WO2011023097A1 - Method, apparatus and system for access control - Google Patents

Abstract

A method, apparatus and system for access control are provided by the embodiment of the present invention. Wherein the method includes the following steps: receiving an access request; obtaining access right information of the UE or the cluster to which UE belongs or the APN in the access request; performing access operation if the access right information accords with the allowing access condition; refusing to perform access operation if the access right information does not accord with the allowing access condition, and determining the UE or the cluster to which UE belongs or some APN is illegal; transmitting the information that the UE or the cluster to which UE belongs or some APN is illegal to a server. The network side judges the access right information of the UE or the cluster to which UE belongs or the APN, allows the UE to access if the UE accords with the allowing access condition, and transmits the information that the UE or the cluster to which UE belongs or some APN is illegal to the server. So that the purpose of limiting the access of UE is achieved, the malice attack from UE to the network side is prevented farther, and the service quality of the network is improved.

Description

 Method, device and system for access control

 This application claims priority to Chinese Patent Application No. 200910167128.6, entitled "A Method, Apparatus and System for Access Control", filed on August 24, 2009, the entire contents of which is incorporated by reference. In this application. Technical field

 The present invention relates to the field of communications technologies, and in particular, to a method, an apparatus, and a system for access control. Background technique

 With the popularity and development of wireless communication technologies, terminals have emerged, such as Machine Type Communications (MTC) applications; in MTC, networks that do not require human intervention between one or more network elements. Communication, that is, Machine to Machine (M2M) application; specific application scenarios such as: traffic control and management, factory monitoring, remote meter reading, etc. In the MTC application, the user equipment (User Equipment, UE) is called M2ME in the MTC application. The multiple M2MEs are integrated into one group. The network operator or the industry user can manage or control the group as a whole. Group IDs can be used to identify and identify different groups. Network operators and industry users can manage access control as a group.

 As shown in FIG. 1 , it is an existing network architecture, including: a mobility management network element 101, a server 102, and an access network 103; wherein the mobility management network element 101 is used for a non-access layer ( Non-Access Stratum (NAS) signaling and NAS signaling encryption and roaming, tracking and other functions, assigning user temporary identity, security functions, etc.; server 102, for storing UE or group related subscription data or information. The access network 103 is configured to receive an access request of the UE, and help the UE complete the access network. The subscription data of the UE refers to the subscription data of each UE as an individual; the subscription data of the group refers to data or subscription data common to each UE in the group.

In the process of implementing the present invention, the inventor finds that: when an illegal UE maliciously attacks the network side or uses a malicious access point name (Access Point Name, ΑΡΝ) to maliciously attack the network, the network side cannot well stop the illegal UE from continuing to attack other network entities. And the network side does not investigate the illegal cause of the illegal UE, resulting in more and more illegal terminals appearing constantly, which poses a great threat to network security and seriously affects the experience of other normal users. Summary of the invention

 The technical problem to be solved by the embodiments of the present invention is to provide a method, a device and a system for access control, which can control an illegal UE to access a network.

 In order to solve the above technical problem, the method embodiment of the access control provided by the present invention can be implemented by the following technical solutions:

 Receiving an access request;

 Obtaining access rights information of the user equipment or the group or access point name to which the user equipment belongs;

 Performing an access operation if the access right information meets the conditions for allowing access;

 Determining that the user equipment or the group in which the user equipment is located or an access point name is illegal if the access right information does not meet the conditions for allowing the access, and the user equipment or the The information about the group where the user equipment is located or the name of an access point is illegal is sent to the server.

 The embodiment of the present invention further provides a mobility management network element or an access network network element, including: a request receiving unit, configured to receive an access request;

 The access right information acquiring unit is configured to acquire the access right information of the user equipment or the group or the access point name to which the user equipment belongs.

 An access operation unit, configured to perform an access operation if the access right information meets a condition for allowing access; otherwise, the access operation is refused;

 An illegal determining unit, configured to determine that the user equipment or the group where the user equipment is located or the name of the access point is illegal if the access right information does not meet the conditions for allowing access;

 The illegal information sending unit is configured to send information about the user equipment or the group where the user equipment is located or an access point name to the server.

 The embodiment of the invention further provides a server, including:

 The illegal information receiving unit is configured to receive the user equipment or the group where the user equipment is located or the name of the access point that is sent by the mobility management network element or the access network element is illegal.

 a troubleshooting unit, configured to: check, by the server, the illegal user equipment or the group where the user equipment is located or the abnormal name of the access point;

a modifying unit, configured to modify the corresponding parameter according to the cause of the abnormality to cause the user equipment The group or the access point name is legal.

 An embodiment of the present invention further provides an access control system, including:

 a mobility management network element or an access network element for receiving an access request; obtaining access rights information of the user equipment or the group or access point name to which the user equipment belongs; If the access information meets the conditions for allowing access, the access operation is performed; if the access right information does not meet the conditions for allowing access, the access operation is refused, and the user equipment or the user equipment group or a certain group is determined. The access point name is illegal; the user equipment or the group where the user equipment is located or the information whose name is illegal is sent to the server;

 And a server, configured to receive information that the user equipment or the group where the user equipment is located or the name of the access point is illegal.

 The foregoing technical solution has the following beneficial effects: The network side determines the access right information of the user equipment that accesses the request or the access right information of the group or the access point name to which the user equipment belongs, and the user equipment that meets the access permission condition is The user is allowed to access, and the user equipment or the group where the user equipment is located or the name of the access point is illegal, and the information is sent to the server, so as to limit the access of the UE, and further prevent the UE from being on the network side. Conduct malicious attacks to improve the quality of service on the network.

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are to be regarded as Other drawings may also be obtained from these drawings without the inventive labor.

 1 is a schematic diagram of a prior art network architecture;

 2 is a schematic flowchart of a method embodiment of an embodiment of the present invention;

 3 is a schematic flowchart of Embodiment 2 of a method according to an embodiment of the present invention;

 4 is a schematic flowchart of a third embodiment of a method according to an embodiment of the present invention;

 FIG. 5 is a schematic structural diagram of a mobility management network element according to Embodiment 4 of the present invention; FIG.

 6 is a schematic structural diagram of a mobility management network element according to Embodiment 4 of the present invention;

 7 is a schematic structural diagram of a server according to Embodiment 5 of the present invention;

8 is a schematic structural diagram of a server according to Embodiment 5 of the present invention; FIG. 9 is a schematic structural diagram of an access control system according to Embodiment 6 of the present invention.

detailed description

 The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

 The first embodiment of the present invention provides a method for access control. The execution entity of the technical solution in this embodiment may be a mobility management network element or an access network element. The following steps can be included:

 Step 201: Receive an access request.

 Step 202: Obtain access rights information of the user equipment or the group or access point name to which the user equipment belongs.

 The foregoing access right information includes: the number of accesses of the group where the user equipment or the user equipment is located in a unit time, and the total number of accesses of the user equipment or the group where the user equipment is located (may be the total number of accesses on a certain network device) For example, the mobility management network element or the access network element, at least one of the number of accesses per unit time under a certain APN, or the total number of accesses to an APN. The process of obtaining the access right information may include: performing statistics by itself; or obtaining server statistics from the server. Of course, the foregoing access rights information may be other, which is not limited by the embodiment of the present invention, and does not affect the implementation of the embodiments of the present invention.

 Step 203: If the access right information meets the conditions for allowing access, perform an access operation, or not, and refuse to perform an access operation, and determine that the user equipment or the group of the user equipment or an access point name is Illegal

 The conditions for allowing access include: the user equipment or the group in which the user equipment is located or the traffic model of an APN. The traffic model specifically includes: the number of accesses of the group where the user equipment or the user equipment is located in the unit time, and the total number of accesses of the group where the user equipment or the user equipment is located on the network side (may be in a certain network) The total number of accesses on the device, such as the mobility management network element or the access network element. The network side allows the number of accesses per unit time in an APN, or the total number of accesses allowed to access an APN on the network side. At least one of the number of entries.

Step 204: The user equipment or the group where the user equipment is located or an access point name is Illegal information is sent to the server.

 The server sends the information about the UE or the group where the UE is located or the name of an access point to the corresponding mobility management network element or the access network when there is an access request from the UE or the intra-group UE or the APN. The current mobility management network element or access network element, or moved to a new mobility management network element or access network element, so that the mobility management network element or the access network element can be described The illegal information rejects the access request of the user equipment or the group or access point name to which the user equipment belongs.

 Further, the user equipment or the group in which the user equipment is located or the APN is illegal may be saved, and the illegal information may be used to control the access request of the user equipment or the group of the user equipment or the APN.

 The mobility management network element or the access network network element determines the access right of the user equipment that accesses the request, and the access request of the user equipment or the intra-group UE or the APN that is allowed to access the access condition is allowed to be accessed. Restricting the access of the UE or the group to which the UE belongs or accessing an APN, and by notifying the server of the illegal information of the user equipment or the group of the user equipment or an access point name, When the access management network element or the access network element receives the access request of the user equipment or the group of the user equipment or the name of an access point, the user equipment or the user equipment group obtained by the user equipment Or illegal information of an access point name, rejecting the access request. Further, the UE or the group or a specific APN is prevented from performing malicious attacks on the network side, improving the service quality of the network, and improving the reliability of the network device. In addition, network congestion can be reduced due to restrictions on UE access.

In another embodiment of the present invention, the server includes the first server and the second server, and the method includes: after the first server (for example, the HSS) receives the information of the user equipment or the group of the user equipment or the name of an access point is illegal, The first server sends a message to notify the second server (for example, the MTC Server), where the message carries the UE identifier (or the group identifier or the APN) and the indication information indicating that the UE (or the group or the APN) is illegal (the foregoing indication information may be a specific The message type or the specific cause value, etc., is used to notify the second server that the UE or the group or the APN is illegal. In this embodiment, the name of the message is not limited. The second server may query, according to the illegal UE or the group or the APN, the information related to the UE or the group or the APN stored in the first server or the second server, where the information refers to affecting the UE or the group or the APN. Information on access rights, including but not It is limited to information such as the corresponding time point for allowing the UE or the group or the APN to access, or the total number of UEs that are allowed to access the group, or the time point at which the service is allowed to occur. The reason for the abnormality of the UE or the group is found by the above information (for example, the total number of UEs allowed to access the group is too large, or the time access point required by the service is too busy, etc.), and the second server The reason for the access abnormality is to modify the corresponding parameters to make the UE or the group or the APN legal (for example, reduce the number of UEs in the group or the time point of the service to perform distributed access control), and send a message to notify the first server that the UE or the group or APN is restored. The foregoing message carries the UE identifier (or group identifier or APN) and indication information indicating that the UE (or group or APN) is legal (the indication information may be a specific message type or a specific cause value). When the mobility management network element subsequently obtains the information of the UE or the group or the APN from the first server, the information of the UE or the group is not found.

 In another embodiment of the present invention, if the access right information does not meet the condition for allowing access, if the access request is a location update request, and the source side mobility management network element, the user equipment, or the access network The above location update request is known to be used for load reassignment, and the access request is allowed. The load redistribution process is used, and the load redistribution process ensures that the UE or the intra-group UE can register with other mobility management network elements to continue the corresponding service. Therefore, when the access request initiated by the UE or the intra-group UE due to Load Rebalancing is not within the scope of the traffic model allowed by the network side, the network side may accept the corresponding access request of the UE or the intra-group UE.

The mobility management network element in the embodiment of the present invention may be explained as follows: The mobility management network element in the Evolved Universal Terrestrial Radio Access Network (E-UTRAN) network may be a mobility management entity. (Mobility Management Entity, MME); The mobility management network element in the Universal Terrestrial Radio Access Network (UTRAN) / GSM/EDGE Radio Access Network (GERAN) may be a general packet The Serving General Packet Radio Service Supporting Node (SGSN); the mobility management network element of the Third Generation Partnership Project (3GPP) network may be an access gateway (Acess Gateway, AGW). The mobility management network element in the Wireless Local Area Network (WLAN) network refers to the mobility management logic function in the Evolved Packet Data Gateway (ePDG); Global mutual 3⁄4 ( Worldwide Interoperability for Microwave Access, Wimax) network, the mobile management network element may be an Access Serving Node Gateway (ASN GW); in a Code Division Multiple Access (CDMA) network, The mobility management network element may be a logical function of mobility management in a High Rate Packet Data Access Network (HRPD AN).

 The access network element in the embodiment of the present invention may be explained as follows: The access network element in the E-UTRAN network may be: an evolved NodeB (eNodeB) or a cellular base station (Honeycomb NodeB, HeNB); The access network element in the UTRAN/GERAN network can be: a radio network controller (RC) or a base station controller (BSC); in a non-3GPP network, an access network in a WLAN network. The element may be an access network logic function in the ePDG. In the Wimax network, the access network element refers to an Access Serving Node Gateway (ASN BS). In the CDMA network, the access network element may be Access network logic in HRPD AN.

 The server in the present invention can store UE or group related subscription data or information. The subscription data or information of the UE refers to the subscription data or information of each UE as an individual; the subscription data or information of the group refers to the subscription data or information common to each UE in the group, and the server may be a Home Subscriber Server (HSS). Or an application server, such as Machine Type Communications (MTC Server).

The above-mentioned examples of the mobility management network element, the access network element, and the server in the various systems are understood to be non-exhaustive and should not be construed as limiting the embodiments of the present invention; In the following embodiments, the server will be described by taking the HSS or the MTC Sever as an example. It can be understood that the server may also be a plurality of types of application servers HSS or MTC Sever. The examples are not to be construed as limiting the embodiments of the present invention. In the second embodiment, the embodiment of the present invention is further described by taking the mobility management network element as an example of the access right information of the user equipment. In this embodiment, the first server and the second server may be used to save the server of the user subscription data, and the second server may also be used to check the server of the illegal APN or the illegal user or the illegal group. Of course, the first server and the second server function can also be combined. If the functions are unified, the first server and the second server are The message belongs to the message interaction within the device. In this embodiment, the first or second server saves

The traffic model of the UE or the group, the traffic model in the present invention refers to a model in which the UE or the intra-group UE initiates an access procedure to access the network, for example, the number of accesses per unit time allowed on the network side, allowing total on a certain device. Information such as the number of accesses. The access process in the present invention includes but is not limited to the following processes: an attach process, a location update process, such as a Routing Area Update (RAU), a Location Area Update (LAU), or a Tracking Area Update (TAU). ), PDN connection establishment, PDP activation, or Service Request process, etc. The mobility management network element obtains the traffic model from the first server or the second server, and accepts or rejects the UE according to the traffic model. An access request, where the first or second server stores a traffic model of the UE or the group, and the first or second server may be an HSS or an MTC Server. As shown in FIG. 3, the following steps may be included:

 Step 301: The UE initiates an access request to the access network element. Optionally, if the UE is performing access for load re-balancing of the mobility management network element, the UE is in radio resource control (Radio Resource Control, RRC) layer message carrying indication to inform the access network element that the UE is performing Load Rebalancing

 If the mobility management network element (ie, the source mobility management network element) registered by the UE or the intra-group UE needs to perform Load Rebalancing, the registered mobility management network element of the UE or the intra-group UE indicates the UE or the group. The inner UE performs a location update process to complete Load Rebanlancing of the source mobility management network element. After receiving the indication, the UE or the intra-group UE initiates a location update process, and the access network element selects a target mobility management network element different from the source mobility management network element for the UE or the intra-group UE, thereby completing Load Rebalancing (ie load redistribution).

 Step 302: The access network element sends an access request to the mobility management network element. Optionally, the access network element carrying indication information is used to indicate that the UE is performing an access procedure for the load rebalancing of the mobility management network element, where the indication information may be a Load Rebalancing Indication, and the information may be used as a separate cell. The reserved bits sent to the mobility management network element or as other cells are sent to the mobility management network element.

Step 303: The mobility management network element acquires subscription data of the UE or the group from the first or second server (which may be referred to as an HSS or an MTC Server, where the HSS or the MTC Server is used as an example). The first or second server sends a traffic model of the UE or the group to the mobility management network element. Traffic The model can also be statically configured in the mobility management network element, for example, configuring the number of access times allowed by a certain UE per unit time; or configuring the number of access times allowed in a certain group unit time; or configuring the mobility management in the unit time. The number of accesses of the network element, etc.

 Step 304: The mobility management network element collects the access situation of the UE or the group, for example, the number of access times of the UE or the group in the statistical unit time, or the access times of all the access to the mobility management network element, and the mobility management network element. Determining whether the access of the UE or the group exceeds the allowed range of the traffic model. If the access times are within the range allowed by the traffic model, the mobility management network element may accept the access request of the UE or the UE in the group. Otherwise, The access request of the UE or the intra-group UE is rejected, and this step is implemented in step 306. Step 306 and steps 304 and 305 have no sequential relationship.

 Optionally, if the foregoing traffic model is for a single UE, and the access situation of the UE (for example, the number of accesses per unit time, or the total number of times connected to the mobility management network element) exceeds that allowed by the foregoing traffic model. The access scope, the mobility management network element sends a message to notify the first server that the UE is an illegal UE, and the message carries the UE identifier and the indication information that the UE is an illegal UE, and the indication information may be a specific message type or a specific The reason value, etc. The next time the UE accesses the other mobile management network element, the first server notifies the mobility management network element of the indication information that the UE is an illegal UE, and prevents the UE from being illegally accessed by other mobility management network elements;

 If the traffic model is for a group, the mobility management network element counts the access conditions of the UEs in the group that belong to the same group identifier (for example, the number of accesses of the UE in the group within a unit time, or access to the mobility management network element) The total number of accesses of the UEs in the group, etc.). The mobility management network element obtains the group identity to which the UE belongs, and may acquire the group identity of the UE by acquiring the subscription data of the UE from the first or the second server by using the manner in which the UE carries the group identity or the mobility management network element. If the access situation of the group exceeds the range allowed by the traffic model of the group, the mobility management network element sends a message to notify the first server that the group is illegal, and the message carries the group identifier and indicates that the group is illegal. The indication information may be a specific message type or a specific cause value or the like. When the UE in the group accesses the other mobility management network element, the first server notifies the mobility management network element of the indication information that the UE in the group is illegal, and prevents the UE in the group of the group from being in other mobility management. The network element is illegally accessed;

Step 305: Optionally, the first server sends a message to notify the second server, where the message carries the UE identifier (or group identifier) and indication information indicating that the UE (or group) is illegal, and the foregoing indication information The information may be a specific message type or a specific cause value. The above message is used by the first server to notify the second server that the UE or the group is illegal. The present invention does not limit the name of the message. The second server may query, according to the illegal UE or the group, information related to the UE or the group that is saved in the first server or the second server, where the information refers to the access situation affecting the UE or the group. The information includes, but is not limited to, a corresponding time point for allowing the UE or the group to access, or a total number of UEs that are allowed to access the group, or a time point at which the service is allowed to occur. The reason for the abnormality of the UE or the group is found by the above information (for example, the total number of UEs allowed to access the group is too large, or the time access point required by the service is too busy, etc.), and the second server The reason for the abnormality of the access is modified to make the UE or the group legal, and the message is sent to notify the first server that the UE or the group is normal. The message carries the UE identifier (or group identifier) and the indication information indicating that the UE (or group) is legal. The above indication information may be a specific message type or a specific cause value. When the mobility management network element subsequently acquires the information of the UE or the group from the first server, the information of the UE or the group is not found.

 Step 306: If the access request of the UE or the group is not in the traffic model, the mobility management network element rejects the access request of the UE or the group, and the rejection message carries the indication information for indicating the access of the UE (or the group). The request information that does not conform to the traffic model may be a specific cause value such as an illegal access request, or a specific indication such as an illegal indication. Conversely, the mobility management network element accepts an access request from a UE or a UE within the group. Steps 305 and 306 have no sequence.

Optionally, although the access request of the UE or the intra-group UE is not in the traffic model set by the network, the UE or the intra-group UE is performing the access procedure, mobility management for the load rebalancing of the mobility management network element. The network element may be in accordance with the indication information of the access procedure that is performed by the access network element in step 302 indicating that the UE or the intra-group UE is performing Load Rebalancing for the mobility management network element, although the UE or the intra-group UE access is not in use. Within the scope allowed by the traffic model, the network side can still accept requests from UEs or UEs within the group. The indication information indicating that the UE or the intra-group UE is performing the access procedure for the Load Rebalancing of the mobility management network element may also be brought by the UE or the intra-group UE to the mobility management network element by using the NAS message, Or the new mobility management network element learns from the mobility management network element on the source side in the context response (Context Response) that the foregoing indication process is performed by the UE or the intra-group UE for the Load Rebalancing of the mobility management network element. Means Show information. The foregoing NAS message includes but is not limited to an attach request (Attach Request), a LAU Request. TAU Request, or a RAU Request message.

 The network side determines the access right of the user equipment that requests the access, and the user equipment that is in compliance with the access condition is allowed to access, and the access of the UE is restricted, thereby further preventing the UE from maliciously attacking the network side. Improve the service quality of the network and improve the reliability of network equipment. In addition, network congestion can be reduced due to restrictions on UE access. In the third embodiment, the embodiment of the present invention is further described by taking the access information of a certain APN as an example. In this embodiment, the traffic model of an APN is stored in the HSS or the MTC Server, or the mobility management network element statically configures the traffic model under an APN, for example, the number of accesses allowed under an APN per unit time, or The total number of accesses allowed to access a certain APN on a device. The mobility management network element collects the access situation of an APN, for example, the number of accesses of an APN in a unit time, or the total access of the mobility management network element to the APN. The access management situation, the mobility management network element accepts or rejects the access request for an APN according to the traffic model of the APN; as shown in FIG. 4, the following steps are included:

 Step 401: The UE initiates an access request to the access network element. Optionally, if the UE is performing access for load re-balancing of the mobility management network element, the UE is in radio resource control (Radio The resource control, RRC) layer carries the indication to inform the access network element that the UE is performing Load Rebalancing, and the access request also needs to carry the APN, where the APN indicates the APN that the UE wishes to access.

If the mobility management network element (ie, the source mobility management network element) registered by the UE or the intra-group UE needs to perform Load Rebalancing, the registered mobility management network element of the UE or the intra-group UE indicates the UE or the group. The inner UE performs a location update process to complete Load Rebanlancing of the source mobility management network element. After receiving the indication, the UE or the intra-group UE initiates a location update process, and the access network element selects a target mobility management network element different from the source mobility management network element for the UE or the intra-group UE, thereby completing Load Rebalancing (ie load redistribution). When the registered mobility management network element cannot continue to be the UE or the intra-group UE, the load re-allocation process ensures that the UE or the intra-group UE can register with other mobility management network elements to continue the corresponding service. Therefore, when the UE or the intra-group UE initiates an access request initiated by Load Rebalancing, it is not allowed on the network side. When the service model is within the range, the network side can accept the corresponding access request of the UE or the UE in the group. Step 402: The access network element sends an access request to the mobility management network element. Optionally, the access network element carrying indication information is used to indicate that the UE is performing an access procedure for the load rebalancing of the mobility management network element, where the indication information may be a Load Rebalancing Indication, and the information may be used as a separate cell. The reserved bits sent to the mobility management network element or as other cells are sent to the mobility management network element.

 Step 403: The mobility management network element obtains subscription data of the UE or the group to the first server, where the server may be an HSS or an MTC Server. In this embodiment, the HSS or the MTC Server is used as an example to dynamically configure an APN traffic model.

 The mobility management network element collects access conditions under an APN, such as the number of accesses in the APN in the unit time, or the total number of accesses of the APN in the mobility management network element, and the access situation. The APN traffic model accepts or rejects the access request in the APN. In step 406, the step 406 and the step 404 and the step 405 have no sequential relationship.

 Step 404: If the access of the U to an APN is within the scope of the access allowed by the traffic model, the mobility management network element allows the access request for the APN, optionally, the mobility management network element is carried. Notifying the first server of the indication information indicating that the APN is illegal, and the indication value such as the age value or the illegal indication may indicate that the APN is illegal. The next time the UE accesses the other mobility management network element, the first server notifies the mobility management network element of the indication information that the APN is a malicious APN, and prevents the user from being illegal in the other mobility management network element by using the APN. Access

Step 405: Optionally, the first server sends a message to notify the second server, where the message carries the APN and the indication information indicating that the APN is illegal, and the indication information may be a specific message type or a specific cause value, etc. Both a server and a second server can be used to store a server for subscriber subscription data, and the second server can also be used to check for a malicious APN or an illegal user or an illegal group of illegal servers. Of course, the first server and the second server can also be functionally combined. If the functions are unified, the message between the first server and the second server belongs to the message interaction in the device. The foregoing message is used by the first server to notify the second server that the APN is illegal. The present invention does not limit the name of the message. The second server can query the first service according to the illegal APN. Corresponding information related to the APN saved in the second server, where the information refers to the information that affects the access situation of the APN, including but not limited to the corresponding time point for allowing the APN to access. Or the total number of UEs that are allowed to access the APN, or information such as the time point at which the service is allowed to occur. The reason for the abnormality of the APN is found by the above information (for example, the total number of UEs that are allowed to access the APN is excessive, the time required for the service is too busy, etc.), and the second server is abnormal according to the access. The reason value is modified to make the APN legal, and the message is sent to notify the first server that the APN is normal. The message carries the APN and the indication information indicating that the APN is legal. The indication information may be a specific message type or a specific cause value.

 Step 406: If the access request under the APN is not in the traffic model, the mobility management network element rejects the access request in the APN, and the indication message carries the indication information to indicate that the access request of the APN is not in compliance with the traffic request. The indication information of the model, the foregoing indication information may be a specific cause value illegal access request (or illegal access request), or a specific indication ^ illegal indication (inversely, the mobility management network element accepts the UE or the intra-group UE or Access request under APN. Steps 405 and 406 have no sequence.

 Optionally, although the UE access request is not in the traffic model set by the network, but the UE is performing an access procedure for the load rebalancing of the mobility management network element, the mobility management network element may access according to step 402. The indication information of the access procedure carried by the network element indicating that the UE or the intra-group UE is performing Load Rebalancing for the mobility management network element, although the UE or the intra-group UE access is not within the range allowed by the traffic model, the network The side can still accept requests from UEs or UEs within the group. The mobility management network element may be informed that the indication information indicating that the UE or the intra-group UE is performing the access re-flow for the mobility management network element may also be brought by the UE4 to the mobility management network element or the new mobile through the NAS message. The sex management network element obtains, from the source side mobility management network element, the indication information indicating the access procedure that the UE is performing for the Load Rebalancing of the mobility management network element in the context response (Context Response). The foregoing NAS message includes but is not limited to an attach request (Attach Request), a LAU Request, a TAU Request, or a RAU Request.

The network side determines the access right of the user equipment that requests the access, and the user equipment that is in compliance with the access condition is allowed to access, and the access of the UE is restricted, thereby further preventing the UE from maliciously attacking the network side. Improve the service quality of the network and improve the reliability of network equipment. In addition Network congestion can also be reduced due to restrictions on access under the UE or group or APN. Embodiment 4 As shown in FIG. 5, the embodiment of the present invention further provides a mobility management network element, where the mobility management network element may also be an access network element, including:

 a request receiving unit 501, configured to receive an access request;

 The access right information acquiring unit 502 is configured to acquire the access right information of the user equipment or the group or the APN to which the user equipment belongs.

 The access operation unit 503 is configured to perform an access operation if the access request of the UE or the intra-group UE or the APN meets the conditions for allowing access, otherwise, the access operation is refused.

 The illegal determining unit 504 is configured to determine that the user equipment or the group in which the user equipment is located or the APN is illegal if the foregoing access request does not meet the conditions for allowing access;

 The illegal information sending unit 505 is configured to send the information about the user equipment or the group in which the user equipment is located or an access point name to the server.

 Optionally, as shown in FIG. 6, the access request is a location update request, and the mobility management network element may further include:

 The load redistribution unit 601 is configured to perform the access operation when the location update request is used for the load reassignment from the source side mobility management network element, the user equipment, or the access network element.

 Specifically, the access right information acquiring unit 502 is specifically configured to collect the access situation of the user equipment or the user equipment or the access situation of the APN; or obtain the result of the server statistics from the server.

In the foregoing embodiment, the user equipment of the access request or the group in which the user equipment is located or the access situation of the APN is determined, and the user equipment or the group or APN in which the user equipment is located is allowed to access. For the purpose of restricting the access of the UE or the group or the APN, the UE or the group or the UE using the illegal APN is further prevented from maliciously attacking the network side, improving the service quality of the network, and improving the reliability of the network device. In addition, network congestion can be reduced due to restrictions on UE access or group access or access under APN. Embodiment 5 As shown in FIG. 7, the embodiment of the present invention further provides a server, including: an illegal information receiving unit 701, configured to receive a mobility management network element or an access network element for sending The information of the group or access point where the user device or user device is located is illegal.

 The checking unit 702 is configured to: perform a server to check whether the illegal user equipment or the group where the user equipment is located or the name of the access point is abnormal;

 The modifying unit 703 is configured to modify the corresponding parameter according to the reason of the abnormality, so that the group where the user equipment is located or the name of the access point is legal.

 Further, as shown in FIG. 8, the foregoing server may further include:

 The access right information statistic unit 801 is configured to collect access rights information of a user equipment or a group or an access point name where the user equipment is located;

 The access right query request receiving unit 802 is configured to receive a request for querying the user equipment or the group of the user equipment or the access right information under the name of the access point;

 The querying unit 803 is configured to query the user equipment or the group or the access point name of the user equipment that is queried by the query request from the access information of the user equipment or the user equipment or the access point information of the user equipment. Access rights information;

 The access right information sending unit 804 is configured to send the accessed access right information.

 The foregoing implementation manner provides an acquisition manner for determining the access right of the user equipment. Embodiment 6 As shown in FIG. 9, an embodiment of the present invention further provides an access control system, including: a mobility management network element or an access network element 901, configured to receive an access request; The access information of the requested user equipment or the group or the access point name to which the user equipment belongs; if the access right information meets the conditions for allowing access, the access operation is performed; if the access right information does not meet the permitted access The condition that the access operation is refused, and the name of the user equipment or the group or the access point of the user equipment is illegal; the information of the user equipment or the group of the user equipment or an access point is illegal. Sending to the server 902, causing the network to reject subsequent illegal access;

 The server 902 is configured to receive the information that the user equipment or the group or the access point name of the user equipment is illegal. If the user equipment or the group or the access point name of the user equipment is illegal, the subsequent illegal UE is rejected. The group or UE accesses the illegal APN.

More specifically, the mobility management network element or the access network element 901, the access right information of the user equipment or the group or the access point name to which the user equipment belongs to obtain the access request includes: The user equipment of the access request or the access right information of the group or the access point name to which the user equipment belongs; or

 The mobility management network element or the access network element 901, the access information of the user equipment or the group or access point name to which the user equipment belongs to obtain the access request includes:

 Obtaining the results of the statistics of the server 92 from the server 902;

 The server 902 is further configured to collect the access situation of the user equipment or the group or the access point name, and send the result of the foregoing statistics to the mobility management network element or the access network element 901.

 The server 902 is further configured to: check the illegal user equipment or the group where the user equipment is located or the reason that the access point name is abnormal; modify the corresponding parameter according to the abnormal reason to make the user equipment The group or the access point name is legal; the group in which the user equipment is located or the information of the access point name is sent to the mobility management network element or the access network element 901.

 More specifically, the foregoing receiving access request is a location update request;

 The mobility management network element 901 is further configured to perform the access operation when the location update request is used for the load re-allocation from the source-side mobility management network element, the user equipment, or the access network element.

 In the foregoing implementation manner, the user equipment that accesses the request or the access group of the user equipment or the access rights of the APN is determined, and the user equipment that meets the access permission condition is allowed to access, and the access to the UE or the group is reached. The access restriction on the APN is used to further prevent the UE from maliciously attacking the network side, improving the service quality of the network, and improving the reliability of the network device. Network congestion can also be reduced due to restrictions on UE access or group access or access under APN. The related hardware can be instructed by a program, and the program can be stored in a computer readable storage medium. The above mentioned storage medium can be a read only memory, a magnetic disk or an optical disk.

 The foregoing description of the method, apparatus, and system for access control provided by the embodiments of the present invention is only for facilitating understanding of the method and core idea of the present invention. Meanwhile, for those skilled in the art, In view of the above, the description of the present invention is not limited to the scope of the present invention.

Claims

Rights request A method for access control, characterized in that it comprises:  Receiving an access request;  Obtaining access rights information of the user equipment or the group or access point name to which the user equipment belongs;  Performing an access operation if the access right information meets the conditions for allowing access;  Determining that the user equipment or the group in which the user equipment is located or an access point name is illegal if the access right information does not meet the conditions for allowing the access, and the user equipment or the The information about the group where the user equipment is located or the name of an access point is illegal is sent to the server.  2. The method of claim 1 wherein:  The access right information includes at least one of the following: the number of accesses of the user equipment or the group where the user equipment is located in a unit time, the total access times of the user equipment or the group where the user equipment is located, and the unit time under the access point name. The number of accesses within, or the total number of accesses accessed to the access point name;  The corresponding access permission condition is a traffic model of the group or the access point name of the user equipment or the user equipment, and includes at least one of the following: the number of access times of the group where the user equipment or the user equipment is allowed to be in unit time. The total number of accesses allowed for the user equipment or the group in which the user equipment is located, the number of accesses per unit time under the access point name, or the total number of accesses allowed to access an access point name.  The method according to claim 1, wherein the determining that the user equipment or the group of the user equipment or the name of the access point is illegal includes:  The server is configured to check the illegal user equipment or the group where the user equipment is located or the reason for the abnormality of the access point name; modify the corresponding parameter according to the abnormality reason, so that the user equipment or the group where the user equipment is located or The access point name is legal.  The method according to claim 3, wherein the access request is a location update request, and the location update request is obtained from a source-side mobility management network element, a user equipment, or an access network element. When used for load reassignment, the access operation is performed.  The method according to any one of claims 1 to 4, wherein the access right information of the user equipment that obtains the access request comprises: Counting the access situation of the user equipment or the group or the access point name; or Get the results of the server statistics from the server.  A mobility management network element or an access network element, comprising: a request receiving unit, configured to receive an access request;  An access right information acquiring unit, configured to acquire access rights information of the user equipment of the access request or the group or access point name to which the user equipment belongs;  An access operation unit, configured to perform an access operation if the access right information meets a condition for allowing access; otherwise, the access operation is refused;  An illegal determining unit, configured to determine that the user equipment or the group where the user equipment is located or the name of the access point is illegal if the access right information does not meet the conditions for allowing access;  The illegal information sending unit is configured to send information about the user equipment or the group where the user equipment is located or an access point name to the server.  The network element according to claim 6, wherein the network element is a mobility management network element, and the access request is a location update request, further comprising:  And a load redistribution unit, configured to perform the access operation when the location update request is used for load redistribution from the source side mobility management network element, the user equipment, or the access network element.  8. The network element according to any one of claims 6 to 7, characterized in that  The access right information acquiring unit is specifically configured to collect the access situation of the user equipment or the group or the access point name of the user equipment; or obtain the result of the server statistics from the server.  9. A server, comprising:  The illegal information receiving unit is configured to receive, by the mobility management network element or the user equipment sent by the network element of the access network, the group where the user equipment is located or the name of the access point is illegal;  a troubleshooting unit, configured to: check, by the server, the illegal user equipment or the group where the user equipment is located or the name of the access point is abnormal;  And a modifying unit, configured to modify the corresponding parameter according to the cause of the abnormality to make the group or the access point name where the user equipment is located legal.  The server according to claim 9, further comprising:  An access right information statistic unit, configured to collect access rights information of a user equipment or a group or an access point name where the user equipment is located; The access right query request receiving unit is configured to receive a request for querying the user equipment or the group of the user equipment or the access right information under the name of the access point; The query unit is configured to query, from the access information of the user equipment or the user equipment or the access point information of the user equipment, the user equipment or the group or the access point name of the user equipment Access rights information;  The access right information sending unit is configured to send the queried access right information.  11. An access control system, characterized by comprising:  a mobility management network element or an access network element for receiving an access request; obtaining access rights information of the user equipment or the group or access point name to which the user equipment belongs; If the access information meets the conditions for allowing access, the access operation is performed; if the access right information does not meet the conditions for allowing access, the access operation is refused, and the user equipment or the user equipment group or a certain group is determined. The access point name is illegal; the user equipment or the group where the user equipment is located or the information whose name is illegal is sent to the server;  And a server, configured to receive information that the user equipment or the group or the access point name of the user equipment is illegal.  The method according to claim 11, wherein the mobility management network element or the access network element is used to obtain the user equipment of the access request or the group or access point name to which the user equipment belongs. The access right information includes: the user equipment of the access request or the access status of the group or the access point to which the user equipment belongs; or  The mobility management network element or the access network network element, the access right information for obtaining the user equipment of the access request or the group or access point name to which the user equipment belongs includes:  Obtain the results of server statistics from the server;  The server is further configured to collect an access situation of the user equipment or the group or the access point name, and send the result of the statistics to the mobility management network element or an access network element. .  The system according to claim 11, wherein the server is further configured to: check whether the illegal user equipment or the group where the user equipment is located or the name of the access point is abnormal; The reason for the abnormality is to modify the corresponding parameter to make the group or the access point name of the user equipment legal; and send the information of the group or the access point name of the user equipment to the mobility management network element. Or access network element.  The system according to any one of claims 11 to 13, wherein the receiving access request is a location update request;  The mobility management network element is further configured to perform the access operation when the location update request is used for the load re-allocation from the source-side mobility management network element, the user equipment, or the access network element.