WO2021103599A1 - 一种签约信息的处理方法、装置及设备 - Google Patents

一种签约信息的处理方法、装置及设备 Download PDF

Info

Publication number
WO2021103599A1
WO2021103599A1 PCT/CN2020/103739 CN2020103739W WO2021103599A1 WO 2021103599 A1 WO2021103599 A1 WO 2021103599A1 CN 2020103739 W CN2020103739 W CN 2020103739W WO 2021103599 A1 WO2021103599 A1 WO 2021103599A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
information
access control
control device
identity
Prior art date
Application number
PCT/CN2020/103739
Other languages
English (en)
French (fr)
Inventor
李世昆
胡力
靳维生
曾正洋
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP20892465.4A priority Critical patent/EP4047968A4/en
Publication of WO2021103599A1 publication Critical patent/WO2021103599A1/zh
Priority to US17/752,337 priority patent/US20220286855A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/72—Subscriber identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H04L9/3273—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response for mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/20—Transfer of user or subscriber data

Definitions

  • This application relates to the field of communication technology, and in particular to a method, device and equipment for processing contract information.
  • the terminal can access the network and the terminal
  • the quality of service enjoyed after accessing the network usually depends on the contract information between the terminal and the network. For example, when the terminal does not have subscription information with the network, the terminal may not be able to access the network; or, when the subscription information between the terminal and the network indicates that the network provides 10M (mega) bandwidth for the terminal, the The network can provide services corresponding to 10M bandwidth for the terminal at most, but cannot enjoy services corresponding to higher bandwidth.
  • the embodiments of the present application provide a method for processing contract information to improve the legality of changes in contract information.
  • an embodiment of the present application provides a method for processing subscription information.
  • the method includes: an access control device obtains authorization information from a target network device, where the authorization information includes the identification of the first terminal and the The authorization operation instruction information for the subscription information of the first terminal; the access control device obtains the subscription information processing request from the second terminal, and the subscription information processing request includes the identifier of the second terminal; when the When the identity of the first terminal matches the identity of the second terminal, the access control device processes the subscription information corresponding to the identity of the second terminal based on the authorization operation instruction information, and the second terminal The subscription information corresponding to the identifier of is pre-stored in the access control device.
  • the access control device only when the target network device grants authorization information, the access control device performs corresponding processing on the subscription information of the second terminal. In this way, even if the terminal is illegally stolen, it unilaterally requests the terminal's access to the terminal.
  • the subscription information is processed. Since the current operator of the terminal cannot trigger the target network device to send the subscription information for the terminal to the access control device, the access control device is only based on the terminal’s unilateral request and will not The corresponding contract information is processed, so that the legality of processing the terminal's contract information can be improved.
  • the method further includes: the access control device performs identity verification on the second terminal; then when the identity of the first terminal matches the identity of the second terminal When the access control device processes the subscription information corresponding to the identity of the second terminal based on the operation instruction information, specifically: when the identity of the first terminal matches the identity of the second terminal And, when the second terminal passes the identity verification, the access control device processes the subscription information corresponding to the identity of the second terminal based on the operation instruction information.
  • the access control device before processing the subscription information of the second terminal, can also verify whether the identity of the second terminal is legal, and only when the second terminal passes the identity verification, the access control device can verify the identity of the second terminal.
  • the contract information of the terminal is processed, so as to avoid processing the contract information of the second terminal when the terminal requesting the processing of the contract information is illegal, for example, an illegal terminal requests the access control device to process the contract information of the second terminal.
  • that the access control device performs identity verification on the second terminal includes: the access control device sends a first challenge value and a second random number to the second terminal, The first challenge value is calculated by the access control device according to the first key value and the first random number from the second terminal, and the first key value is calculated by the access control device according to the data from the The identification of the second terminal is determined; the access control device calculates a response value according to the first key value and the second random value; when the response value is the same as the second challenge value from the second terminal When the same, the access control device determines that the second terminal passes the identity verification, and the second challenge value is calculated based on the second key value on the second terminal and the second random number.
  • the access control device may specifically verify the legitimacy of the second terminal in a challenge-response manner, which can achieve two-way verification between the second terminal and the access control device.
  • the subscription information of the second terminal cannot be processed, so that the security of processing the subscription information can be further improved.
  • the access control device when the identity of the first terminal matches the identity of the second terminal, the access control device corresponds to the identity of the second terminal based on the operation instruction information
  • the processing of the subscription information is specifically as follows: when the identifier of the first terminal matches the identifier of the second terminal, and the time period during which the access control device receives the authorization information does not exceed the authorization information
  • the access control device processes the subscription information corresponding to the identifier of the second terminal based on the operation instruction information.
  • the authorization information has a certain validity period.
  • the access control device can process the subscription information of the corresponding terminal, and when the authorization information exceeds the validity period, the access control The device may refuse to process the contract information of the terminal, thereby avoiding that after the second terminal requests to process the contract information at a time, it may still be able to process the contract information in the later stage if it is illegal.
  • the authorization operation instruction information is used to instruct to delete or update the subscription information of the first terminal.
  • the authorization information when used to instruct to update the subscription information of the first terminal, the authorization information further includes updated subscription information.
  • the access control device can parse out the updated contract information from the received authorization information, so as to use the updated contract information to update the saved contract information.
  • the method further includes: when the access control device completes the processing of the subscription information corresponding to the identity of the second terminal based on the authorization operation instruction information, the access The control device deletes the authorization information from the target network device.
  • the access control device may refuse to process the subscription information, thereby avoiding illegal users of the second terminal requesting illegal operations on the subscription information of the second terminal.
  • an embodiment of the present application also provides a device for processing subscription information.
  • the device is applied to an access control device, and the device includes:
  • the first acquisition module is configured to acquire authorization information from the target network device, the authorization information includes the identification of the first terminal and authorization operation instruction information for the subscription information of the first terminal;
  • the second acquisition module Used to obtain a processing request from an access network device, where the processing request includes an identifier for the second terminal; a processing module is used for when the identifier of the first terminal matches the identifier of the second terminal, The subscription information corresponding to the identifier of the second terminal is processed based on the authorization operation instruction information, and the subscription information corresponding to the identifier of the second terminal is pre-stored in the access control device.
  • the device further includes: a verification module, configured to perform identity verification on the second terminal; and the processing module is specifically configured to act as the identity of the first terminal and the The identifiers of the second terminal match, and when the second terminal passes the identity verification, the access control device processes the subscription information corresponding to the identifier of the second terminal based on the operation instruction information.
  • a verification module configured to perform identity verification on the second terminal
  • the processing module is specifically configured to act as the identity of the first terminal and the The identifiers of the second terminal match, and when the second terminal passes the identity verification, the access control device processes the subscription information corresponding to the identifier of the second terminal based on the operation instruction information.
  • the verification module includes: a sending unit, configured to send a first challenge value and a second random number to the second terminal, the first challenge value being controlled by the access
  • the device calculates according to the first key value and the first random number from the second terminal, and the first key value is determined by the access control device according to the identifier from the second terminal; the calculation unit uses The response value is calculated according to the first key value and the second random value; the determining unit is configured to: when the response value is the same as the second challenge value from the second terminal, the access control The device determines that the second terminal passes the identity verification, and the second challenge value is calculated based on the second key value on the second terminal and the second random number.
  • the processing module is specifically configured to: when the identifier of the first terminal matches the identifier of the second terminal, and the access control device receives the authorization information When the duration does not exceed the valid duration of the authorization information, the access control device processes the subscription information corresponding to the identifier of the second terminal based on the operation instruction information.
  • the authorization operation instruction information is used to instruct to delete or update the subscription information of the first terminal.
  • the authorization information when the authorization operation instruction information is used to instruct to update the subscription information of the first terminal, the authorization information further includes updated subscription information.
  • the apparatus further includes: a deletion module, configured to: when the access control device completes the processing of the subscription information corresponding to the identifier of the second terminal based on the authorization operation instruction information To delete the authorization information from the target network device.
  • a deletion module configured to: when the access control device completes the processing of the subscription information corresponding to the identifier of the second terminal based on the authorization operation instruction information To delete the authorization information from the target network device.
  • the contract information processing device provided in the second aspect corresponds to the contract information processing method provided in the first aspect
  • various possible implementations of the contract information processing device provided in the second aspect can be referred to in the first aspect.
  • Various possible implementations of the contract information processing method are possible implementations of the contract information processing method.
  • an embodiment of the present application also provides a device, the device includes a processor and a memory, the processor is coupled with the memory; the memory is used to store computer programs or instructions; the processor is used to execute all The computer program or instruction enables the contract information processing method described in any one of the possible implementations of the first aspect to be executed.
  • the embodiments of the present application also provide a computer-readable storage medium, including instructions, which when run on a computer, cause the computer to execute the contract information described in any one of the possible implementations of the first aspect. ⁇ Treatment methods.
  • an embodiment of the present application also provides a computer-readable storage medium that stores a program for implementing the contract information processing method described in any one of the possible implementations of the first aspect. For example, when the program runs in an access control device, the access control device is caused to execute the method for processing subscription information described in any one of the possible implementation manners in the first aspect.
  • the embodiments of the present application provide a computer program product, the program product includes a program, when the program is run, the contract information processing method described in any one of the possible implementations of the first aspect Be executed.
  • the access control device may obtain authorization information from the target network device.
  • the authorization information includes the identification of the first terminal and the authorization information for the first terminal.
  • the authorization operation instruction information of the subscription information of the terminal may be obtained before processing the subscription information of the terminal.
  • the access control device can determine based on the authorization information that corresponding processing is currently allowed for the subscription of the first terminal; then, the access control device can obtain the subscription information from the second terminal Processing request, the processing request includes the identity of the second terminal; then, when the identity of the second terminal in the subscription information processing request matches the identity of the first terminal in the authorization information, it indicates that the first terminal and the second terminal are The same terminal, so that the processing operation performed by the access control device on the subscription information of the second terminal is a legal operation.
  • the access control device may based on the authorization operation instruction information on the subscription information corresponding to the identity of the second terminal For processing, the subscription information corresponding to the identifier of the second terminal is pre-stored in the access control device.
  • the access control device processes the subscription information of the second terminal accordingly.
  • the access control device is only based on the terminal’s unilateral request and will not The contract information corresponding to the terminal is processed, so that the legality of processing the contract information of the terminal can be improved.
  • Fig. 1 is a schematic structural diagram of an exemplary application scenario in an embodiment of the application
  • FIG. 2 is a schematic flowchart of a method for processing subscription information in an embodiment of the application
  • FIG. 3 is a schematic diagram of signaling interaction of a method for processing subscription information combined with an exemplary scenario in an embodiment of the application;
  • FIG. 4 is a schematic diagram of signaling interaction of a method for processing subscription information combined with another exemplary scenario in an embodiment of the application;
  • FIG. 5 is a schematic structural diagram of an apparatus for processing contract information in an embodiment of the application.
  • FIG. 6 is a schematic diagram of the hardware structure of a device in an embodiment of the application.
  • a terminal that accesses the network usually stores corresponding subscription information in the network, and the subscription information can enable the terminal to have access to the network and the network to provide the terminal with services of corresponding quality.
  • the contract information between the terminal and the network may need to be changed. For example, when the enterprise recycles the terminal, the terminal may be reset. Accordingly, the network needs to be reset. After the terminal, delete its stored contract information in the network.
  • the inventor found through research that directly resetting the terminal causes the network to delete the contract information corresponding to the terminal, which poses a certain security risk. For example, when an illegal user steals the terminal and directly resets the terminal, if the network deletes the terminal's subscription information based on this operation, the illegal user may be able to start using the terminal or use it for other purposes. Therefore, when the contract information of the terminal needs to be changed, its legitimacy needs to be paid attention to.
  • the embodiment of the present application provides a method for processing contract information, which aims to improve the legality of processing the contract information of the terminal.
  • the access control device may obtain authorization information from the target network device, the authorization information including the identification of the first terminal and an authorization operation instruction for the subscription information of the first terminal.
  • the access control device can determine that corresponding processing is currently allowed for the subscription of the first terminal; then, the access control device can obtain the subscription information processing request from the second terminal, and the processing request includes the first terminal.
  • the identification of the terminal then, when the identification of the second terminal in the subscription information processing request matches the identification of the first terminal in the authorization information, it indicates that the first terminal and the second terminal are the same terminal, thereby accessing the control device
  • the processing operation performed on the subscription information of the second terminal is a legal operation.
  • the access control device may process the subscription information corresponding to the identity of the second terminal based on the authorization operation instruction information.
  • the subscription information corresponding to the identifier is pre-stored in the access control device. It can be seen that in this embodiment, only when the target network device grants authorization information, the access control device processes the subscription information of the second terminal accordingly.
  • the terminal since the current operator of the terminal cannot trigger the target network device to send the subscription information for the terminal to the access control device, the access control device is only based on the terminal’s unilateral request and will not The contract information corresponding to the terminal is processed, so that the legality of processing the contract information of the terminal can be improved.
  • a wide-band access point controller (WBAC) 101 can be connected to multiple wide-band access points (WBAP), as shown in Figure 1, WBAC101 It can be connected with WBAP1021, WBAP1022, WBAP1023 through wired or wireless connection, and each WBAP can be connected to wide-band customer premises equipment (WBCPE).
  • WBAP1021 is connected to WBCPE103 as an example.
  • the WBAC101 can be connected to the server 104 of an operator (such as a communication operator or an industry operator, etc.).
  • the operator server 104 may send authorization information to WBAC101, the authorization information includes the identifier of the WBCPE corresponding to the contract information allowed to be processed and the authorization operation instruction information for the contract information of the WBCPE ;
  • WBCPE103 can also send a contract information processing request to WBAC101 through WBAP1021, and the contract information processing request includes the WBCPE103 identifier; after WBAC101 receives the authorization information and the contract information processing request, if it is determined that the contract information processing request is in The included WBCPE103 identifier matches the WBCPE identifier corresponding to the processing-allowed subscription information included in the authorization information, then WBAC101 can perform corresponding processing on the subscription information corresponding to the WBCPE103 identifier based on the authorization operation instruction information.
  • the subscription information corresponding to the WBCPE103 logo is pre-stored on WBAC101.
  • the embodiments of the present application can be applied to any applicable communication system, and are not limited to the above examples.
  • the WBAC 101 and the operator server 104 may be connected through one or more intermediate nodes.
  • the embodiments of the present application can be applied to any applicable communication, and are not limited to the above-mentioned scenario examples.
  • FIG. 2 shows a schematic flowchart of a method for processing subscription information in an embodiment of the present application.
  • the method may specifically include:
  • the target network device sends authorization information to the access control device, where the authorization information includes the identity of the first terminal and authorization operation instruction information for the subscription information of the first terminal.
  • the target network device may send authorization information to the access control device, and the authorization information may be used to notify the access control device of which terminal's subscription information is currently operating Is legal (that is, authorized), and the specific authorized operations allowed to be performed on the contract information.
  • the authorization information may include the identification of the first terminal, and the identification of the first terminal is used to notify the access control device that the subscription information of the first terminal corresponding to the identification is currently allowed to be processed; at the same time, the authorization information is also It may include authorization operation instruction information for the subscription information of the first terminal, and the authorization operation instruction information may be used to notify the access control device of the specific operation that can be performed on the subscription information of the terminal.
  • the authorization operation instruction information may specifically be operation information used to indicate the subscription information for the first terminal, such as information for deleting the subscription information, or information for updating the subscription information, etc., where the authorization operation instruction
  • the information is used to indicate that when the subscription of the first terminal is updated, the authorization information may also include updated subscription information, so that the access control device can update the subscription information of the first terminal to the subscription information carried in the authorization information.
  • the authorization operation instruction information can also be mode instruction information, such as the mode instructing to reset the terminal, etc., because different modes of the terminal can correspond to different operations, for example, the reset mode can correspond to the subscription information.
  • the deletion operation and the update mode may correspond to the update of the subscription information, etc. Therefore, the access control device may also determine which operation to perform on the subscription information based on the mode indication information.
  • the authorization operation instruction information is specifically an update mode
  • the authorization information may also carry updated subscription information.
  • the target network device in this embodiment may be a trusted legal device, such as a server of a third-party operator, etc., that is, the access control device may be based on information such as instructions sent by the target network device by default. Legal information, and subsequent operations performed by the access control device based on the information are also legal operations.
  • the legality of the information sent by the target network device to the access control device may be verified by means such as account login.
  • the staff of the third-party operator such as account opening personnel, etc.
  • a specific account and password such as an administrator account and password, etc.
  • the identification of the first terminal sent by the target network device to the access control device may be obtained by a staff member using a related device to scan the QR code of the first terminal (for example, using an application on the device to The QR code is scanned), the QR code of the first terminal can carry the identity of the first terminal, such as international mobile equipment identity (IMEI), etc., of course, it can also be
  • the staff directly enters the identification of the first terminal into the related device, and then the related device sends the identification of the first terminal to the target network device, so that the target network device sends the identification of the first terminal to the access device. controlling device.
  • the authorization operation instruction information sent by the target network device to the access control device may be generated by the related device in response to a specific operation of the staff and sent to the target network device.
  • the authorization information may have a certain period of validity (such as 30 minutes, 1 hour, etc.), that is, when the duration of the authorization information stored on the access control device reaches the preset duration, the authorization information A failure has occurred.
  • the access control device may refuse to process the subscription information of the first terminal.
  • the access control device obtains a subscription information processing request from the second terminal, where the subscription information processing request includes an identifier of the second terminal.
  • the second terminal may send a subscription information processing request to the access control device to request the access control device to perform processing on the subscription information of the second terminal. deal with.
  • the identifier of the second terminal carried in the subscription information processing request is used to instruct the access control device to process the subscription information of which terminal.
  • the access control device processes the subscription information corresponding to the identity of the second terminal based on the authorization operation instruction information, and the identity of the second terminal corresponds to the subscription
  • the information is pre-stored in the access control device.
  • the access control device may first determine the second terminal requesting to process the subscription information and the second terminal authorized to process the subscription information. Whether a terminal is a terminal, in specific implementation, it can be judged whether the identity of the first terminal and the identity of the second terminal are the same. If they are the same, it means that the second terminal has been authorized to process the subscription information of the second terminal in advance. , The access control device may process the subscription information of the second terminal according to the authorization operation instruction information from the target network device, that is, process the subscription information corresponding to the identifier of the second terminal.
  • the access control device may refuse to process the subscription information of the second terminal.
  • the identification of the second terminal and the subscription information of the second terminal may be correspondingly stored in the access control device in advance. For example, before the second terminal initially accesses the network, the target network device may register the subscription information of the second terminal The access control device saves the identification of the second terminal and the subscription information corresponding to the identification of the second terminal, so as to subsequently process the subscription information of the second terminal.
  • the subscription information of the second terminal may specifically be the quality of service (QoS) and/or the group ID (identity) of the second terminal.
  • QoS quality of service
  • identity identity
  • the subscription information of the second terminal may specifically be the quality of service (QoS) and/or the group ID (identity) of the second terminal.
  • QoS quality of service
  • identity identity
  • it may also be other information, which is not limited in this embodiment.
  • the authorization information stored on the access control device may have a validity period, and the access control device determines that the identity of the first terminal is consistent with the identity of the second terminal, and the duration of receiving the authorization information does not exceed the authorization period. Only when the information is valid for the duration of time, the access control device processes the subscription information of the second terminal based on the operation instruction information. When the authorization information exceeds the valid period, the subscription information of the first terminal does not have the authority to be processed. At this time, even if the second terminal, which is the same terminal as the first terminal, requests the subscription information to be processed again, the access control The device may refuse to process the subscription information of the second terminal.
  • the access control device when receiving the subscription information processing request of the second terminal, may also perform identity verification on the second terminal, and only when the second terminal passes the identity verification, access The control device processes the subscription information of the second terminal. At this time, when it is determined that the identity of the first terminal is the same as the identity of the second terminal, and the second terminal also passes identity authentication, the access control device processes the subscription information corresponding to the identity of the second terminal.
  • the second terminal can establish security based on protocols such as hypertext transfer security protocol (hypertext transfer protocol over securesocket layer, HTTPS) and the access control device through a pre-configured certificate.
  • Connection where the connection may be an indirect connection between the second terminal and the access control device through the access point, and in some possible implementation manners, it may also be a direct connection between the second terminal and the access control device (that is, , There is a separate direct connection channel between the second terminal and the access control device).
  • the second terminal may send the identification of the second terminal and the first random number generated by the second terminal to the access control device based on the established secure connection.
  • the access control device can determine the first key value corresponding to the second terminal’s identity according to the second terminal’s identity.
  • the first key value can be determined through pre-negotiation with the second terminal.
  • the first key value is stored on the device, and the same key value is stored on the second terminal (for ease of description, it is referred to as the second key value hereinafter).
  • the access control device can calculate a first challenge value based on the value of the first key and the first random number.
  • the access control device can also generate a second random number, and compare the first challenge value with the first random number.
  • the two random numbers are sent to the second terminal.
  • the second terminal uses the second key value and the first random number stored thereon to verify the received first challenge value.
  • the second terminal may calculate the second challenge value based on the second key value and the second random number, and send the second challenge value to the access control device.
  • the access control device may use the first key value and the second random number to verify the second challenge value. Specifically, it calculates a value based on the first key value and the second random number, and compares the value with the second challenge value. The challenge value is compared, and if the value is consistent with the second challenge value, the access control device passes the authentication of the second terminal. Of course, if the two values are inconsistent, the second terminal fails the authentication.
  • the verification process is exemplified by taking the second terminal and the access control device as an example to perform two-way verification.
  • the access control device may also perform the verification process on the second terminal.
  • Two terminals perform one-way verification.
  • the second terminal can generate a challenge value by using the second key value and the first random number stored by itself, and send the challenge value and the first random number to the access control device; the access control device can use the first random number stored by itself.
  • a key value (determined according to the representation of the second terminal) is calculated with the received first random number to calculate a value, and the value is compared with the received challenge value. If the two values are the same, then access control The device passes the authentication of the second terminal, and if the two values are not the same, the second terminal fails the authentication.
  • the access control device may delete the authorization information from the target network device. In this way, an illegal user using the second terminal can be prevented from performing illegal operations on the subscription information of the second terminal.
  • the access control device may also delete the temporarily stored authorization information when the authorization information reaches the validity period.
  • the access control device may obtain authorization information from the target network device.
  • the authorization information includes the identification of the first terminal and the authorization for the subscription information of the first terminal.
  • Operation instruction information so that, based on the authorization information, the access control device can determine that corresponding processing is currently allowed for the subscription of the first terminal; then, the access control device can obtain the subscription information processing request from the second terminal, and the processing request Including the identity of the second terminal; then, when the identity of the second terminal in the subscription information processing request matches the identity of the first terminal in the authorization information, it indicates that the first terminal and the second terminal are the same terminal, and thus access
  • the processing operation performed by the control device on the subscription information of the second terminal is a legal operation.
  • the access control device may process the subscription information corresponding to the identity of the second terminal based on the authorization operation instruction information.
  • the subscription information corresponding to the terminal identifier is pre-stored in the access control device. It can be seen that in this embodiment, only when the target network device grants authorization information, the access control device processes the subscription information of the second terminal accordingly. In this way, even if the terminal is illegally stolen, it unilaterally requests the terminal Since the current operator of the terminal cannot trigger the target network device to send the subscription information for the terminal to the access control device, the access control device is only based on the terminal’s unilateral request and will not The contract information corresponding to the terminal is processed, so that the legality of processing the contract information of the terminal can be improved.
  • FIG. 3 shows a schematic diagram of signaling interaction of a method for processing subscription information in an embodiment of the present application.
  • WBCPE the second terminal in the above method embodiment
  • WBAC the access control device in the above method embodiment
  • the method may specifically include:
  • WBCPE connects to the network and connects with WBAP.
  • the relevant device obtains the IMEI information of the WBCPE, and in the case of successfully logging in to the specific account, sends the IMEI information and the reset instruction to the operator server.
  • the staff can manually enter the IMEI information of the WBCPE on the relevant device, or scan the QR code carrying IMEI information on the WBCPE through the application on the relevant device to obtain the IMEI of the WBCPE information.
  • the staff adjusts the operating menu on the relevant equipment to the reset mode, the relevant equipment can generate a corresponding reset instruction.
  • a staff member successfully logs in to a specific account, it can be considered that the staff member's identity is legitimate, and the operation triggered by the staff member using the relevant device is also a legitimate operation, so that the relevant device can send it together with the IMEI information to the operator server.
  • S303 The operator server forwards the received IMEI information and reset instruction of the WBCPE to WBAC.
  • WBCPE sends IMEI information of WBCPE and random number rand1 to WBAC through WBAP, where rand1 is generated by WBCPE.
  • WBCPE uses a pre-configured certificate to establish a secure connection with the OSU in WBAC through the HTTPS protocol.
  • WBCPE communicates with WBAC through WBAP.
  • WBCPE can use a certain random algorithm to generate a random number rand1, and send the rand1 and the IMEI information of the WBCPE to WBAC through the established secure connection.
  • the OSU in the WBAC obtains the pre-stored key value Key1 according to the IMEI information, and calculates the expected challenge value XRES1 according to the Key1 and the received rand1.
  • WBAC can store the IMEI information of the WBCPE and the key value Key1 in advance. For example, WBAC can allocate Key1 to the WBCPE when the WBCPE initially accesses the network, and store Key1 and the IMEI information of the WBCPE correspondingly.
  • the WBAC may specifically include an online signing unit (OSU) and a unified authentication and authorization unit (authentication, authorization, accounting, AAA).
  • OSU online signing unit
  • AAA authentication, authorization, accounting
  • OSU can perform operations such as communication and verification with other devices
  • AAA can perform operations such as processing for subscription information.
  • S306 The OSU in WBAC generates a random number rand2, and sends rand2 and XRES1 to WBCPE through WBAP.
  • WBCPE can calculate a response value RES1 based on Key2 and rand1, and compare RES1 with the received XRES1. If RES1 is the same as XRES1, WBCPE passes the authentication of XRES1, that is, WBCPE passes the docking Authentication of access to the network. Of course, if RES1 and XRES1 are not the same, XRES1 has not passed the authentication, and accordingly, WBCPE can stop performing the subsequent steps. Furthermore, when XRES1 fails the authentication, WBCPE can report errors and so on.
  • OSU can calculate a response value RES2 based on Key1 and rand2, and compare RES2 with the received XRES2. If RES2 is the same as XRES2, OSU passes the authentication of XRES2, that is, OSU passes the WBCPE Certification.
  • AAA deletes the WBCPE subscription information according to the reset confirmation instruction.
  • AAA can also delete relevant credential information for WBCPE access to the network.
  • FIG. 4 shows a schematic diagram of signaling interaction of another method for processing subscription information.
  • WBCPE requests WBAC to update the subscription information of the WBCPE.
  • the method may specifically include:
  • WBCPE connects to the network and connects with WBAP.
  • the relevant device obtains the IMEI information of the WBCPE, and in the case of successfully logging in to the specific account, sends the IMEI information, the updated contract information, and the update instruction to the operator server.
  • the relevant equipment can also send the updated subscription information along with the IMEI information and the update instructions to the operator server for subsequent follow-up
  • the operator server forwards this information to WBAC.
  • S403 The operator server forwards the received IMEI information, updated subscription information, and reset instruction to WBAC.
  • WBCPE sends IMEI information of WBCPE and random number rand1 to WBAC through WBAP, where rand1 is generated by WBCPE.
  • S405 The OSU in the WBAC obtains the pre-stored key value Key1 according to the IMEI information, and calculates the expected challenge value XRES1 according to the Key1 and the received rand1.
  • S406 The OSU in WBAC generates a random number rand2, and sends rand2 and XRES1 to WBCPE through WBAP.
  • S407 The WBCPE verifies the received XRES1 according to the Key2 and rand1 stored in the WBCPE.
  • step S401 to step S409 are similar to the specific implementation manners of step S301 to step S309 in the foregoing embodiment, and reference may be made to the foregoing description of the relevant parts, which will not be repeated here.
  • the AAA uses the received updated contract information to update the existing contract information.
  • FIG. 5 shows a schematic structural diagram of an apparatus for processing subscription information in an embodiment of the present application.
  • the apparatus 500 may be applied to an access control device.
  • the apparatus 500 includes:
  • the first obtaining module 501 is configured to obtain authorization information from a target network device, where the authorization information includes the identification of the first terminal and authorization operation instruction information for the subscription information of the first terminal;
  • the second obtaining module 502 is configured to obtain a processing request from an access network device, where the processing request includes an identifier for the second terminal;
  • the processing module 503 is configured to process the subscription information corresponding to the identity of the second terminal based on the authorization operation instruction information when the identity of the first terminal matches the identity of the second terminal, and The subscription information corresponding to the identifier of the second terminal is pre-stored in the access controller.
  • the device 500 further includes:
  • a verification module configured to perform identity verification on the second terminal
  • the processing module 503 is specifically configured to: when the identity of the first terminal matches the identity of the second terminal, and the second terminal passes the identity verification, the access controller is based on the The operation instruction information processes the subscription information corresponding to the identifier of the second terminal.
  • the verification module includes:
  • the sending unit is configured to send a first challenge value and a second random number to the second terminal, where the access controller uses the first key value and the first challenge value from the second terminal according to the first challenge value.
  • a random number is calculated, and the first key value is determined by the access controller according to the identifier from the second terminal;
  • a calculation unit configured to calculate a response value according to the first key value and the second random value
  • the determining unit is configured to: when the response value is the same as the second challenge value from the second terminal, the access controller determines that the second terminal passes the identity verification, and the second challenge value is based on the The second key value on the second terminal and the second random number are calculated.
  • processing module 503 the processing module 503:
  • the The access controller processes the subscription information corresponding to the identifier of the second terminal based on the operation instruction information.
  • the authorization operation instruction information is used to instruct to delete or update the subscription information of the first terminal.
  • the authorization information when the authorization operation instruction information is used to instruct to update the subscription information of the first terminal, the authorization information further includes updated subscription information.
  • the device 500 further includes:
  • the deleting module is configured to delete the authorization information from the target network device when the access controller completes the processing of the subscription information corresponding to the identifier of the second terminal based on the authorization operation instruction information.
  • an embodiment of the present application also provides a device.
  • the device can be applied to the access control device mentioned in the above method embodiment.
  • the device may include a processor, which is coupled to the memory;
  • the memory is used to store computer programs or instructions
  • the processor is configured to execute the computer program or instruction to enable the method for processing subscription information executed by the access control device in the foregoing method embodiment.
  • Fig. 5 is a schematic diagram of the hardware structure of a device, which can be applied to the access control device in the embodiment of the present application.
  • the device includes at least one processor 111, at least one memory 112, and at least one network interface 113.
  • the processor 111 and the memory 112 are connected to the network interface 113, for example, via a bus.
  • the connection may include various interfaces, transmission lines, or buses, which are not limited in this embodiment.
  • the network interface 113 is used to connect the device to other communication devices through a communication link.
  • the processor 111 shown in FIG. 5 can specifically complete the actions processed by the access control device in the above method
  • the memory 112 can complete the actions stored in the above method
  • the network interface 113 can complete the communication with other devices in the above method.
  • the interactive actions are illustrated below by taking the device shown in FIG. 5 as an access control device as an example:
  • the processor 111 may, when the identity of the first terminal matches the identity of the second terminal, the access control device processes the subscription information corresponding to the identity of the second terminal based on the authorization operation instruction information
  • the subscription information corresponding to the identifier of the second terminal is pre-stored in the access control device.
  • the network interface 113 can obtain authorization information from the target network device and a subscription information processing request from the second terminal, the authorization information including the identification of the first terminal and the authorization operation for the subscription information of the first terminal Indication information, the subscription information processing request includes the identification of the second terminal; the memory 112 may store the authorization information and the subscription information processing request, etc.
  • the processor 111 may also perform identity verification on the second terminal, and when the identity of the first terminal matches the identity of the second terminal, and the second terminal When the terminal passes the identity verification, the subscription information corresponding to the identity of the second terminal is processed specifically based on the operation instruction information.
  • the processor 111 may specifically send a first challenge value and a second random number to the second terminal, where the first challenge value is determined by the access control device according to the first key value and the second random number.
  • the first random number from the second terminal is calculated, and the first key value is determined by the access control device according to the identifier from the second terminal; the access control device is determined according to the first A key value and the second random value to calculate a response value; when the response value is the same as the second challenge value from the second terminal, the access control device determines that the second terminal passes the identity verification,
  • the second challenge value is calculated based on the second key value on the second terminal and the second random number.
  • the processor 111 may specifically be when the identifier of the first terminal matches the identifier of the second terminal, and the time period during which the access control device receives the authorization information When the valid duration of the authorization information is not exceeded, the access control device processes the subscription information corresponding to the identifier of the second terminal based on the operation instruction information.
  • the authorization operation instruction information is used to instruct to delete or update the subscription information of the first terminal.
  • the authorization information when the authorization operation instruction information is used to instruct to update the subscription information of the first terminal, the authorization information further includes updated subscription information.
  • the processor 111 may also, when the access control device completes the processing of the subscription information corresponding to the identity of the second terminal based on the authorization operation instruction information, the access The control device deletes the authorization information from the target network device.
  • the processor in the embodiment of the present application may include but is not limited to at least one of the following: a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), and a microcontroller
  • CPU central processing unit
  • DSP digital signal processor
  • MCU microcontroller unit
  • each computing device may include one or more cores for executing software instructions for calculation or processing.
  • the processor can be a single semiconductor chip, or it can be integrated with other circuits to form a semiconductor chip. For example, it can form an SoC (on-chip) with other circuits (such as codec circuits, hardware acceleration circuits, or various bus and interface circuits).
  • the processor can also include necessary hardware accelerators, such as field programmable gate array (FPGA) and PLD (programmable logic device) , Or a logic circuit that implements dedicated logic operations.
  • FPGA field programmable gate array
  • PLD programmable logic device
  • the memory in the embodiment of the present application may include at least one of the following types: read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory , RAM) or other types of dynamic storage devices that can store information and instructions, or electrically erasable programmable read-only memory (EEPROM).
  • ROM read-only memory
  • RAM random access memory
  • EEPROM electrically erasable programmable read-only memory
  • the memory can also be a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital universal discs, Blu-ray discs, etc.) , Disk storage media or other magnetic storage devices, or any other media that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, but are not limited thereto.
  • the memory 112 may exist independently and is connected to the processor 111.
  • the memory 112 may be integrated with the processor 111, for example, integrated in one chip.
  • the memory 112 can store program codes for executing the technical solutions of the embodiments of the present application, and the processor 111 controls the execution.
  • Various types of computer program codes that are executed can also be regarded as drivers of the processor 111.
  • the processor 111 is configured to execute computer program codes stored in the memory 112, so as to implement the technical solutions in the embodiments of the present application.
  • the instructions stored in the memory for execution by the processor may be implemented in the form of a computer program product.
  • the computer program product may be written in the memory in advance, or it may be downloaded and installed in the memory in the form of software.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • Computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • computer instructions may be transmitted from a website, computer, server, or data center through a cable (such as Coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) to transmit to another website site, computer, server or data center.
  • a cable such as Coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk, SSD).
  • the embodiment of the present application also provides a computer-readable storage medium.
  • the methods described in the foregoing embodiments may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. If implemented in software, the functions can be stored on a computer-readable medium or transmitted on a computer-readable medium as one or more instructions or codes.
  • Computer-readable media may include computer storage media and communication media, and may also include any media that can transfer a computer program from one place to another.
  • the storage medium may be any target medium that can be accessed by a computer.
  • the computer-readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that is targeted to carry or use instructions or data structures.
  • the required program code is stored in the form of and can be accessed by the computer.
  • any connection is properly termed a computer-readable medium. For example, if you use coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL) or wireless technology (such as infrared, radio and microwave) to transmit software from a website, server or other remote source, then coaxial cable, fiber optic cable , Twisted pair, DSL or wireless technologies such as infrared, radio and microwave are included in the definition of the medium.
  • DSL digital subscriber line
  • wireless technology such as infrared, radio and microwave
  • Magnetic disks and optical disks as used herein include compact disks (CDs), laser disks, optical disks, digital versatile disks (DVDs), floppy disks and blu-ray disks, where disks usually reproduce data magnetically, while optical disks reproduce data optically using lasers. Combinations of the above should also be included in the scope of computer-readable media.
  • At least one refers to one or more.
  • Multiple means two or more.
  • And/or describes the association relationship of the associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone, where A, B can be singular or plural.
  • the character “/” generally indicates that the associated objects before and after are in an “or” relationship.
  • the following at least one item (a)” or similar expressions refers to any combination of these items, including any combination of a single item (a) or a plurality of items (a).
  • a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .
  • words such as “first” and “second” are used to distinguish the same items or similar items that have substantially the same function and effect. Those skilled in the art can understand that words such as “first” and “second” do not limit the quantity and order of execution, and words such as “first” and “second” do not limit the difference.
  • the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the difference from other embodiments.
  • the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment.
  • the device embodiments described above are merely illustrative.
  • the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place. , Or it can be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the objectives of the solutions of the embodiments. Those of ordinary skill in the art can understand and implement without creative work.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种签约信息的处理方法、装置及设备，包括：接入控制设备获取来自目标网络设备的授权信息，授权信息包括第一终端的标识以及针对于签约信息的授权操作指示信息；并获取来自第二终端的签约信息处理请求，签约信息处理请求包括第二终端的标识；当第一终端的标识与第二终端的标识相匹配时，接入控制设备基于所述授权操作指示信息对所述第二终端的标识对应的签约信息进行处理。在目标网络设备给予授权信息的情况下，接入控制设备才对第二终端的签约信息进行相应处理，这样，可以提高处理终端的签约信息时的合法性。

Description

一种签约信息的处理方法、装置及设备
本申请要求于2019年11月26日递交中国专利局、申请号为201911176692.4，发明名称为“一种签约信息的处理方法、装置及设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，特别是涉及一种签约信息的处理方法、装置及设备。
背景技术
在第三代合作伙伴计划(3rd generation partnership project，3GPP)、MulteFire、未授权频带上的长期演进(long term evolution-unlicensed，LTE-U)等制式通信系统中，终端是否能够接入网络以及终端接入网络后所享受到的服务质量，通常取决于终端与该网络之间的签约信息。比如，当终端不具有与该网络之间的签约信息时，终端可能无法接入该网络；或者，当终端与该网络之间的签约信息表征该网络为终端提供10M(兆)带宽时，该网络最多为该终端提供10M带宽对应的服务，而无法享受更高带宽对应的服务。
当终端与网络之间的签约信息需要发生变动时，该签约信息变动的合法性是目前需要重点关注的问题。
发明内容
本申请实施例提供了一种签约信息的处理方法，以提高签约信息的变动时的合法性。
第一方面，本申请实施例提供了一种签约信息的处理方法，所述方法包括：接入控制设备获取来自目标网络设备的授权信息，所述授权信息包括所述第一终端的标识以及针对于所述第一终端的签约信息的授权操作指示信息；所述接入控制设备获取来自第二终端的签约信息处理请求，所述签约信息处理请求包括所述第二终端的标识；当所述第一终端的标识与所述第二终端的标识相匹配时，所述接入控制设备基于所述授权操作指示信息对所述第二终端的标识对应的签约信息进行处理，所述第二终端的标识对应的签约信息预先存储于所述接入控制设备。在该实施方式中，在目标网络设备给予授权信息的情况下，接入控制设备才对第二终端的签约信息进行相应处理，这样，即使终端被非法盗用，并单方面的请求对该终端的签约信息进行处理，由于该终端当前的操作者无法触发目标网络设备向接入控制设备发送针对于该终端的签约信息，因此，接入控制设备仅基于终端单方面的请求并不会对该终端对应的签约信息进行处理，从而可以提高处理终端的签约信息时的合法性。
在一种可能的实施方式中，所述方法还包括：所述接入控制设备对所述第二终端进行身份验证；则当所述第一终端的标识与所述第二终端的标识相匹配时，所述接入控制设备基于所述操作指示信息对所述第二终端的标识对应的签约信息进行处理，具体为：当所述第一终端的标识与所述第二终端的标识相匹配，并且，所述第二终端通过身份验证时，所述接入控制设备基于所述操作指示信息对所述第二终端的标识对应的签约信息进行处理。在该实施方式中，接入控制设备在对第二终端的签约信息进行处理之前，还可以验证第二 终端的身份是否合法，并且，在第二终端通过身份验证的情况下，才对第二终端的签约信息进行处理，这样可以避免请求处理签约信息的终端不合法时对第二终端的签约信息进行处理，比如，非法终端请求接入控制设备对第二终端的签约信息进行处理等。
在一种可能的实施方式中，所述接入控制设备对所述第二终端进行身份验证，包括：所述接入控制设备向所述第二终端发送第一挑战值以及第二随机数，所述第一挑战值由所述接入控制设备根据第一关键值以及来自所述第二终端的第一随机数计算得到，所述第一关键值由所述接入控制设备根据来自所述第二终端的标识进行确定；所述接入控制设备根据所述第一关键值以及所述第二随机值计算出响应值；当所述响应值与来自所述第二终端的第二挑战值相同时，所述接入控制设备确定所述第二终端通过身份验证，所述第二挑战值是基于所述第二终端上的第二关键值与所述第二随机数计算得到。在该实施方式中，接入控制设备具体可以是采用挑战-应答的方式对第二终端的合法性进行验证，可以实现第二终端与接入控制设备之间的双向验证，当第二终端与接入控制设备之间存在任何一方的合法性出现问题时，该第二终端的签约信息均无法被处理，从而可以进一步提高处理签约信息的安全性。
在一种可能的实施方式中，当所述第一终端的标识与所述第二终端的标识相匹配时，所述接入控制设备基于所述操作指示信息对所述第二终端的标识对应的签约信息进行处理，具体为：当所述第一终端的标识与所述第二终端的标识相匹配，且，所述接入控制设备接收所述授权信息的时长不超过所述授权信息的有效时长时，所述接入控制设备基于所述操作指示信息对所述第二终端的标识对应的签约信息进行处理。在该实施方式中，授权信息具有一定的有效期，在该授权信息的有效期内，接入控制设备可以对该相应终端的签约信息进行处理，而当该授权信息超出有效时长后，该接入控制设备可以拒绝对该终端的签约信息进行处理，从而可以避免第二终端一次请求对签约信息进行处理后，后期可能在不合法的情况下仍然能够对签约信息进行处理。
在一种可能的实施方式中，所述授权操作指示信息用于指示对所述第一终端的签约信息进行删除或更新。
在一种可能的实施方式中，当所述授权操作指示信息用于指示对所述第一终端的签约信息进行更新时，所述授权信息还包括更新的签约信息。在该实施方式中，接入控制设备可以从接收到的授权信息中解析出更新的签约信息，从而利用该更新的签约信息对已保存的签约信息进行更新。
在一种可能的实施方式中，所述方法还包括：当所述接入控制设备基于所述授权操作指示信息对所述第二终端的标识对应的签约信息的处理完成时，所述接入控制设备删除所述来自目标网络设备的授权信息。在该实施方式中，当接入控制完成签约信息的处理后，可以将接收到的授权信息进行删除，这样，当第二终端再次请求对该第二终端的签约信息进行处理时，若没有目标网络设备的再次授权，接入控制设备可以拒绝处理该签约信息，从而可以避免第二终端的非法使用者请求对该第二终端的签约信息进行非法操作。
第二方面，本申请实施例还提供了一种签约信息的处理装置，所述装置应用于接入控制设备，所述装置包括：
第一获取模块，用于获取来自目标网络设备的授权信息，所述授权信息包括所述第一 终端的标识以及针对于所述第一终端的签约信息的授权操作指示信息；第二获取模块，用于获取来自接入网设备的处理请求，所述处理请求包括针对于第二终端的标识；处理模块，用于当所述第一终端的标识与所述第二终端的标识相匹配时，基于所述授权操作指示信息对所述第二终端的标识对应的签约信息进行处理，所述第二终端的标识对应的签约信息预先存储于所述接入控制设备。
在一种可能的实施方式中，所述装置还包括：验证模块，用于对所述第二终端进行身份验证；则所述处理模块，具体用于当所述第一终端的标识与所述第二终端的标识相匹配，并且，所述第二终端通过身份验证时，所述接入控制设备基于所述操作指示信息对所述第二终端的标识对应的签约信息进行处理。
在一种可能的实施方式中，所述验证模块，包括：发送单元，用于向所述第二终端发送第一挑战值以及第二随机数，所述第一挑战值由所述接入控制设备根据第一关键值以及来自所述第二终端的第一随机数计算得到，所述第一关键值由所述接入控制设备根据来自所述第二终端的标识进行确定；计算单元，用于根据所述第一关键值以及所述第二随机值计算出响应值；确定单元，用于当所述响应值与来自所述第二终端的第二挑战值相同时，所述接入控制设备确定所述第二终端通过身份验证，所述第二挑战值是基于所述第二终端上的第二关键值与所述第二随机数计算得到。
在一种可能的实施方式中，所述处理模块，具体用于当所述第一终端的标识与所述第二终端的标识相匹配，且，所述接入控制设备接收所述授权信息的时长不超过所述授权信息的有效时长时，所述接入控制设备基于所述操作指示信息对所述第二终端的标识对应的签约信息进行处理。
在一种可能的实施方式中，所述授权操作指示信息用于指示对所述第一终端的签约信息进行删除或更新。
在一种可能的实施方式中，当所述授权操作指示信息用于指示对所述第一终端的签约信息进行更新时，所述授权信息还包括更新的签约信息。
在一种可能的实施方式中，所述装置还包括：删除模块，用于当所述接入控制设备基于所述授权操作指示信息对所述第二终端的标识对应的签约信息的处理完成时，删除所述来自目标网络设备的授权信息。
由于第二方面提供的签约信息的处理装置，对应于第一方面提供的签约信息的处理方法，故第二方面提供的签约信息的处理装置的各种可能的实施方式，可以参照第一方面提供的签约信息的处理方法的各种可能的实施方式。
第三方面，本申请实施例还提供了一种设备，所述设备包括处理器和存储器，所述处理器与存储器耦合；所述存储器用于存储计算机程序或指令；所述处理器用于执行所述计算机程序或指令，使得上述第一方面中任一种可能的实施方式所述的签约信息的处理方法被执行。
第四方面，本申请实施例还提供了一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行上述第一方面中任一种可能的实施方式所述的签约信息的处理方法。
第五方面，本申请实施例还提供了一种计算机可读存储介质，存储有用于实现上述第 一方面中任一种可能的实施方式所述的签约信息的处理方法的程序。例如，当该程序在接入控制设备而中运行时，使得该接入控制设备执行第一方面中任一种可能的实施方式所述的签约信息的处理方法。
第六方面，本申请实施例提供了一种计算机程序产品，该程序产品包括程序，当该程序被运行时，使得上述第一方面中任一种可能的实施方式所述的签约信息的处理方法被执行。
在本申请实施例的上述实现方式中，在对终端的签约信息进行处理之前，接入控制设备可以获取来自目标网络设备的授权信息，该授权信息包括第一终端的标识以及针对于该第一终端的签约信息的授权操作指示信息，这样，接入控制设备基于该授权信息可以确定当前允许对第一终端的签约进行相应的处理；然后，接入控制设备可以获取来自第二终端的签约信息处理请求，该处理请求包括第二终端的标识；接着，当签约信息处理请求中的第二终端的标识与授权信息中的第一终端的标识相匹配时，表明第一终端与第二终端是同一终端，从而接入控制设备对该第二终端的签约信息执行的处理操作为合法的操作，此时，接入控制设备可以基于该授权操作指示信息对该第二终端的标识对应的签约信息进行处理，该第二终端的标识对应的签约信息预先存储于该接入控制设备。可见，本实施例中，在目标网络设备给予授权信息的情况下，接入控制设备才对第二终端的签约信息进行相应处理，这样，即使终端被非法盗用，并单方面的请求对该终端的签约信息进行处理，由于该终端当前的操作者无法触发目标网络设备向接入控制设备发送针对于该终端的签约信息，因此，接入控制设备仅基于终端单方面的请求并不会对该终端对应的签约信息进行处理，从而可以提高处理终端的签约信息时的合法性。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请中记载的一些实施例，对于本领域普通技术人员来讲，还可以根据这些附图获得其他的附图。
图1为本申请实施例中一种示例性应用场景的结构示意图；
图2为本申请实施例中一种签约信息的处理方法的流程示意图；
图3为本申请实施例中一种结合一示例性场景的签约信息的处理方法的信令交互示意图；
图4为本申请实施例中一种结合另一示例性场景的签约信息的处理方法的信令交互示意图；
图5为本申请实施例中一种签约信息的处理装置的结构示意图；
图6为本申请实施例中一种设备的硬件结构示意图。
具体实施方式
接入网络的终端，通常会在网络中存储有相应的签约信息，该签约信息可以使得终端具有接入该网络的权限以及网络为该终端提供相应质量的服务。而实际应用的众多场景中，该终端与网络之间的签约信息可能需要发生变动，比如，当企业回收终端时，可能会对该 终端进行复位处理，相应的，网络需要针对于该经过复位处理后的终端,删除其在网络中已存储的签约信息。
但是，发明人经研究发现，直接复位终端使得网络删除该终端对应的签约信息，存在一定的安全隐患。比如，当存在非法用户盗用该终端，并且直接对该终端进行复位后，若网络基于该操作删除该终端的签约信息，则可能会使得非法用户能够开始使用该终端，或者用于其它用途。因此，当终端的签约信息需要发生变动时，其合法性需要予以关注。
基于此，本申请实施例提供了一种签约信息的处理方法，旨在提高处理终端的签约信息时的合法性。具体的，在对终端的签约信息进行处理之前，接入控制设备可以获取来自目标网络设备的授权信息，该授权信息包括第一终端的标识以及针对于该第一终端的签约信息的授权操作指示信息，这样，接入控制设备基于该授权信息可以确定当前允许对第一终端的签约进行相应的处理；然后，接入控制设备可以获取来自第二终端的签约信息处理请求，该处理请求包括第二终端的标识；接着，当签约信息处理请求中的第二终端的标识与授权信息中的第一终端的标识相匹配时，表明第一终端与第二终端是同一终端，从而接入控制设备对该第二终端的签约信息执行的处理操作为合法的操作，此时，接入控制设备可以基于该授权操作指示信息对该第二终端的标识对应的签约信息进行处理，该第二终端的标识对应的签约信息预先存储于该接入控制设备。可见，本实施例中，在目标网络设备给予授权信息的情况下，接入控制设备才对第二终端的签约信息进行相应处理，这样，即使终端被非法盗用，并单方面的请求对该终端的签约信息进行处理，由于该终端当前的操作者无法触发目标网络设备向接入控制设备发送针对于该终端的签约信息，因此，接入控制设备仅基于终端单方面的请求并不会对该终端对应的签约信息进行处理，从而可以提高处理终端的签约信息时的合法性。
作为一种示例，本申请实施例的技术方案可以应用于如图1所示的类似无线局域网(wireless local area network，WLAN)瘦AP(接入点)+AC(接入控制器)极简部署架构/协议的示例性通信系统。在该通信系统100中，宽带接入控制器(wide-band access point controller，WBAC)101可以与多个宽带接入点(wide-band access point，WBAP)进行连接，如图1所示，WBAC101可以分别与WBAP1021、WBAP1022、WBAP1023通过有线或者无线进行连接，每个WBAP均可以接入宽带客户终端设备(wide-band customer premises equipment，WBCPE)，图1中以WBAP1021接入WBCPE103作为示例，同时，WBAC101可以与运营商(如通信运营商或者行业运营商等)服务器104进行连接。
在WBAC101处理该WBCPE103对应的签约信息之前，运营商服务器104可以向WBAC101发送授权信息，该授权信息包括允许处理的签约信息所对应的WBCPE的标识以及针对于该WBCPE的签约信息的授权操作指示信息；同时，WBCPE103也可以是通过WBAP1021向WBAC101发送签约信息处理请求，该签约信息处理请求中包括有该WBCPE103标识；WBAC101在接收该授权信息以及签约信息处理请求后，若确定该签约信息处理请求中所包括的WBCPE103标识，与授权信息中包括的允许处理的签约信息所对应的WBCPE的标识相匹配，则WBAC101可以基于该授权操作指示信息对该WBCPE103的标识对应的签约信息进行相应处理，当然，该WBCPE103的标识所对应的签约信息预先存储于WBAC101上。
值得注意的是，本申请实施例可以应用于任何可适用的通信系统中，而不局限于上述示例。比如，在其它可能的通信系统中，WBAC101与运营商服务器104之间可以通过一个或者多个中间节点实现连接等。总之，本申请实施例可以应用于任何可适用的通信中，而不局限于上述场景示例。
为使本申请的上述目的、特征和优点能够更加明显易懂，下面将结合附图对本申请实施例中的各种非限定性实施方式进行示例性说明。显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本申请保护的范围。
参阅图2，图2示出了本申请实施例中一种签约信息的处理方法流程示意图。该方法具体可以包括：
S201：目标网络设备向接入控制设备发送授权信息，该授权信息包括第一终端的标识以及针对于该第一终端的签约信息的授权操作指示信息。
本实施例中，在接入控制设备处理终端的签约信息之前，目标网络设备可以向接入控制设备发送授权信息，该授权信息可以用于通知接入控制设备当前对哪些终端的签约信息进行操作是合法的(即是经过授权的)，以及对这些签约信息所允许执行的具体授权操作。具体实现时，该授权信息可以包括第一终端的标识，该第一终端的标识用于通知接入控制设备当前允许对该标识对应的第一终端的签约信息进行处理；同时，该授权信息还可以包括针对于该第一终端的签约信息的授权操作指示信息，该授权操作指示信息可以用于通知接入控制设备可以对该终端的签约信息具体进行哪种操作。其中，该授权操作指示信息，具体可以是用于指示针对第一终端的签约信息的操作信息，如对签约信息进行删除的信息，或者对签约信息进行更新的信息等，其中，当授权操作指示信息用于指示对第一终端的签约进行更新时，该授权信息中还可以包括更新的签约信息，以便于接入控制设备将该第一终端的签约信息更新为该授权信息中所携带的签约信息。值得注意的是，该授权操作指示信息也可以是模式指示信息，如指示对该终端进行复位的模式等，由于终端不同的模式可以对应于不同的操作，如复位模式可以对应于对签约信息的删除操作，更新模式可以对应于对签约信息的更新等，因此，接入控制设备基于该模式指示信息也可以是确定出对签约信息进行何种操作。同样，当授权操作指示信息具体为更新模式时，该授权信息也可以携带更新的签约信息。
需要说明的是，本实施例中的目标网络设备可以是可信的合法设备，如第三方运营商的服务器等，即接入控制设备可以默认基于该目标网络设备所发送的指令等信息，是合法的信息，从而接入控制设备基于该信息所执行的后续操作，也是合法的操作。在一些可能的实施方式中，为了使得该目标网络设备具备合法性，可以是通过账号登录等方式验证该目标网络设备向接入控制设备发送信息的合法性。具体实现时，可以第三方运营商的工作人员(如开户人员等)可以利用特定的账号和密码(如管理员账号和密码等)进行登录，若登录成功，则通过对工作人员的身份认证，从而目标网络设备响应该工作人员的相关操作而向接入控制设备下发的信息为合法信息，当然，若该工作人员的账号登录失败，则目标网络设备可以拒绝响应该工作人员的操作请求。
实际应用中，该目标网络设备向接入控制设备发送的第一终端的标识，可以是工作人员利用相关设备对第一终端的二维码进行扫描得到的(如利用该设备上的应用程序对该二维码进行扫描得到)，该第一终端的二维码上可以承载有该第一终端的标识，如国际移动设备识别码(international mobile equipment identity，IMEI)等，当然，也可以是由工作人员直接将该第一终端的标识输入至该相关设备中，然后，由该相关设备将第一终端的标识发送给目标网络设备，以便目标网络设备将该第一终端的标识发送给接入控制设备。而该目标网络设备向接入控制设备发送的授权操作指示信息，可以是由该相关设备响应工作人员的特定操作而生成并发送给目标网络设备的。
在进一步可能的实施方式中，该授权信息可以具有一定时长的有效期(比如30分钟、1小时等)，即当该授权信息在接入控制设备上保存的时长达到预设时长时，该授权信息发生失效。而当该授权信息发生失效时，接入控制设备可以拒绝处理该第一终端的签约信息。
S202：接入控制设备获取来自第二终端的签约信息处理请求，该签约信息处理请求包括第二终端的标识。
本实施例中，当需要对第二终端的签约信息进行相应的处理时，第二终端可以向接入控制设备发送签约信息处理请求，以请求接入控制设备对该第二终端的签约信息进行处理。其中，该签约信息处理请求中携带的第二终端的标识，用于指示接入控制设备对哪个终端的签约信息进行处理。
S203：当第一终端的标识与第二终端的标识相匹配时，接入控制设备基于该授权操作指示信息对第二终端的标识对应的签约信息进行处理，该第二终端的标识对应的签约信息预先存储于接入控制设备。
本实施例中，接入控制设备在接收到目标网络设备发送的授权信息以及第二终端发送的签约信息处理请求后，可以先确定请求处理签约信息的第二终端与已授权处理签约信息的第一终端是否为一个终端，具体实现时，可以判断第一终端的标识与第二终端的标识是否相同，若相同，表明该第二终端预先已经被授权允许对该第二终端的签约信息进行处理，则接入控制设备可以根据来自目标网络设备的授权操作指示信息对第二终端的签约信息进行处理，也即为对第二终端的标识所对应的签约信息进行处理。而若第一终端的标识与第二终端的标识不相同，表明第二终端并没有获得对签约信息进行处理的授权，则接入控制设备可以拒绝对该第二终端的签约信息进行处理。其中，第二终端的标识与第二终端的签约信息可以对应的预先保存于接入控制设备中，比如，在第二终端初始接入网络之前，目标网络设备可以进行第二终端签约信息的注册，由接入控制设备将第二终端的标识以及该第二终端的标识对应的签约信息进行保存，以便后续对该第二终端的签约信息进行处理。
本实施例中，第二终端的签约信息具体可以是第二终端的服务质量(quality of service，QoS)和/或组ID(identity)等。当然，也可以是其它信息，本实施例对此并不进行限定。
值得注意的是，接入控制设备上保存的授权信息可以具有有效期，则接入控制设备在确定第一终端的标识与第二终端的标识一致，并且，接收到该授权信息的时长不超过授权信息的有效时长时，该接入控制设备才基于该操作指示信息对第二终端的签约信息进行处理。而当该授权信息超出有效时长时，该第一终端的签约信息不具有被处理的权限，此时，即使与第一终端为同一终端的第二终端再次请求对签约信息进行处理，接入控制设备可以 拒绝处理该第二终端的签约信息。
在进一步可能的实施方式中，接入控制设备在接收到第二终端的签约信息处理请求时，还可以对该第二终端进行身份验证，并且，只有当第二终端通过身份认证后，接入控制设备才对该第二终端的签约信息进行处理。此时，在确定第一终端的标识与第二终端的标识相同，并且，该第二终端也通过身份认证时，接入控制设备才对第二终端的标识对应的签约信息进行处理。
作为一种验证第二终端的身份的示例，第二终端可以预先通过预配的证书与接入控制设备之间基于超文本传输安全协议(hyper text transfer protocol over securesocket layer，HTTPS)等协议建立安全连接，其中，该连接可以是第二终端通过接入点与接入控制设备实现间接连接，在一些可能的实施方式中，也可以是第二终端与接入控制设备之间的直接连接(即，在第二终端与接入控制设备之间存在单独设置的直连通道)。然后，第二终端可以基于已建立的安全连接向接入控制设备发送第二终端的标识以及第二终端所生成的第一随机数。接入控制设备可以根据该第二终端的标识，确定与该第二终端的标识所对应的第一关键值，该第一关键值可以预先与第二终端进行协商而确定的，在接入控制设备上均保存有该第一关键值，在第二终端上保存有相同的关键值(为便于描述，以下称之为第二关键值)。然后，接入控制设备可以根据该第一关键之值与该第一随机数计算出第一挑战值，同时，接入控制设备还可以生成第二随机数，并将该第一挑战值与第二随机数发送给第二终端。第二终端利用其上保存的第二关键值与第一随机数对接收到的第一挑战值进行校验，具体可以是根据第二关键值与第一随机数计算得到一个值，并将该值与第一挑战值进行比对；若两个值相同，则通过对第一挑战值的校验，也即为第二终端通过对网络的认证，当然，若两个值不相同，则第一挑战值未通过校验。当第一挑战值校验通过后，第二终端可以基于第二关键值与第二随机数计算出第二挑战值，并将该第二挑战值发送给接入控制设备。接入控制设备可以利用第一关键值与第二随机数对该第二挑战值进行校验，具体是根据该第一关键值与第二随机数计算出一个值，并将该值与第二挑战值进行比对，若该值与第二挑战值一致，则接入控制设备通过对该第二终端的认证，当然，若两个值不一致，则第二终端未通过认证。
需要说明的是，上述实施方式中，是以第二终端与接入控制设备进行双向验证为例对验证过程进行示例性说明，在其他可能的实施方式中，也可以是接入控制设备对第二终端进行单向验证。比如，第二终端可以利用自身存储的第二关键值与第一随机数生成挑战值，并将该挑战值与第一随机数发送给接入控制设备；接入控制设备可以利用自身存储的第一关键值(根据第二终端的表示进行确定)与接收到的第一随机数计算出一个值，并将该值与接收到的挑战值进行比对，若两个值相同，则接入控制设备通过对该第二终端的认证，而若两个值不相同，则第二终端未通过验证。
进一步的，当接入控制设备完成对第二终端的签约信息的处理后，接入控制设备可以删除来自目标网络设备的授权信息。这样，可以避免使用第二终端的非法用户对该第二终端的签约信息进行非法操作。当然，实际应用中，接入控制设备也可以是在授权信息达到有效期时，将临时存储的授权信息进行删除。
本实施例中，在对终端的签约信息进行处理之前，接入控制设备可以获取来自目标网 络设备的授权信息，该授权信息包括第一终端的标识以及针对于该第一终端的签约信息的授权操作指示信息，这样，接入控制设备基于该授权信息可以确定当前允许对第一终端的签约进行相应的处理；然后，接入控制设备可以获取来自第二终端的签约信息处理请求，该处理请求包括第二终端的标识；接着，当签约信息处理请求中的第二终端的标识与授权信息中的第一终端的标识相匹配时，表明第一终端与第二终端是同一终端，从而接入控制设备对该第二终端的签约信息执行的处理操作为合法的操作，此时，接入控制设备可以基于该授权操作指示信息对该第二终端的标识对应的签约信息进行处理，该第二终端的标识对应的签约信息预先存储于该接入控制设备。可见，本实施例中，在目标网络设备给予授权信息的情况下，接入控制设备才对第二终端的签约信息进行相应处理，这样，即使终端被非法盗用，并单方面的请求对该终端的签约信息进行处理，由于该终端当前的操作者无法触发目标网络设备向接入控制设备发送针对于该终端的签约信息，因此，接入控制设备仅基于终端单方面的请求并不会对该终端对应的签约信息进行处理，从而可以提高处理终端的签约信息时的合法性。
为了便于理解本发明的技术方案，下面结合复位WBCPE的具体场景示例本申请实施例的技术方案进行详细描述。参阅图3，图3示出了本申请实施例中一种签约信息的处理方法的信令交互示意图。在下述场景实施例中，WBCPE(上述方法实施例中的第二终端)请求WBAC(上述方法实施例中的接入控制设备)对该WBCPE的签约信息进行删除，该方法具体可以包括：
S301：WBCPE接入网络，与WBAP连接。
S302：相关设备获取WBCPE的IMEI信息，并在成功登录特定账号的情况下，将IMEI信息以及复位指示发送给运营商服务器。
本实施例中，工作人员可以在该相关设备上手动输入WBCPE的IMEI信息，也可以是通过该相关设备上的应用程序对WBCPE上承载有IMEI信息的二维码进行扫描，得到该WBCPE的IMEI信息。同时，当工作人员在相关设备上将操作菜单调整至复位模式时，相关设备可以生成相应的复位指示。当工作人员成功登录特定的账号时，则可以认为该工作人员的身份合法，其在利用相关设备所触发的操作也为合法操作，从而相关设备可以将其与IMEI信息一起发送至运营商服务器。
S303：运营商服务器将接收到的WBCPE的IMEI信息以及复位指示转发给WBAC。
S304：WBCPE通过WBAP向WBAC发送WBCPE的IMEI信息以及随机数rand1，其中，该rand1由WBCPE生成。
本实施例中，WBCPE使用预配的证书通过HTTPS协议与WBAC中的OSU建立安全连接，这样，WBCPE通过WBAP与WBAC进行通信。然后，WBCPE可以采用一定的随机算法生成随机数rand1，并将该rand1与WBCPE的IMEI信息通过已建立的安全连接一起发送给WBAC。
S305：WBAC中的OSU根据IMEI信息获得预先存储的关键值Key1，并根据该Key1与接收到的rand1计算出期望挑战值XRES1。
本实施例中，WBAC可以预先对应保存WBCPE的IMEI信息与关键值Key1，比如，可 以是WBAC在WBCPE初始接入网络时为该WBCPE分配Key1，并对应保存Key1与该WBCPE的IMEI信息。
值得注意的是，WBAC中具体可以包括在线签约单元(online signing unit，OSU)以及统一认证授权单元(authentication、authorization、accounting，AAA)。其中，OSU可以执行与其它设备之间的通信、验证等操作，AAA可以执行针对于签约信息的处理等操作。
S306：WBAC中的OSU生成随机数rand2，并将rand2与XRES1通过WBAP发送至WBCPE。
S307：WBCPE根据自身存储的Key2与rand1对接收到的XRES1进行验证。
具体实现时，WBCPE可以根据Key2与rand1计算出一个响应值RES1，并将RES1与接收到的XRES1进行比对，若RES1与XRES1相同，则WBCPE通过对XRES1的认证，也即为WBCPE通过对接入网络的认证。当然，若RES1与XRES1不相同，则XRES1未通过认证，相应的，WBCPE可以停止执行后续步骤。进一步的，当XRES1未通过认证时，WBCPE可以进行报错等。
S308：当XRES1通过认证时，WBCPE根据Key2与接收到的rand2计算出期望挑战值XRES2，并将该XRES2发送给WBAC中的OSU。
S309：WBAC中的OSU根据Key1与rand2对XRES2进行认证。
具体实现时，OSU可以根据Key1与rand2计算出一个响应值RES2，并将RES2与接收到的XRES2进行比对，若RES2与XRES2相同，则OSU通过对XRES2的认证，也即为OSU通过对WBCPE的认证。
S310：当XRES2通过认证时，OSU根据接收到的复位指示，向AAA下发复位确定指示。
S311：AAA根据该复位确认指示，删除WBCPE的签约信息。
进一步的，AAA还可以删除WBCPE接入网络的相关凭证信息等。
上述场景实施例中，是以对签约信息进行删除为例进行示例性说明。在其它场景实施例中，也可以是对签约信息进行更新。参阅图4，图4示出了又一种签约信息的处理方法的信令交互示意图，在下述场景实施例中，WBCPE请求WBAC对该WBCPE的签约信息进行更新，该方法具体可以包括：
S401：WBCPE接入网络，与WBAP连接。
S402：相关设备获取WBCPE的IMEI信息，并在成功登录特定账号的情况下，将IMEI信息、更新的签约信息以及更新指示发送给运营商服务器。
与上一实施例不同的是，本实施例中，由于是对WBCPE的签约信息进行更新，因此，相关设备还可以将更新的签约信息随IMEI信息以及更新指示一起发送给运营商服务器，以便后续由运营商服务器将这些信息转发给WBAC。
S403：运营商服务器将接收到的IMEI信息、更新的签约信息以及复位指示转发给WBAC。
S404：WBCPE通过WBAP向WBAC发送WBCPE的IMEI信息以及随机数rand1，其中，该rand1由WBCPE生成。
S405：WBAC中的OSU根据IMEI信息获得预先存储的关键值Key1，并根据该Key1与接 收到的rand1计算出期望挑战值XRES1。
S406：WBAC中的OSU生成随机数rand2，并将rand2与XRES1通过WBAP发送至WBCPE。
S407：WBCPE根据自身存储的Key2与rand1对接收到的XRES1进行验证。
S408：当XRES1通过认证时，WBCPE根据Key2与接收到的rand2计算出期望挑战值XRES2，并将该XRES2发送给WBAC中的OSU。
S409：WBAC中的OSU根据Key1与rand2对XRES2进行认证。
本实施例中，步骤S401至步骤S409的具体实施方式，与前述实施例中步骤S301至步骤S309的具体实施方式类似，可参见前述相关之处的描述，在此不做赘述。
S410：当XRES2通过认证时，OSU根据接收到的更新指示，向AAA下发更新确定指示。
S411：AAA根据该更新确认指示，利用接收到的更新的签约信息对已有的签约信息进行更新。
第二方面，本申请实施例还提供了一种签约信息的处理装置。参阅图5，图5示出了本申请实施例中一种签约信息的处理装置的结构示意图，该装置500可以应用于接入控设备，所述装置500包括：
第一获取模块501，用于获取来自目标网络设备的授权信息，所述授权信息包括所述第一终端的标识以及针对于所述第一终端的签约信息的授权操作指示信息；
第二获取模块502，用于获取来自接入网设备的处理请求，所述处理请求包括针对于第二终端的标识；
处理模块503，用于当所述第一终端的标识与所述第二终端的标识相匹配时，基于所述授权操作指示信息对所述第二终端的标识对应的签约信息进行处理，所述第二终端的标识对应的签约信息预先存储于所述接入控制器。
在一种可能的实施方式中，所述装置500还包括：
验证模块，用于对所述第二终端进行身份验证；
则所述处理模块503，具体用于当所述第一终端的标识与所述第二终端的标识相匹配，并且，所述第二终端通过身份验证时，所述接入控制器基于所述操作指示信息对所述第二终端的标识对应的签约信息进行处理。
在一种可能的实施方式中，所述验证模块，包括：
发送单元，用于向所述第二终端发送第一挑战值以及第二随机数，所述第一挑战值由所述接入控制器根据第一关键值以及来自所述第二终端的第一随机数计算得到，所述第一关键值由所述接入控制器根据来自所述第二终端的标识进行确定；
计算单元，用于根据所述第一关键值以及所述第二随机值计算出响应值；
确定单元，用于当所述响应值与来自所述第二终端的第二挑战值相同时，所述接入控制器确定所述第二终端通过身份验证，所述第二挑战值是基于所述第二终端上的第二关键值与所述第二随机数计算得到。
在一种可能的实施方式中，所述处理模块503，
具体用于当所述第一终端的标识与所述第二终端的标识相匹配，且，所述接入控制器 接收所述授权信息的时长不超过所述授权信息的有效时长时，所述接入控制器基于所述操作指示信息对所述第二终端的标识对应的签约信息进行处理。
在一种可能的实施方式中，所述授权操作指示信息用于指示对所述第一终端的签约信息进行删除或更新。
在一种可能的实施方式中，当所述授权操作指示信息用于指示对所述第一终端的签约信息进行更新时，所述授权信息还包括更新的签约信息。
在一种可能的实施方式中，所述装置500还包括：
删除模块，用于当所述接入控制器基于所述授权操作指示信息对所述第二终端的标识对应的签约信息的处理完成时，删除所述来自目标网络设备的授权信息。
需要说明的是，上述装置各模块/单元之间的信息交互、执行过程等内容，由于与本申请实施例中方法实施例基于同一构思，其带来的技术效果与本申请实施例中方法实施例相同，具体内容可参见本申请实施例前述所示的方法实施例中的叙述，此处不再赘述。
此外，本申请实施例还提供了一种设备。其中，该设备可以应用于上述方法实施例中所提及的接入控制设备。
该设备可以包括处理器，所述处理器与存储器耦合；
所述存储器用于存储计算机程序或指令；
所述处理器用于执行所述计算机程序或指令，使得上述方法实施例中接入控制设备所执行的签约信息的处理方法。
图5是一种设备的硬件结构示意图，可以应用于本申请实施例中的接入控制设备。该设备包括至少一个处理器111、至少一个存储器112和至少一个网络接口113。处理器111、存储器112与网络接口113相连，例如通过总线相连，在本申请实施例中，所述连接可包括各类接口、传输线或总线等，本实施例对此不做限定。网络接口113用于使得该设备通过通信链路，与其它通信设备相连。
其中，图5中所示的处理器111具体可以完成上述方法中接入控制设备处理的动作，存储器112可以完成上述方法中存储的动作，网络接口113可以完成上述方法中与其它设备之间进行交互的动作，下面以图5所示的设备为接入控制设备为例进行示例性的说明：
处理器111可以所述第一终端的标识与所述第二终端的标识相匹配时，所述接入控制设备基于所述授权操作指示信息对所述第二终端的标识对应的签约信息进行处理，所述第二终端的标识对应的签约信息预先存储于所述接入控制设备。网络接口113可以获取来自目标网络设备的授权信息，以及来自第二终端的签约信息处理请求，所述授权信息包括所述第一终端的标识以及针对于所述第一终端的签约信息的授权操作指示信息，所述签约信息处理请求包括所述第二终端的标识；存储器112可以存储该授权信息以及签约信息处理请求等。
在一些可能的实施方式中，处理器111还可以是对所述第二终端进行身份验证，并当所述第一终端的标识与所述第二终端的标识相匹配，并且，所述第二终端通过身份验证时，具体基于所述操作指示信息对所述第二终端的标识对应的签约信息进行处理。
在一些可能的实施方式中，处理器111具体可以是向所述第二终端发送第一挑战值以及 第二随机数，所述第一挑战值由所述接入控制设备根据第一关键值以及来自所述第二终端的第一随机数计算得到，所述第一关键值由所述接入控制设备根据来自所述第二终端的标识进行确定；所述接入控制设备根据所述第一关键值以及所述第二随机值计算出响应值；当所述响应值与来自所述第二终端的第二挑战值相同时，所述接入控制设备确定所述第二终端通过身份验证，所述第二挑战值是基于所述第二终端上的第二关键值与所述第二随机数计算得到。
在一些可能的实施方式中，所述处理器111具体可以是当所述第一终端的标识与所述第二终端的标识相匹配，且，所述接入控制设备接收所述授权信息的时长不超过所述授权信息的有效时长时，所述接入控制设备基于所述操作指示信息对所述第二终端的标识对应的签约信息进行处理。
在一种可能的实施方式中，所述授权操作指示信息用于指示对所述第一终端的签约信息进行删除或更新。
在一种可能的实施方式中，当所述授权操作指示信息用于指示对所述第一终端的签约信息进行更新时，所述授权信息还包括更新的签约信息。
在一些可能的实施方式中，所述处理器111还可以当所述接入控制设备基于所述授权操作指示信息对所述第二终端的标识对应的签约信息的处理完成时，所述接入控制设备删除所述来自目标网络设备的授权信息。
本申请实施例中的处理器，例如处理器111，可以包括但不限于以下至少一种：中央处理单元(central processing unit，CPU)、微处理器、数字信号处理器(DSP)、微控制器(microcontroller unit，MCU)、或人工智能处理器等各类运行软件的计算设备，每种计算设备可包括一个或多个用于执行软件指令以进行运算或处理的核。该处理器可以是个单独的半导体芯片，也可以跟其他电路一起集成为一个半导体芯片，例如，可以跟其他电路(如编解码电路、硬件加速电路或各种总线和接口电路)构成一个SoC(片上系统)，或者也可以作为一个ASIC的内置处理器集成在所述ASIC当中，该集成了处理器的ASIC可以单独封装或者也可以跟其他电路封装在一起。该处理器除了包括用于执行软件指令以进行运算或处理的核外，还可进一步包括必要的硬件加速器，如现场可编程门阵列(field programmable gate array，FPGA)、PLD(可编程逻辑器件)、或者实现专用逻辑运算的逻辑电路。
本申请实施例中的存储器，可以包括如下至少一种类型：只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically erasable programmabler-only memory，EEPROM)。在某些场景下，存储器还可以是只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
存储器112可以是独立存在，与处理器111相连。可选的，存储器112可以和处理器111集成在一起，例如集成在一个芯片之内。其中，存储器112能够存储执行本申请实施例的技术方案的程序代码，并由处理器111来控制执行，被执行的各类计算机程序代码也可被视为 是处理器111的驱动程序。例如，处理器111用于执行存储器112中存储的计算机程序代码，从而实现本申请实施例中的技术方案。
在上述实施例中，存储器存储的供处理器执行的指令可以以计算机程序产品的形式实现。计算机程序产品可以是事先写入在存储器中，也可以是以软件形式下载并安装在存储器中。
计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行计算机程序指令时，全部或部分地产生按照本申请实施例的流程或功能。计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包括一个或多个可用介质集成的服务器、数据中心等数据存储设备。可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘solid state disk，SSD)等。
本申请实施例还提供了一种计算机可读存储介质。上述实施例中描述的方法可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。如果在软件中实现，则功能可以作为一个或多个指令或代码存储在计算机可读介质上或者在计算机可读介质上传输。计算机可读介质可以包括计算机存储介质和通信介质，还可以包括任何可以将计算机程序从一个地方传送到另一个地方的介质。存储介质可以是可由计算机访问的任何目标介质。
作为一种可选的设计，计算机可读介质可以包括RAM，ROM，EEPROM，CD-ROM或其它光盘存储器，磁盘存储器或其它磁存储设备，或目标于承载的任何其它介质或以指令或数据结构的形式存储所需的程序代码，并且可由计算机访问。而且，任何连接被适当地称为计算机可读介质。例如，如果使用同轴电缆，光纤电缆，双绞线，数字用户线(DSL)或无线技术(如红外，无线电和微波)从网站，服务器或其它远程源传输软件，则同轴电缆，光纤电缆，双绞线，DSL或诸如红外，无线电和微波之类的无线技术包括在介质的定义中。如本文所使用的磁盘和光盘包括光盘(CD)，激光盘，光盘，数字通用光盘(DVD)，软盘和蓝光盘，其中磁盘通常以磁性方式再现数据，而光盘利用激光光学地再现数据。上述的组合也应包括在计算机可读介质的范围内。
需要说明的是，本申请中“的(英文：of)”，相应的“(英文corresponding，relevant)”和“对应的(英文：corresponding)”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是一致的。
需要说明的是，本申请实施例中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本申请实施例中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其他实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念。
本申请中，“至少一个”是指一个或者多个。“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在 A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
通过以上的实施方式的描述可知，本领域的技术人员可以清楚地了解到上述实施例方法中的全部或部分步骤可借助软件加通用硬件平台的方式来实现。基于这样的理解，本申请的技术方案可以以软件产品的形式体现出来，该计算机软件产品可以存储在存储介质中，如只读存储器(英文：read-only memory，ROM)/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者诸如路由器等网络通信设备)执行本申请各个实施例或者实施例的某些部分所述的方法。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于装置实施例而言，由于其基本相似于方法实施例，所以描述得比较简单，相关之处参见方法实施例的部分说明即可。以上所描述的装置实施例仅仅是示意性的，其中作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理模块，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
以上所述仅是本申请示例性的实施方式，并非用于限定本申请的保护范围。

Claims (10)

  1. 一种签约信息的处理方法，其特征在于，所述方法包括：
    接入控制设备获取来自目标网络设备的授权信息，所述授权信息包括所述第一终端的标识以及针对于所述第一终端的签约信息的授权操作指示信息；
    所述接入控制设备获取来自第二终端的签约信息处理请求，所述签约信息处理请求包括所述第二终端的标识；
    当所述第一终端的标识与所述第二终端的标识相匹配时，所述接入控制设备基于所述授权操作指示信息对所述第二终端的标识对应的签约信息进行处理，所述第二终端的标识对应的签约信息预先存储于所述接入控制设备。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述接入控制设备对所述第二终端进行身份验证；
    则当所述第一终端的标识与所述第二终端的标识相匹配时，所述接入控制设备基于所述操作指示信息对所述第二终端的标识对应的签约信息进行处理，具体为：
    当所述第一终端的标识与所述第二终端的标识相匹配，并且，所述第二终端通过身份验证时，所述接入控制设备基于所述操作指示信息对所述第二终端的标识对应的签约信息进行处理。
  3. 根据权利要求2所述的方法，其特征在于，所述接入控制设备对所述第二终端进行身份验证，包括：
    所述接入控制设备向所述第二终端发送第一挑战值以及第二随机数，所述第一挑战值由所述接入控制设备根据第一关键值以及来自所述第二终端的第一随机数计算得到，所述第一关键值由所述接入控制设备根据来自所述第二终端的标识进行确定；
    所述接入控制设备根据所述第一关键值以及所述第二随机值计算出响应值；
    当所述响应值与来自所述第二终端的第二挑战值相同时，所述接入控制设备确定所述第二终端通过身份验证，所述第二挑战值是基于所述第二终端上的第二关键值与所述第二随机数计算得到。
  4. 根据权利要求1所述的方法，其特征在于，当所述第一终端的标识与所述第二终端的标识相匹配时，所述接入控制设备基于所述操作指示信息对所述第二终端的标识对应的签约信息进行处理，具体为：
    当所述第一终端的标识与所述第二终端的标识相匹配，且，所述接入控制设备接收所述授权信息的时长不超过所述授权信息的有效时长时，所述接入控制设备基于所述操作指示信息对所述第二终端的标识对应的签约信息进行处理。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，所述授权操作指示信息用于指示对所述第一终端的签约信息进行删除或更新。
  6. 根据权利要求5所述的方法，其特征在于，当所述授权操作指示信息用于指示对所述第一终端的签约信息进行更新时，所述授权信息还包括更新的签约信息。
  7. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    当所述接入控制设备基于所述授权操作指示信息对所述第二终端的标识对应的签约信息的处理完成时，所述接入控制设备删除所述来自目标网络设备的授权信息。
  8. 一种签约信息的处理装置，其特征在于，所述装置应用于接入控制设备，所述装置包括：
    第一获取模块，用于获取来自目标网络设备的授权信息，所述授权信息包括所述第一终端的标识以及针对于所述第一终端的签约信息的授权操作指示信息；
    第二获取模块，用于获取来自接入网设备的处理请求，所述处理请求包括针对于第二终端的标识；
    处理模块，用于当所述第一终端的标识与所述第二终端的标识相匹配时，基于所述授权操作指示信息对所述第二终端的标识对应的签约信息进行处理，所述第二终端的标识对应的签约信息预先存储于所述接入控制设备。
  9. 一种设备，其特征在于，所述设备包括处理器和存储器，所述处理器与存储器耦合；
    所述存储器用于存储计算机程序或指令；
    所述处理器用于执行所述计算机程序或指令，使得如权利要求1至7任一所述的方法被执行。
  10. 一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行如权利要求1至7任一所述的方法。
PCT/CN2020/103739 2019-11-26 2020-07-23 一种签约信息的处理方法、装置及设备 WO2021103599A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20892465.4A EP4047968A4 (en) 2019-11-26 2020-07-23 METHOD, APPARATUS AND DEVICE FOR PROCESSING CONTRACT INFORMATION
US17/752,337 US20220286855A1 (en) 2019-11-26 2022-05-24 Subscription information processing method and apparatus, and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911176692.4 2019-11-26
CN201911176692.4A CN112954694B (zh) 2019-11-26 2019-11-26 一种签约信息的处理方法、装置及设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/752,337 Continuation US20220286855A1 (en) 2019-11-26 2022-05-24 Subscription information processing method and apparatus, and device

Publications (1)

Publication Number Publication Date
WO2021103599A1 true WO2021103599A1 (zh) 2021-06-03

Family

ID=76129938

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/103739 WO2021103599A1 (zh) 2019-11-26 2020-07-23 一种签约信息的处理方法、装置及设备

Country Status (4)

Country Link
US (1) US20220286855A1 (zh)
EP (1) EP4047968A4 (zh)
CN (1) CN112954694B (zh)
WO (1) WO2021103599A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101657039A (zh) * 2009-09-21 2010-02-24 中兴通讯股份有限公司 可以动态调整语音优先级的方法、装置及系统
CN102404738A (zh) * 2010-09-14 2012-04-04 中国移动通信集团山东有限公司 一种接入、退出wlan网络的方法、系统及认证服务器
US20150180851A1 (en) * 2013-12-25 2015-06-25 Huawei Technologies Co., Ltd. Method, device, and system for registering terminal application
CN108076452A (zh) * 2016-11-18 2018-05-25 大唐移动通信设备有限公司 一种通知业务能力的方法、装置和系统

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102045688B (zh) * 2009-10-15 2014-03-12 中兴通讯股份有限公司 用户设备被非法使用的检测方法及检测装置
FR2984069A1 (fr) * 2011-12-12 2013-06-14 Buzzinbees Procede de controle d'acces a un reseau cellulaire
US9883384B2 (en) * 2014-07-16 2018-01-30 Qualcomm Incorporated UE-based network subscription management
KR102333395B1 (ko) * 2015-02-17 2021-12-03 삼성전자 주식회사 이동통신 시스템의 단말에서 프로파일 수신을 위한 방법 및 장치
US9516491B2 (en) * 2015-02-27 2016-12-06 T-Mobile Usa, Inc. Remote device modification
CN106998552A (zh) * 2016-01-26 2017-08-01 中兴通讯股份有限公司 路由控制方法、装置及系统
WO2018098713A1 (zh) * 2016-11-30 2018-06-07 华为技术有限公司 一种获取授权文件的方法及设备
CN109196891B (zh) * 2017-01-13 2020-09-08 华为技术有限公司 一种签约数据集的管理方法、终端及服务器

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101657039A (zh) * 2009-09-21 2010-02-24 中兴通讯股份有限公司 可以动态调整语音优先级的方法、装置及系统
CN102404738A (zh) * 2010-09-14 2012-04-04 中国移动通信集团山东有限公司 一种接入、退出wlan网络的方法、系统及认证服务器
US20150180851A1 (en) * 2013-12-25 2015-06-25 Huawei Technologies Co., Ltd. Method, device, and system for registering terminal application
CN108076452A (zh) * 2016-11-18 2018-05-25 大唐移动通信设备有限公司 一种通知业务能力的方法、装置和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4047968A1

Also Published As

Publication number Publication date
EP4047968A1 (en) 2022-08-24
CN112954694A (zh) 2021-06-11
CN112954694B (zh) 2023-05-05
EP4047968A4 (en) 2022-12-21
US20220286855A1 (en) 2022-09-08

Similar Documents

Publication Publication Date Title
US10319160B2 (en) Anonymous and ephemeral tokens to authenticate elevator calls
US10651984B2 (en) Method for controlling access to an in-vehicle wireless network
EP3453136B1 (en) Methods and apparatus for device authentication and secure data exchange between a server application and a device
US9294468B1 (en) Application-level certificates for identity and authorization
KR101482534B1 (ko) 개인 도메인 제어기
CN104125565A (zh) 一种基于oma dm实现终端认证的方法、终端及服务器
US11924195B2 (en) Onboarding an unauthenticated client device within a secure tunnel
WO2016095540A1 (zh) 一种处理授权的方法、设备和系统
KR20160127167A (ko) 다중 팩터 인증 기관
JP6997886B2 (ja) コアネットワ－クへの非３ｇｐｐ装置アクセス
US11409861B2 (en) Passwordless authentication
WO2021109753A1 (zh) 一种应用于极简网络的机卡验证方法和相关设备
JP7337912B2 (ja) コアネットワークへの非３ｇｐｐデバイスアクセス
CN104348620A (zh) 一种对智能家居终端进行鉴权的方法及相应装置
WO2019056971A1 (zh) 一种鉴权方法及设备
US20230035970A1 (en) Method for Protecting Terminal Parameter Update and Communication Apparatus
CN113543121A (zh) 一种终端参数更新的保护方法和通信装置
WO2021103599A1 (zh) 一种签约信息的处理方法、装置及设备
KR102558821B1 (ko) 사용자 및 디바이스 통합 인증 시스템 및 그 방법
KR20100053703A (ko) Ｏｔｐ 클라이언트기반의 공중 무선랜 서비스망 사용자 인증 시스템 및 방법
CN113039766B (zh) 无线网络中的优化的等值同时认证（sae）认证
CN110351726B (zh) 终端认证的方法及装置
WO2018137239A1 (zh) 一种鉴权方法、鉴权服务器和核心网设备
US20220399996A1 (en) Device access authorization via connected user equipment
CN117459933A (zh) 用于实现多个不同网络与设备之间的使用各种连接技术的通信的技术

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20892465

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020892465

Country of ref document: EP

Effective date: 20220520

NENP Non-entry into the national phase

Ref country code: DE