WO2019237926A1 - 一种限制终端设备接入的方法及装置 - Google Patents

一种限制终端设备接入的方法及装置 Download PDF

Info

Publication number
WO2019237926A1
WO2019237926A1 PCT/CN2019/089137 CN2019089137W WO2019237926A1 WO 2019237926 A1 WO2019237926 A1 WO 2019237926A1 CN 2019089137 W CN2019089137 W CN 2019089137W WO 2019237926 A1 WO2019237926 A1 WO 2019237926A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
identifier
access
access network
network device
Prior art date
Application number
PCT/CN2019/089137
Other languages
English (en)
French (fr)
Inventor
胡力
陈璟
潘凯
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19819076.1A priority Critical patent/EP3780688B1/en
Publication of WO2019237926A1 publication Critical patent/WO2019237926A1/zh
Priority to US17/089,216 priority patent/US11678187B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/11—Allocation or use of connection identifiers

Definitions

  • the present application relates to the field of mobile communication technologies, and in particular, to a method and an apparatus for limiting access of a terminal device.
  • some terminal devices are usually simple to implement, have poor security protection, and are easily attacked by attackers and become devices controlled by attackers.
  • An example of an attack is that an attacker can use virus software to quickly control a large number of terminal devices to form a botnet that they control. When the scale reaches a certain value, an attacker can control these terminal devices to initiate a large number of connections to a server at the same time, making the server overwhelmed and down, resulting in a Denial of Service (DoS) attack.
  • DoS Denial of Service
  • the present application provides a method and a device for restricting access of a terminal device, so as to implement effective control of attacks on the terminal device.
  • the present application provides a method for limiting access of a terminal device, the method including: the access network device receives a first identifier from the first terminal device, where the first identifier is used to identify the first terminal device; If the identifier matches the second identifier, the access network device restricts the access of the first terminal device; wherein the second identifier is used to identify the terminal device that has abnormal behavior. Based on this solution, the second identifier of the terminal device with abnormal behavior is pre-recorded in the access network device.
  • a first terminal device When a first terminal device sends the first identifier to the access network device to request to establish a connection or request to resume the connection, then The access network device first determines whether the first identifier matches the second identifier recorded by the access network device according to the first identifier. If the identifier matches, it indicates that the first terminal device corresponding to the first identifier is a terminal device with abnormal behavior. The access network device restricts the access of the first terminal device, so as to effectively control the attack of the terminal device.
  • the abnormal behavior of the terminal device may include, for example, abnormal signalling on the terminal device, abnormal traffic, and abnormal service.
  • the abnormal signaling may include abnormal signaling behavior, abnormal terminal location, and abnormal signaling parameters.
  • Traffic anomalies can include abnormal traffic content, abnormal traffic characteristics, abnormal access objects, and protocol application exceptions.
  • Business anomalies can include abnormal voice messages, abnormal multimedia messages, and abnormal packages.
  • the access network device may further match the first identifier with the second identifier.
  • the following methods can be used to match the first identifier with the second identifier, but are not limited to the following methods:
  • Implementation method one The access network device matches the first identifier with the second identifier.
  • the first identifier is a globally unique temporary identifier (GUTI), and the second identifier is GUTI; or, the first identifier is S-TMSI, and the second The identifier is a system architecture evolution temporary mobile station identifier (S-TMSI); or, the first identifier is a GUTI hash value, and the second identifier is a GUTI hash value; or, the first The identifier is a hash value of S-TMSI, and the second identifier is a hash value of S-TMSI.
  • GUI globally unique temporary identifier
  • S-TMSI system architecture evolution temporary mobile station identifier
  • the first identification is a 5G-Globally Unique Temporary Identity (5G-GUTI), and the second identification is 5G-GUTI; or, the first identification 5G-System Architecture Evolution Temporary Mobile Station Identifier (5G-S-TMSI), the second identifier is 5G-S-TMSI; or, the first identifier is a hash of 5G-GUTI Value, the second identifier is a hash value of 5G-GUTI; or, the first identifier is a hash value of 5G-S-TMSI, and the second identifier is a hash value of 5G-S-TMSI.
  • 5G-GUTI 5G-Globally Unique Temporary Identity
  • 5G-S-TMSI 5G-System Architecture Evolution Temporary Mobile Station Identifier
  • the second identifier is 5G-S-TMSI
  • the first identifier is a hash of 5G-GUTI Value
  • the second identifier is a hash value of 5G-GUTI
  • the access network device determines the third identity of the terminal device according to the second identity; the access network device matches the first identity with the third identity.
  • the first identifier is S-TMSI
  • the second identifier is GUTI
  • the third identifier is S-TMSI
  • the first identifier is a hash value of GUTI
  • the second identifier is GUTI
  • the third identifier is GUTI
  • the first identifier is the hash value of S-TMSI
  • the second identifier is the S-TMSI
  • the third identifier is the hash value of S-TMSI.
  • the first identifier is S-TMSI
  • the second identifier is eNB UES1AP ID or MME UES1AP ID
  • the third identifier is S-TMSI.
  • eNB is the abbreviation of evolved NodeB in 4G
  • UE is the abbreviation of user equipment
  • S1AP is the abbreviation of S1Application Protocol
  • ID is the abbreviation of identification
  • MME is the mobile Abbreviation for mobility management entity.
  • the first identifier is 5G-S-TMSI
  • the second identifier is 5G-GUTI
  • the third identifier is 5G-S-TMSI
  • the first identifier is a hash value of 5G-GUTI
  • the second identifier is It is 5G-GUTI
  • the third identifier is the hash value of 5G-GUTI
  • the first identifier is the hash value of 5G-S-TMSI
  • the second identifier is 5G-S-TMSI
  • the third identifier is 5G-S -The hash value of TMSI.
  • the first identifier is 5G-S-TMSI
  • the second identifier is gNB UEN2AP ID or AMF UEN2AP ID
  • the third identifier is 5G-S-TMSI.
  • gNB is an abbreviation of base station (next generation NodeB) in 5G
  • N2AP is an abbreviation of N2 Application Protocol
  • AMF is an abbreviation of access and mobility management function.
  • Implementation method three The access network device determines the fourth identity of the first terminal device according to the first identity; the access network device matches the fourth identity with the second identity.
  • the first identifier is GUTI
  • the second identifier is S-TMSI
  • the fourth identifier is S-TMSI
  • the first identifier is S-TMSI
  • the second identifier is the hash value of S-TMSI.
  • the fourth identifier is a hash value of the S-TMSI; or, the first identifier is a GUTI, the second identifier is a GUTI hash value, and the fourth identifier is a GUTI hash value.
  • the first identity is 5G-GUTI
  • the second identity is 5G-S-TMSI
  • the fourth identity is 5G-S-TMSI
  • the first identity is 5G-S-TMSI
  • the second identity is 5G -
  • the fourth identifier is the hash value of 5G-S-TMSI
  • the first identifier is the 5G-GUTI
  • the second identifier is the hash value of 5G-GUTI
  • the fourth identifier is 5G -GUTI hash value.
  • Implementation method four The access network device determines the fifth identification of the first terminal device according to the first identification, and determines the sixth identification of the terminal device according to the second identification; the access network device matches the fifth identification with the sixth identification.
  • the first identifier is S-TMSI
  • the fifth identifier is the hash value of S-TMSI
  • the second identifier is GUTI
  • the sixth identifier is the hash value of S-TMSI
  • the first identifier is S -TMSI
  • the fifth identifier is the hash value of S-TMSI
  • the second identifier is the eNB UES1AP ID or the MME UES1AP ID
  • the sixth identifier is the hash value of S-TMSI.
  • the first identifier is 5G-S-TMSI
  • the fifth identifier is the hash value of 5G-S-TMSI
  • the second identifier is 5G-GUTI
  • the sixth identifier is the hash value of 5G-S-TMSI
  • the first identifier is 5G-S-TMSI
  • the fifth identifier is the hash value of 5G-S-TMSI
  • the second identifier is gNB UEN2AP ID or AMF UEN2AP ID
  • the sixth identifier is 5G-S-TMSI Hash value.
  • the access network device may further receive the second identifier from the security function network element.
  • the access network device may also start a timer. Then, the access network device restricts the access of the first terminal device, which specifically includes: if the timer does not expire, the access network device restricts the access of the first terminal device. Based on this solution, the access network device restricts terminal devices that have abnormal behavior before the timer expires. After the timer expires, these terminal devices are no longer restricted, which helps to prevent the terminal devices from returning to normal after Still unable to access the access device.
  • the access network device may also release the access network device and the terminal. Connection between devices. Based on this solution, for a terminal device that has abnormal behavior, when the terminal device is currently connected, it can release the connection with the terminal device, thereby reducing the load on the access network device and helping Avoid terminal devices with abnormal behaviors from causing attacks on access network devices.
  • the access network device receiving the second identifier from the security function network element specifically includes: the access network device receives the first message from the security function network element, and the first message includes the second identifier, The first message is used to indicate that the terminal device is a terminal device that restricts access.
  • the access network device receiving the second identification from the security function network element specifically includes: the access network device receiving the second identification and indication information from the security function network element, where the indication information is used for Indicates that the terminal device is a terminal device that restricts access.
  • the access network device may further send a cause value to the first terminal device, and the cause value is used to indicate that the reason for limiting the access of the first terminal device is Security reasons.
  • the present application provides a method for restricting access of a terminal device, the method comprising: the access network device receives a first identifier from the terminal device, the first identifier is used to identify the terminal device; Identification to obtain the context of the terminal device; if the context of the terminal device includes a restriction indication, the access network device restricts the access of the terminal device, and the restriction indication is used for the terminal device as a terminal device with restricted access. Based on this solution, if the terminal device has abnormal behavior, the access network device can record a restriction indication in the context of the terminal device, and the restriction indication is used to indicate that the terminal device is a terminal device that restricts access. The device sends the first identifier to the access network device.
  • an inactive terminal device sends the first identifier to the access network device for requesting to resume the connection. Then, the access network device can obtain the terminal device according to the first identifier.
  • the context of the terminal device if the context of the terminal device includes a restriction indication, it indicates that the terminal device is a terminal device that restricts access, so the access network device can restrict access of the terminal device. In this way, it is possible to effectively control attacks on terminal devices that have abnormal behavior.
  • the context of the terminal device does not include a restriction indication, indicating that the terminal device is a normal terminal device, the access network device may not perform an operation of restricting the access of the terminal device.
  • the access network device receives a second identifier from the security function network element, and the second identifier is used to identify the terminal device that has abnormal behavior; the access network device sends the second identifier to the terminal device according to the second identifier.
  • Limit indication added in context.
  • the access network device may also start a timer.
  • the access network device restricts the access of the terminal device, including: if the timer does not expire, the access network device restricts the access of the terminal device. Based on this solution, the access network device restricts terminal devices that have abnormal behavior before the timer expires. After the timer expires, these terminal devices are no longer restricted, which helps to prevent the terminal device from returning to normal after the timer expires. Still unable to access the access device.
  • the access network device receiving the second identifier from the security function network element includes: the access network device receives a first message from the security function network element, the first message includes the second identifier, the first A message is used to indicate that the terminal device is a terminal device with restricted access.
  • the access network device receiving the second identification from the security function network element includes: the access network device receiving the second identification and indication information from the security function network element, and the indication information is used to indicate A terminal device is a terminal device that restricts access.
  • the access network device sends a cause value to the terminal device, and the cause value is used to indicate that the reason for restricting the access of the terminal device is a security reason.
  • the present application provides a method for restricting access of a terminal device, the method including: the terminal device sends a first identifier of the terminal device to the access network device, where the first identifier is used to identify the terminal device; A rejection message from the network access device.
  • the rejection message includes a reason value, which is used to indicate that the reason for restricting the access of the terminal device is a security reason.
  • the terminal device tries to access again after waiting for a set time according to the cause value.
  • the present application provides a method for restricting access of a terminal device, the method comprising: a security function network element determining that the terminal device has abnormal behavior according to the traffic data of the terminal device; the security function network element sending the terminal to the access network device The second identifier of the device, and the second identifier is used to identify the terminal device.
  • the security function network element determines that the terminal device has abnormal behavior, it sends the second identification of the terminal device to the access network device, so that the access network device can restrict the terminal device's Access. In this way, it is possible to effectively control attacks on terminal devices that have abnormal behavior.
  • the traffic data here may include control plane traffic or characteristic data of the terminal device, user plane traffic or characteristic data, and the like.
  • the sending, by the security function network element, the second identifier of the terminal device to the access network device includes: sending, by the security function network element, the first message to the access network device, where the first message includes the second identifier, The first message is used to indicate that the terminal device is a terminal device that restricts access.
  • the sending of the second identification of the terminal device to the access network device by the security function network element includes: sending, by the security function network element, the second identification and indication information to the access network device, where the indication information is used for Indicates that the terminal device is a terminal device that restricts access.
  • the present application provides a device, which may be an access network device, a terminal device, a security function network element, or a chip.
  • the device has a function of implementing the embodiments of any one of the first aspect, the second aspect, the third aspect, or the fourth aspect described above. This function can be realized by hardware, and can also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • an apparatus including: a processor and a memory; the memory is configured to store computer execution instructions, and when the apparatus is running, the processor executes the computer execution instructions stored in the memory, so that the apparatus executes
  • Method, or to cause the apparatus to perform the method for restricting access to a terminal device as described in the third aspect or any of the third aspects, or to cause the apparatus to perform as described in the fourth aspect or any of the fourth aspects The method of restricting access to terminal equipment described above.
  • the present application further provides a computer-readable storage medium, where the computer-readable storage medium stores instructions, and when the computer-readable storage medium runs on the computer, the computer executes the methods described in the above aspects.
  • the present application also provides a computer program product including instructions, which when executed on a computer, causes the computer to execute the methods described in the above aspects.
  • the present application further provides a system, which includes the access network device in the first aspect or any one of the embodiments of the first aspect, and the fourth aspect or any one of the embodiments of the fourth aspect.
  • Security function network element Further, the system may further include the terminal device in the third aspect or any one of the embodiments of the third aspect.
  • the present application further provides a system including the access network device in the second aspect or any embodiment of the second aspect, and the fourth aspect or any embodiment of the fourth aspect.
  • Security function network element Further, the system may further include the terminal device in the third aspect or any one of the embodiments of the third aspect.
  • FIG. 1 is a schematic diagram of a possible network architecture provided by this application.
  • FIG. 2 is a flowchart of a method for limiting access of a terminal device provided by this application;
  • FIG. 3 is a flowchart of another method for limiting access of a terminal device provided by this application.
  • FIG. 4 is a schematic diagram of a device provided by the present application.
  • FIG. 5 is a schematic diagram of a security function network element provided by this application.
  • FIG. 6 is a schematic diagram of a terminal device provided by this application.
  • FIG. 7 is a schematic diagram of an access network device provided by the present application.
  • the network architecture and service scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that with the network The evolution of the architecture and the emergence of new business scenarios. The technical solutions provided in the embodiments of the present application are also applicable to similar technical issues.
  • the network architecture includes terminal equipment, access network equipment and security function network elements.
  • the network architecture may also include core network equipment.
  • a terminal device is a device with wireless transceiver capabilities that can be deployed on land, including indoor or outdoor, handheld, or vehicle-mounted; it can also be deployed on the water (such as a ship, etc.); it can also be deployed in the air (such as airplanes, balloons, and Satellite first class).
  • the terminal device may be a mobile phone, a tablet, a computer with a wireless transmitting and receiving function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, or an industrial control. ), Wireless terminal in self-driving, wireless terminal in remote medical, wireless terminal in smart grid, wireless terminal in transportation safety , Wireless terminals in smart cities, wireless terminals in smart homes, and the like.
  • Access network equipment is a device that provides wireless communication functions for terminal equipment.
  • the access network equipment includes, but is not limited to, a next-generation base station (gNB) in 5G, an evolved node B (eNB) in 4G, a radio network controller (RNC), Node B (node B, NB), base station controller (BSC), base transceiver station (BTS), home base station (e.g., home nodeB, or home node B, HNB), baseband unit (baseBand unit, BBU), transmission point (TRP), transmission point (TP), mobile switching center, etc.
  • gNB next-generation base station
  • eNB evolved node B
  • RNC radio network controller
  • Node B node B
  • BSC base station controller
  • BTS base transceiver station
  • home base station e.g., home nodeB, or home node B, HNB
  • baseband unit baseBand unit, BBU
  • TRP transmission point
  • TP mobile switching center
  • the core network device in this application may be, for example, an AMF network element in 5G or an MME in 4G.
  • the AMF network element has access and mobility management functions, is the termination point of non-access stratum (NAS) signaling, and is responsible for access authentication and mobility management functions.
  • the MME is the endpoint of NAS signaling and is responsible for access authentication and mobility management functions, as well as session management functions.
  • the security function network element in the present application has security functions, and can analyze the traffic data of the terminal device to find malicious traffic therein, that is, find the terminal device in which there is abnormal behavior.
  • security function network elements can be integrated into a Network Work Data Analysis Function (NWDAF) entity, or integrated into an Operation, Administration, and Maintenance (OAM) entity. , Or integrated in an Application Function (AF) entity.
  • NWDAF Network Work Data Analysis Function
  • OAM Operation, Administration, and Maintenance
  • AF Application Function
  • security function network elements can be integrated into Application Servers (AS).
  • the OAM entity can also be called a network management system, which is used to provide a set of network management functions, including fault monitoring, fault notification, fault location, and fault repair.
  • NWDAF entity is used to provide big data analysis services. This entity can collect data from the 3GPP network and perform big data analysis to provide a better strategy.
  • the AF entity is used to provide application services.
  • application services may be provided by a third party or provided by an operator.
  • AS is used to provide application services.
  • application services can be provided by a third party or by an operator.
  • the above functions can be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (for example, a cloud platform).
  • a method for limiting access of a terminal device includes the following steps:
  • Step 201 The security function network element determines the terminal device having abnormal behavior according to the traffic data of the terminal device.
  • the traffic data may include control plane traffic or characteristic data of the terminal device, user plane traffic or characteristic data, and the like.
  • the abnormal behavior of the terminal device may include, for example, abnormal signalling on the terminal device, abnormal traffic, and abnormal service.
  • the abnormal signaling may include abnormal signaling behavior, abnormal terminal location, and abnormal signaling parameters.
  • Traffic anomalies can include abnormal traffic content, abnormal traffic characteristics, abnormal access objects, and protocol application exceptions.
  • Business anomalies can include abnormal voice messages, abnormal multimedia messages, and abnormal packages.
  • Step 202 The security function network element sends a second identifier of the terminal device to the access network device, where the second identifier is used to identify the terminal device that has abnormal behavior.
  • the access network device may receive the second identity.
  • the security function network element sends a first message to the access network device, the first message includes a second identifier, and the first message is used to indicate that the terminal device is a terminal device with restricted access.
  • the first message itself has an indication function, and is specifically used to indicate that the terminal device identified by the second identifier in the first message is a terminal device that restricts access.
  • the first message here may also be referred to as a notification message, etc.
  • the specific name of the message is not limited in this application.
  • the security function network element sends a second identification and instruction information to the access network device, and the instruction information is used to indicate that the terminal device is a terminal device with restricted access.
  • the second identifier and the indication information may be carried in the same message and sent to the access network device, or may be sent to the access network device separately through two messages.
  • an additional instruction message is used to indicate that the terminal device is a terminal device that restricts access.
  • the access network device may store the second identity.
  • the second identifier may be stored in the storage space of the access network device or in a storage space outside the access network device in the form of a list, such as a unified data management (UDM) network. Yuanzhong.
  • UDM unified data management
  • the storage mode As shown in Table 1, the identifier of the terminal device that restricts access is stored for the access network device.
  • the second identifier in this application is used to identify the terminal device that has abnormal behavior, so any identifier of the terminal device that restricts access recorded by the access network device may be referred to as the second identifier.
  • the second identifier As shown in Table 1, UE ID1, UE ID2, and UE ID3 can all be referred to as the second identification, and terminal devices identified by UE ID1, UE ID2, and UE ID3 are all terminal devices that restrict access.
  • implementation manner of the second identifier may include, but is not limited to, the following implementation manners:
  • the second identifier may be an S-TMSI, a hash value of S-TMSI, a GUTI, a GUTI hash value, an eNB UE S1AP ID, or an MME UE S1AP ID.
  • the second identifier may be a 5G-S-TMSI, a 5G-S-TMSI hash value, a 5G-GUTI, a 5G-GUTI hash value, a gNB UE N2AP ID, or an AMF UE N2AP ID.
  • the second identifier may also be another identifier, which is not limited in this application.
  • step 202 may also be replaced by the following steps 202A and 202B:
  • Step 202A The security function network element sends a second identifier of the terminal device to the core network device, where the second identifier is used to identify the terminal device that has abnormal behavior.
  • the core network device may receive the second identity.
  • the core network device may be an AMF network element or an MME.
  • Step 202B The core network device sends the second identification of the terminal device to the access network device.
  • the access network device may receive the second identity.
  • Step 203 The access network device releases the connection with the terminal device. This step 203 is an optional step.
  • the access network device may perform step 203 to release the connection with the terminal device, thereby reducing the load of the access network device.
  • the access network device may perform step 203 to release the connection with the terminal device, thereby reducing the load of the access network device.
  • the access network device may not perform step 203.
  • an inactive state is introduced.
  • the base station will suspend the terminal device.
  • the terminal device and the access network device delete part of the access stratum (AS).
  • Context, and retaining some AS contexts for example, it is possible to retain the access layer key (which can be called KgNB in 5G), the security capabilities of the terminal device, the security algorithm for the communication between the terminal device and the source base station accessed by the terminal device (including the complete Protection algorithms and encryption algorithms).
  • KgNB access layer key
  • the security capabilities of the terminal device the security algorithm for the communication between the terminal device and the source base station accessed by the terminal device (including the complete Protection algorithms and encryption algorithms).
  • the access network device decides to release the connection with the terminal device, it can be achieved by any of the following methods:
  • the second identifier is any one of S-TMSI, 5G-S-TMSI, GUTI, 5G-GUTI, gNB UE2N ID or AMF UEN2AP ID, eNB UES1AP ID or MME UES1AP ID, you can According to the second identifier, the terminal device identified by the second identifier is determined, and then the connection with the terminal device is released.
  • the access network device may also receive the eNB UES1AP ID or MME UES1AP ID, and then determine the identifier identified by the second identifier based on the eNB UES1AP ID or MME UES1AP ID Terminal device, and then release the connection to the terminal device. If the second identity is 5G-S-TMSI or 5G-GUTI, the access network device can also receive the gNB UEN2AP ID or AMF UEN2AP ID, and then determine the second identity by the gNB UEN2AP ID or AMF UEN2AP ID. Identify the terminal device and then release the connection to the terminal device.
  • the terminal devices with abnormal behaviors determined by the security function network element can be implemented, and the second identifiers of these terminal devices are sent to the access network device, and The network access device stores the second identities of these terminal devices. Therefore, when a subsequent terminal device, such as the first terminal device, requests the access network device to establish a connection, the access network device can determine whether the first terminal device is a terminal that restricts access based on the stored second identifier. The device, and decide whether to restrict the access of the terminal device according to the judgment result. Thus, restricted access can be implemented to terminal devices that have abnormal behavior.
  • the first terminal device here may be a terminal device among the terminal devices identified by the second identifier stored by the access network device, or may not be a terminal identified by the second identifier stored by the access network device. Any terminal device in the device.
  • Step 204 The first terminal device sends a first identifier of the first terminal device to the access network device, and the first identifier is used to identify the first terminal device.
  • the access network device may receive the first identity.
  • the first terminal device here may be an idle terminal device or an inactive terminal device.
  • step 204 may be implemented by the following method: the first terminal device sends a first request message to the access network device, and the first request message includes a first request message of the first terminal device. An identifier.
  • the first request message is used to request establishment of a radio resource control (radio resource control, RRC) connection.
  • RRC radio resource control
  • the first request message may also be called a request message, or a connection establishment request message, or have another name.
  • step 204 may be implemented by the following method: the first terminal device sends a second request message to the access network device, and the second request message includes the first terminal device A first identification, and the second request message is used to request restoration of an RRC connection.
  • the second request message may also be called a request message, or a connection restoration request message, or have another name.
  • Step 205 The access network device matches the first identifier and the second identifier.
  • Steping here means that the terminal devices indicated by the first identifier and the second identifier are the same terminal device.
  • step 206 is performed.
  • the access network device may not restrict the first terminal device. Access, so that a connection with the first terminal device can be established.
  • the following describes several implementation methods for matching the first identifier with the second identifier.
  • Implementation method one The access network device matches the first identifier with the second identifier.
  • the first identifier is GUTI and the second identifier is GUTI; or the first identifier is S-TMSI and the second identifier is S-TMSI; or the first identifier is the hash value of GUTI and the second identifier Is the hash value of GUTI; or, the first identifier is the hash value of S-TMSI, and the second identifier is the hash value of S-TMSI.
  • the first identifier is 5G-GUTI and the second identifier is 5G-GUTI; or the first identifier is 5G-S-TMSI and the second identifier is 5G-S-TMSI; or the first identifier is 5G -A hash value of GUTI, the second identifier is a hash value of 5G-GUTI; or, the first identifier is a hash value of 5G-S-TMSI, and the second identifier is a hash value of 5G-S-TMSI.
  • the access network device determines the third identity of the terminal device according to the second identity; the access network device matches the first identity with the third identity.
  • the first identifier is S-TMSI
  • the second identifier is GUTI
  • the third identifier is S-TMSI
  • the first identifier is a hash value of GUTI
  • the second identifier is GUTI
  • the third identifier is GUTI
  • the first identifier is the hash value of S-TMSI
  • the second identifier is the S-TMSI
  • the third identifier is the hash value of S-TMSI.
  • the first identifier is S-TMSI
  • the second identifier is eNB UES1AP ID or MME UES1AP ID
  • the third identifier is S-TMSI.
  • the first identifier is 5G-S-TMSI
  • the second identifier is 5G-GUTI
  • the third identifier is 5G-S-TMSI
  • the first identifier is a hash value of 5G-GUTI
  • the second identifier is It is 5G-GUTI
  • the third identifier is the hash value of 5G-GUTI
  • the first identifier is the hash value of 5G-S-TMSI
  • the second identifier is 5G-S-TMSI
  • the third identifier is 5G-S -The hash value of TMSI.
  • the first identifier is 5G-S-TMSI
  • the second identifier is gNB UEN2AP ID or AMF UEN2AP ID
  • the third identifier is 5G-S-TMSI.
  • Implementation method three The access network device determines the fourth identity of the first terminal device according to the first identity; the access network device matches the fourth identity with the second identity.
  • the first identifier is GUTI
  • the second identifier is S-TMSI
  • the fourth identifier is S-TMSI
  • the first identifier is S-TMSI
  • the second identifier is the hash value of S-TMSI.
  • the fourth identifier is a hash value of the S-TMSI; or, the first identifier is a GUTI, the second identifier is a GUTI hash value, and the fourth identifier is a GUTI hash value.
  • the first identity is 5G-GUTI
  • the second identity is 5G-S-TMSI
  • the fourth identity is 5G-S-TMSI
  • the first identity is 5G-S-TMSI
  • the second identity is 5G -
  • the fourth identifier is the hash value of 5G-S-TMSI
  • the first identifier is the 5G-GUTI
  • the second identifier is the hash value of 5G-GUTI
  • the fourth identifier is 5G -GUTI hash value.
  • Implementation method four The access network device determines the fifth identification of the first terminal device according to the first identification, and determines the sixth identification of the terminal device according to the second identification; the access network device matches the fifth identification with the sixth identification.
  • the first identifier is S-TMSI
  • the fifth identifier is the hash value of S-TMSI
  • the second identifier is GUTI
  • the sixth identifier is the hash value of S-TMSI
  • the first identifier is S -TMSI
  • the fifth identifier is the hash value of S-TMSI
  • the second identifier is the eNB UES1AP ID or the MME UES1AP ID
  • the sixth identifier is the hash value of S-TMSI.
  • the first identifier is 5G-S-TMSI
  • the fifth identifier is the hash value of 5G-S-TMSI
  • the second identifier is 5G-GUTI
  • the sixth identifier is the hash value of 5G-S-TMSI
  • the first identifier is 5G-S-TMSI
  • the fifth identifier is the hash value of 5G-S-TMSI
  • the second identifier is gNB UEN2AP ID or AMF UEN2AP ID
  • the sixth identifier is 5G-S-TMSI Hash value.
  • Step 206 The access network device restricts access of the first terminal device.
  • the access network device restricting the access of the first terminal device may be that the access network device sends a rejection message to the first terminal device, and the rejection message is used to deny the access of the first terminal device.
  • the rejection message may further include a reason value, which is used to indicate that the reason for restricting the access of the first terminal device is a security reason.
  • the access network device may restrict the access of the first terminal device, or the access network device may not perform subsequent operations. That is, the access network device neither sends a rejection message to the first terminal device nor performs the establishment of a connection with the first terminal device, so that the first terminal device cannot access the access network device, and the first terminal device is restricted. Purpose of access.
  • step 203 the following step 207 may be further included.
  • step 207 the first terminal device tries to access again after waiting for the set duration.
  • the first terminal device may wait for a set period of time according to the cause value, and then try to access again.
  • the set duration may be sent by the access network device to the first terminal device through step 206, or may be set by the first terminal device itself.
  • the access attempt refers to that the first terminal device directly initiates a request to establish or restore a connection to the first access device.
  • the attempt to access means that the first terminal device randomly generates a value between 0 and 1, if the value is less than a preset value (the preset value may be sent by the access network device to the first through step 206) Terminal device or preset by the first terminal device), the first terminal device initiates a request to establish or resume a connection to the first access device. If the value is greater than or equal to the preset value, no request for establishing or restoring a connection is initiated.
  • the second identifier of the terminal device with abnormal behavior is pre-recorded in the access network device.
  • a first terminal device sends the first identifier to the access network device to request to establish a connection or request to resume the connection
  • the access network device first determines whether the first identifier matches the second identifier recorded by the access network device according to the first identifier. If the identifier matches, it indicates that the first terminal device corresponding to the first identifier is a terminal device with abnormal behavior.
  • the access network device restricts the access of the first terminal device, so as to effectively control the attack of the terminal device.
  • the access network device may also start one after receiving the second identification.
  • a timer which is directed to all terminal devices identified by the second identifier in the list. The timer is used to indicate that the duration of the terminal device identified by the second identifier is limited. For example, if the security function network element sends a list to the access network device as shown in Table 1, including the UE ID1, UE ID2, and UE ID3, the timer is used to indicate the restriction on the identification of UE ID1, UE ID2, and UE ID3. The duration of your terminal device. That is, before the timer expires, if any of the terminal devices identified by the second identifier requests the access network device to access the core network device, the core network device will restrict the access of the terminal device. .
  • the network access device may also start a timer for each second identifier, and the timer is for the terminal device identified by the second identifier. The timer is used to indicate that the duration of the terminal device identified by the second identifier is limited.
  • the access network device starts a first timer for the terminal device identified by UE ID1 after receiving UE ID1, and starts a second timer for the terminal device identified by UE ID2 after receiving UE ID2, and upon receiving the UE After ID3, a third timer, etc., is started for the terminal device identified by the UE ID3, and each timer is used to indicate that the duration of one terminal device is limited. That is, before the first timer expires, if the terminal device identified by the UE ID1 requests the access network device to access the core network device, the core network device will restrict the access of the terminal device.
  • the core network device Before the second timer expires, if the terminal device identified by the UE ID2 requests the access network device to access the core network device, the core network device will restrict the access of the terminal device. Before the third timer expires, if the terminal device identified by the UE ID3 requests the access network device to access the core network device, the core network device will restrict the access of the terminal device.
  • a timer is started for the first terminal device, and the timer is used to indicate that the first terminal device is restricted. The duration of the terminal device access.
  • duration of any of the above timers may be set by the access network device itself, or may be specified by the security function network element to the access network device, which is not limited in this application.
  • another method for limiting access of a terminal device includes the following steps:
  • Steps 301 to 302 are the same as steps 201 to 202 of the second embodiment, and reference may be made to the foregoing description.
  • Step 303 The access network device adds a restriction indication to the context of the terminal device according to the second identifier.
  • the terminal device here may be an inactive terminal device.
  • implementation manner of the second identifier may include, but is not limited to, the following implementation manners:
  • the second identifier may be an S-TMSI, a hash value of S-TMSI, a GUTI, a GUTI hash value, an eNB UE S1AP ID, or an MME UE S1AP ID.
  • the second identifier may be a 5G-S-TMSI, a 5G-S-TMSI hash value, a 5G-GUTI, a 5G-GUTI hash value, a gNB UE N2AP ID, or an AMF UE N2AP ID.
  • the second identifier may also be another identifier, which is not limited in this application.
  • the access network device After receiving the second identifier, the access network device determines the context of the terminal device according to the second identifier, and then adds a restriction indication to the context of the terminal device, where the restriction indication is used for the terminal device as a terminal device that restricts access.
  • the terminal devices having abnormal behavior are determined by the security function network element, and send the second identifications of these terminal devices to the access network device, and the access network device according to the second identification
  • a restriction instruction is added to the terminal context of the corresponding terminal device, thereby indicating that the terminal device is a terminal device that needs to be restricted from accessing. Therefore, when there is a subsequent terminal device, for example, the first terminal device requests the access network device to restore the connection, the access network device can determine whether the first terminal device is a restricted access device according to the context of the first terminal device. The terminal device determines whether to restrict the access of the terminal device according to the judgment result. This can restrict access to terminal devices with abnormal behavior.
  • the process of requesting access by the first terminal device is specifically described below. It should be noted that there may be a restriction indication in the context of the first terminal device (that is, added to the context through the above steps 301 to 303), or there may be no restriction indication.
  • Step 304 The first terminal device sends a first identifier of the first terminal device to the access network device, and the first identifier is used to identify the first terminal device.
  • the access network device may receive the first identity.
  • the first terminal device here may be an inactive terminal device.
  • step 304 may be implemented by the following method: the first terminal device sends a request message to the access network device, the request message includes the first identifier of the first terminal device, and the request message is used to request the restoration of the RRC connection .
  • the request message may also be called a connection restoration request message, or have another name.
  • the first identifier here may be, for example, S-TMSI, 5G-S-TMSI, GUTI, 5G-GUTI, or an Inactive-Radio Network Temporary Identifier (I-RNTI), or may be The hash value of S-TMSI, the hash value of 5G-S-TMSI, the hash value of GUTI, the hash value of 5G-GUTI, or the hash value of I-RNTI.
  • Step 305 The access network device determines whether the context of the first terminal device includes a restriction indication.
  • the access network device obtains the context of the first terminal device according to the first identifier, and determines whether the context includes a restriction indication.
  • step 306 is performed.
  • the access network device does not need to restrict the access of the first terminal device Therefore, a connection with the first terminal device can be established.
  • Step 306 is the same as step 206 of the embodiment shown in FIG. 2, and reference may be made to the foregoing description.
  • step 307 may be further included after step 306.
  • This step 307 is the same as step 207 in the embodiment shown in FIG. 2, and reference may be made to the foregoing description.
  • the access network device records a restriction indication in the context of the terminal device with abnormal behavior in advance.
  • a first terminal device sends a first identifier to the access network device to request the connection to be restored
  • the access The network device first determines whether the restriction instruction is included in the context of the first terminal device according to the first identifier. If the restriction instruction is included, it indicates that the first terminal device is a terminal device with abnormal behavior, so the access network device restricts the first terminal. Device access to effectively control attacks on terminal devices.
  • the access network device may also start a timer, which is directed to the terminal identified by the second identifier. equipment.
  • the timer is used to indicate that the duration of the terminal device identified by the second identifier is limited.
  • the access network device determines in step 305 that the context of the first terminal device includes a restriction indication, it starts a timer for the first terminal device, where the timer is used to instruct to restrict the first terminal device.
  • the access time of a terminal device is used to instruct to restrict the first terminal device.
  • duration of any of the above timers may be set by the access network device itself, or may be specified by the security function network element to the access network device, which is not limited in this application.
  • each network element includes a hardware structure and / or a software module corresponding to each function.
  • the present invention can be implemented in the form of hardware or a combination of hardware and computer software in combination with the units and algorithm steps of the examples described in the embodiments disclosed herein. Whether a certain function is performed by hardware or computer software-driven hardware depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.
  • FIG. 4 shows a possible exemplary block diagram of a device involved in the embodiment of the present invention, and the device 400 may exist in the form of software.
  • the apparatus 400 may include a processing unit 402 and a communication unit 403.
  • the communication unit 403 may include a receiving unit and a sending unit.
  • the processing unit 402 is configured to control and manage the operations of the device 400.
  • the communication unit 403 is configured to support communication between the device 400 and other network entities.
  • the device 400 may further include a storage unit 401 for storing program code and data of the device 400.
  • the processing unit 402 may be a processor or a controller.
  • the processing unit 402 may be a general-purpose central processing unit (CPU), a general-purpose processor, digital signal processing (DSP), or an application-specific integrated circuit. circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logical blocks, modules, and circuits described in connection with the present disclosure.
  • the processor may also be a combination that implements a computing function, for example, including a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.
  • the communication unit 403 may be a communication interface, a transceiver, or a transceiver circuit. The communication interface is collectively referred to. In specific implementations, the communication interface may include multiple interfaces.
  • the storage unit 401 may be a memory.
  • the apparatus 400 may be an access network device or a chip in an access network device.
  • the processing unit 402 may support the apparatus 400 to perform the actions of the access network device in the foregoing method examples.
  • the processing unit 402 is configured to support the apparatus 400 to perform step 205 in FIG. 2, steps 303 and 305 in FIG. 3, and / Or other processes for the techniques described herein.
  • the communication unit 403 is configured to support communication between the device 400 and a security function network element or a terminal device.
  • the communication unit is used to support the device 400 to perform steps 202 to 204 and step 206 in FIG. 2, and steps 302, 304, and 306 in FIG. 3.
  • the receiving unit is configured to receive a first identifier from a first terminal device, and the first identifier is used to identify the first terminal.
  • the processing unit is further configured to match the first identifier with the second identifier.
  • the processing unit is specifically configured to determine a third identifier of the terminal device according to the second identifier; the access network device associates the first identifier with the first identifier Three identities are matched.
  • the processing unit is specifically configured to: determine a fourth identifier of the first terminal device according to the first identifier; and perform the fourth identifier with the second identifier. match.
  • the receiving unit is further configured to receive the second identifier from a security function network element before the processing unit matches the first identifier with the second identifier. .
  • the processing unit is specifically configured to start a timer after the receiving unit receives the second identifier from the security function network element; if the timer does not expire, the receiving unit The network access device restricts access of the first terminal device.
  • the receiving unit is specifically configured to receive a first message from the security function network element, the first message includes the second identifier, and the first message is used for Indicating that the terminal device is a terminal device that restricts access; or receiving the second identification and instruction information from the security function network element, where the instruction information is used to indicate that the terminal device is a terminal that restricts access device.
  • the processing unit is further configured to, after the receiving unit receives the second identifier from the security function network element, the receiving unit receives all the data from the first terminal device. Before the first identification, the connection with the terminal device is released.
  • the sending unit is configured to send a cause value to the first terminal device, where the cause value is used to indicate that a reason for restricting access by the first terminal device is a security reason.
  • the receiving unit is configured to receive a first identifier from a terminal device, where the first identifier is used to identify the terminal device; processing A unit configured to obtain the context of the terminal device according to the first identifier; if the context of the terminal device includes a restriction indication, restricting access to the terminal device, the restriction indication being used for the terminal device To restrict access to terminal equipment.
  • the receiving unit is further configured to receive a second identifier from a security function network element, where the second identifier is used to identify the terminal device having abnormal behavior; the processing unit, And is further configured to add the restriction indication to a context of the terminal device according to the second identifier.
  • the processing unit is specifically configured to start a timer after the second identification of the receiving unit from the security function network element; if the timer does not expire, limit the terminal Device access.
  • the receiving unit is specifically configured to receive a first message from the security function network element, the first message includes the second identifier, and the first message is used for Indicating that the terminal device is a terminal device that restricts access; or receiving the second identification and instruction information from the security function network element, where the instruction information is used to indicate that the terminal device is a terminal that restricts access device.
  • the sending unit is configured to send a cause value to the terminal device, where the cause value is used to indicate that the reason for restricting access by the terminal device is a security reason.
  • the device 400 may also be a safety function network element or a chip in a safety function network element involved in this application.
  • the processing unit 402 may support the device 400 to perform the actions of the security function network element in the foregoing method examples.
  • the processing unit 402 is configured to support the device 400 to perform step 201 in FIG. 2 and step 301 in FIG. 3.
  • the communication unit 403 may support communication between the apparatus 400 and an access network device.
  • the communication unit 403 is configured to support the apparatus 400 to perform steps 203 and 206 in FIG. 2.
  • the processing unit is configured to determine that the terminal device has abnormal behavior according to the traffic data of the terminal device; the sending unit is configured to provide access to the access device.
  • the network device sends a second identifier of the terminal device, where the second identifier is used to identify the terminal device.
  • the sending unit is specifically configured to send a first message to the access network device, the first message includes the second identifier, and the first message is used to indicate
  • the terminal device is a terminal device that restricts access; or sends the second identification and indication information to the access network device, where the instruction information is used to indicate that the terminal device is a terminal device that restricts access.
  • the apparatus 400 may also be a terminal device (or a first terminal device) or a chip in the terminal device (or the first terminal device) involved in this application.
  • the processing unit 402 may support the device 400 to perform the actions of the terminal device (the first terminal device) in each of the method examples above.
  • the processing unit 402 is configured to support the device 400 to perform step 207 in FIG. 2 and step 307 in FIG. And / or other processes for the techniques described herein.
  • the communication unit 403 may support communication between the apparatus 400 and an access network device.
  • the communication unit 403 is used to support the apparatus 400 to perform steps 203, 204, 206, and 304 and 306 in FIG.
  • the sending unit is configured to send a first identifier of the terminal device to an access network device, where the first identifier is used to identify all Mentioned terminal equipment;
  • the receiving unit is configured to receive a rejection message from the access network device, where the rejection message includes a cause value, and the cause value is used to indicate that the reason for restricting the access of the terminal device is a security cause.
  • the processing unit is configured to, according to the cause value, wait for a set duration to try to access again.
  • the device 500 includes: a processor 502, a communication interface 503, and a memory 501.
  • the apparatus 500 may further include a communication line 504.
  • the communication interface 503, the processor 502, and the memory 501 can be connected to each other through a communication line 504.
  • the communication line 504 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture. , Referred to as EISA) bus and so on.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the communication line 504 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only a thick line is used in FIG. 5, but it does not mean that there is only one bus or one type of bus.
  • the processor 502 may be a CPU, a microprocessor, an ASIC, or one or more integrated circuits for controlling the execution of the program of the solution of the present application.
  • the communication interface 503 uses any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), Wired access network, etc.
  • RAN radio access network
  • WLAN wireless local area networks
  • Wired access network etc.
  • the memory 501 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type that can store information and instructions
  • the dynamic storage device can also be electrically erasable programmable read-only memory (electrically server-programmable read-only memory (EEPROM)), compact disc (read-only memory (CD-ROM) or other optical disk storage, Optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can Any other media accessed by the computer, but not limited to this.
  • the memory may exist independently, and is connected to the processor through the communication line 504. The memory can also be integrated with the processor.
  • the memory 501 is configured to store a computer execution instruction for executing the solution of the present application, and the processor 502 controls execution.
  • the processor 502 is configured to execute computer execution instructions stored in the memory 501, so as to implement the method for limiting access of a terminal device provided by the foregoing embodiments of the present application.
  • the computer-executable instructions in the embodiments of the present application may also be referred to as application program codes, which are not specifically limited in the embodiments of the present application.
  • FIG. 6 shows a simplified schematic diagram of a possible design structure of a terminal device involved in an embodiment of the present invention.
  • the terminal 600 includes a transmitter 601, a receiver 602, and a processor 603.
  • the processor 603 may also be a controller, which is shown as "controller / processor 603" in FIG. 6.
  • the terminal 600 may further include a modem processor 605.
  • the modem processor 605 may include an encoder 606, a modulator 607, a decoder 608, and a demodulator 609.
  • the transmitter 601 adjusts (eg, analog conversion, filtering, amplification, upconversion, etc.) the output samples and generates an uplink signal, which is transmitted to the access described in the above embodiment via the antenna Network equipment.
  • the antenna receives the downlink signal transmitted by the access network device in the above embodiment.
  • the receiver 602 conditions (e.g., filters, amplifies, downconverts, and digitizes, etc.) the signal received from the antenna and provides input samples.
  • the encoder 606 receives service data and signaling messages to be transmitted on the uplink, and processes (e.g., formats, encodes, and interleaves) the service data and signaling messages.
  • the modulator 607 further processes (e.g., symbol maps and modulates) the encoded service data and signaling messages and provides output samples.
  • a demodulator 609 processes (e.g., demodulates) the input samples and provides symbol estimates.
  • the decoder 608 processes (e.g., deinterleaves and decodes) the symbol estimates and provides decoded data and signaling messages sent to the terminal 600.
  • the encoder 606, the modulator 607, the demodulator 609, and the decoder 608 may be implemented by a synthesized modem processor 605. These units process according to the radio access technology (for example, the access technology of LTE and other evolved systems) adopted by the radio access network. It should be noted that when the terminal 600 does not include the modem processor 605, the above functions of the modem processor 605 may also be performed by the processor 603.
  • the processor 603 controls and manages the actions of the terminal device 600, and is configured to execute the processing procedure performed by the terminal device 600 in the foregoing embodiment of the present invention.
  • the processor 603 is further configured to execute a processing process involving a terminal device (or a first terminal device) and / or other processes of the technical solution described in this application in the methods shown in FIG. 2 to FIG. 3.
  • the terminal device 600 may further include a memory 604, and the memory 604 is configured to store program codes and data for the terminal device 600.
  • FIG. 7 shows a possible structure diagram of an access network device according to an embodiment of the present invention.
  • the access network device 700 includes a processor 702 and a communication interface 704.
  • the processor 702 may also be a controller, which is shown as "controller / processor 702" in FIG.
  • the communication interface 704 is used to support communication between the access network device and other network elements (for example, security function network elements).
  • the access network device 700 may further include a transmitter / receiver 701.
  • the transmitter / receiver 701 is configured to support radio communication between the access network device and the terminal device (or the first terminal device) in the foregoing embodiment.
  • the processor 702 may perform various functions for communicating with a terminal device (or a first terminal device).
  • the uplink signal from the terminal device (or the first terminal device) is received via the antenna, demodulated by the receiver 701 (such as demodulating a high-frequency signal into a baseband signal), and further processed by a processor 702 Perform processing to recover the service data and signaling information sent by the terminal device (or the first terminal device).
  • the service data and signaling messages are processed by the processor 702 and modulated by the transmitter 701 (for example, modulating the baseband signal into a high-frequency signal) to generate a downlink signal and transmitted to the terminal via the antenna Device (or first terminal device).
  • the above-mentioned demodulation or modulation function may also be completed by the processor 702.
  • the processor 702 is further configured to execute a processing process involving an access network device in the methods shown in FIG. 2 to FIG. 3 and / or other processes of the technical solution described in this application.
  • the access network device 700 may further include a memory 703, where the memory 703 is configured to store program code and data of the access network device 700.
  • FIG. 7 only shows a simplified design of the access network device 700.
  • the access network device 700 may include any number of transmitters, receivers, processors, controllers, memories, communication units, etc., and all access network devices that can implement the embodiments of the present invention are in the present invention. Within the scope of protection of the embodiments.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be from a website site, a computer, a server, or a data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, a data center, and the like that includes one or more available medium integration.
  • the available medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (Solid State Disk, SSD)), and the like.
  • Various illustrative logic units and circuits described in the embodiments of the present application may be implemented by a general-purpose processor, a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices. Discrete gate or transistor logic, discrete hardware components, or any combination of the above are designed to implement or operate the described functions.
  • the general-purpose processor may be a microprocessor. Alternatively, the general-purpose processor may also be any conventional processor, controller, microcontroller, or state machine.
  • the processor may also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, multiple microprocessors, one or more microprocessors in conjunction with a digital signal processor core, or any other similar configuration. achieve.
  • a software unit may be stored in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium in the art.
  • the storage medium may be connected to the processor, so that the processor can read information from the storage medium and can write information to the storage medium.
  • the storage medium may be integral to the processor.
  • the processor and the storage medium may be provided in an ASIC, and the ASIC may be provided in a terminal device. Alternatively, the processor and the storage medium may also be provided in different components in the terminal device.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of steps can be performed on the computer or other programmable device to produce a computer-implemented process, which can be executed on the computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more flowcharts and / or one or more blocks of the block diagrams.

Abstract

本申请提供一种限制终端设备接入的方法及装置。该方法包括：接入网设备接收来自终端设备的第一标识，第一标识用于标识终端设备；若第一标识和第二标识匹配，则接入网设备限制终端设备的接入；其中，第二标识用于标识存在异常行为的终端设备。基于该方案，接入网设备中预先记录了存在异常行为的终端设备的第二标识，当有终端设备向接入网设备发送第一标识，以请求建立连接或请求恢复连接时，则接入网设备先根据第一标识，判断第一标识是否与接入网设备记录的第二标识匹配，若匹配，表明该第一标识对应的终端设备是存在异常行为的终端设备，因而接入网设备限制该终端设备的接入，从而实现有效控制终端设备的攻击。

Description

一种限制终端设备接入的方法及装置
本申请要求在2018年6月13日提交中华人民共和国知识产权局、申请号为201810609145.X、发明名称为“一种限制终端设备接入的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及移动通信技术领域，尤其涉及一种限制终端设备接入的方法及装置。
背景技术
在一些业务场景中，有些终端设备通常实现简单，安全防护差，容易被攻击者攻击，成为攻击者控制的设备。一种攻击的示例是，攻击者可以利用病毒软件快速控制大量的终端设备，形成自己控制的僵尸网络。当规模达到一定数值，攻击者可以控制这些终端设备对某个服务器同时发起大量连接，使服务器不堪重负而宕机，造成拒绝服务(Denial of Service，DoS)攻击。
因此，如何有效控制终端设备的攻击，则是有待解决的问题。
发明内容
本申请提供一种限制终端设备接入的方法及装置，用以实现有效控制终端设备的攻击。
第一方面，本申请提供一种限制终端设备接入的方法，该方法包括：接入网设备接收来自第一终端设备的第一标识，第一标识用于标识第一终端设备；若第一标识和第二标识匹配，则接入网设备限制第一终端设备的接入；其中，第二标识用于标识存在异常行为的终端设备。基于该方案，接入网设备中预先记录了存在异常行为的终端设备的第二标识，当有第一终端设备向接入网设备发送第一标识，以请求建立连接或请求恢复连接时，则接入网设备先根据第一标识，判断第一标识是否与接入网设备记录的第二标识匹配，若匹配，表明该第一标识对应的第一终端设备是存在异常行为的终端设备，因而接入网设备限制该第一终端设备的接入，从而实现有效控制终端设备的攻击。
这里的终端设备出现的异常行为，例如可以包括：终端设备出现信令异常，流量异常，业务异常等等。其中，信令异常可以包括信令行为异常，终端位置异常，信令参数异常等。流量异常可以包括流量内容异常，流量特征异常，访问对象异常，协议应用异常等。业务异常可以包括语音短信异常，彩信异常，套餐异常等。
在一种可能的实现方式中，接入网设备还可以将第一标识与第二标识进行匹配。例如可以通过以下方法但不限于以下方法，将第一标识与第二标识进行匹配：
实现方法一，接入网设备将第一标识与第二标识进行匹配。
在第四代(the 4th generation，4G)通信中，第一标识是全局唯一的临时标识(Globally Unique Temporary Identity，GUTI)，第二标识是GUTI；或者，第一标识是S-TMSI，第二标识是系统架构演进临时移动台标识符(System Architecture Evolution Temporary Mobile Station Identifier，S-TMSI)；或者，第一标识是GUTI的哈希值，第二标识是GUTI的哈希值；或者，第一标识是S-TMSI的哈希值，第二标识是S-TMSI的哈希值。
在第五代(the 5th generation，5G)通信中，第一标识是5G全局唯一的临时标识(5G-Globally Unique Temporary Identity，5G-GUTI)，第二标识是5G-GUTI；或者，第一标识是5G系统架构演进临时移动台标识符(5G-System Architecture Evolution Temporary  Mobile Station Identifier，5G-S-TMSI)，第二标识是5G-S-TMSI；或者，第一标识是5G-GUTI的哈希值，第二标识是5G-GUTI的哈希值；或者，第一标识是5G-S-TMSI的哈希值，第二标识是5G-S-TMSI的哈希值。
实现方法二，接入网设备根据第二标识确定终端设备的第三标识；接入网设备将第一标识与第三标识进行匹配。
在4G通信中，第一标识是S-TMSI，第二标识是GUTI，第三标识是S-TMSI；或者，第一标识是GUTI的哈希值，第二标识是GUTI，第三标识是GUTI的哈希值；或者，第一标识是S-TMSI的哈希值，第二标识是S-TMSI，第三标识是S-TMSI的哈希值。或者，第一标识是S-TMSI，第二标识是eNB UE S1AP ID或MME UE S1AP ID，第三标识是S-TMSI。
其中，eNB是4G中的基站(evolved NodeB)的简称，UE是用户设备(user equipment)的简称，S1AP是S1应用协议(S1Application Protocol)的简称，ID是标识(identification)的简称，MME是移动性管理实体(mobility management entity)的简称。
在5G通信中，第一标识是5G-S-TMSI，第二标识是5G-GUTI，第三标识是5G-S-TMSI；或者，第一标识是5G-GUTI的哈希值，第二标识是5G-GUTI，第三标识是5G-GUTI的哈希值；或者，第一标识是5G-S-TMSI的哈希值，第二标识是5G-S-TMSI，第三标识是5G-S-TMSI的哈希值。或者，第一标识是5G-S-TMSI，第二标识是gNB UE N2AP ID或AMF UE N2AP ID，第三标识是5G-S-TMSI。
其中，gNB是5G中的基站(next generation NodeB)的简称，N2AP是N2应用协议(N2 Application Protocol)的简称，AMF是接入与移动性管理功能(access and mobility management function)的简称。
实现方法三，接入网设备根据第一标识确定第一终端设备的第四标识；接入网设备将第四标识与第二标识进行匹配。
在4G通信中，第一标识是GUTI，第二标识是S-TMSI，第四标识是S-TMSI；或者，第一标识是S-TMSI，第二标识是S-TMSI的哈希值，第四标识是S-TMSI的哈希值；或者，第一标识是GUTI，第二标识是GUTI的哈希值，第四标识是GUTI的哈希值。
在5G通信中，第一标识是5G-GUTI，第二标识是5G-S-TMSI，第四标识是5G-S-TMSI；或者，第一标识是5G-S-TMSI，第二标识是5G-S-TMSI的哈希值，第四标识是5G-S-TMSI的哈希值；或者，第一标识是5G-GUTI，第二标识是5G-GUTI的哈希值，第四标识是5G-GUTI的哈希值。
实现方法四，接入网设备根据第一标识确定第一终端设备的第五标识，根据第二标识确定终端设备的第六标识；接入网设备将第五标识与第六标识进行匹配。
在4G通信中，第一标识是S-TMSI，第五标识是S-TMSI的哈希值，第二标识是GUTI，第六标识是S-TMSI的哈希值；或者，第一标识是S-TMSI，第五标识是S-TMSI的哈希值，第二标识是eNB UE S1AP ID或MME UE S1AP ID，第六标识是S-TMSI的哈希值。
在5G通信中，第一标识是5G-S-TMSI，第五标识是5G-S-TMSI的哈希值，第二标识是5G-GUTI，第六标识是5G-S-TMSI的哈希值；或者，第一标识是5G-S-TMSI，第五标识是5G-S-TMSI的哈希值，第二标识是gNB UE N2AP ID或AMF UE N2AP ID，第六标识是5G-S-TMSI的哈希值。
在一种可能的实现方式中，接入网设备将第一标识与第二标识进行匹配之前，接入网设备还可以接收来自安全功能网元的上述第二标识。
在一种可能的实现方式中，接入网设备接收来自安全功能网元的第二标识之后，接入网设备还可以启动计时器。则接入网设备限制第一终端设备的接入，具体包括：若计时器未超时，则接入网设备限制第一终端设备的接入。基于该方案，接入网设备在定时器超时前，对存在异常行为的终端设备进行限制，在定时器超时后，则不再对这些终端设备进行限制，有助于避免在终端设备恢复正常后仍然不能接入到接入设备。
在一种可能的实现方式中，接入网设备接收来自安全功能网元的第二标识之后，接收来自第一终端设备的第一标识之前，接入网设备还可以释放接入网设备与终端设备之间的连接。基于该方案，接入网设备对于存在异常行为的终端设备，当该终端设备当前处于连接态时，则可以释放与该终端设备之间的连接，从而减轻接入网设备的负载，有助于避免存在异常行为的终端设备对接入网设备造成攻击。
在一种可能的实现方式中，接入网设备接收来自安全功能网元的第二标识，具体包括：接入网设备接收来自安全功能网元的第一消息，第一消息包括第二标识，第一消息用于指示终端设备为限制接入的终端设备。
在又一种可能的实现方式中，接入网设备接收来自安全功能网元的第二标识，具体包括：接入网设备接收来自安全功能网元的第二标识和指示信息，指示信息用于指示终端设备为限制接入的终端设备。
在一种可能的实现方式中，接入网设备在限制第一终端设备的接入之后，还可以向第一终端设备发送原因值，原因值用于指示限制第一终端设备接入的原因为安全原因。
第二方面，本申请提供一种限制终端设备接入的方法，该方法包括：接入网设备接收来自终端设备的第一标识，第一标识用于标识终端设备；接入网设备根据第一标识，获取终端设备的上下文；若终端设备的上下文包括限制指示，则接入网设备限制终端设备的接入，限制指示用于终端设备为限制接入的终端设备。基于该方案，若终端设备存在异常行为，则接入网设备可以在该终端设备的上下文中记录限制指示，该限制指示用于指示该终端设备为限制接入的终端设备，从而后续若有终端设备向接入网设备发送第一标识，比如不活跃态的终端设备向接入网设备发送第一标识，以用于请求恢复连接，则接入网设备可以根据第一标识，获取该终端设备的上下文，若该终端设备的上下文中包括限制指示，表明该终端设备是一个限制接入的终端设备，因而接入网设备可以限制该终端设备的接入。从而实现有效控制存在异常行为的终端设备的攻击。当然，若该终端设备的上下文中不包括限制指示，表明该终端设备是正常的终端设备，则接入网设备可以不实施限制该终端设备的接入的操作。
在一种可能的实现方式中，接入网设备接收来自安全功能网元的第二标识，第二标识用于标识存在异常行为的终端设备；接入网设备根据第二标识，向终端设备的上下文中添加限制指示。
在一种可能的实现方式中，接入网设备接收来自安全功能网元的第二标识之后，接入网设备还可以启动计时器。则接入网设备限制终端设备的接入，包括：若计时器未超时，则接入网设备限制终端设备的接入。基于该方案，接入网设备在定时器超时前，对存在异常行为的终端设备进行限制，在定时器超时后，则不再对这些终端设备进行限制，有助于避免在终端设备恢复正常后仍然不能接入到接入设备。
在一种可能的实现方式中，接入网设备接收来自安全功能网元的第二标识，包括：接入网设备接收来自安全功能网元的第一消息，第一消息包括第二标识，第一消息用于指示 终端设备为限制接入的终端设备。
在又一种可能的实现方式中，接入网设备接收来自安全功能网元的第二标识，包括：接入网设备接收来自安全功能网元的第二标识和指示信息，指示信息用于指示终端设备为限制接入的终端设备。
在一种可能的实现方式中，接入网设备向终端设备发送原因值，原因值用于指示限制终端设备接入的原因为安全原因。
第三方面，本申请提供一种限制终端设备接入的方法，该方法包括：终端设备向接入网设备发送终端设备的第一标识，第一标识用于标识终端设备；终端设备接收来自接入网设备的拒绝消息，拒绝消息包括原因值，原因值用于指示限制终端设备接入的原因为安全原因。基于该方案，若终端设备是存在异常行为的终端，则接入网设备可以以安全原因，限制终端设备的接入。从而实现有效控制存在异常行为的终端设备的攻击。
在一种可能的实现方式中，终端设备根据原因值，等待设定时长后再次尝试接入。
第四方面，本申请提供一种限制终端设备接入的方法，该方法包括：安全功能网元根据终端设备的流量数据，确定终端设备存在异常行为；安全功能网元向接入网设备发送终端设备的第二标识，第二标识用于标识终端设备。基于该方案，当安全功能网元确定终端设备存在异常行为时，则将该终端设备的第二标识发送给接入网设备，使得接入网设备可以根据该第二标识，限制该终端设备的接入。从而实现有效控制存在异常行为的终端设备的攻击。
其中，这里的流量数据可以包括终端设备的控制面流量或其特征数据、用户面流量或其特征数据等。
在一种可能的实现方式中，安全功能网元向接入网设备发送终端设备的第二标识，包括：安全功能网元向接入网设备发送第一消息，第一消息包括第二标识，第一消息用于指示终端设备为限制接入的终端设备。
在又一种可能的实现方式中，安全功能网元向接入网设备发送终端设备的第二标识，包括：安全功能网元向接入网设备发送第二标识和指示信息，指示信息用于指示终端设备为限制接入的终端设备。
第五方面，本申请提供一种装置，该装置可以是接入网设备、终端设备、安全功能网元，也可以是芯片。该装置具有实现上述第一方面、或者第二方面、或者第三方面、或者第四方面中任意一个方面的各实施例的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第六方面，提供了一种装置，包括：处理器和存储器；该存储器用于存储计算机执行指令，当该装置运行时，该处理器执行该存储器存储的该计算机执行指令，以使该装置执行如上述第一方面或第一方面中任一所述的限制终端设备接入的方法、或者以使该装置执行如上述第二方面或第二方面中任一所述的限制终端设备接入的方法、或者以使该装置执行如上述第三方面或第三方面中任一所述的限制终端设备接入的方法、或者以使该装置执行如上述第四方面或第四方面中任一所述的限制终端设备接入的方法。
第七方面，本申请还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
第八方面，本申请还提供一种包括指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
第九方面，本申请还提供一种系统，该系统包括上述第一方面或第一方面的任一实施例中的接入网设备，和，上述第四方面或第四方面的任一实施例中的安全功能网元。进一步地，该系统还可以包括上述第三方面或第三方面的任一实施例中的终端设备。
第十方面，本申请还提供一种系统，该系统包括上述第二方面或第二方面的任一实施例中的接入网设备，和，上述第四方面或第四方面的任一实施例中的安全功能网元。进一步地，该系统还可以包括上述第三方面或第三方面的任一实施例中的终端设备。
本申请的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
图1为本申请提供的一种可能的网络架构示意图；
图2为本申请提供的一种限制终端设备接入的方法流程图；
图3为本申请提供的又一种限制终端设备接入的方法流程图；
图4为本申请提供的一种装置示意图；
图5为本申请提供的一种安全功能网元示意图；
图6为本申请提供的一种终端设备示意图；
图7为本申请提供的接入网设备示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述。方法实施例中的具体操作方法也可以应用于装置实施例或系统实施例中。其中，在本申请的描述中，除非另有说明，“多个”的含义是两个或两个以上。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
如图1所示，为本申请适用的一种可能的网络架构示意图。该网络架构包括终端设备、接入网设备和安全功能网元。当然，该网络架构还可以包括核心网设备。
终端设备是一种具有无线收发功能的设备，可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。所述终端设备可以是手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。
接入网设备，是一种为终端设备提供无线通信功能的设备。接入网设备例如包括但不限于：5G中的下一代基站(g nodeB，gNB)、4G中的演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(baseBand unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point， TP)、移动交换中心等。
本申请中的核心网设备，例如可以是5G中的AMF网元，还可以是4G中的MME。其中，AMF网元具有接入与移动管理功能，是非接入层(non access stratum，NAS)信令的终结点，负责接入认证和移动性管理等功能。MME是NAS信令的终结点，负责接入认证和移动性管理功能，还负责会话管理功能。
本申请中的安全功能网元，具备安全功能，可以对终端设备的流量数据进行分析，发现其中的恶意流量，即发现其中存在异常行为的终端设备。在具体实现中，在5G中，安全功能网元可以集成于网络数据分析功能(NetWork Data Analysis Function，NWDAF)实体中、或集成于操作、管理和维护(Operation,Administration and Maintenance，OAM)实体中、或集成于应用功能(Application Function，AF)实体中。在4G中，安全功能网元可以集成于应用服务器(Application Server，AS)中。
其中，OAM实体也可以称为网络管理系统，用于提供一组网络管理功能，包括故障监测，故障申告，故障定位，以及故障修复等。
NWDAF实体，用于提供大数据分析服务，该实体可以从3GPP网络收集数据，并进行大数据分析，从而提供更佳的策略。
AF实体，用于提供应用服务，这种应用服务可以是第三方提供的，也可以是运营商提供的。
AS，用于提供应用服务，这种应用服务可以是第三方提供的，也可以是运营商提供的。
可以理解的是,上述功能既可以是硬件设备中的网络元件,也可以是在专用硬件上运行软件功能，或者是平台(例如,云平台)上实例化的虚拟化功能。
下面结合附图，对本申请提供的限制终端设备接入的方法做具体介绍。
如图2所示，为本申请提供的一种限制终端设备接入的方法，包括以下步骤：
步骤201，安全功能网元根据终端设备的流量数据，确定存在异常行为的终端设备。
其中，流量数据可以包括终端设备的控制面流量或其特征数据、用户面流量或其特征数据等。
终端设备出现的异常行为，例如可以包括：终端设备出现信令异常，流量异常，业务异常等等。其中，信令异常可以包括信令行为异常，终端位置异常，信令参数异常等。流量异常可以包括流量内容异常，流量特征异常，访问对象异常，协议应用异常等。业务异常可以包括语音短信异常，彩信异常，套餐异常等。
步骤202，安全功能网元向接入网设备发送终端设备的第二标识，该第二标识用于标识存在异常行为的终端设备。相应的，接入网设备可以接收到该第二标识。
作示例，下面给出安全功能网元向接入网设备发送第二标识的两种具体实现方法。
实现方法一，安全功能网元向接入网设备发送第一消息，第一消息包括第二标识，第一消息用于指示终端设备为限制接入的终端设备。
即第一消息本身具有指示功能，具体用于指示第一消息中的第二标识所标识的终端设备为限制接入的终端设备。
这里的第一消息，也可以称为通知消息等，本申请对该消息的具体名称不做限定。
实现方法二，安全功能网元向接入网设备发送第二标识和指示信息，指示信息用 于指示终端设备为限制接入的终端设备。
比如，第二标识和指示信息可以是携带于同一个消息中发送至接入网设备的，也可以是通过两个消息分别发送至接入网设备的。
该实现方法二中，是通过一个额外的指示信息，指示终端设备为限制接入的终端设备。
接入网设备在接收到第二标识后，可以存储第二标识。例如可以以列表的形式，将第二标识存储于接入网设备的存储空间中或存储于接入网设备之外的一个存储空间中，如存储于统一数据管理(unified data management，UDM)网元中。
下面以按照列表的存储方式为例进行说明。如表1所示，为接入网设备存储的限制接入的终端设备的标识。
表1
限制接入的终端设备的第二标识
UE ID1
UE ID2
UE ID3
……
需要说明的是，本申请中第二标识用于标识存在异常行为的终端设备，因此接入网设备记录的任一个限制接入的终端设备的标识均可以称为第二标识。如表1所示，UE ID1、UE ID2、UE ID3均可以称为第二标识，UE ID1、UE ID2、UE ID3所分别标识的终端设备，均为限制接入的终端设备。
本申请中，第二标识的实现方式可以包括但不限于以下实现方式：
在4G中，第二标识可以是S-TMSI、S-TMSI的哈希值、GUTI、GUTI的哈希值、eNB UE S1AP ID、或MME UE S1AP ID。
在5G中，第二标识可以是5G-S-TMSI、5G-S-TMSI的哈希值、5G-GUTI、5G-GUTI的哈希值、gNB UE N2AP ID、或AMF UE N2AP ID。
当然，在未来通信，如第六代(the 6th generation,6G)通信中，第二标识还可以是其他标识，本申请不做限定。
需要说明的是，该步骤202也可以由以下步骤202A和步骤202B替换：
步骤202A，安全功能网元向核心网设备发送终端设备的第二标识，该第二标识用于标识存在异常行为的终端设备。相应的，核心网设备可以接收到该第二标识。
该核心网设备可以是AMF网元或MME。
步骤202B，核心网设备向接入网设备发送终端设备的第二标识。相应的，接入网设备可以接收到该第二标识。
步骤203，接入网设备释放与终端设备之间的连接。该步骤203为可选步骤。
比如，当限制接入的终端设备为连接态的终端设备时，则接入网设备可以通过执行步骤203，释放与该终端设备之间的连接，从而可以降低接入网设备的负载。
再比如，当限制接入的终端设备为不活跃态的终端设备时，则接入网设备可以通 过执行步骤203，释放与该终端设备之间的连接，从而可以降低接入网设备的负载。
再比如，当限制接入的终端设备为不活跃态的终端设备时，则接入网设备也可以不执行步骤203。
在5G中，引入了不活跃态，当终端设备从连接态进入不活跃态时，基站将挂起终端设备，此时，终端设备和接入网设备删除部分接入层(access stratum，AS)上下文，以及保留部分AS上下文，例如可以保留接入层密钥(5G中可以称为KgNB)、终端设备的安全能力、终端设备和终端设备接入的源基站之间通信的安全算法(包括完整性保护算法和加密算法)等。当终端设备处于不活跃态时，由于终端设备上保留了部分AS上下文，因此相较于终端设备从空闲态进入连接态，终端设备从不活跃态进入连接态会更加快速。
这里，若接入网设备决定释放与终端设备之间的连接，则可以通过以下任一方法实现：
方法一，若第二标识是S-TMSI、5G-S-TMSI、GUTI、5G-GUTI、gNB UE N2AP ID或AMF UE N2AP ID、eNB UE S1AP ID或MME UE S1AP ID中的任一个，则可以根据第二标识，确定第二标识所标识的终端设备，然后释放与该终端设备之间的连接。
方法二，若第二标识是S-TMSI或GUTI，则接入网设备还可以接收eNB UE S1AP ID或MME UE S1AP ID，然后根据eNB UE S1AP ID或MME UE S1AP ID，确定第二标识所标识的终端设备，然后释放与终端设备之间的连接。若第二标识是5G-S-TMSI或5G-GUTI，则接入网设备还可以接收gNB UE N2AP ID或AMF UE N2AP ID，然后根据gNB UE N2AP ID或AMF UE N2AP ID，确定第二标识所标识的终端设备，然后释放与终端设备之间的连接。
通过执行上述步骤201-步骤202，或者执行步骤201-步骤203，可实现由安全功能网元确定存在异常行为的终端设备，并将这些终端设备的第二标识发送给接入网设备，由接入网设备存储这些终端设备的第二标识。由此，当后续有终端设备，如第一终端设备向接入网设备请求建立连接时，则接入网设备可以根据存储的第二标识，判断该第一终端设备是否为限制接入的终端设备，并根据判断结果，决策是否限制该终端设备的接入。从而可实现对存在异常行为的终端设备进行限制接入。
下面对第一终端设备请求接入的过程进行具体说明。需要说明的是，这里的第一终端设备可以是接入网设备存储的第二标识所标识的终端设备中的某个终端设备，也可以不是接入网设备存储的第二标识所标识的终端设备中的任一终端设备。
步骤204，第一终端设备向接入网设备发送第一终端设备的第一标识，第一标识用于标识第一终端设备。相应的，接入网设备可以接收该第一标识。
这里的第一终端设备可以是空闲态的终端设备或不活跃态的终端设备。
当该第一终端设备是空闲态的终端设备时，该步骤204可以通过以下方法实现：第一终端设备向接入网设备发送第一请求消息，该第一请求消息包括第一终端设备的第一标识，该第一请求消息用于请求建立无线资源控制(radio resource control，RRC)连接。该第一请求消息也可以称为请求消息、或称为连接建立请求消息、或有其他名称。
当该第一终端设备是不活跃态的终端设备时，该步骤204可以通过以下方法实现：第一终端设备向接入网设备发送第二请求消息，该第二请求消息包括第一终端设备的 第一标识，该第二请求消息用于请求恢复RRC连接。该第二请求消息也可以称为请求消息、或称为连接恢复请求消息、或有其他名称。
步骤205，接入网设备将第一标识和第二标识进行匹配。
这里的“匹配”，指的是第一标识和第二标识所指示的终端设备是同一个终端设备。
若第一标识和第二标识匹配，表明该第一终端设备是限制接入的终端设备，则执行步骤206。
若第一标识和第二标识不匹配，表明该第一终端不是限制接入的终端设备，即该第一终端设备是正常的终端设备，则接入网设备可以不限制该第一终端设备的接入，因而可以建立与第一终端设备之间的连接。
下面介绍几种将第一标识和第二标识进行匹配的实现方法。
实现方法一，接入网设备将第一标识与第二标识进行匹配。
在4G通信中，第一标识是GUTI，第二标识是GUTI；或者，第一标识是S-TMSI，第二标识是S-TMSI；或者，第一标识是GUTI的哈希值，第二标识是GUTI的哈希值；或者，第一标识是S-TMSI的哈希值，第二标识是S-TMSI的哈希值。
在5G通信中，第一标识是5G-GUTI，第二标识是5G-GUTI；或者，第一标识是5G-S-TMSI，第二标识是5G-S-TMSI；或者，第一标识是5G-GUTI的哈希值，第二标识是5G-GUTI的哈希值；或者，第一标识是5G-S-TMSI的哈希值，第二标识是5G-S-TMSI的哈希值。
实现方法二，接入网设备根据第二标识确定终端设备的第三标识；接入网设备将第一标识与第三标识进行匹配。
在4G通信中，第一标识是S-TMSI，第二标识是GUTI，第三标识是S-TMSI；或者，第一标识是GUTI的哈希值，第二标识是GUTI，第三标识是GUTI的哈希值；或者，第一标识是S-TMSI的哈希值，第二标识是S-TMSI，第三标识是S-TMSI的哈希值。或者，第一标识是S-TMSI，第二标识是eNB UE S1AP ID或MME UE S1AP ID，第三标识是S-TMSI。
在5G通信中，第一标识是5G-S-TMSI，第二标识是5G-GUTI，第三标识是5G-S-TMSI；或者，第一标识是5G-GUTI的哈希值，第二标识是5G-GUTI，第三标识是5G-GUTI的哈希值；或者，第一标识是5G-S-TMSI的哈希值，第二标识是5G-S-TMSI，第三标识是5G-S-TMSI的哈希值。或者，第一标识是5G-S-TMSI，第二标识是gNB UE N2AP ID或AMF UE N2AP ID，第三标识是5G-S-TMSI。
实现方法三，接入网设备根据第一标识确定第一终端设备的第四标识；接入网设备将第四标识与第二标识进行匹配。
在4G通信中，第一标识是GUTI，第二标识是S-TMSI，第四标识是S-TMSI；或者，第一标识是S-TMSI，第二标识是S-TMSI的哈希值，第四标识是S-TMSI的哈希值；或者，第一标识是GUTI，第二标识是GUTI的哈希值，第四标识是GUTI的哈希值。
在5G通信中，第一标识是5G-GUTI，第二标识是5G-S-TMSI，第四标识是5G-S-TMSI；或者，第一标识是5G-S-TMSI，第二标识是5G-S-TMSI的哈希值，第四标识是5G-S-TMSI的哈希值；或者，第一标识是5G-GUTI，第二标识是5G-GUTI的哈希值，第四标识是5G-GUTI的哈希值。
实现方法四，接入网设备根据第一标识确定第一终端设备的第五标识，根据第二标识确定终端设备的第六标识；接入网设备将第五标识与第六标识进行匹配。
在4G通信中，第一标识是S-TMSI，第五标识是S-TMSI的哈希值，第二标识是GUTI，第六标识是S-TMSI的哈希值；或者，第一标识是S-TMSI，第五标识是S-TMSI的哈希值，第二标识是eNB UE S1AP ID或MME UE S1AP ID，第六标识是S-TMSI的哈希值。
在5G通信中，第一标识是5G-S-TMSI，第五标识是5G-S-TMSI的哈希值，第二标识是5G-GUTI，第六标识是5G-S-TMSI的哈希值；或者，第一标识是5G-S-TMSI，第五标识是5G-S-TMSI的哈希值，第二标识是gNB UE N2AP ID或AMF UE N2AP ID，第六标识是5G-S-TMSI的哈希值。
步骤206，接入网设备限制第一终端设备的接入。
作为一种实现方式，接入网设备限制第一终端设备的接入可以是接入网设备向第一终端设备发送拒绝消息，该拒绝消息用于拒绝第一终端设备的接入。可选的，该拒绝消息还可以包括原因值，原因值用于指示限制第一终端设备接入的原因为安全原因。
作为又一种实现方式，接入网设备限制第一终端设备的接入还可以是接入网设备不执行后续操作。即接入网设备既不向第一终端设备发送拒绝消息，也不执行建立与第一终端设备之间的连接，从而第一终端设备无法接入到接入网设备，达到限制第一终端设备接入的目的。
可选的，在步骤203之后还可以包括以下步骤207。
步骤207，第一终端设备在等待设定时长后，再次尝试接入。
例如，当拒绝消息包括原因值，且该原因值为安全原因，则第一终端设备可以根据该原因值等待设定时长后，再次尝试接入。该设定时长可以是由接入网设备通过步骤206发送至第一终端设备的，也可以是由第一终端设备自身设置的。
其中，尝试接入指的是，第一终端设备直接向第一接入设备发起建立或恢复连接的请求。或者，尝试接入指的是，第一终端设备随机生成0至1之间的一个值，若该值小于预设值(该预设值可以是由接入网设备通过步骤206发送至第一终端设备或由第一终端设备预先设置的)，则第一终端设备向第一接入设备发起建立或恢复连接的请求。若该值大于或等于预设值，则不发起建立或恢复连接的请求。
通过上述方法，接入网设备中预先记录了存在异常行为的终端设备的第二标识，当有第一终端设备向接入网设备发送第一标识，以请求建立连接或请求恢复连接时，则接入网设备先根据第一标识，判断第一标识是否与接入网设备记录的第二标识匹配，若匹配，表明该第一标识对应的第一终端设备是存在异常行为的终端设备，因而接入网设备限制该第一终端设备的接入，从而实现有效控制终端设备的攻击。
作为一种实现方式，上述步骤202中，若安全功能网元以列表的形式向接入网设备发送了多个第二标识，则接入网设备在接收到第二标识之后，还可以启动一个定时器，该定时器是针对该列表中的所有第二标识所标识的终端设备的。该定时器用于指示限制第二标识所标识的终端设备的时长。比如，安全功能网元向接入网设备发送的是如表1所示的列表，包括了UE ID1、UE ID2和UE ID3，则该定时器用于指示限制UE ID1、UE ID2和UE ID3所标识的终端设备的时长。即在该定时器超时前，若有第二标识所标识的终端设备中的任一终端设备向接入网设备请求接入到核心网设备，则 核心网设备将会限制该终端设备的接入。
作为又一种实现方式，上述步骤202中，若安全功能网元以列表的形式向接入网设备发送了多个第二标识或者是单独向接入网设备发送每个第二标识，则接入网设备在接收到第二标识之后，还可以针对每个第二标识，分别启动一个定时器，该定时器是针对该第二标识所标识的终端设备的。该定时器用于指示限制第二标识所标识的终端设备的时长。比如，接入网设备在接收到UE ID1后为UE ID1所标识的终端设备启动第一定时器，在接收到UE ID2后为UE ID2所标识的终端设备启动第二定时器，在接收到UE ID3后为UE ID3所标识的终端设备启动第三定时器等等，每个定时器分别用于指示限制一个终端设备的时长。即在第一定时器超时前，若UE ID1所标识的终端设备向接入网设备请求接入到核心网设备，则核心网设备将会限制该终端设备的接入。在第二定时器超时前，若UE ID2所标识的终端设备向接入网设备请求接入到核心网设备，则核心网设备将会限制该终端设备的接入。在第三定时器超时前，若UE ID3所标识的终端设备向接入网设备请求接入到核心网设备，则核心网设备将会限制该终端设备的接入。
作为又一种实现方式，还可以是接入网设备在步骤205中确定第一标识和第二标识不匹配之后，为该第一终端设备启动一个定时器，该定时器用于指示限制该第一终端设备接入的时长。
需要说明的是，上述任一定时器的时长，可以是由接入网设备自身设置的，也可以是由安全功能网元向接入网设备指定的，本申请对此不作限定。
如图3所示，为本申请提供的又一种限制终端设备接入的方法，该方法包括以下步骤：
步骤301-步骤302，同实施例2的步骤201-步骤202，可参考前述描述。
步骤303，接入网设备根据第二标识，向终端设备的上下文中添加限制指示。
这里的终端设备可以是不活跃态的终端设备。
本申请中，第二标识的实现方式可以包括但不限于以下实现方式：
在4G中，第二标识可以是S-TMSI、S-TMSI的哈希值、GUTI、GUTI的哈希值、eNB UE S1AP ID、或MME UE S1AP ID。
在5G中，第二标识可以是5G-S-TMSI、5G-S-TMSI的哈希值、5G-GUTI、5G-GUTI的哈希值、gNB UE N2AP ID、或AMF UE N2AP ID。
当然，在未来通信，如6G通信中，第二标识还可以是其他标识，本申请不做限定。
接入网设备在接收到第二标识后，根据第二标识确定终端设备的上下文，然后在终端设备的上下文中添加限制指示，该限制指示用于终端设备为限制接入的终端设备。
通过执行上述步骤301-步骤303，可实现由安全功能网元确定存在异常行为的终端设备，并将这些终端设备的第二标识发送给接入网设备，由接入网设备根据第二标识，分别在相应的终端设备的终端上下文中添加限制指示，从而指示该终端设备是需要限制接入的终端设备。由此，当后续有终端设备，如第一终端设备向接入网设备请求恢复连接时，则接入网设备可以根据第一终端设备的上下文，判断该第一终端设备是否为限制接入的终端设备，并根据判断结果，决策是否限制该终端设备的接入。从 而可实现对存在异常行为的终端设备进行限制接入。
下面对第一终端设备请求接入的过程进行具体说明。需要说明的是，这里的第一终端设备的上下文中可能有限制指示(即通过上述步骤301-步骤303添加至上下文中的)，也可能没有限制指示。
步骤304，第一终端设备向接入网设备发送第一终端设备的第一标识，第一标识用于标识第一终端设备。相应的，接入网设备可以接收到该第一标识。
这里的第一终端设备可以是不活跃态的终端设备。
作为一种实现方式，该步骤304可以通过以下方法实现：第一终端设备向接入网设备发送请求消息，该请求消息包括第一终端设备的第一标识，该请求消息用于请求恢复RRC连接。该请求消息也可以称为连接恢复请求消息、或有其他名称。
这里的第一标识，例如可以是S-TMSI、5G-S-TMSI、GUTI、5G-GUTI、或不活跃-无线网络临时标识(INACTIVE-Radio Network Temporary Identifier，I-RNTI)，或者还可以是S-TMSI的哈希值、5G-S-TMSI的哈希值、GUTI的哈希值、5G-GUTI的哈希值、或I-RNTI的哈希值。
步骤305，接入网设备判断第一终端设备的上下文中是否包括限制指示。
接入网设备根据第一标识，获取第一终端设备的上下文，并判断该上下文中是否包括限制指示。
若该上下文中包括限制指示，表明该第一终端设备是限制接入的终端设备，则执行步骤306。
若该上下文中不包括限制指示，表明该第一终端不是限制接入的终端设备，即该第一终端设备是正常的终端设备，则接入网设备不需要限制该第一终端设备的接入，因而可以建立与第一终端设备之间的连接。
步骤306，同图2所示的实施例的步骤206，可参考前述描述。
可选的，在步骤306之后还可以包括步骤307。该步骤307同图2所示的实施例的步骤207，可参考前述描述。
通过上述方法，接入网设备中预先在存在异常行为的终端设备的上下文中记录了限制指示，当有第一终端设备向接入网设备发送第一标识，以请求恢复连接时，则接入网设备先根据第一标识，判断第一终端设备的上下文中是否包括限制指示，若包括限制指示，表明该第一终端设备是存在异常行为的终端设备，因而接入网设备限制该第一终端设备的接入，从而实现有效控制终端设备的攻击。
作为又一种实现方式，接入网设备在根据第二标识向相应的终端设备的上下文中添加了限制指示之后，还可以启动一个定时器，该定时器是针对该第二标识所标识的终端设备的。该定时器用于指示限制第二标识所标识的终端设备的时长。
作为又一种实现方式，还可以是接入网设备在步骤305中确定第一终端设备的上下文中包括限制指示之后，为该第一终端设备启动一个定时器，该定时器用于指示限制该第一终端设备接入的时长。
需要说明的是，上述任一定时器的时长，可以是由接入网设备自身设置的，也可以是由安全功能网元向接入网设备指定的，本申请对此不作限定。
可以理解的是，上述实现各网元为了实现上述功能，其包括了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的 实施例描述的各示例的单元及算法步骤，本发明能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
在采用集成的单元的情况下，图4示出了本发明实施例中所涉及的装置的可能的示例性框图，该装置400可以以软件的形式存在。装置400可以包括：处理单元402和通信单元403。作为一种实现方式，该通信单元403可以包括接收单元和发送单元。处理单元402用于对装置400的动作进行控制管理。通信单元403用于支持装置400与其他网络实体的通信。装置400还可以包括存储单元401，用于存储装置400的程序代码和数据。
其中，处理单元402可以是处理器或控制器，例如可以是通用中央处理器(central processing unit，CPU)，通用处理器，数字信号处理(digital signal processing，DSP)，专用集成电路(application specific integrated circuits，ASIC)，现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包括一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元403可以是通信接口、收发器或收发电路等，其中，该通信接口是统称，在具体实现中，该通信接口可以包括多个接口。存储单元401可以是存储器。
该装置400可以为接入网设备或接入网设备中的芯片。处理单元402可以支持装置400执行上文中各方法示例中接入网设备的动作，例如，处理单元402用于支持装置400执行图2中的步骤205，图3中的步骤303和步骤305，和/或用于本文所描述的技术的其它过程。通信单元403用于支持装置400与安全功能网元、终端设备的通信。例如，通信单元用于支持装置400执行图2中的步骤202-步骤204和步骤206，图3中的步骤302、步骤304和步骤306。
具体地，当通信单元403包括发送单元和接收单元时，在一个实施例中，接收单元，用于接收来自第一终端设备的第一标识，所述第一标识用于标识所述第一终端设备；处理单元，用于若所述第一标识和第二标识匹配，则限制所述第一终端设备的接入；其中，所述第二标识用于标识存在异常行为的终端设备。
在一种可能的实现方式中，所述处理单元，还用于将所述第一标识与所述第二标识进行匹配。
在一种可能的实现方式中，所述处理单元，具体用于根据所述第二标识，确定所述终端设备的第三标识；所述接入网设备将所述第一标识与所述第三标识进行匹配。
在一种可能的实现方式中，所述处理单元，具体用于：根据所述第一标识，确定所述第一终端设备的第四标识；将所述第四标识与所述第二标识进行匹配。
在一种可能的实现方式中，所述接收单元，还用于在所述处理单元将所述第一标识与所述第二标识进行匹配之前，接收来自安全功能网元的所述第二标识。
在一种可能的实现方式中，所述处理单元，具体用于在所述接收单元接收来自安全功能网元的第二标识之后，启动计时器；若所述计时器未超时，则所述接入网设备 限制所述第一终端设备的接入。
在一种可能的实现方式中，所述接收单元，具体用于：接收来自所述安全功能网元的第一消息，所述第一消息包括所述第二标识，所述第一消息用于指示所述终端设备为限制接入的终端设备；或者，接收来自所述安全功能网元的所述第二标识和指示信息，所述指示信息用于指示所述终端设备为限制接入的终端设备。
在一种可能的实现方式中，所述处理单元，还用于在所述接收单元接收来自安全功能网元的所述第二标识之后，所述接收单元接收来自所述第一终端设备的所述第一标识之前，释放与所述终端设备之间的连接。
在一种可能的实现方式中，所述发送单元，用于向所述第一终端设备发送原因值，所述原因值用于指示限制所述第一终端设备接入的原因为安全原因。
具体地，当通信单元403包括发送单元和接收单元时，在又一个实施例中，接收单元，用于接收来自终端设备的第一标识，所述第一标识用于标识所述终端设备；处理单元，用于根据所述第一标识，获取所述终端设备的上下文；若所述终端设备的上下文包括限制指示，则限制所述终端设备的接入，所述限制指示用于所述终端设备为限制接入的终端设备。
在一种可能的实现方式中，所述接收单元，还用于接收来自安全功能网元的第二标识，所述第二标识用于标识存在异常行为的所述终端设备；所述处理单元，还用于根据所述第二标识，向所述终端设备的上下文中添加所述限制指示。
在一种可能的实现方式中，所述处理单元，具体用于在所述接收单元来自安全功能网元的第二标识之后，启动计时器；若所述计时器未超时，则限制所述终端设备的接入。
在一种可能的实现方式中，所述接收单元，具体用于：接收来自所述安全功能网元的第一消息，所述第一消息包括所述第二标识，所述第一消息用于指示所述终端设备为限制接入的终端设备；或者，接收来自所述安全功能网元的所述第二标识和指示信息，所述指示信息用于指示所述终端设备为限制接入的终端设备。
在一种可能的实现方式中，所述发送单元，用于向所述终端设备发送原因值，所述原因值用于指示限制所述终端设备接入的原因为安全原因。
该装置400还可以是本申请所涉及的安全功能网元或安全功能网元中的芯片。处理单元402可以支持装置400执行上文中各方法示例中安全功能网元的动作，例如，处理单元402用于支持装置400执行图2中的步骤201，图3中的步骤301。通信单元403可以支持装置400与接入网设备之间的通信，例如，通信单元403用于支持装置400执行图2中的步骤203和步骤206。
具体地，当通信单元403包括发送单元和接收单元时，在一个实施例中，处理单元，用于根据终端设备的流量数据，确定所述终端设备存在异常行为；发送单元，用于向接入网设备发送所述终端设备的第二标识，所述第二标识用于标识所述终端设备。
在一种可能的实现方式中，所述发送单元，具体用于：向所述接入网设备发送第一消息，所述第一消息包括所述第二标识，所述第一消息用于指示所述终端设备为限制接入的终端设备；或者，向所述接入网设备发送所述第二标识和指示信息，所述指示信息用于指示所述终端设备为限制接入的终端设备。
该装置400还可以是本申请所涉及的终端设备(或第一终端设备)，或终端设备 (或第一终端设备)中的芯片。处理单元402可以支持装置400执行上文中各方法示例中终端设备(第一终端设备)的动作，例如，处理单元402用于支持装置400执行图2中的步骤207，图3中的步骤307，和/或用于本文所描述的技术的其它过程。通信单元403可以支持装置400与接入网设备之间的通信，例如，通信单元403用于支持装置400执行图2中的步骤203，步骤204步骤206，图3中的步骤304和步骤306。
具体地，当通信单元403包括发送单元和接收单元时，在一个实施例中，发送单元，用于向接入网设备发送所述终端设备的第一标识，所述第一标识用于标识所述终端设备；
接收单元，用于接收来自所述接入网设备的拒绝消息，所述拒绝消息包括原因值，所述原因值用于指示限制所述终端设备接入的原因为安全原因。
在一种可能的实现方式中，所述处理单元，用于根据所述原因值，等待设定时长后再次尝试接入。
参阅图5所示，为本申请提供的一种装置示意图，该装置可以是上述安全功能网元。该装置500包括：处理器502、通信接口503、存储器501。可选的，装置500还可以包括通信线路504。其中，通信接口503、处理器502以及存储器501可以通过通信线路504相互连接；通信线路504可以是外设部件互连标准(peripheral component interconnect，简称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。所述通信线路504可以分为地址总线、数据总线、控制总线等。为便于表示，图5中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
处理器502可以是一个CPU，微处理器，ASIC，或一个或多个用于控制本申请方案程序执行的集成电路。
通信接口503，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(wireless local area networks，WLAN)，有线接入网等。
存储器501可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically er服务器able programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过通信线路504与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器501用于存储执行本申请方案的计算机执行指令，并由处理器502来控制执行。处理器502用于执行存储器501中存储的计算机执行指令，从而实现本申请上述实施例提供的限制终端设备接入的方法。
可选的，本申请实施例中的计算机执行指令也可以称之为应用程序代码，本申请实施例对此不作具体限定。
图6示出了本发明实施例中所涉及的终端设备的一种可能的设计结构的简化示意图。所述终端600包括发射器601，接收器602和处理器603。其中，处理器603也可以为控制器，图6中表示为“控制器/处理器603”。可选的，所述终端600还可以包括调制解调处理器605，其中，调制解调处理器605可以包括编码器606、调制器607、解码器608和解调器609。
在一个示例中，发射器601调节(例如，模拟转换、滤波、放大和上变频等)输出采样并生成上行链路信号，该上行链路信号经由天线发射给上述实施例中所述的接入网设备。在下行链路上，天线接收上述实施例中接入网设备发射的下行链路信号。接收器602调节(例如，滤波、放大、下变频以及数字化等)从天线接收的信号并提供输入采样。在调制解调处理器605中，编码器606接收要在上行链路上发送的业务数据和信令消息，并对业务数据和信令消息进行处理(例如，格式化、编码和交织)。调制器607进一步处理(例如，符号映射和调制)编码后的业务数据和信令消息并提供输出采样。解调器609处理(例如，解调)该输入采样并提供符号估计。解码器608处理(例如，解交织和解码)该符号估计并提供发送给终端600的已解码的数据和信令消息。编码器606、调制器607、解调器609和解码器608可以由合成的调制解调处理器605来实现。这些单元根据无线接入网采用的无线接入技术(例如，LTE及其他演进系统的接入技术)来进行处理。需要说明的是，当终端600不包括调制解调处理器605时，调制解调处理器605的上述功能也可以由处理器603完成。
处理器603对终端设备600的动作进行控制管理，用于执行上述本发明实施例中由终端设备600进行的处理过程。例如，处理器603还用于执行图2-图3所示方法中涉及终端设备(或第一终端设备)的处理过程和/或本申请所描述的技术方案的其他过程。
进一步的，终端设备600还可以包括存储器604，存储器604用于存储用于终端设备600的程序代码和数据。
图7示出了本发明实施例提供的接入网设备的一种可能的结构示意图。接入网设备700包括处理器702和通信接口704。其中，处理器702也可以为控制器，图7中表示为“控制器/处理器702”。通信接口704用于支持接入网设备与其他网元(例如安全功能网元)进行通信。进一步的，接入网设备700还可以包括发射器/接收器701。所述发射器/接收器701用于支持接入网设备与上述实施例中的终端设备(或第一终端设备)之间进行无线电通信。所述处理器702可以执行各种用于与终端设备(或第一终端设备)通信的功能。在上行链路，来自终端设备(或第一终端设备)的上行链路信号经由天线接收，由接收器701进行解调(例如将高频信号解调为基带信号)，并进一步由处理器702进行处理来恢复终端设备(或第一终端设备)发送的业务数据和信令信息。在下行链路上，业务数据和信令消息由处理器702进行处理，并由发射器701进行调制(例如将基带信号调制为高频信号)来产生下行链路信号，并经由天线发射给终端设备(或第一终端设备)。需要说明的是，上述解调或调制的功能也可以由处理器702完成。
例如，处理器702还用于执行图2-图3所示方法中涉及接入网设备的处理过程和/或本申请所描述的技术方案的其他过程。
进一步的，接入网设备700还可以包括存储器703，存储器703用于存储接入网设备700的程序代码和数据。
可以理解的是，图7仅仅示出了接入网设备700的简化设计。在实际应用中，接入网设备700可以包括任意数量的发射器，接收器，处理器，控制器，存储器，通信单元等，而所有可以实现本发明实施例的接入网设备都在本发明实施例的保护范围之内。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包括一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。
本申请实施例中所描述的各种说明性的逻辑单元和电路可以通过通用处理器，数字信号处理器，专用集成电路(ASIC)，现场可编程门阵列(FPGA)或其它可编程逻辑装置，离散门或晶体管逻辑，离散硬件部件，或上述任何组合的设计来实现或操作所描述的功能。通用处理器可以为微处理器，可选地，该通用处理器也可以为任何传统的处理器、控制器、微控制器或状态机。处理器也可以通过计算装置的组合来实现，例如数字信号处理器和微处理器，多个微处理器，一个或多个微处理器联合一个数字信号处理器核，或任何其它类似的配置来实现。
本申请实施例中所描述的方法或算法的步骤可以直接嵌入硬件、处理器执行的软件单元、或者这两者的结合。软件单元可以存储于RAM存储器、闪存、ROM存储器、EPROM存储器、EEPROM存储器、寄存器、硬盘、可移动磁盘、CD-ROM或本领域中其它任意形式的存储媒介中。示例性地，存储媒介可以与处理器连接，以使得处理器可以从存储媒介中读取信息，并可以向存储媒介存写信息。可选地，存储媒介还可以集成到处理器中。处理器和存储媒介可以设置于ASIC中，ASIC可以设置于终端设备中。可选地，处理器和存储媒介也可以设置于终端设备中的不同的部件中。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管结合具体特征及其实施例对本申请进行了描述，显而易见的，在不脱离本申请的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅 仅是所附权利要求所界定的本申请的示例性说明，且视为已覆盖本申请范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包括这些改动和变型在内。

Claims (28)

  1. 一种限制终端设备接入的方法，其特征在于，包括：
    接入网设备接收来自第一终端设备的第一标识，所述第一标识用于标识所述第一终端设备；
    若所述第一标识和第二标识匹配，则所述接入网设备限制所述第一终端设备的接入；其中，所述第二标识用于标识存在异常行为的终端设备。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述接入网设备将所述第一标识与所述第二标识进行匹配。
  3. 根据权利要求2所述的方法，其特征在于，所述接入网设备将所述第一标识与所述第二标识进行匹配，包括：所述接入网设备根据所述第二标识，确定所述终端设备的第三标识；所述接入网设备将所述第一标识与所述第三标识进行匹配。
  4. 根据权利要求2所述的方法，其特征在于，所述接入网设备将所述第一标识与所述第二标识进行匹配，包括：
    所述接入网设备根据所述第一标识，确定所述第一终端设备的第四标识；
    所述接入网设备将所述第四标识与所述第二标识进行匹配。
  5. 根据权利要求2-4任一所述的方法，其特征在于，所述接入网设备将所述第一标识与所述第二标识进行匹配之前，所述方法还包括：
    所述接入网设备接收来自安全功能网元的所述第二标识。
  6. 根据权利要求5所述的方法，其特征在于，所述接入网设备接收来自安全功能网元的所述第二标识之后，还包括：
    所述接入网设备启动计时器；
    所述接入网设备限制所述第一终端设备的接入，包括：
    若所述计时器未超时，则所述接入网设备限制所述第一终端设备的接入。
  7. 根据权利要求5或6所述的方法，其特征在于，所述接入网设备接收来自安全功能网元的所述第二标识之后，接收来自所述第一终端设备的所述第一标识之前，还包括：
    所述接入网设备释放与所述终端设备之间的连接。
  8. 根据权利要求5-7任一所述的方法，其特征在于，所述接入网设备接收来自安全功能网元的所述第二标识，包括：
    所述接入网设备接收来自所述安全功能网元的第一消息，所述第一消息包括所述第二标识，所述第一消息用于指示所述终端设备为限制接入的终端设备；或者，
    所述接入网设备接收来自所述安全功能网元的所述第二标识和指示信息，所述指示信息用于指示所述终端设备为限制接入的终端设备。
  9. 根据权利要求1-8任一所述的方法，其特征在于，所述方法还包括：
    所述接入网设备向所述第一终端设备发送原因值，所述原因值用于指示限制所述第一终端设备接入的原因为安全原因。
  10. 一种限制终端设备接入的方法，其特征在于，包括：
    所述接入网设备接收来自终端设备的第一标识，所述第一标识用于标识所述终端设备；
    所述接入网设备根据所述第一标识，获取所述终端设备的上下文；
    若所述终端设备的上下文包括限制指示，则所述接入网设备限制所述终端设备的接入，所述限制指示用于所述终端设备为限制接入的终端设备。
  11. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    所述接入网设备接收来自安全功能网元的第二标识，所述第二标识用于标识存在异常行为的所述终端设备；
    所述接入网设备根据所述第二标识，向所述终端设备的上下文中添加所述限制指示。
  12. 根据权利要求11所述的方法，其特征在于，所述接入网设备接收来自安全功能网元的第二标识之后，还包括：
    所述接入网设备启动计时器；
    所述接入网设备限制所述终端设备的接入，包括：
    若所述计时器未超时，则所述接入网设备限制所述终端设备的接入。
  13. 根据权利要求11或12所述的方法，其特征在于，所述接入网设备接收来自安全功能网元的第二标识，包括：
    所述接入网设备接收来自所述安全功能网元的第一消息，所述第一消息包括所述第二标识，所述第一消息用于指示所述终端设备为限制接入的终端设备；或者，
    所述接入网设备接收来自所述安全功能网元的所述第二标识和指示信息，所述指示信息用于指示所述终端设备为限制接入的终端设备。
  14. 根据权利要求10-13任一所述的方法，其特征在于，所述方法还包括：
    所述接入网设备向所述终端设备发送原因值，所述原因值用于指示限制所述终端设备接入的原因为安全原因。
  15. 一种装置，其特征在于，包括：
    接收单元，用于接收来自第一终端设备的第一标识，所述第一标识用于标识所述第一终端设备；
    处理单元，用于若所述第一标识和第二标识匹配，则限制所述第一终端设备的接入；其中，所述第二标识用于标识存在异常行为的终端设备。
  16. 根据权利要求15所述的装置，其特征在于，所述处理单元，还用于将所述第一标识与所述第二标识进行匹配。
  17. 根据权利要求16所述的装置，其特征在于，所述处理单元，具体用于根据所述第二标识，确定所述终端设备的第三标识；所述接入网设备将所述第一标识与所述第三标识进行匹配。
  18. 根据权利要求16所述的装置，其特征在于，所述处理单元，具体用于：
    根据所述第一标识，确定所述第一终端设备的第四标识；
    将所述第四标识与所述第二标识进行匹配。
  19. 根据权利要求16-18任一所述的装置，其特征在于，所述接收单元，还用于在所述处理单元将所述第一标识与所述第二标识进行匹配之前，接收来自安全功能网元的所述第二标识。
  20. 根据权利要求19所述的装置，其特征在于，所述处理单元，具体用于在所述接收单元接收来自安全功能网元的所述第二标识之后，启动计时器；若所述计时器未 超时，则所述接入网设备限制所述第一终端设备的接入。
  21. 根据权利要求19或20所述的装置，其特征在于，所述处理单元，还用于在所述接收单元接收来自安全功能网元的所述第二标识之后，所述接收单元接收来自所述第一终端设备的所述第一标识之前，释放与所述终端设备之间的连接。
  22. 根据权利要求19-21任一所述的装置，其特征在于，所述接收单元，具体用于：
    接收来自所述安全功能网元的第一消息，所述第一消息包括所述第二标识，所述第一消息用于指示所述终端设备为限制接入的终端设备；或者，
    接收来自所述安全功能网元的所述第二标识和指示信息，所述指示信息用于指示所述终端设备为限制接入的终端设备。
  23. 根据权利要求15-22任一所述的装置，其特征在于，所述装置还包括发送单元，用于向所述第一终端设备发送原因值，所述原因值用于指示限制所述第一终端设备接入的原因为安全原因。
  24. 一种装置，其特征在于，包括：
    接收单元，用于接收来自终端设备的第一标识，所述第一标识用于标识所述终端设备；
    处理单元，用于根据所述第一标识，获取所述终端设备的上下文；若所述终端设备的上下文包括限制指示，则限制所述终端设备的接入，所述限制指示用于所述终端设备为限制接入的终端设备。
  25. 根据权利要求24所述的装置，其特征在于，所述接收单元，还用于接收来自安全功能网元的第二标识，所述第二标识用于标识存在异常行为的所述终端设备；
    所述处理单元，还用于根据所述第二标识，向所述终端设备的上下文中添加所述限制指示。
  26. 根据权利要求25所述的装置，其特征在于，所述处理单元，具体用于在所述接收单元来自安全功能网元的第二标识之后，启动计时器；若所述计时器未超时，则限制所述终端设备的接入。
  27. 根据权利要求25或26所述的装置，其特征在于，所述接收单元，具体用于：
    接收来自所述安全功能网元的第一消息，所述第一消息包括所述第二标识，所述第一消息用于指示所述终端设备为限制接入的终端设备；或者，
    接收来自所述安全功能网元的所述第二标识和指示信息，所述指示信息用于指示所述终端设备为限制接入的终端设备。
  28. 根据权利要求24-27任一所述的装置，其特征在于，所述装置还包括发送单元，用于向所述终端设备发送原因值，所述原因值用于指示限制所述终端设备接入的原因为安全原因。
PCT/CN2019/089137 2018-06-13 2019-05-29 一种限制终端设备接入的方法及装置 WO2019237926A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19819076.1A EP3780688B1 (en) 2018-06-13 2019-05-29 Method and apparatus for restricting access of terminal device
US17/089,216 US11678187B2 (en) 2018-06-13 2020-11-04 Method for restricting access of terminal device and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810609145.XA CN110602697B (zh) 2018-06-13 2018-06-13 一种限制终端设备接入的方法及装置
CN201810609145.X 2018-06-13

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/089,216 Continuation US11678187B2 (en) 2018-06-13 2020-11-04 Method for restricting access of terminal device and apparatus

Publications (1)

Publication Number Publication Date
WO2019237926A1 true WO2019237926A1 (zh) 2019-12-19

Family

ID=68842822

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/089137 WO2019237926A1 (zh) 2018-06-13 2019-05-29 一种限制终端设备接入的方法及装置

Country Status (4)

Country Link
US (1) US11678187B2 (zh)
EP (1) EP3780688B1 (zh)
CN (1) CN110602697B (zh)
WO (1) WO2019237926A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021131902A1 (en) * 2019-12-23 2021-07-01 Nec Corporation Methods and devices of detection of misbehaving ues using data analysis

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019221033A1 (en) * 2018-05-18 2019-11-21 Nec Corporation A method for synchronizing status of ue in a communication network
WO2022061675A1 (zh) * 2020-09-24 2022-03-31 华为技术有限公司 一种数据分析方法及装置
CN116156670A (zh) * 2021-11-22 2023-05-23 华为技术有限公司 一种通信方法、装置及设备
CN114389716A (zh) * 2021-12-14 2022-04-22 中科创达软件股份有限公司 一种终端接入方法、装置、设备及存储介质
CN115811428A (zh) * 2022-11-28 2023-03-17 济南大学 一种抵御DDoS攻击的防御方法、系统、设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101400106A (zh) * 2007-09-27 2009-04-01 华为技术有限公司 一种家用基站接入控制的方法
US20110199898A1 (en) * 2010-02-16 2011-08-18 Samsung Electronics Co. Ltd. Method and apparatus for controlling network access of ue in wireless communication system
CN102404821A (zh) * 2010-09-15 2012-04-04 电信科学技术研究院 一种mtc终端接入控制方法及装置
CN106576286A (zh) * 2014-08-11 2017-04-19 瑞典爱立信有限公司 用于接入控制的方法和装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7693530B1 (en) * 2007-03-30 2010-04-06 Clear Wireless Llc Ranging resource allocation for wireless devices in networks providing access by Wi-MAX and like protocols
GB2458102B (en) * 2008-03-03 2010-02-24 I P Access Ltd Method and apparatus for providing access to a cellular communication network
US20120166652A1 (en) * 2010-12-23 2012-06-28 Bouthemy Jean-Luc R Advanced simultaneous and sequential sip forking
US10148693B2 (en) * 2015-03-25 2018-12-04 Fireeye, Inc. Exploit detection system
US9853975B2 (en) * 2015-08-26 2017-12-26 Ca, Inc. Restricting access to content based on measurements of user terminal operational performance
US10230522B1 (en) * 2016-03-24 2019-03-12 Amazon Technologies, Inc. Network access control
US10972495B2 (en) * 2016-08-02 2021-04-06 Invincea, Inc. Methods and apparatus for detecting and identifying malware by mapping feature data into a semantic space

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101400106A (zh) * 2007-09-27 2009-04-01 华为技术有限公司 一种家用基站接入控制的方法
US20110199898A1 (en) * 2010-02-16 2011-08-18 Samsung Electronics Co. Ltd. Method and apparatus for controlling network access of ue in wireless communication system
CN102404821A (zh) * 2010-09-15 2012-04-04 电信科学技术研究院 一种mtc终端接入控制方法及装置
CN106576286A (zh) * 2014-08-11 2017-04-19 瑞典爱立信有限公司 用于接入控制的方法和装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021131902A1 (en) * 2019-12-23 2021-07-01 Nec Corporation Methods and devices of detection of misbehaving ues using data analysis

Also Published As

Publication number Publication date
EP3780688B1 (en) 2023-10-04
CN110602697B (zh) 2021-08-31
CN110602697A (zh) 2019-12-20
US11678187B2 (en) 2023-06-13
US20210058789A1 (en) 2021-02-25
EP3780688A4 (en) 2021-06-30
EP3780688A1 (en) 2021-02-17

Similar Documents

Publication Publication Date Title
WO2019237926A1 (zh) 一种限制终端设备接入的方法及装置
Kim et al. Touching the untouchables: Dynamic security analysis of the LTE control plane
US11963242B2 (en) Communication method and apparatus
US10972917B2 (en) Signaling attack prevention method and apparatus
CN112997454B (zh) 经由移动通信网络连接到家庭局域网
US20210250771A1 (en) Method For Determining Class Information And Apparatus
US10171993B2 (en) Identity request control for user equipment
TWI812678B (zh) 終端訊息的傳遞方法及相關產品
US11895533B2 (en) Method for controlling connection between terminal and network, and related apparatus
WO2017113063A1 (zh) 一种nas消息处理、小区列表更新方法及设备
JP2023071683A5 (zh)
US20230014494A1 (en) Communication method, apparatus, and system
WO2020001437A1 (zh) 一种配置方法、协商方法及装置
TW202118259A (zh) 在核心網路中的網路功能處的系統資訊保護
US20230239693A1 (en) Association control method and related apparatus
WO2019232698A1 (zh) 信息上报方法、装置、终端及存储介质
US20210168614A1 (en) Data Transmission Method and Device
WO2023179679A1 (zh) 一种基于信道秘钥的加密方法及装置
WO2021196011A1 (zh) 一种终端设备标识的获取方法、装置及系统
US20180343559A1 (en) Method and device for obtaining user equipment identifier, and method and device for sending user equipment identifier
CN105052183A (zh) 近距离发现方法和装置
WO2022262611A1 (zh) 一种通信方法及装置
WO2022135517A1 (zh) 由用户设备执行的方法以及用户设备
Li et al. Wireless network security detection system design based on client
WO2023071885A1 (zh) 一种通信方法及通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19819076

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019819076

Country of ref document: EP

Effective date: 20201110

NENP Non-entry into the national phase

Ref country code: DE