指示信息；
所述处理单元1101具体用于：根据所述注册请求中携带的所述指示信息，确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
所述发送单元1102具体用于：向所述终端设备发送注册接受消息，其中，所述注册接受消息中携带所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息的指示信息。
其中，所述处理单元1101对应的实体设备可以为处理器，所述发送单元1102对应的实体设备可以为发射器，所述接收单元1103对应的实体设备可以为接收器。
本申请实施例提供了一种寻呼处理装置，所述寻呼处理装置能够使用与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行安全保护，得到安全保护的寻呼标识，并向基站发送寻呼消息，所述寻呼消息中包括所述终端设备的寻呼标识以及所述安全保护的 寻呼标识，通过所述基站向所述终端设备发送携带所述安全保护的寻呼标识的寻呼消息，使得所述终端设备在接收到所述基站发送的寻呼消息后，对该寻呼消息中的安全保护的寻呼标识进行解安全保护处理，根据解安全保护处理后的寻呼标识以及所述终端设备的身份标识，处理所述基站发送的寻呼消息，在所述解安全保护处理后的寻呼标识与所述终端设备的身份标识一致的情况下，才响应所述基站发送的寻呼消息，否则，忽略所述基站发送的寻呼消息，而不是接收到寻呼消息就响应，因而可以避免伪网络对所述终端设备的寻呼攻击。
本申请实施例提供了一种寻呼处理装置，所述寻呼处理装置用于实现如图3至图5所示的寻呼处理方法。如图12所示，所述寻呼处理装置1200中包括：接收单元1201、处理单元1202和发送单元1203。
所述接收单元1201，用于接收移动管理网元发送的第一寻呼消息，所述第一寻呼消息携带第一寻呼标识以及第二寻呼标识，所述第一寻呼标识为所述移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述第二寻呼标识进行安全保护后得到的，所述第二寻呼标识为所述终端设备的寻呼标识；
所述处理单元1202用于：根据所述第二寻呼标识，确定所述移动管理网元所要寻呼的所述终端设备；
所述发送单元1203，用于向所述终端设备发送第二寻呼消息，所述第二寻呼消息携带所述第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识。
其中，所述接收单元1201对应的实体设备可以为接收器，所述处理单元1202对应的实体设备可以为处理器，所述发送单元1203对应的实体设备可以为发射器。
本申请实施例提供了一种寻呼处理装置，所述寻呼处理装置能够接收移动管理网元发送的第一寻呼消息，所述第一寻呼消息携带第一寻呼标识以及第二寻呼标识，并向所述终端设备发送第二寻呼消息，所述第二寻呼消息携带所述第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识，使得所述终端设备在接收到所述第二寻呼消息后，对所述第二寻呼消息中的第一寻呼标识进行解安全保护处理，根据解安全保护处理后的寻呼标识以及所述终端设备的身份标识，处理所述第二寻呼消息，在所述解安全保护处理后的寻呼标识与所述终端设备的身份标识一致的情况下，才响应所述第二寻呼消息，否则，忽略所述第二寻呼消息，而不是接收到寻呼消息就响应，因而可以避免伪网络对所述终端设备的寻呼攻击。
本申请实施例提供了一种寻呼处理装置，所述寻呼处理装置用于实现如图6所示的寻呼处理方法。如图13所示，所述寻呼处理装置1300中包括：接收单元1301、处理单元1302和发送单元1303。
所述接收单元1301，用于接收寻呼消息。
所述处理单元1302，用于统计在第一设定时长内接收的寻呼消息的次数；以及，确定统计的所述寻呼消息的次数大于或等于第一阈值。
所述发送单元1303，用于在所述处理单元1302确定统计的所述寻呼消息的次数大于或等于第一阈值时，向基站发送用于维持与所述基站之间的通信连接的数据包或信令包。
一个可能的实施方式中，所述发送单元1302具体用于：在第二设定时长内，按照设定周期向所述基站发送用于维持与所述基站之间的通信连接的数据包或信令包；其中，所述 设定周期小于第二阈值，所述第二阈值为所述终端设备与所述基站之间的通信连接维持的时长。
一个可能的实施方式中，所述寻呼消息中携带固定寻呼标识，或者所述寻呼消息中携带临时寻呼标识。
一个可能的实施方式中，所述寻呼消息包括第一类寻呼消息和第二类寻呼消息，所述第一类寻呼消息中携带固定寻呼标识，所述第二类寻呼消息中携带临时寻呼标识；所述终端设备统计的寻呼消息的次数为在所述第一设定时长内接收的第一类寻呼消息的次数以及第二类寻呼消息的次数之和。
一个可能的实施方式中，所述处理单元1302分别统计在所述第一设定时长内从不同基站接收的寻呼消息的次数；以及，确定从任意一个基站接收的寻呼消息的次数大于或等于所述第一阈值。
其中，所述接收单元1301对应的实体设备可以为接收器，所述处理单元1302对应的实体设备可以为处理器，所述发送单元1303对应的实体设备可以为发射器。
在本申请实施例提供了一种寻呼处理装置，所述寻呼处理装置能够统计在第一设定时长内接收的寻呼消息的次数，在确定统计的所述寻呼消息的次数大于或等于第一阈值时，向基站发送用于维持与所述基站之间的通信连接的数据包或信令包，使得所述寻呼处理装置处于连接态，由于当所述寻呼处理装置处于连接态时不会响应寻呼消息，因此，可以避免伪网络对所述寻呼处理装置的寻呼攻击。
本申请实施例提供了一种寻呼处理装置，所述寻呼处理装置用于实现如图7至图9所示的寻呼处理方法中终端设备的功能。如图14所示，所述寻呼处理装置1400中包括：接收单元1401、处理单元1402和发送单元1403。
所述接收单元1401，用于接收携带临时寻呼标识的寻呼消息。
所述处理单元1402，用于统计在设定时长内接收的携带临时寻呼标识的寻呼消息的次数；以及，确定统计的所述寻呼消息的次数大于或等于设定阈值。
所述发送单元1403，用于在所述处理单元1402确定统计的所述寻呼消息的次数大于或等于设定阈值时，向移动管理网元发送用于请求分配全球唯一临时标识GUTI的指示信息。
所述接收单元1401还用于：接收所述移动管理网元发送的GUTI。
所述处理单元1402还用于：根据所述接收单元1401接收到的GUTI，处理携带临时寻呼标识的寻呼消息。
一个可能的实施方式中，所述发送单元1403具体用于：向所述移动管理网元发送位置更新请求，所述位置更新请求中携带所述用于请求分配GUTI的指示信息；
所述接收单元1401具体用于：接收所述移动管理网元发送的位置更新接受消息，所述位置更新接受消息中携带所述移动管理网元为所述终端设备分配的GUTI。
一个可能的实施方式中，所述接收单元1401具体用于：接收所述移动管理网元发送的GUTI重分配消息，其中，所述GUTI重分配消息中携带所述移动管理网元为所述终端设备分配的GUTI；或者，接收所述移动管理网元发送的配置更新消息，其中，所述配置更新消息中携带所述移动管理网元为所述终端设备分配的GUTI。
其中，所述接收单元1401对应的实体设备可以为接收器，所述处理单元1402对应的实体设备可以为处理器，所述发送单元1403对应的实体设备可以为发射器。
本申请实施例提供了一种寻呼处理装置，所述寻呼处理装置能够统计在设定时长内接 收的携带临时寻呼标识的寻呼消息的次数，在确定统计的所述寻呼消息的次数大于或等于设定阈值时，向移动管理网元发送用于请求分配全球唯一临时标识GUTI的指示信息；所述寻呼处理装置在接收到所述移动管理网元发送的GUTI后，根据所述移动网元发送的GUTI，处理携带临时寻呼标识的寻呼消息。由于伪网络无法获得所述移动管理网元根据所述指示信息，为所述终端设备分配GUTI，即伪网络发送给所述终端设备的寻呼消息中不会携带所述移动管理网元为所述终端设备分配的新GUTI对应的寻呼标识，因此所述呼处理装置获得所述移动管理网元发送的新GUTI后，不会响应伪网络发送的寻呼消息，进而可以避免伪网络对所述呼处理装置的寻呼攻击。
本申请实施例还提供了一种呼处理装置，所述呼处理装置用于实现如图7至图9所示的寻呼处理方法。如图15所示，所述呼处理装置1500中包括：接收单元1501、分配单元1502和发送单元1503。
所述接收单元1501，用于接收终端设备发送的用于请求分配全球唯一临时标识GUTI的指示信息。
所述分配单元1502，用于所述指示信息，为所述终端设备分配GUTI。
所述发送单元1503，用于将所述GUTI发送给所述终端设备。
一种可能的实施方式中，所述接收单元1501具体用于：接收所述终端设备发送的位置更新请求，所述位置更新请求中携带所述用于请求分配GUTI的指示信息；
所述发送单元1503具体用于：向所述终端设备发送位置更新接受消息，所述位置更新接受消息中携带所述GUTI。
一种可能的实施方式中，所述发送单元1503具体用于：向所述终端设备发送GUTI重分配消息，所述GUTI重分配消息中携带所述GUTI；或者，向所述终端设备发送配置更新消息，所述配置更新消息中携带所述GUTI。
其中，所述接收单元1501对应的实体设备可以为接收器，所述分配单元1502对应的实体设备可以为处理器，所述发送单元1503对应的实体设备可以为发射器。
本申请实施例提供了一种寻呼处理装置，所述寻呼处理装置能够接收终端设备发送的用于请求分配全球唯一临时标识GUTI的指示信息，根据所述指示信息，为所述终端设备分配GUTI，并将分配的GUTI发送给所述终端设备，使得所述终端设备根据所述移动网元分配的GUTI，处理携带临时寻呼标识的寻呼消息。由于伪网络无法获得所述寻呼处理装置根据所述指示信息，为所述终端设备分配GUTI，即伪网络发送给所述终端设备的寻呼消息中不会携带所述寻呼处理装置为所述终端设备分配的新GUTI对应的寻呼标识，因此所述终端设备获得所述寻呼处理装置为所述终端设备分配的新GUTI后，不会响应伪网络发送的寻呼消息，进而可以避免伪网络对所述终端设备的寻呼攻击。
需要说明的是，本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。在本申请的实施例中的各功能模块可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备 (可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
图16示出了上述实施例中所涉及的终端设备的一种可能的设计结构的简化示意图。所述终端设备包括发射器1601，接收器1602，控制器/处理器1603，存储器1604和调制解调处理器1605。
所述发射器1601调节(例如，模拟转换、滤波、放大和上变频等)该输出采样并生成上行链路信号，该上行链路信号经由天线发射给上述实施例中所述的基站。在下行链路上，天线接收上述实施例中基站发射的下行链路信号。所述接收器1602调节(例如，滤波、放大、下变频以及数字化等)从天线接收的信号并提供输入采样。在所述调制解调处理器1605中，编码器1606接收要在上行链路上发送的业务数据和信令消息，并对业务数据和信令消息进行处理(例如，格式化、编码和交织)。调制器1607进一步处理(例如，符号映射和调制)编码后的业务数据和信令消息并提供输出采样。解调器1609处理(例如，解调)该输入采样并提供符号估计。解码器1608处理(例如，解交织和解码)该符号估计并提供发送给UE的已解码的数据和信令消息。编码器1606、调制器1607、解调器1609和解码器1608可以由合成的调制解调处理器1605来实现。这些单元根据无线接入网采用的无线接入技术(例如，LTE及其他演进系统的接入技术)来进行处理。
所述控制器/处理器1603对终端设备的动作进行控制管理，用于执行上述实施例中由终端设备进行的处理。例如用于控制终端设备根据第二寻呼消息中携带的所述第一指示信息，使用与移动管理网元协商的安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识，根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第二寻呼消息和/或本发明所描述的技术的其他过程。作为示例，所述控制器/处理器1603用于支持终端设备执行图3中的步骤S304和S305，图4中的步骤S404、S408至S410a(或S410b)和S412，图5中的步骤S504、S509至S511a(或S511b)和S513，图6中的步骤S601和S602，图7中的步骤S701、S702和S705，图8中的步骤S801、S802、S805和S808，图9中的步骤S901、S902、S905和S908。
所述存储器1604用于存储用于所述终端设备1600涉及的程序代码和数据。
需要说明的是，本申请实施例提供的所述终端设备1600用于实现图3至图5所示的寻呼处理方法，或者图6所示的寻呼处理方法，或者图7至图9所示的寻呼处理方法中终端设备的功能，此处仅对所述终端设备1600中各个模块之间的连接关系进行了描述，所述终端设备1600处理寻呼消息的具体方案以及具体执行的动作参见上述方法实施例中的相关描述，此处不再赘述。
图17示出了上述实施例中所涉及的移动管理网元的一种可能的结构示意图。所述移动管理网元1700包括：发射器/接收器1701,控制器/处理器1702以及存储器1703。
所述发射器/接收器1701用于支持移动管理网元与上述实施例中所述的终端设备之间收发信息，以及支持所述终端设备与其他终端设备之间进行无线电通信。所述控制器/处理器1702执行各种用于与终端设备通信的功能。在上行链路，来自所述终端设备的上行链路信号经由天线接收，由接收器1701进行调解，并进一步由所述控制器/处理器1702进行处理来恢复终端设备所发送到业务数据和信令信息。在下行链路上，业务数据和信令消息由所 述控制器/处理器1702进行处理，并由发射器1701进行调解来产生下行链路信号，并经由天线发射给终端设备。所述控制器/处理器1702还执行图3至图5，图7至图9中涉及移动管理网元的处理过程和/或用于本申请所描述的技术的其他过程。
所述存储器1703用于存储移动管理网元的程序代码和数据。所述移动管理网元1700还可以包括通信单元1704，所述通信单元1704用于支持移动管理网元与其他网络实体进行通信。例如,用于支持移动管理网元与图1(或图2)中示出的其他通信网络实体间进行通信，例如图1中的SGSN、SGW或PGW等，又如图2中的AUSF实体或SMF等。
需要说明的是，本申请实施例提供的所述移动管理网元1700用于实现图3至图5所示的寻呼处理方法或者图7至图9所示的寻呼处理方法中移动管理网元的功能，此处仅对所述移动管理网元1700中各个模块之间的连接关系进行了描述，所述移动管理网元1700处理寻呼消息的具体方案以及具体执行的动作参见上述方法实施例中的相关描述，此处不再赘述。
图18示出了上述实施例中所涉及的基站的一种可能的结构示意图。所述基站1800包括：发射器/接收器1801,控制器/处理器1802以及存储器1803。
所述发射器/接收器1801用于支持移动管理网元与上述实施例中所述的终端设备之间收发信息，以及支持所述终端设备与其他终端设备之间进行无线电通信。所述控制器/处理器1802执行各种用于与终端设备通信的功能。在上行链路，来自所述终端设备的上行链路信号经由天线接收，由接收器1801进行调解，并进一步由所述控制器/处理器1802进行处理来恢复终端设备所发送到业务数据和信令信息。在下行链路上，业务数据和信令消息由所述控制器/处理器1802进行处理，并由发射器1801进行调解来产生下行链路信号，并经由天线发射给终端设备。所述控制器/处理器1802还执行图3至图5中涉及移动管理网元的处理过程和/或用于本申请所描述的技术的其他过程。
所述存储器1803用于存储移动管理网元的程序代码和数据。所述基站1800还可以包括通信单元1804，所述通信单元1804用于支持移动管理网元与其他网络实体进行通信。例如,用于支持移动管理网元与图1(或图2)中示出的其他通信网络实体间进行通信，例如图1中的SGSN、SGW或PGW等，又如图2中的AUSF实体或SMF等。
需要说明的是，本申请实施例提供的所述基站1800用于实现图3至图5所示的寻呼处理方法中基站的功能，此处仅对所述基站1800中各个模块之间的连接关系进行了描述，所述基站1800处理寻呼消息的具体方案以及具体执行的动作参见上述方法实施例中的相关描述，此处不再赘述。
如图19所示，本申请实施例提供的第四种寻呼处理方法，应用于在终端设备与第一网络设备(接入网设备)之间的通信链路处于未激活态、且第一网路设备与第二网络设备(核心网设备)之间的通信链路处于连接态时，即所述终端设备以及所述接入网设备处于无线资源控制(radio resource control,RRC)INACTIVE状态，网络侧设备需要与终端设备进行通信的场景下，主要适用于上述图2所示的5G通信系统。所述方法包括以下步骤：
S1901：第一网络设备接收到下行数据包或者下行信令包后，使用所述第一网络设备与终端设备协商的安全上下文，对终端设备的寻呼标识进行安全保护，得到第一寻呼标识。
其中，所述第一网络设备具体可以为5G网络中的基站(gNB)或TRP等，也可以是未来网络中的基站。发送所述下行信令包或者下行数据包的设备为核心网设备，发送所述下行信令包的设备可以是移动管理网元，例如5G网络中的AMF实体，发送所述下行数据包的设备可以是用户面管理网元，例如5G网络中的UPF实体。所述第一网络设备能够接收到下 行数据包或者下行信令包，说明此时所述第一网络设备与核心网设备之间的通信链路处于连接态。所述终端设备的寻呼标识可以为未激活状态下的无线网络临时标识(inactive-radio network temporary identifier，I-RNTI)。
S1902：所述第一网络设备向所述终端设备发送第一寻呼消息，所述第一寻呼消息携带所述第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识。此时，所述第一网络设备与所述终端设备之间的通信链路处于未激活态。
其中，所述终端设备与所述第一网络设备协商的安全上下文为RRC层的安全上下文，可以通过非接入层(non-access stratum，NAS)的安全上下文(即所述终端设备与移动管理网元协商的安全上下文)衍生得到。
相应地，所述终端设备接收第一网络设备发送的所述第一寻呼消息。
S1903：所述终端设备与所述第一网络设备之间通信链路的状态为未激活态时，所述终端设备根据所述第一指示信息，使用与所述第一网络设备协商的安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识。
此时，所述终端设备以及所述第一网络设备处于RRC INACTIV状态。
S1904：所述终端设备根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第一寻呼消息。
示例性的，所述终端设备还可以接收第二寻呼消息，所述第二寻呼消息中没有携带所述第一指示信息；所述终端设备忽略所述第二寻呼消息；或者，所述终端设备接收第二寻呼消息，所述第二寻呼消息中携带第三寻呼标识和第二指示信息，且所述第二指示信息用于指示所述第三寻呼标识为明文；所述终端设备忽略所述第二寻呼消息。
由于伪网络发送给的寻呼消息中携带的寻呼标识通常不会进行安全保护处理，也不会携带所述第一指示信息，即伪网络发送的寻呼消息通常为所述第二寻呼消息，因此，所述终端设备忽略所述第二寻呼消息，可以避免伪网络对所述终端设备的寻呼攻击，进而使得所述终端设备可以与真实网络正常通信。
示例性的，所述第一网络设备在接收到下行数据包或者下行信令包之前，还要确定所述终端设备以及第二网络设备均支持携带安全保护的寻呼标识的寻呼消息。其中，所述第一网络设备确定所述终端设备以及第二网络设备均支持携带安全保护的寻呼标识的寻呼消息具体包括：
步骤A：所述第二网络设备向所述第一网络设备发送指示信息，所述第二网络设备发送的指示信息用于指示所述第二网络设备以及所述终端设备支持携带安全保护的寻呼标识的寻呼消息。
相应地，所述第一网络设备接收所述第二网络设备发送的指示信息。
步骤B：所述第一网络设备根据所述第二网络设备发送的指示信息，确定所述终端设备以及第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
其中，所述第二网络设备向所述第一网络设备发送指示信息之前，所述第二网络设备还要确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息。所述第二网络设备还要确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息后，将所述第二网络设备支持携带安全保护的寻呼标识的寻呼消息的指示信息，发送给所述终端设备，使得所述终端设备能够根据所述第二网络设备发送的指示信息，确定所述第二网络设备支持携带安全保护 的寻呼标识的寻呼消息。
其中，所述第二网络设备与所述终端设备互相确定对方支持携带安全保护的寻呼标识的寻呼消息的方法具体包括以下步骤：
1、所述终端设备向所述第二网络设备发送注册请求，所述注册请求中携带第三指示信息，所述第三指示信息用于指示所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
相应地，所述第二网络设备接收所述终端设备发送的注册请求。其中，在5G网络中所述注册请求可以是注册请求registration request消息。
需要说明的是，本申请实施例并不对所述第三指示信息在所述注册请求中的具体格式进行限定，所述第三指示信息可以携带在所述注册请求中现有的信元的预留项中。
2、所述第二网络设备根据所述注册请求，确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息。
其中，所述第二网络设备确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息之后，还可以向所述第一网络设备发送用于指示所述第二网络设备以及所述终端设备支持携带安全保护的寻呼标识的寻呼消息的指示信息，以使所述第一网络设备确定所述终端设备以及第二网络设备均支持携带安全保护的寻呼标识的寻呼消息。
例如，在5G网络中，所述第二网络设备在确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息之后，可以通过初始用户上下文建立请求initial UE context setup request消息，将用于指示所述第二网络设备以及所述终端设备支持携带安全保护的寻呼标识的寻呼消息的指示信息发送给所述第一网络设备。
3、所述第二网络设备向所述终端设备发送注册接受消息，所述注册接受消息中携带第四指示信息，所述第四指示信息用于指示所述第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
相应地，所述终端设备接收所述第二网络设备发送的注册接受消息。其中，当所述注册请求为registration request消息时，所述注册接受消息为registration accept消息。
需要说明的是，本申请实施例并不对所述第四指示信息在所述注册请求中的具体格式进行限定，所述第四指示信息可以携带在所述注册接受消息中现有的信元的预留项中。例如，当所述注册接受消息为registration accept消息时，所述第四指示信息可以携带在5GS network feature support信元的预留项中。
4、所述终端设备根据所述第四指示信息，确定所述第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
示例性的，在执行步骤S1901时，所述第一网络设备可以通过但不限于以下任一方式对所述终端设备的寻呼标识进行安全保护：
方式1、所述第一网络设备使用所述第一网络设备与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行加密；或者，
方式2、所述第一网络设备使用所述第一网络设备与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行完整性保护；或者，
方式3、所述第一网络设备使用所述第一网络设备与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行加密，然后对加密的寻呼标识进行完整性保护；或者，
方式4、所述第一网络设备使用所述第一网络设备与终端设备协商的安全上下文，对 所述终端设备的寻呼标识进行完整性保护，并进行抗重放处理；或者，
方式5、所述第一网络设备使用所述第一网络设备与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行加密，然后对加密的寻呼标识进行完整性保护，并进行抗重放处理。
在上述五种方式中，所述安全上下文中包括对所述终端设备的寻呼标识进行加密和/或完整性保护所需的密钥以及相应的加密算法。
相应地，在执行步骤S1903时，所述终端设备可以通过但不限于以下任一方式对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识：
方式一、当所述第一网络设备采用上述方式1对所述终端设备的寻呼标识进行安全保护时，所述终端设备使用与所述第一网络设备约定的安全上下文，对所述第一寻呼标识进行解密，得到所述第二寻呼标识；或者，
方式二、当所述第一网络设备采用上述方式2对所述终端设备的寻呼标识进行安全保护时，所述终端设备使用与所述第一网络设备约定的安全上下文，对所述第一寻呼标识进行完整性验证，得到所述第二寻呼标识；或者，
方式三、当所述第一网络设备采用上述方式3对所述终端设备的寻呼标识进行安全保护时，所述终端设备使用与所述第一网络设备约定的安全上下文，对所述第一寻呼标识进行完整性验证以及解密，得到所述第二寻呼标识；或者，
方式四、当所述第一网络设备采用上述方式4对所述终端设备的寻呼标识进行安全保护时，所述终端设备使用与所述第一网络设备约定的安全上下文，对所述第一寻呼标识进行完整性验证，得到所述第二寻呼标识，并进行抗重放验证；或者，
方式五、当所述第一网络设备采用上述方式5对所述终端设备的寻呼标识进行安全保护时，所述终端设备使用与所述第一网络设备约定的安全上下文，对所述第一寻呼标识进行完整性验证以及解密，得到所述第二寻呼标识，并进行抗重放验证；或者，
一个具体的实施方式中，在执行步骤S1904时，所述终端设备具体可以通过以下任一方式处理所述第一寻呼消息：
方式I：所述终端设备确定所述第一寻呼标识与所述终端设备的身份标识一致时，即所述终端设备确定所述第一寻呼消息为真实网络发送的寻呼消息时，响应所述第一寻呼消息；或者，
方式II：所述终端设备确定所述第一寻呼标识与所述终端设备的身份标识不一致时，即所述终端设备确定所述第一寻呼消息不是真实网络发送的寻呼消息时，忽略所述第一寻呼消息。
具体地，所述终端设备确定所述第一寻呼标识与所述终端设备的身份标识不一致时，所述终端设备可以不响应所述第一寻呼消息，或者直接丢弃所述第一寻呼消息。
由于伪网络无法获得所述终端设备与所述第一网络设备协商的安全上下文，因此所述终端设备在所述第二寻呼标识与所述终端设备的身份标识一致时，响应所述第一寻呼消息，在所述第二寻呼标识与所述终端设备的身份标识不一致时，忽略所述第一寻呼消息，可以有效避免伪网络对所述终端设备的寻呼攻击。
在本申请实施例中，终端设备接收第一网络设备发送第一寻呼消息，所述第一寻呼消息中携带第一寻呼标识以及用于指示所述第一寻呼标识为安全保护的寻呼标识的第一指示信息；若所述终端设备与第一网络设备之间的通信链路为未激活态，所述终端设备使用 与所述第一网络设备协商的安全上下文，对所述第一寻呼消息中的第一寻呼标识进行解安全保护处理，得到第二寻呼标识，根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第一寻呼消息，在所述第二寻呼标识与所述终端设备的身份标识一致的情况下，才响应所述第一寻呼消息，否则，忽略所述寻呼消息，而不是接收到寻呼消息就响应，因而可以避免伪网络对所述终端设备的寻呼攻击。
下面通过具体实施例五对本申请实施例提供的第一种寻呼处理方法应用在5G网络下的场景，进行详细说明。其中，以所述第一网络设备为gNB，所述第二网络设备为AMF实体，所述终端设备UE为例。如图20所示，所述方法包括以下步骤：
S2001：UE向AMF实体发送registration request消息。其中，所述registration request消息中携带第三指示信息，所述第三指示信息用于指示所述UE支持携带安全保护的寻呼标识的寻呼消息。
相应地，所述AMF实体接收所述registration request消息。
S2002：所述AMF实体根据所述registration request消息中的第三指示信息，确定所述UE支持携带安全保护的寻呼标识的寻呼消息。
S2003：所述AMF向所述gNB发送initial UE context setup request消息，所述初始用户上下文建立请求initial UE context setup request消息中携带用于指示所述AMF以及所述UE支持携带安全保护的寻呼标识的寻呼消息的指示信息。
相应地，所述gNB接收所述initial UE context setup request消息。
S2004：所述gNB根据所述initial UE context setup request消息中携带的指示信息，确定所述AMF以及所述UE支持携带安全保护的寻呼标识的寻呼消息。
S2005：所述AMF实体向所述UE发送registration accept消息，其中，所述registration accept消息中携带第四指示信息，所述第四指示信息用于指示所述AMF实体支持携带安全保护的寻呼标识的寻呼消息。
相应地，所述UE接收所述registration accept消息。此时，所述UE与网络侧之间建立协议数据单元(protocol data unit，PDU)会话(session)，能够进行数据传输。
可选地，所述UE接收所述registration accept消息之后，还可以向所述AMF实体发送注册完成(registration complete)消息。
S2006：所述UE根据所述registration accept中的第四指示信息，确定所述AMF实体支持携带安全保护的寻呼标识的寻呼消息。
通过上述步骤S2001至步骤S2006，所述UE确定所述AMF实体支持携带安全保护的寻呼标识的寻呼消息，所述AMF实体确定所述UE支持携带安全保护的寻呼标识的寻呼消息，所述gNB可以确定所述AMF以及所述UE支持携带安全保护的寻呼标识的寻呼消息，进而使得所述gNB在所述gNB与所述UE之间的通信链路为未激活态时，可以通过携带安全保护的寻呼标识的寻呼消息寻呼所述UE。
S2007：UPF实体向所述gNB发送下行数据包。
相应地，所述gNB接收所述UPF发送的下行数据包。
S2008：所述gNB使用与所述UE协商的安全上下文对所述UE的寻呼标识进行安全保护，得到第一寻呼标识。
S2009:所述gNB向所述UE发送第一寻呼消息，所述第一寻呼消息中携带所述第一寻呼标识以及第一指示信息。
相应地，所述UE接收所述第一寻呼消息。
S2010：所述UE与所述gNB之间的通信链路处于未激活态时，所述UE根据所述第一指示信息，使用与所述gNB协商的安全上下文，对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识。
S2011：所述UE判断所述第二寻呼标识与所述UE的身份标识是否一致，若是，执行S2012a，否则执行S2012b。
S2012a：所述UE响应所述第一寻呼消息。
S2012b：所述UE忽略所述第一寻呼消息。
可选地，在所述UE执行S2006之后，还可以直接执行步骤S2013：伪网络向所述UE发送第二寻呼消息，所述第二寻呼消息中不携带所述第一指示信息。所述UE接收所述第二寻呼消息后，直接执行S2014：忽略所述第二寻呼消息。
上述本申请提供的实施例中，分别从终端设备、第一网络设备、以及第二网络设备之间交互的角度对本申请实施例提供的方法进行了介绍。可以理解的是，各个网元，例如终端设备、第一网络设备为了实现上述本申请实施例提供的方法中的各功能，终端设备和第一网络设备包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对终端设备、第一网络设备进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用对应各个功能划分各个功能模块的情况下，图21示出了上述和实施例中涉及的寻呼处理装置的一种可能的组成示例图一，该寻呼处理装置能执行本申请第四种方法实施例中任一可能实施方式中终端设备所执行的步骤。如图21所示，所述寻呼处理装置为终端设备或支持终端设备实现第四种方法实施例中提供的方法的寻呼处理装置，例如该寻呼处理装置可以是芯片系统。所述寻呼处理装置可以包括：接收单元2101和处理单元2102。
所述接收单元2101，用于支持寻呼处理装置执行本申请第四种方法实施例中描述的方法。例如，所述接收单元2101，用于执行或用于支持寻呼处理装置执行图19所示的寻呼处理方法中的S1902，图20所示的寻呼处理方法中的S2005、S2009和S2013。
所述处理单元2102，用于支持寻呼处理装置执行图19寻呼处理方法中的S1903、S1904，图20所示的寻呼处理方法中的S2006、S2010、S2011、S2012a、S2012b以及S2014。
进一步的，所述寻呼处理装置还可以包括发送单元2103。发送单元2103，用于支持寻呼处理装置执行图20所示的寻呼处理方法中的S2001。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
本申请实施例提供的寻呼处理装置，用于执行上述任意实施例的方法，因此可以达到与上述实施例的方法相同的效果。
接收单元对应的实体设备可以为接收器，发送单元对应的实体设备可以为发射器，处理单元对应的实体设备可以为处理器。
在采用对应各个功能划分各个功能模块的情况下，图22示出了上述和实施例中涉及的寻呼处理装置的一种可能的组成示例图二，该寻呼处理能执行本申请第四种方法实施例中任一可能实施方式中第一网络设备所执行的步骤。如图22所示，所述寻呼处理装置为第一网络设备或支持第一网络设备实现第四种方法实施例中提供的方法的寻呼处理装置，例如该寻呼处理装置可以是芯片系统。该寻呼处理装置可以包括：接收单元2201、处理单元2202和发送单元2203。
所述接收单元2201，用于支持寻呼处理装置执行本申请第四种方法实施例中描述的方法。例如，所述接收单元2201，用于执行或用于支持寻呼处理装置执行图19所示的寻呼处理方法中的S1901，图20所示的寻呼处理方法中的S2003和S2007。
所述处理单元2202，用于支持寻呼处理装置执行图19寻呼处理方法中的S1901，图20所示的寻呼处理方法中的S2004和S2008。
所述发送单元2203，用于支持寻呼处理装置执行图19寻呼处理方法中的S1902，图20所示的寻呼处理方法中的S2009。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
本申请实施例提供的寻呼处理装置，用于执行上述任意实施例的方法，因此可以达到与上述实施例的方法相同的效果。
接收单元对应的实体设备可以为接收器，发送单元对应的实体设备可以为发射器，处理单元对应的实体设备可以为处理器。
图23示出了上述第四种方法实施例中所涉及的终端设备的一种可能的设计结构的简化示意图。所述终端设备包括发射器2301，接收器2302，控制器/处理器2303，存储器2304和调制解调处理器2305。
所述发射器2301调节(例如，模拟转换、滤波、放大和上变频等)该输出采样并生成上行链路信号，该上行链路信号经由天线发射给上述实施例中所述的基站。在下行链路上，天线接收上述实施例中基站发射的下行链路信号。所述接收器2302调节(例如，滤波、放大、下变频以及数字化等)从天线接收的信号并提供输入采样。在所述调制解调处理器2305中，编码器2306接收要在上行链路上发送的业务数据和信令消息，并对业务数据和信令消息进行处理(例如，格式化、编码和交织)。调制器2307进一步处理(例如，符号映射和调制)编码后的业务数据和信令消息并提供输出采样。解调器2309处理(例如，解调)该输入采样并提供符号估计。解码器2308处理(例如，解交织和解码)该符号估计并提供发送给UE的已解码的数据和信令消息。编码器2306、调制器2307、解调器2309和解码器2308可以由合成的调制解调处理器2305来实现。这些单元根据无线接入网采用的无线接入技术(例如，LTE及其他演进系统的接入技术)来进行处理。
所述控制器/处理器2303对终端设备的动作进行控制管理，用于执行上述实施例中由终端设备进行的处理。例如用于控制终端设备根据第二寻呼消息中携带的所述第一指示信息，使用与移动管理网元协商的安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识，根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第二寻呼消息和/或本发明所描述的技术的其他过程。作为示例，所述控制器/处理器2303用于支 持终端设备执行图19中的步骤S1903、S1904，图20中的步骤S2006、S2010、S2011、S2012a、S2012b以及S2014。
所述存储器2304用于存储用于所述终端设备2300涉及的程序代码和数据。
需要说明的是，本申请实施例提供的所述终端设备2300用于实现图19以及图20所示的寻呼处理方中终端设备的功能，此处仅对所述终端设备2300中各个模块之间的连接关系进行了描述，所述终端设备2300处理寻呼消息的具体方案以及具体执行的动作参见上述方法实施例中的相关描述，此处不再赘述。
图24示出了上述实施例中所涉及的第一网络设备的一种可能的结构示意图。所述第一网络设备2400包括：发射器/接收器2401,控制器/处理器2402以及存储器2403。
所述发射器/接收器2401用于支持第一网络设备与上述实施例中所述的终端设备之间收发信息，以及支持所述终端设备与其他终端设备之间进行无线电通信。所述控制器/处理器2402执行各种用于与终端设备通信的功能。在上行链路，来自所述终端设备的上行链路信号经由天线接收，由接收器2401进行调解，并进一步由所述控制器/处理器2402进行处理来恢复终端设备所发送到业务数据和信令信息。在下行链路上，业务数据和信令消息由所述控制器/处理器2402进行处理，并由发射器2401进行调解来产生下行链路信号，并经由天线发射给终端设备。所述控制器/处理器2402还执行图19和图20中涉及第一网络设备的处理过程和/或用于本申请所描述的技术的其他过程。
所述存储器2403用于存储第一网络设备的程序代码和数据。所述第一网络设备2400还可以包括通信单元2404，所述通信单元2404用于支持第一网络设备与其他网络实体进行通信。例如,用于支持第一网络设备与图2中示出的其他通信网络实体间进行通信，如图2中的AUSF实体或SMF等。
需要说明的是，本申请实施例提供的所述第一网络设备2400用于实现图19以及图20所示的寻呼处理方法中第一网络设备的功能，此处仅对所述第一网络设备2400中各个模块之间的连接关系进行了描述，所述第一网络设备2400处理寻呼消息的具体方案以及具体执行的动作参见上述方法实施例中的相关描述，此处不再赘述。
综上所述，本申请实例提供了一种寻呼处理方法以及装置，通过对寻呼消息中的关键信息寻呼标识进行安全保护，或者在终端设备频繁接收到寻呼消息后，通过使终端设备在一定时间内保持连接态，或者从移动管理网元获取新的GUTI，以增加伪网络持续对中设备进行寻呼攻击的难度，进而可以避免伪网络对终端设备的寻呼攻击，减少终端设备的不必要功耗，提升用体验。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个 方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请实施例的精神和范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (64)

  1. 一种寻呼处理方法，其特征在于，包括：
    终端设备接收第一寻呼消息，所述第一寻呼消息中携带第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识；
    所述终端设备根据所述第一指示信息，使用与移动管理网元协商的安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识；
    所述终端设备根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第一寻呼消息。
  2. 如权利要求1所述的方法，其特征在于，所述终端设备根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第一寻呼消息，包括：
    所述终端设备确定所述第二寻呼标识与所述终端设备的身份标识一致时，响应所述第一寻呼消息；或者，
    所述终端设备确定所述第二寻呼标识与所述终端设备的身份标识不一致时，忽略所述第一寻呼消息。
  3. 如权利要求1或2所述的方法，其特征在于，所述方法还包括：
    所述终端设备接收第二寻呼消息，所述第二寻呼消息中没有携带所述第一指示信息；所述终端设备忽略所述第二寻呼消息；或者，
    所述终端设备接收第二寻呼消息，所述第二寻呼消息中携带第三寻呼标识和第二指示信息，且所述第二指示信息用于指示所述第三寻呼标识为明文；所述终端设备忽略所述第二寻呼消息。
  4. 如权利要求1-3任意一项所述的方法，其特征在于，所述终端设备接收第一寻呼消息之前，还包括：
    所述终端设备确定所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息。
  5. 如权利要求4所述的方法，其特征在于，所述终端设备确定所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息，包括：
    所述终端设备向所述移动管理网元发送注册请求，所述注册请求中携带第三指示信息，所述第三指示信息用于指示所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
    所述终端设备接收所述移动管理网元发送的注册接受消息，所述注册接受消息中携带第四指示信息，所述第四指示信息用于指示所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息；
    所述终端设备根据所述第四指示信息，确定所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息。
  6. 一种寻呼处理方法，其特征在于，包括：
    移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行安全保护，得到安全保护的寻呼标识；
    所述移动管理网元向基站发送寻呼消息，所述寻呼消息中包括所述终端设备的寻呼标识以及所述安全保护的寻呼标识。
  7. 如权利要求6所述的方法，其特征在于，所述移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行安全保护之前，还包括：
    所述移动管理网元确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
    所述移动管理网元将所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息的指示信息，发送给所述终端设备。
  8. 如权利要求7所述的方法，其特征在于，所述移动管理网元确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息，包括：
    所述移动管理网元接收所述终端设备发送的注册请求，所述注册请求中携带所述终端设备支持携带安全保护的寻呼标识的寻呼消息的指示信息；
    所述移动管理网元根据所述指示信息，确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
    所述移动管理网元将移动管理网元支持携带安全保护的寻呼标识的寻呼消息的指示信息，发送给所述终端设备，包括：
    所述移动管理网元向所述终端设备发送注册接受消息，其中，所述注册接受消息中携带所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息的指示信息。
  9. 一种寻呼处理方法，其特征在于，包括：
    基站接收移动管理网元发送的第一寻呼消息，所述第一寻呼消息携带第一寻呼标识以及第二寻呼标识，所述第一寻呼标识为所述移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述第二寻呼标识进行安全保护后得到的，所述第二寻呼标识为所述终端设备的寻呼标识；
    所述基站向所述终端设备发送第二寻呼消息，所述第二寻呼消息携带所述第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识。
  10. 一种寻呼处理方法，其特征在于，包括：
    终端设备接收第一网络设备发送的第一寻呼消息，所述第一寻呼消息中携带第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识；
    所述终端设备与所述第一网络设备之间通信链路的状态为未激活态时，所述终端设备根据所述第一指示信息，使用与所述第一网络设备协商的安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识；
    所述终端设备根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第一寻呼消息。
  11. 如权利要求10所述的方法，其特征在于，所述终端设备根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第一寻呼消息，包括：
    所述终端设备确定所述第二寻呼标识与所述终端设备的身份标识一致时，响应所述第一寻呼消息；或者，
    所述终端设备确定所述第二寻呼标识与所述终端设备的身份标识不一致时，忽略所述第一寻呼消息。
  12. 如权利要求10或11所述的方法，其特征在于，所述方法还包括：
    所述终端设备接收第二寻呼消息，所述第二寻呼消息中没有携带所述第一指示信息；所述终端设备忽略所述第二寻呼消息；或者，
    所述终端设备接收第二寻呼消息，所述第二寻呼消息中携带第三寻呼标识和第二指示 信息，且所述第二指示信息用于指示所述第三寻呼标识为明文；所述终端设备忽略所述第二寻呼消息。
  13. 如权利要求10-12任意一项所述的方法，其特征在于，所述终端设备接收第一寻呼消息之前，还包括：
    所述终端设备确定第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
  14. 如权利要求13所述的方法，其特征在于，所述终端设备确定第二网络设备支持携带安全保护的寻呼标识的寻呼消息，包括：
    所述终端设备向所述第二网络设备发送注册请求，所述注册请求中携带第三指示信息，所述第三指示信息用于指示所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
    所述终端设备接收所述第二网络设备发送的注册接受消息，所述注册接受消息中携带第四指示信息，所述第四指示信息用于指示所述第二网络设备支持携带安全保护的寻呼标识的寻呼消息；
    所述终端设备根据所述第四指示信息，确定所述第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
  15. 一种寻呼处理方法，其特征在于，包括：
    第一网络设备接收到下行数据包或者下行信令包后，使用所述第一网络设备与终端设备协商的安全上下文，对终端设备的寻呼标识进行安全保护，得到安全保护的寻呼标识；
    所述第一网络设备向所述终端设备发送寻呼消息，所述寻呼消息携带所述安全保护的寻呼标识以及用于指示所述携带的寻呼标识为安全保护的寻呼标识的指示信息。
  16. 如权利要求15所述的方法，其特征在于，所述第一网络设备接收到下行数据包或者下行信令包之前，还包括：
    所述第一网络设备确定所述终端设备以及第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
  17. 如权利要求16所述的方法，其特征在于，所述第一网络设备确定所述终端设备以及第二网络设备支持携带安全保护的寻呼标识的寻呼消息，包括：
    所述第一网络设备接收所述第二网络设备发送的指示信息，所述第二网络设备发送的指示信息用于指示所述第二网络设备以及所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
    所述第一网络设备根据所述第二网络设备发送的指示信息，确定所述终端设备以及第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
  18. 一种寻呼处理方法，其特征在于，包括：
    终端设备统计在第一设定时长内接收的寻呼消息的次数；
    所述终端设备确定统计的所述寻呼消息的次数大于或等于第一阈值时，向基站发送用于维持与所述基站之间的通信连接的数据包或信令包。
  19. 如权利要求18所述的方法，其特征在于，所述终端设备向所述基站发送用于维持与所述基站之间的通信连接的数据包或信令包，包括：
    所述终端设备在第二设定时长内，按照设定周期向所述基站发送用于维持与所述基站之间的通信连接的数据包或信令包；
    其中，所述设定周期小于第二阈值，所述第二阈值为所述终端设备与所述基站之间的通信连接维持的时长。
  20. 如权利要求18或19所述的方法，其特征在于，所述寻呼消息中携带固定寻呼标识，或者所述寻呼消息中携带临时寻呼标识。
  21. 如权利要求18或19所述的方法，其特征在于，所述寻呼消息包括第一类寻呼消息和第二类寻呼消息，所述第一类寻呼消息中携带固定寻呼标识，所述第二类寻呼消息中携带临时寻呼标识；
    所述终端设备统计的寻呼消息的次数为在所述第一设定时长内接收的第一类寻呼消息的次数以及第二类寻呼消息的次数之和。
  22. 如权利要求18或19所述的方法，其特征在于，所述终端设备统计在第一设定时长内接收的寻呼消息的次数，包括：
    所述终端设备分别统计在所述第一设定时长内从不同基站接收的寻呼消息的次数；
    所述终端设备确定统计的寻呼消息的次数大于或等于第一阈值，包括：
    所述终端设备确定从任意一个基站接收的寻呼消息的次数大于或等于所述第一阈值。
  23. 一种寻呼处理方法，其特征在于，包括：
    终端设备统计在设定时长内接收的携带临时寻呼标识的寻呼消息的次数；
    所述终端设备确定统计的所述寻呼消息的次数大于或等于设定阈值时，向移动管理网元发送用于请求分配全球唯一临时标识GUTI的指示信息；
    所述终端设备接收所述移动管理网元发送的GUTI；
    所述终端设备根据接收到的GUTI，处理携带临时寻呼标识的寻呼消息。
  24. 如权利要求23所述的方法，其特征在于，所述终端设备向移动管理网元发送用于请求分配GUTI的指示信息，包括：
    所述终端设备向所述移动管理网元发送位置更新请求，所述位置更新请求中携带所述用于请求分配GUTI的指示信息；
    所述终端设备接收所述移动管理网元发送的GUTI，包括：
    所述终端设备接收所述移动管理网元发送的位置更新接受消息，所述位置更新接受消息中携带所述移动管理网元为所述终端设备分配的GUTI。
  25. 如权利要求23所述的方法，其特征在于，所述终端设备接收所述移动管理网元发送的GUTI，包括：
    所述终端设备接收所述移动管理网元发送的GUTI重分配消息，其中，所述GUTI重分配消息中携带所述移动管理网元为所述终端设备分配的GUTI；或者，
    所述终端设备接收所述移动管理网元发送的配置更新消息，其中，所述配置更新消息中携带所述移动管理网元为所述终端设备分配的GUTI。
  26. 一种寻呼处理方法，其特征在于，包括：
    移动管理网元接收终端设备发送的用于请求分配全球唯一临时标识GUTI的指示信息；
    所述移动管理网元根据所述指示信息，为所述终端设备分配GUTI；
    所述移动管理网元将所述GUTI发送给所述终端设备。
  27. 如权利要求16所述的方法，其特征在于，所述移动管理网元接收终端设备发送的用于请求分配全球唯一临时标识GUTI的指示信息，包括：
    所述移动管理网元接收所述终端设备发送的位置更新请求，所述位置更新请求中携带所述用于请求分配GUTI的指示信息；
    所述移动管理网元将所述GUTI发送给所述终端设备，包括：
    所述移动管理网元向所述终端设备发送位置更新接受消息，所述位置更新接受消息中携带所述GUTI。
  28. 如权利要求26所述的方法，其特征在于，所述移动管理网元将所述GUTI发送给所述终端设备，包括：
    所述移动管理网元向所述终端设备发送GUTI重分配消息，所述GUTI重分配消息中携带所述GUTI；或者，
    所述移动管理网元向所述终端设备发送配置更新消息，所述配置更新消息中携带所述GUTI。
  29. 一种寻呼处理装置，其特征在于，包括：接收单元和处理单元；
    所述接收单元，用于接收第一寻呼消息，所述第一寻呼消息中携带第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识；
    所述处理单元，用于根据所述接收单元接收的所述第一寻呼消息中的所述第一指示信息，使用与移动管理网元协商的安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识；以及根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第一寻呼消息。
  30. 如权利要求29所述的装置，其特征在于，所述处理单元具体用于：
    确定所述第二寻呼标识与所述终端设备的身份标识一致时，响应所述第一寻呼消息；或者，
    确定所述第二寻呼标识与所述终端设备的身份标识不一致时，忽略所述第一寻呼消息。
  31. 如权利要求29或30所述的装置，其特征在于，所述接收单元还用于：
    接收第二寻呼消息，所述第二寻呼消息中没有携带所述第一指示信息；所述终端设备忽略所述第二寻呼消息；或者，
    接收第二寻呼消息，所述第二寻呼消息中携带第三寻呼标识和第二指示信息，且所述第二指示信息用于指示所述第三寻呼标识为明文；所述终端设备忽略所述第二寻呼消息。
  32. 如权利要求29-31任意一项所述的装置，其特征在于，在所述接收单元接收第一寻呼消息之前，所述处理单元还用于：
    确定所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息。
  33. 如权利要求32所述的装置，其特征在于，还包括：
    发送单元，用于向所述移动管理网元发送注册请求，所述注册请求中携带第三指示信息，所述第三指示信息用于指示所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
    所述接收单元还用于：接收所述移动管理网元发送的注册接受消息，所述注册接受消息中携带第四指示信息，所述第四指示信息用于指示所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息；
    所述处理单元具体用于：根据所述第四指示信息，确定所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息。
  34. 一种寻呼处理装置，其特征在于，包括：处理单元和发送单元；
    所述处理单元用于：使用与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行安全保护，得到安全保护的寻呼标识；
    所述发送单元用于向基站发送寻呼消息，所述寻呼消息中包括所述终端设备的寻呼标 识以及所述安全保护的寻呼标识。
  35. 如权利要求34所述的装置，其特征在于，所述处理单元在使用所述移动管理网元与终端设备协商的安全上下文，对所述终端设备的寻呼标识进行安全保护之前，还用于：
    确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
    所述发送单元还用于：将所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息的指示信息，发送给所述终端设备。
  36. 如权利要求35所述的装置，其特征在于，还包括：
    接收单元，用于接收所述终端设备发送的注册请求，所述注册请求中携带所述终端设备支持携带安全保护的寻呼标识的寻呼消息的指示信息；
    所述处理单元具体用于：根据所述接收单元接收的所述注册请求中携带的所述指示信息，确定所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
    所述发送单元具体用于：向所述终端设备发送注册接受消息，其中，所述注册接受消息中携带所述移动管理网元支持携带安全保护的寻呼标识的寻呼消息的指示信息。
  37. 一种寻呼处理装置，其特征在于，包括接收单元、发送单元和处理单元；
    所述接收单元，用于收移动管理网元发送的第一寻呼消息，所述第一寻呼消息携带第一寻呼标识以及第二寻呼标识，所述第一寻呼标识为所述移动管理网元使用所述移动管理网元与终端设备协商的安全上下文，对所述第二寻呼标识进行安全保护后得到的，所述第二寻呼标识为所述终端设备的寻呼标识；
    所述处理单元，用于根据所述第二寻呼标识，确定所述移动管理网元所要寻呼的所述终端设备；
    所述发送单元用于：向所述终端设备发送第二寻呼消息，所述第二寻呼消息携带所述第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识。
  38. 一种寻呼处理装置，其特征在于，包括接收单元和处理单元:
    所述接收单元，用于接收第一网络设备发送的第一寻呼消息，所述第一寻呼消息中携带第一寻呼标识以及第一指示信息，所述第一指示信息用于指示所述第一寻呼标识为安全保护的寻呼标识；
    所述处理单元，用于在确定所述装置与所述第一网络设备之间通信链路的状态为未激活态时，根据所述第一指示信息，使用与所述第一网络设备协商的安全上下文对所述第一寻呼标识进行解安全保护处理，得到第二寻呼标识；以及，根据所述第二寻呼标识以及所述终端设备的身份标识，处理所述第一寻呼消息。
  39. 如权利要求38所述的装置，其特征在于，所述处理单元具体用于：确定所述第二寻呼标识与所述终端设备的身份标识一致时，响应所述第一寻呼消息；或者，
    确定所述第二寻呼标识与所述终端设备的身份标识不一致时，忽略所述第一寻呼消息。
  40. 如权利要求38或39所述的装置，其特征在于，所述接收单元还用于接收第二寻呼消息，所述第二寻呼消息中没有携带所述第一指示信息；所述处理单元还用于：忽略所述第二寻呼消息；或者，
    所述接收单元还用于接收第二寻呼消息，所述第二寻呼消息中携带第三寻呼标识和第二指示信息，且所述第二指示信息用于指示所述第三寻呼标识为明文；所述处理单元还用 于：忽略所述第二寻呼消息。
  41. 如权利要求38-40任意一项所述的装置，其特征在于，所述处理单元还用于：
    在所述接收单元接收第一寻呼消息之前，确定第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
  42. 如权利要求41所述的装置，其特征在于，还包括：发送单元，用于向所述第二网络设备发送注册请求，所述注册请求中携带第三指示信息，所述第三指示信息用于指示所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
    所述接收单元还用于：接收所述第二网络设备发送的注册接受消息，所述注册接受消息中携带第四指示信息，所述第四指示信息用于指示所述第二网络设备支持携带安全保护的寻呼标识的寻呼消息；
    所述处理单元具体用于：根据所述第四指示信息，确定所述第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
  43. 一种寻呼处理装置，其特征在于，包括接收单元、处理单元和发送单元；
    所述接收单元，用于接收下行数据包或者下行信令包；
    所述处理单元，用于在所述接收单元接收下行数据包或者下行信令包之后，使用所述第一网络设备与终端设备协商的安全上下文，对终端设备的寻呼标识进行安全保护，得到安全保护的寻呼标识；
    所述发送单元，用于向所述终端设备发送寻呼消息，所述寻呼消息携带所述安全保护的寻呼标识以及用于指示所述携带的寻呼标识为安全保护的寻呼标识的指示信息。
  44. 如权利要求43所述的装置，其特征在于，所述处理单元还用于：
    在所述接收单元接收下行数据包或者下行信令包之前，确定所述终端设备以及第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
  45. 如权利要求44所述的装置，其特征在于，所述接收单元还用于：接收所述第二网络设备发送的指示信息，所述第二网络设备发送的指示信息用于指示所述第二网络设备以及所述终端设备支持携带安全保护的寻呼标识的寻呼消息；
    所述处理单元具体用于：根据所述第二网络设备发送的指示信息，确定所述终端设备以及第二网络设备支持携带安全保护的寻呼标识的寻呼消息。
  46. 一种寻呼处理装置，其特征在于，包括接收单元、处理单元和发送单元；
    所述接收单元，用于接收寻呼消息；
    所述处理单元用于：统计在第一设定时长内所述接收单元接收的寻呼消息的次数；以及确定统计的所述寻呼消息的次数大于或等于第一阈值；
    所述发送单元，用于在所述处理单元确定统计的所述寻呼消息的次数大于或等于第一阈值时，向基站发送用于维持与所述基站之间的通信连接的数据包或信令包。
  47. 如权利要求46所述的装置，其特征在于，所述发送单元具体用于：
    在第二设定时长内，按照设定周期向所述基站发送用于维持与所述基站之间的通信连接的数据包或信令包；
    其中，所述设定周期小于第二阈值，所述第二阈值为所述终端设备与所述基站之间的通信连接维持的时长。
  48. 如权利要求46或47所述的装置，其特征在于，所述寻呼消息中携带固定寻呼标识，或者所述寻呼消息中携带临时寻呼标识。
  49. 如权利要求46或47所述的装置，其特征在于，所述寻呼消息包括第一类寻呼消息和第二类寻呼消息，所述第一类寻呼消息中携带固定寻呼标识，所述第二类寻呼消息中携带临时寻呼标识；
    所述终端设备统计的寻呼消息的次数为在所述第一设定时长内接收的第一类寻呼消息的次数以及第二类寻呼消息的次数之和。
  50. 如权利要求46或47所述的装置，其特征在于，所述处理器单元具体用于：
    分别统计在所述第一设定时长内从不同基站接收的寻呼消息的次数；
    确定从任意一个基站接收的寻呼消息的次数大于或等于所述第一阈值。
  51. 一种寻呼处理装置，其特征在于，包括接收单元、处理单元和发送单元；
    所述接收单元，用于接收的携带临时寻呼标识的寻呼消息；
    所述处理单元用于：统计所述接收单元在设定时长内接收的携带临时寻呼标识的寻呼消息的次数；以及，确定统计的所述寻呼消息的次数大于或等于设定阈值；
    所述发送单元用于：在所述处理单元确定统计的所述寻呼消息的次数大于或等于设定阈值时，向移动管理网元发送用于请求分配全球唯一临时标识GUTI的指示信息；
    所述接收单元还用于：接收所述移动管理网元发送的GUTI；
    所述处理单元还用于：根据所述接收单元接收到的GUTI，处理携带临时寻呼标识的寻呼消息。
  52. 如权利要求51所述的装置，其特征在于，所述发送单元具体用于：
    向所述移动管理网元发送位置更新请求，所述位置更新请求中携带所述用于请求分配GUTI的指示信息；
    所述接收单元具体用于：接收所述移动管理网元发送的位置更新接受消息，所述位置更新接受消息中携带所述移动管理网元为所述终端设备分配的GUTI。
  53. 如权利要求51所述的装置，其特征在于，所述接收单元具体用于：
    接收所述移动管理网元发送的GUTI重分配消息，其中，所述GUTI重分配消息中携带所述移动管理网元为所述终端设备分配的GUTI；或者，
    接收所述移动管理网元发送的配置更新消息，其中，所述配置更新消息中携带所述移动管理网元为所述终端设备分配的GUTI。
  54. 一种寻呼处理装置，其特征在于，包括接收单元、分配单元和发送单元；
    所述接收单元用于：接收终端设备发送的用于请求分配全球唯一临时标识GUTI的指示信息；
    所述分配单元用于：根据所述接收单元接收到的所述指示信息，为所述终端设备分配GUTI；
    所述发送单元还用于：将所述处理单元分配的所述GUTI发送给所述终端设备。
  55. 如权利要求54所述的装置，其特征在于，所述接收单元具体用于：
    接收所述终端设备发送的位置更新请求，所述位置更新请求中携带所述用于请求分配GUTI的指示信息；
    所述发送单元具体用于：向所述终端设备发送位置更新接受消息，所述位置更新接受消息中携带所述GUTI。
  56. 如权利要求54所述的装置，其特征在于，所述发送单元具体用于：
    向所述终端设备发送GUTI重分配消息，所述GUTI重分配消息中携带所述GUTI；或者，
    向所述终端设备发送配置更新消息，所述配置更新消息中携带所述GUTI。
  57. 一种计算机存储介质，其特征在于，所述计算机存储介质上存储有计算机可执行指令，所述计算机可执行指令在被所述计算机调用时用于使所述计算机执行权利要求1-9任一项所述的方法。
  58. 一种计算机存储介质，其特征在于，所述计算机存储介质上存储有计算机可执行指令，所述计算机可执行指令在被所述计算机调用时用于使所述计算机执行权利要求10-17任一项所述的方法。
  59. 一种计算机存储介质，其特征在于，所述计算机存储介质上存储有计算机可执行指令，所述计算机可执行指令在被所述计算机调用时用于使所述计算机执行权利要求18-22任一项所述的方法。
  60. 一种计算机存储介质，其特征在于，所述计算机存储介质上存储有计算机可执行指令，所述计算机可执行指令在被所述计算机调用时用于使所述计算机执行权利要求23-28任一项所述的方法。
  61. 一种包含指令的计算机程序产品，其特征在于，当所述计算机程序产品在计算机上运行时，使得计算机执行权利要求1-9任一项所述的方法。
  62. 一种包含指令的计算机程序产品，其特征在于，当所述计算机程序产品在计算机上运行时，使得计算机执行权利要求10-17任一项所述的方法。
  63. 一种包含指令的计算机程序产品，其特征在于，当所述计算机程序产品在计算机上运行时，使得计算机执行权利要求18-22任一项所述的方法。
  64. 一种包含指令的计算机程序产品，其特征在于，当所述计算机程序产品在计算机上运行时，使得计算机执行权利要求23-28任一项所述的方法。
PCT/CN2019/088203 2018-05-24 2019-05-23 一种寻呼处理方法及装置 WO2019223769A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19808078.0A EP3817421A4 (en) 2018-05-24 2019-05-23 PAGING PROCESSING METHOD AND DEVICE
US17/100,351 US20210076353A1 (en) 2018-05-24 2020-11-20 Paging processing method and apparatus

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201810510941.8 2018-05-24
CN201810510941 2018-05-24
CN201910047972.9 2019-01-18
CN201910047972.9A CN110536290B (zh) 2018-05-24 2019-01-18 一种寻呼处理方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/100,351 Continuation US20210076353A1 (en) 2018-05-24 2020-11-20 Paging processing method and apparatus

Publications (1)

Publication Number Publication Date
WO2019223769A1 true WO2019223769A1 (zh) 2019-11-28

Family

ID=68616570

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/088203 WO2019223769A1 (zh) 2018-05-24 2019-05-23 一种寻呼处理方法及装置

Country Status (1)

Country Link
WO (1) WO2019223769A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220386273A1 (en) * 2019-11-15 2022-12-01 Beijing Xiaomi Mobile Software Co., Ltd. Methods of sending paging signaling, paging methods, information sending methods and apparatuses thereof

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1747593A (zh) * 2004-09-08 2006-03-15 华为技术有限公司 一种寻呼实现方法
US20110153844A1 (en) * 2009-12-18 2011-06-23 Tektronix Inc. System and Method for Automatic Discovery of Topology in an LTE/SAE Network
CN102149107A (zh) * 2010-02-10 2011-08-10 中国移动通信集团公司 一种跟踪区域列表的分配方法
CN102740297A (zh) * 2012-07-03 2012-10-17 大唐移动通信设备有限公司 一种寻呼方法及寻呼装置、寻呼系统
CN105142136A (zh) * 2014-06-03 2015-12-09 展讯通信（上海）有限公司 一种防伪基站攻击的方法
US20170257904A1 (en) * 2016-03-01 2017-09-07 Telefonaktiebolaget Lm Ericsson (Publ) Correlation of User Equipment Identity to Information Centric Networking Request

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1747593A (zh) * 2004-09-08 2006-03-15 华为技术有限公司 一种寻呼实现方法
US20110153844A1 (en) * 2009-12-18 2011-06-23 Tektronix Inc. System and Method for Automatic Discovery of Topology in an LTE/SAE Network
CN102149107A (zh) * 2010-02-10 2011-08-10 中国移动通信集团公司 一种跟踪区域列表的分配方法
CN102740297A (zh) * 2012-07-03 2012-10-17 大唐移动通信设备有限公司 一种寻呼方法及寻呼装置、寻呼系统
CN105142136A (zh) * 2014-06-03 2015-12-09 展讯通信（上海）有限公司 一种防伪基站攻击的方法
US20170257904A1 (en) * 2016-03-01 2017-09-07 Telefonaktiebolaget Lm Ericsson (Publ) Correlation of User Equipment Identity to Information Centric Networking Request

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3817421A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220386273A1 (en) * 2019-11-15 2022-12-01 Beijing Xiaomi Mobile Software Co., Ltd. Methods of sending paging signaling, paging methods, information sending methods and apparatuses thereof

Similar Documents

Publication Publication Date Title
CN110536290B (zh) 一种寻呼处理方法及装置
US10034324B2 (en) Optimization of power consumption in dual SIM mobiles in connected mode in a wireless network
CN102118789B (zh) 业务卸载方法、业务卸载功能实体和业务卸载系统
US10582522B2 (en) Data transmission and reception method and device of terminal in wireless communication system
CN113225776B (zh) 用户设备及其通信控制方法
US10003957B2 (en) Method and apparatus for supporting location privacy protection in wireless access system supporting small cell environment
ES2375001T3 (es) Método y disposiciones para localizar un equipo de usuario para servicios de circuitos conmutados mediante una red de comunicación lte de paquetes conmutados.
US20190028337A1 (en) Method for setting configuration of non-ip data delivery (nidd) in wireless communication system and device for same
CN107836135B (zh) 在无线通信系统中由终端发送和接收数据的方法和设备
WO2019096075A1 (zh) 一种消息保护的方法及装置
EP3371993B1 (en) Method, ue and network node for protecting user privacy in networks
US20130201924A1 (en) Data radio bearer (drb) enhancements for small data transmissions apparatus, systems, and methods
JP2019050437A (ja) 端末装置、ｃ−ｓｇｎおよび通信制御方法
CN106470419B (zh) 一种ue的接入、切换和加密控制的方法与设备
JP2019050436A (ja) 端末装置、ｃ−ｓｇｎおよび通信制御方法
JP2019068114A (ja) 端末装置、ＭＭＥ（ＭｏｂｉｌｉｔｙＭａｎａｇｅｍｅｎｔＥｎｔｉｔｙ）、および通信制御方法
JP2019050435A (ja) 端末装置、ｃ−ｓｇｎおよび通信制御方法
WO2016177106A1 (zh) 专用核心网的选择方法和装置
US20150365989A1 (en) Adaptive paging procedure for a call terminating via a wireless local area network
US10779144B2 (en) Method and apparatus for transmitting downlink data and uplink data in NB-IoT system
WO2019223769A1 (zh) 一种寻呼处理方法及装置
KR20130036875A (ko) 이동통신 시스템에서 로밍 게이트웨이 서비스 방법 및 망 연동 장치
CN106470397B (zh) WiFi网络中获取终端位置的方法、终端、LTE通信设备及系统
CN110536301A (zh) 一种拒绝消息处理方法及装置
KR20130073728A (ko) 엘티이(ｌｔｅ) 시스템에서의 인증 장치 및 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19808078

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019808078

Country of ref document: EP

Effective date: 20201208