WO2018103655A1

WO2018103655A1 - Method of accessing network apparatus, terminal apparatus thereof, and network apparatus

Info

Publication number: WO2018103655A1
Application number: PCT/CN2017/114765
Authority: WO
Inventors: 杨铮杰; 曾信
Original assignee: 华为技术有限公司
Priority date: 2016-12-08
Filing date: 2017-12-06
Publication date: 2018-06-14
Also published as: CN108174380A

Abstract

The embodiment of the invention provides a terminal apparatus. The terminal apparatus receives a system message transmitted from a base station controller, determines according to the system message that the terminal apparatus has permission to access a first cell, and performs, when accessing the first cell, network authentication, wherein the first cell is a cell supporting bidirectional authentication. The terminal apparatus further transmits an uplink authentication request message to a core network apparatus, wherein the uplink authentication request message is used to notify the core network apparatus of performing authentication on the terminal apparatus. Upon receiving a downlink authentication request message transmitted from the core network apparatus, the terminal apparatus further performs network authentication on a target cell in the first cell to determine whether to access the target cell. In the embodiment of the invention, the terminal apparatus is instructed to only access a cell supporting the bidirectional authentication, and to perform the network authentication on the target cell to be accessed to determine whether the network is accessible, thereby preventing a fake base station from performing a network attack on the network.

Description

Method for accessing network device and terminal device and network device thereof

This application claims the priority of the Chinese patent application filed on December 8, 2016, the Chinese Patent Office, the application number is 201611124220.0, and the application name is "Access to network equipment and its terminal equipment, network equipment". The citations are incorporated herein by reference.

Technical field

The present application relates to the field of communications, and in particular, to a method for accessing a network device, a terminal device thereof, and a network device.

Background technique

In the Global System for Mobile Communication (GSM), only the authentication authentication process of the terminal device on the network side is defined, and the terminal device does not have an authentication and authentication process on the network side. Therefore, a pseudo base station exists in the GSM network system, and the pseudo base station refers to a base station masquerading as an operator, and can use the mobile phone number of another person to forcibly send short messages such as fraud and advertisement promotion to the user's mobile phone. The GSM pseudo base station has strong concealment, and has formed a fraud industry chain with pseudo base stations as the source, causing users to be deceived and suffered heavy losses.

Further, as the pseudo base station technology is continuously upgraded, even if the terminal device and the network are upgraded to the 3/4G network, as long as the terminal device supports GSM, the pseudo base station can interfere with the 3/4G signal through the full frequency band, and the terminal device can also fall back to the 2G. The network, so that it can continue to send spam messages to the terminal device.

Therefore, a technical means is needed to minimize the impact of the pseudo base station on the network.

Summary of the invention

The embodiment of the present application provides a method for accessing a network device and a network device thereof, which can minimize the impact of the pseudo base station on the network.

In a first aspect, a terminal device receives a system message sent by a base station controller, determines, according to the system message, that the terminal device is allowed to access a first cell, and the terminal device performs network authentication when accessing the first cell. And the first cell is a cell that supports two-way authentication; the terminal device sends an uplink authentication request message to the core network device, where the uplink authentication request message is used to notify the core network device to The terminal device performs authentication; when the terminal device receives the downlink authentication request message sent by the core network device, performs network authentication on the target cell in the first cell to determine whether to access the target cell.

Therefore, the embodiment of the present application can indicate that the terminal device can only access the cell supporting the two-way authentication, and perform network authentication on the target cell to be accessed to determine whether the network can be accessed, thereby preventing the pseudo base station from being caused to the network. Cyber attack.

In conjunction with the first aspect, in a first possible implementation manner of the first aspect, the first cell is a cell identified as a R99+ version in a system message.

Therefore, the embodiment of the present application indicates that the terminal device only allows access to the cell identified as the R99+ version, because R99+ The version of the cell supports the two-way authentication. Therefore, the terminal device determines whether the target cell of the R99+ version can be accessed by performing network authentication on the target cell to be accessed, so that the network attack caused by the pseudo base station to the network can be avoided as much as possible.

With reference to the first aspect and the foregoing implementation manner, in a second possible implementation manner of the first aspect, the performing, by using the target cell in the first cell, performing network authentication, determining whether to access the target cell, The method includes: when the terminal device passes the network authentication of the target cell, determining to access the target cell; when the terminal device fails to pass the network authentication of the target cell, determining to not access the target cell.

That is to say, when the pseudo base station simulates the generation of the pseudo cell of the R99+ version, the terminal device does not pass the authentication of the pseudo cell, that is, does not access the pseudo cell, and avoids the terminal device accessing the pseudo cell, and the network suffering from the pseudo base station. attack.

With reference to the first aspect and the foregoing implementation manner, in a third possible implementation manner of the foregoing aspect, after performing network authentication on the target cell in the first cell, the method further includes: The core network device returns an authentication response message, where the authentication response message is used to identify the terminal device by performing authentication authentication on the target cell.

Therefore, the terminal device can notify the core network device terminal device to perform authentication authentication on the target cell by returning the authentication response to the core network device.

With reference to the first aspect and the foregoing implementation manner, in a fourth possible implementation manner of the foregoing aspect, the uplink authentication request message is an access request message, where the access request message includes The secret key serial number CKSN field is used to trigger the authentication process of the network device by the network device.

Therefore, by setting the CKSN field in the access request message to an invalid setting, the core network device can be instructed to trigger the authentication of the terminal device, and the information interaction between the network device and the terminal device is implemented without increasing the signaling overhead.

With reference to the first aspect and the foregoing implementation manner, in a fifth possible implementation manner of the first aspect, the access request message is one of: a location update request message, a connection management CM service request message, Call the reply message.

With reference to the first aspect and the foregoing implementation manner, in a sixth possible implementation manner of the first aspect, the system message carries the identifier information, where the identifier information is used to indicate that the first cell is an identifier of the R99+ version. Community.

That is to say, by carrying the identifier information in the system message, the terminal device can be notified to allow access to the first cell with the version of 99+.

The second aspect provides a method for accessing a network device, where the core network device receives an uplink authentication request message sent by the terminal device, where the uplink authentication request message is sent by the terminal device to the base station controller. a request message sent after the system message, the system message is used by the terminal device to determine to allow access to the first cell, and the terminal device is instructed to perform network authentication when accessing the first cell, where the first cell is a cell that supports bidirectional authentication; the core network authenticates the terminal device according to the uplink authentication request message, so that the terminal device performs network authentication on the target cell in the first cell. And determining whether to access the target cell.

With reference to the second aspect, in a first possible implementation manner of the second aspect, after the core network device receives the uplink authentication request message sent by the terminal device, the core network is configured according to the uplink authentication request message, The authentication of the terminal device further includes: a downlink authentication request message sent to the terminal device, where the downlink authentication request message is used to instruct the terminal device to perform network authentication on the target cell, where Carrying the downlink authentication request message The identifier of the target cell.

With reference to the second aspect and the foregoing implementation manner, in a second possible implementation manner of the second aspect, the network covered by the core network device is a network supporting two-way authentication, and further, the core network device is The network covered is the R99+ version.

A third aspect provides a method for accessing a network device, where the base station controller sends a system message to the terminal device, where the system message is used to indicate that the terminal device allows access to the first cell, and the terminal device When the first cell is accessed, the first cell is authenticated, the first cell is a cell that supports bidirectional authentication, and the base station controller receives an uplink authentication request message sent by the terminal device, where the uplink packet is sent. The right request message is used to indicate that the terminal device needs to perform network authentication on the first cell; the base station controller sends the uplink authentication request message to the core network device, to notify the core network device to The terminal device performs authentication to facilitate access by the terminal device to a cell authenticated by the network.

With reference to the third aspect, in a first possible implementation manner of the third aspect, the method further includes: receiving a downlink authentication request message sent by the core network device, where the downlink authentication request message is used to notify the The terminal device performs network authentication on the target cell in the first cell, where the downlink authentication request message carries the identifier of the target cell, and sends the downlink authentication request message to the terminal device.

With reference to the third aspect and the foregoing implementation manner, in a second possible implementation manner of the third aspect, the system message carries the identifier information, where the identifier information is used to indicate that the first cell is identified as an R99+ version. The cell, the system message is one of the following: base station subsystem BSS system message 2, BSS system message 3, BSS system message 4.

With reference to the third aspect and the foregoing implementation manner, in a third possible implementation manner of the third aspect, before the base station controller sends the system message to the terminal device, the method further includes: determining the core network device The network covered is the R99+ version.

In a fourth aspect, a terminal device is provided for performing the method of any of the above first aspect or any of the possible implementations of the first aspect. In particular, the terminal device comprises means for performing the method of any of the above-described first aspect or any of the possible implementations of the first aspect.

In a fifth aspect, a network device is provided for performing the method of any of the foregoing second aspect or any of the possible implementations of the second aspect. In particular, the apparatus comprises means for performing the method of any of the above-described second aspect or any of the possible implementations of the second aspect.

In a sixth aspect, there is provided another network device for performing the method of any of the above-described third aspect or any of the possible implementations of the third aspect. In particular, the apparatus comprises means for performing the method of any of the possible implementations of the third aspect or the third aspect described above.

In a seventh aspect, a terminal device is provided, the network device comprising: a transceiver, a memory, a processor, and a bus system. Wherein the transceiver, the memory and the processor are connected by the bus system, the memory is for storing instructions for executing instructions stored by the memory to control the transceiver to receive and/or transmit signals, and When the processor executes the instructions stored by the memory, the execution causes the processor to perform the method of the first aspect or any of the possible implementations of the first aspect.

In an eighth aspect, a network device is provided, the network device comprising: a transceiver, a memory, a processor, and a bus system. Wherein the transceiver, the memory and the processor are coupled by the bus system, the memory is for storing instructions for executing instructions stored by the memory to control the transceiver to receive signals and/or transmit signals, and And when the processor executes the instructions stored by the memory, the executing causes the processor to perform the method of any of the possible implementations of the second aspect or the second aspect.

In a ninth aspect, a network device is provided, the network device comprising: a transceiver, a memory, a processor, and a bus system. Wherein the transceiver, the memory and the processor are connected by the bus system, the memory is for storing instructions for executing instructions stored by the memory to control the transceiver to receive signals and/or transmit signals, and When the processor executes the instructions stored by the memory, the execution causes the processor to perform the method of any of the possible implementations of the third aspect or the third aspect.

A tenth aspect, a computer readable medium for storing a computer program, the computer program comprising instructions for performing the method of the first aspect or any of the possible implementations of the first aspect.

In an eleventh aspect, a computer readable medium is provided for storing a computer program comprising instructions for performing the method of any of the second aspect or any of the possible implementations of the second aspect.

According to a twelfth aspect, a computer readable medium is provided for storing a computer program comprising instructions for performing the method of any of the third aspect or any of the possible implementations of the third aspect.

DRAWINGS

FIG. 1 is a schematic diagram of an authentication scenario applied in an embodiment of the present application.

FIG. 2 shows a schematic flow chart of a method of an embodiment of the present application.

Figure 3 shows a schematic diagram of a method of one embodiment of the present application.

Figure 4 shows a schematic diagram of a method of one embodiment of the present application.

FIG. 5 shows a schematic flow chart of a method of an embodiment of the present application.

FIG. 6 shows a schematic block diagram of a terminal device of one embodiment of the present application.

FIG. 7 shows a schematic block diagram of a network device according to an embodiment of the present application.

FIG. 8 shows a schematic block diagram of a network device of another embodiment of the present application.

FIG. 9 is a schematic structural diagram of a terminal device according to an embodiment of the present application.

FIG. 10 is a schematic block diagram of a network device according to an embodiment of the present application.

FIG. 11 is a schematic block diagram of a network device of another embodiment of the present application.

detailed description

The technical solutions in the embodiments of the present application will be clearly and completely described in the following with reference to the accompanying drawings in the embodiments.

As shown in FIG. 1, a user (ie, a user using a USIM card) authentication scenario under the Universal Mobile Telecommunications System (UMTS) is shown.

Specifically, the terminal device 110 communicates with the core network 130 through a Global System for Mobile Communication (GSM) radio access network 120, where the GSM radio access network 120 includes a Base Station Controller (BSC). The terminal device 110 is a terminal device with UMTS authentication and encryption capability, and has a Universal Subscriber Identity Module (USIM) with UMTS security. The core network supports Release 99+ and later, that is, core network support. Two-way authentication authentication on the network side and the terminal device side.

In the current 3rd Generation Partnership Project (3GPP) protocol, "terminals supporting 3/4G networks and using Universal Subscriber Identity Module (USIM) and supporting UMTS authentication have been defined. The device "lives in the GSM radio access network (GRAN) network (2G), and when the core network is the R99+ version, the two-way authentication process is performed, that is, the terminal device will also authenticate the authentication. Community. That is, as long as the core network initiates the authentication process, the terminal device authenticates the network.

However, since the authentication is not mandatory, the pseudo base station bypasses this process and does not initiate authentication for the mobile phone, so that the mobile phone cannot authenticate the pseudo base station.

FIG. 2 is a schematic flowchart of a method of an embodiment of the present application, where an execution entity of the method is a terminal device, where the terminal device can communicate with a core network via a Radio Access Network (RAN). A terminal may refer to a User Equipment (UE), an access terminal, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a wireless communication device, a user agent, or a user device. The access terminal may be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), with wireless communication. Functional handheld devices, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in future 5G networks, and the like.

The base station may be a network device used for communication with the terminal device, for example, may be a base station (Base Transceiver Station, BTS) in the GSM system or CDMA, or a base station (NodeB, NB) in the WCDMA system. It may be an evolved base station (Evolutional Node B, eNB or eNodeB) in the LTE system, or the base station may be a relay station, an access point, an in-vehicle device, a wearable device, and a network side device in a future 5G network.

The core network device is composed of a series of devices that complete the user location management, the network function, and the service control function, and is not limited in this embodiment.

As shown in FIG. 2, the method includes the following steps.

Step 210: The terminal device receives the system message sent by the base station controller, determines, according to the system message, that the terminal device is allowed to access the first cell, and the terminal device performs network authentication when accessing the first cell, where the first cell supports the two-way. The community of authentication.

Step 220: The terminal device sends an uplink authentication request message to the core network device, where the uplink authentication request message is used to notify the core network device to perform authentication on the terminal device.

Step 230: When the terminal device receives the downlink authentication request message sent by the core network device, perform network authentication on the target cell in the first cell to determine whether to access the target cell.

It should be understood that, in step 210, the first cell is a cell supporting bidirectional authentication, that is, a cell supporting Terrestrial Radio Access Network (UTRAN) or Long Term Evolution (LTE) authentication authentication. .

Optionally, the first cell is a cell identified as a R99+ version in the system message.

Specifically, in step 210, the first cell refers to a type of cell identified as a R99+ version in a system message, and the base station controller refers to a communication device that manages the terminal device. After receiving the system message, the terminal device determines that only the first cell of the R99+ version can be accessed, but cannot access other types of cells, and further, in the R99+ version of the cell, the two-way authentication between the supporting network side and the terminal device is supported. Right, that is, not only network devices can authenticate terminal devices, The terminal device also needs to authenticate whether it can access the network.

Before the step 210, the base station controller sends a system message to the terminal device, where the system message is used to indicate that the terminal device allows access to the first cell, and when the terminal device accesses the first cell The first cell is authenticated, and the first cell is a cell identified as a R99+ version in the system message.

Optionally, the system message carries the identifier information, where the identifier information is used to indicate that the first cell is a cell identified as an R99+ version.

Optionally, the system message is one of the following: a base station system (BSS) system message 2, a BSS system message 3, and a BSS system message 4. That is to say, the system message can use the vacant field in the above message to carry the identification information for identifying the message of the R99+ version.

It should be understood that the system message may be a newly defined message, or may be an existing system message carrying the identification information, which is not limited in the embodiment of the present application, and the system message capable of carrying the identification information falls within the scope of the embodiment of the present application.

In the step 220, the uplink authentication request message is used to notify the core network device to perform authentication on the terminal device. Specifically, the uplink authentication request message may be one of the following three conditions:

In the first embodiment, after the terminal device sends the location update request message to the core network device, the core network device learns that the terminal device performs cross-location reselection, and the terminal device continues to send the uplink authentication request message to the core network device to notify The core network device authenticates the terminal device, and determines whether the terminal device can access the network covered by the core network device;

In the second embodiment, the uplink authentication request message may be a newly defined message, and the newly defined uplink authentication request message can be used not only to notify the core network device to authenticate the terminal device, but also to indicate that the terminal device will perform Re-selection across location areas;

In a third embodiment, the uplink authentication request message is an access request message, and the access request message includes a Ciphering Key Sequence Number (CKSN) field set to be unavailable for the key, so that And triggering the authentication process of the network device by the network device, optionally, the access request message is one of the following: a location update request message, a connection management (CM) service request message, Paging response message.

After the step 220, the base station controller receives the uplink authentication request message sent by the terminal device, where the uplink authentication request message is used to indicate that the terminal device needs to perform network authentication on the first cell; further, And sending, by the base station controller, the uplink authentication request message to the core network device, to notify the core network device to perform authentication on the terminal device, so that the terminal device accesses a cell that is authenticated by the terminal.

In step 230, after the core network device receives the uplink authentication request message in step 220, the authentication process for the terminal device is triggered, and the downlink authentication request message sent to the terminal device is sent, and the downlink is sent. The authentication request message is used to instruct the terminal device to perform network authentication on the target cell in the first cell.

Specifically, the downlink authentication request message sent by the core network device to the terminal device, where the downlink authentication request message is used to indicate that the terminal device performs network authentication on the target cell, where the downlink authentication is performed. The request message carries an identifier of the target cell.

Optionally, as an embodiment of the present application, the performing network authentication on the target cell in the first cell to determine whether to access the target cell includes:

When the terminal device passes the network authentication of the target cell, determining to access the target cell;

When the terminal device fails to pass the network authentication of the target cell, it is determined that the target cell is not accessed.

It should be understood that the location update request message, the access request message, the uplink authentication request message, and the offline authentication request message are all forwarded by the base station controller, where the location update request message and the access request sent by the terminal device The message and the uplink authentication request message are forwarded to the core network device by the base station controller, and the downlink authentication request message sent by the core network device is also sent to the terminal device by using the base station controller.

It should also be understood that the target cell is one of the cells in the first cell and belongs to the base station controller. Specifically, when the terminal device is expected to access the target cell, the uplink authentication request message is sent to the base station controller by the target cell, and the base station controller further forwards the uplink authentication request message to the core network device, thereby triggering the core network. The device authenticates the terminal device, that is, the core network device sends a downlink authentication request message to the terminal device by using the base station controller, and the terminal device determines, according to the downlink authentication request message, whether the target cell can pass the authentication of the terminal device. Only the target cell can access the target cell through the authentication of the terminal device, otherwise the terminal device will not access the target cell.

That is to say, if the target cell is a non-R99+ cell generated by the pseudo base station, the terminal device will not access the pseudo cell generated by the pseudo base station, and thus will not be affected by the pseudo base station, thereby avoiding the influence of the pseudo base station on the network. .

If the pseudo base station simulates generating a pseudo cell of the R99+ version, the terminal device fails to pass the authentication of the pseudo cell, that is, does not access the pseudo cell.

Therefore, the embodiment of the present application can indicate that the terminal device can only access the cell identified as the R99+ version, and perform network authentication on the target cell to be accessed to determine whether the network can be accessed. Cyber attack.

Optionally, as an embodiment of the present application, after performing network authentication on the target cell in the first cell, the method further includes: returning an authentication response message to the core network device, where the authentication The response message is used to characterize the terminal device by authenticating the target cell.

That is to say, the terminal device notifies the core network device by returning an authentication response message to the core network device, and the terminal device accesses the target cell.

FIG. 3 is a schematic diagram of a method of an embodiment of the present application. The execution body of the method may be a core network device. As shown in FIG. 3, the method 300 includes the following steps.

Step 310: The core network device receives an uplink authentication request message sent by the terminal device, where the uplink authentication request message is a request message sent by the terminal device after receiving the system message sent by the base station controller, and the system message is used by the terminal device to determine that the terminal device is allowed to connect. And entering the first cell, and instructing the terminal device to perform network authentication when accessing the first cell, where the first cell is a cell identified as a R99+ version in the system message.

Step 320: The core network authenticates the terminal device according to the uplink authentication request message, so that the terminal device performs network authentication on the target cell in the first cell to determine whether to access the target cell.

Optionally, as an embodiment of the present application, after the core network device receives the uplink authentication request message sent by the terminal device, the core network performs the authentication on the terminal device according to the uplink authentication request message. The right further includes: a downlink authentication request message sent to the terminal device, where the downlink authentication request message is used to indicate that the terminal device performs network authentication on the target cell, where the downlink authentication request message is carried in the The identifier of the target cell.

Optionally, as an embodiment of the present application, the network covered by the core network device is an R99+ version.

4 is a schematic diagram of a method of an embodiment of the present application. The execution body of the method is a base station controller. As shown in FIG. 4, the method 400 includes the following steps.

Step 410: The base station controller sends a system message to the terminal device, where the system message is used to indicate that the terminal device is allowed to connect. And entering the first cell, and performing authentication on the first cell network when the terminal device accesses the first cell, where the first cell is a cell that supports bidirectional authentication.

Step 420: The base station controller receives an uplink authentication request message sent by the terminal device, where the uplink authentication request message is used to indicate that the terminal device needs to perform network authentication on the first cell.

Step 430: The base station controller sends an uplink authentication request message to the core network device, and notifies the core network device to perform authentication on the terminal device, so that the terminal device accesses the cell that is authenticated by the network.

Optionally, as an embodiment of the present application, the method further includes: receiving a downlink authentication request message sent by the core network device, where the downlink authentication request message is used to notify the terminal device to the first The target cell in the cell performs network authentication, where the downlink authentication request message carries the identifier of the target cell, and the downlink authentication request message is sent to the terminal device.

Optionally, as an embodiment of the present application, the system message carries the identifier information, where the identifier information is used to indicate that the first cell is a cell identified as an R99+ version, and the system message is one of the following: BSS system message 2, 2BIS, BSS system message 3, BSS system message 4.

FIG. 5 shows a schematic flow chart of a method of an embodiment of the present application. As shown in FIG. 5, the method includes the following steps.

Step 501: The base station controller sends a system message to the terminal device, where the system message is used to indicate that the UE can only access the first cell, and the terminal device performs network authentication when accessing the first cell, where the first cell Refers to a cell identified by the system message as the R99+ version.

It should be understood that the system message may be a newly defined system message, or may be an existing system message indicating that the first cell is a R99+ version of the cell, for example, may be BSS system message 2, 2BIS, BSS system message 3, BSS System message 4, in the blank field of the system message, carries the identifier information indicating the first cell type, indicating that the UE can only allow access to the identified first cell.

Step 502: The terminal device sends an uplink authentication request to the core network device. The uplink authentication request is used to notify the core network device to perform authentication on the terminal device.

Specifically, the uplink authentication message is sent by the terminal device to the base station controller, and is forwarded by the base station controller to the core network device.

It should be understood that, before the step 502, the terminal device sends an access request message to the core network device, where the access request message is used to notify the core network device that the terminal device is about to enter the cross-location area reselection.

Optionally, the uplink authentication request message is an access request message, where the access request message includes a CKSN field set to be unavailable for the key, for example, a CKSN field set to “111”, in order to trigger the network device to The authentication process of the terminal device.

Optionally, the foregoing access request message is one of the following: a location update request message, a CM service request message, and a page response message.

Step 503: The core network device sends a downlink authentication request message to the UE, that is, when the core network device receives the uplink authentication request message in step 502, the network side authenticates the UE.

Specifically, the core network device sends a downlink authentication request message to the UE through the base station controller, and notifies the UE to perform network authentication on the target cell in the first cell to determine whether to access the target cell.

The target cell is one of the first cells that the UE desires to access.

Step 504: The UE authenticates the network, that is, the UE performs network authentication on the target cell to determine whether to access the network. Target cell.

Specifically, when the terminal device passes the network authentication of the target cell, determining to access the target cell; when the terminal device fails to pass the network authentication of the target cell, determining not to access the target cell .

Step 506: The UE returns an authentication response message to the core network device, where the authentication response message is used to identify the terminal device by authenticating the target cell.

Step 507: The network authenticates the terminal, that is, the core network device determines whether the UE can access the target cell. If the target cell can be accessed, step 508 is performed.

Step 508: The core network device sends a location update success notification message to the UE, where the UE has completed cross-location area reselection and accesses the target cell.

Optionally, before step 501, when it is determined that the network covered by the current core network device is the R99+ version, that is, the control switch is added to the base station controller to ensure that the foregoing process is performed under the R99+ network.

The flow of the method for accessing the network device in the embodiment of the present application is described in detail above with reference to FIG. 1 to FIG. 5. The terminal device and the network device in the embodiments of the present application are described in detail below with reference to FIG.

FIG. 6 shows a schematic block diagram of a terminal device of one embodiment of the present application. It should be understood that the terminal device 600 can perform the various steps performed by the UE in FIG. 2 and FIG. 5, and is not detailed herein to avoid repetition.

As shown in FIG. 6, the terminal device 600 includes the following units.

a receiving unit 610, configured to receive a system message sent by the base station controller, determine, according to the system message, that the terminal device allows access to the first cell, and the terminal device performs access to the first cell. Network authentication, where the first cell is a cell that supports two-way authentication.

The sending unit 620 is configured to send an uplink authentication request message to the core network device, where the uplink authentication request message is used to notify the core network device to perform authentication on the terminal device.

The authentication unit 630 is configured to: when receiving the downlink authentication request message sent by the core network device, perform network authentication on the target cell in the first cell, and determine whether to access the target cell. .

FIG. 7 shows a schematic block diagram of a network device according to an embodiment of the present application. It should be understood that the network device 700 can perform the various steps performed by the core network device in FIG. 3 and FIG. 5, and is not detailed herein to avoid repetition.

As shown in FIG. 7, network device 700 includes the following units.

The receiving unit 710 is configured to receive an uplink authentication request message sent by the terminal device, where the uplink authentication request message is a request message sent by the terminal device after receiving the system message sent by the base station controller, The system message is used by the terminal device to determine that the first cell is allowed to access, and the terminal device is instructed to perform network authentication when accessing the first cell, where the first cell is a cell that supports two-way authentication;

The authentication unit 720 is configured to perform authentication on the terminal device according to the uplink authentication request message, so that the terminal device performs network on the target cell in the first cell. Authentication, determining whether to access the target cell.

FIG. 8 shows a schematic block diagram of a network device of another embodiment of the present application. It should be understood that the network device 800 is capable of performing the various steps performed by the base station controller device of FIGS. 4 and 5, and to avoid repetition, it will not be described in detail herein.

As shown in FIG. 8, the network device 800 includes the following units.

a sending unit 810, configured to send a system message to the terminal device, where the system message is used to indicate that the terminal device allows access to the first cell, and is performed when the terminal device accesses the first cell The first cell network is authenticated, and the first cell is a cell that supports bidirectional authentication.

The receiving unit 820 is configured to receive an uplink authentication request message sent by the terminal device, where the uplink authentication request message is used to indicate that the terminal device needs to perform network authentication on the first cell.

The sending unit 810 is further configured to send the uplink authentication request message to the core network device, to notify the core network device to perform authentication on the terminal device, so that the terminal device accesses the network through the network for authentication. Community.

FIG. 9 is a schematic structural diagram of a terminal device according to an embodiment of the present application. It should be understood that the terminal device 900 can perform the various steps performed by the UE in FIG. 2 and FIG. 5, and is not detailed herein to avoid repetition.

Device 900 includes the following components.

The memory 910 is configured to store a program.

The transceiver 920 is configured to communicate with other devices.

The processor 930 is configured to execute a program in the memory 910, and the processor 930 is respectively connected to the memory 910 and the transceiver 920, and is configured to execute the instruction stored by the memory 910 to execute the instruction Perform the following steps:

The processor 930 is configured to receive, by using the transceiver 920, a system message sent by the base station controller, determine, according to the system message, that the terminal device is allowed to access the first cell, and the terminal device is in accessing the first cell. Performing network authentication, where the first cell is a cell that supports bidirectional authentication; and the uplink authentication request message is sent to the core network device, where the uplink authentication request message is used to notify the core network device to the terminal. The device performs authentication; when the terminal device receives the downlink authentication request message sent by the core network device, performs network authentication on the target cell in the first cell to determine whether to access the target cell.

It should be understood that the terminal device 900 may be specifically the terminal device in the foregoing embodiment, and may be used to perform various steps and/or processes corresponding to the terminal device in the foregoing method embodiments.

FIG. 10 is a schematic block diagram of a network device according to an embodiment of the present application. It should be understood that the terminal device 1000 can perform the various steps performed by the core network device in FIG. 3 and FIG. 5, and is not detailed herein to avoid repetition.

Device 1000 includes the following components.

The memory 1010 is configured to store a program.

The transceiver 1020 is configured to communicate with other devices.

a processor 1030, configured to execute a program in the memory 1010, the processor 1030 is coupled to the memory 1010 and the transceiver 1020, respectively, for executing the instructions stored by the memory 1010 to execute the instructions And performing the following steps: receiving an uplink authentication request message sent by the terminal device, where the uplink authentication request message is a request message sent by the terminal device after receiving a system message sent by the base station controller, where the system message is used The terminal device determines to allow access to the first cell, and instructs the terminal device to perform network authentication when accessing the first cell, where the first cell is a cell supporting two-way authentication; according to the uplink authentication request The message is used to authenticate the terminal device, so that the terminal device performs network authentication on the target cell in the first cell to determine whether to access the target cell.

It should be understood that the network device 1000 may be specifically the terminal device in the foregoing embodiment, and may be used to perform various steps and/or processes corresponding to the core network device in the foregoing method embodiments.

It should be understood that the terminal device 1100 can perform the various steps performed by the base station controller in FIGS. 3 and 5, and in order to avoid repetition, it will not be described in detail herein.

Device 1100 includes the following components.

The memory 1110 is configured to store a program.

The transceiver 1120 is configured to communicate with other devices.

The processor 1130 is configured to execute a program in the memory 1110, and the processor 1130 is respectively connected to the memory 1110 and the transceiver 1120, and is configured to execute the instruction stored by the memory 1110, when executing the instruction. Performing the following steps: sending a system message to the terminal device, where the system message is used to indicate that the terminal device is allowed to access the first cell, and performing network packetization on the first cell when the terminal device accesses the first cell The first cell is a cell that supports bidirectional authentication; the uplink authentication request message sent by the terminal device is received, and the uplink authentication request message is used to indicate that the terminal device needs to perform network authentication on the first cell. Sending the uplink authentication request message to the core network device, and instructing the core network device to perform authentication on the terminal device, so that the terminal device accesses a cell that is authenticated by the network.

It should be understood that the network device 1100 may be specifically the base station controller in the foregoing embodiment, and may be used to perform various steps and/or processes corresponding to the base station controller in the foregoing method embodiments.

Those skilled in the art will appreciate that the various method steps and elements described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both, in order to clearly illustrate hardware and software. Interchangeability, the steps and composition of the various embodiments have been generally described in terms of function in the foregoing description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. Different methods may be used to implement the described functionality for each particular application, but such implementation should not be considered to be beyond the scope of the application.

The methods or steps described in connection with the embodiments disclosed herein may be implemented in hardware, a software program executed by a processor, or a combination of both. Software programs can be placed in random access memory (RAM), memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or technical fields. Any other form of storage medium known.

Although the present application has been described in detail by reference to the accompanying drawings in conjunction with the preferred embodiments, this application is not limited thereto. Various equivalent modifications and alterations to the embodiments of the present application can be made by those skilled in the art without departing from the scope of the present application, and such modifications or substitutions are within the scope of the present application.

Claims

A method for accessing a network device, comprising:

Receiving, by the terminal device, a system message sent by the base station controller, determining, according to the system message, that the terminal device is allowed to access the first cell, and the terminal device performs network authentication when accessing the first cell, where the A cell is a cell supporting two-way authentication;

The terminal device sends an uplink authentication request message to the core network device, where the uplink authentication request message is used to notify the core network device to perform authentication on the terminal device.

When the terminal device receives the downlink authentication request message sent by the core network device, performing network authentication on the target cell in the first cell to determine whether to access the target cell.
The method according to claim 1, wherein after performing network authentication on the target cell in the first cell, the method further includes:

Returning an authentication response message to the core network device, where the authentication response message is used to identify the terminal device by performing authentication authentication on the target cell.
The method according to claim 1 or 2, wherein the uplink authentication request message is an access request message, and the access request message includes a key sequence number CKSN field set to be unavailable for the key, so that And triggering an authentication process of the network device to the terminal device.
The method according to claim 3, wherein the access request message is one of the following:

A location update request message, a connection management CM service request message, and a paging response message.
The method according to any one of claims 1 to 4, wherein the system message carries identification information, and the identification information is used to indicate that the first cell is a cell identified as an R99+ version.
A method for accessing a network device, comprising:

The core network device receives the uplink authentication request message sent by the terminal device, where the uplink authentication request message is a request message sent by the terminal device after receiving the system message sent by the base station controller, where the system message is used by the The terminal device determines to allow access to the first cell, and instructs the terminal device to perform network authentication when accessing the first cell, where the first cell is a cell supporting two-way authentication;

The core network authenticates the terminal device according to the uplink authentication request message, so that the terminal device performs network authentication on the target cell in the first cell, and determines whether to access the Target cell.
The method according to claim 6, wherein after the core network device receives the uplink authentication request message sent by the terminal device, the core network refers to the uplink authentication request message to the terminal device. The authentication also includes:

a downlink authentication request message sent to the terminal device, where the downlink authentication request message is used to indicate that the terminal device performs network authentication on the target cell, where the downlink authentication request message carries the target cell Logo.
A method for accessing a network device, comprising:

The base station controller sends a system message to the terminal device, where the system message is used to indicate that the terminal device is allowed to access the first cell, and the first cell is authenticated when the terminal device accesses the first cell. The first cell is a cell supporting two-way authentication;

The base station controller receives an uplink authentication request message sent by the terminal device, where the uplink authentication request message is used Characterizing the terminal device requires network authentication for the first cell;

And sending, by the base station controller, the uplink authentication request message to the core network device, to notify the core network device to perform authentication on the terminal device, so that the terminal device accesses a cell that is authenticated by the network.
The method of claim 8 further comprising:

Receiving a downlink authentication request message sent by the core network device, where the downlink authentication request message is used to notify the terminal device to perform network authentication on a target cell in the first cell, where the downlink authentication is performed. The request message carries an identifier of the target cell;

Sending the downlink authentication request message to the terminal device.
The method according to claim 8 or 9, wherein the system message carries identification information, the identifier information is used to indicate that the first cell is a cell identified as an R99+ version, and the system message is the following One kind:

Base station subsystem BSS system message 2, BSS system message 3, BSS system message 4.
A terminal device, comprising:

a receiving unit, configured to receive a system message sent by the base station controller, determine, according to the system message, that the terminal device is allowed to access the first cell, and the terminal device performs network authentication when accessing the first cell Right, wherein the first cell is a cell supporting two-way authentication;

a sending unit, configured to send an uplink authentication request message to the core network device, where the uplink authentication request message is used to notify the core network device to perform authentication on the terminal device;

The authentication unit is configured to perform network authentication on the target cell in the first cell to determine whether to access the target cell when receiving the downlink authentication request message sent by the core network device.
The terminal device according to claim 11, wherein the sending unit is further configured to:

Returning an authentication response message to the core network device, where the authentication response message is used to identify the terminal device by performing authentication authentication on the target cell.
The terminal device according to claim 11 or 12, wherein the uplink authentication request message is an access request message, and the access request message includes a key sequence number CKSN field that is set to be unavailable for the key. In order to trigger the authentication process of the network device by the network device.
The terminal device according to claim 12, wherein the access request message is one of the following:

A location update request message, a connection management CM service request message, and a paging response message.
The terminal device according to any one of claims 11 to 14, wherein the system message carries identification information, and the identifier information is used to indicate that the first cell is a cell identified as an R99+ version.
A network device, comprising:

a receiving unit, where the receiving unit is configured to receive an uplink authentication request message sent by the terminal device, where the uplink authentication request message is a request message sent by the terminal device after receiving a system message sent by the base station controller, where The system message is used by the terminal device to determine that the first cell is allowed to access, and the terminal device is instructed to perform network authentication when accessing the first cell, where the first cell is a cell that supports two-way authentication;

An authentication unit, configured to perform authentication on the terminal device according to the uplink authentication request message, so that the terminal device performs network authentication on the target cell in the first cell And determining whether to access the target cell.
The network device according to claim 16, wherein the network device further comprises:

a sending unit, where the sending unit is configured to send a downlink authentication request message to the terminal device, where the downlink authentication request message is used to instruct the terminal device to perform network authentication on a target cell, where the downlink authentication The identity request message carries the identifier of the target cell.
A network device, comprising:

a sending unit, configured to send a system message to the terminal device, where the system message is used to indicate that the terminal device allows access to the first cell, and when the terminal device accesses the first cell, First cell network authentication, the first cell is a cell supporting two-way authentication;

a receiving unit, configured to receive an uplink authentication request message sent by the terminal device, where the uplink authentication request message is used to indicate that the terminal device needs to perform network authentication on the first cell;

The sending unit is further configured to send the uplink authentication request message to the core network device, to notify the core network device to perform authentication on the terminal device, so that the terminal device accesses the network authentication. Community.
The network device according to claim 18, wherein the receiving unit is further configured to:

Receiving a downlink authentication request message sent by the core network device, where the downlink authentication request message is used to notify the terminal device to perform network authentication on a target cell in the first cell, where the downlink authentication is performed. The request message carries an identifier of the target cell;

The sending unit is further configured to: send the downlink authentication request message to the terminal device.
The network device according to claim 18 or 19, wherein the system message carries identification information, the identifier information is used to indicate that the first cell is a cell identified as a R99+ version, and the system message is the following One of them:

Base station subsystem BSS system message 2, BSS system message 3, BSS system message 4.
A computer readable medium for storing a computer program, the computer program comprising instructions for performing the method of any one of claims 1 to 10.
A computer program product, wherein the computer program product is executed by a computer to implement the method of any one of claims 1 to 10.