WO2018112895A1 - Handover method, terminal and domain master - Google Patents

Abstract

Disclosed in the embodiments of the present invention are a handover method, a terminal and a domain master. The method comprises: if a terminal needs a domain handover, selecting a target domain master; acquiring bandwidth resources allocated by the target domain master; and before the completion of authentication with the target domain master, using the bandwidth resources allocated by the target domain master to communicate with the target domain master, the frames transmitted during the communication of the terminal with the target domain master being encrypted using a cluster common key. The present invention can reduce the delay during the domain handover of a terminal, ensuring normal service transmission.

Description

Switching method, terminal and domain master node Technical field

The present invention relates to the field of optical wireless communication technologies, and in particular, to a handover method, a terminal, and a domain master node.

Background technique

Optical Wireless Communication (OWC) refers to all optical communication without using cables (such as optical fibers). Visible Light Communication (VLC) and infrared communication are all communication methods in optical wireless communication. VLC refers to the way of communicating using the visible light spectrum (380 nm - 780 nm). It has sufficient spectrum resources and is unlicensed frequency band, which can be used free of charge; it is environmentally friendly, has no electromagnetic pollution, can be used in electromagnetic interference sensitive environment, and is safe for human body; in addition, it has better security, because VLC transmission can only be limited to light energy. The place where it is irradiated, so VLC has strong security of confidentiality. Recently, VLC communication has received more and more attention from academia and industry. It can be expected that VLC will become a widely used communication technology in the future.

The International Telecommunication Union Telecommunication Standardization Sector (ITU-T) is developing a VLC standard for indoor applications, namely G.vlc. The network topology that the VLC system can support includes a coordinated topology and a star topology. The coordinated topology is a unified coordination of networks of multiple star topologies through a global master (GM). The VLC network of each star topology is called a domain, and the VLC network of each coordinated topology includes one or more domains to form a cluster. If the domain works in the security mode, there should be a security controller (SC) in each domain, which is responsible for the security authentication and key management of the terminal (EndPoint, EP). The same device can serve as both a Domain Master (DM) and an SC. Of course, the SC can also be on a different device than the DM. In a cluster, there are multiple DMs, they work under the coordination of GM, GM can perform interference coordination of neighbor DMs, and assist EP to switch between different DMs. As shown in Figure 1, a GM is included, and DM1-DM3 has three DMs. Domain1 corresponding to DM1 is connected to EP1 and EP2, Domain 2 corresponding to DM2 is connected to EP3, and Domain3 corresponding to DM3 is connected to EP4. The three domains form a cluster. When a domain works in a non-secure mode, network admission includes a registration process; when the domain operates in a secure mode, network admission includes two processes of registration and authentication. After completing the registration, the DM will assign the terminal a unique short address (DEVICE_ID) within the domain. After the authentication is completed, the EP can obtain a key for communication with the DM and then communicate with the DM.

Since the EP is mobile, there is a case of switching from one domain to another. If the two processes of registration and authentication are required to perform the service transmission with the new DM, the delay will be very large, and if the link with the original DM is interrupted before the EP completes the authentication with the new DM, This will cause the transmission of the service to be interrupted.

Summary of the invention

The embodiment of the invention provides a handover method, a terminal, and a domain master node, which can reduce the delay of the terminal when the domain is switched, and ensure that the service transmission is performed normally.

A first aspect of the present invention provides a handover method applied to an optical wireless communication system, including:

If the terminal needs to perform domain switching, select the target domain primary node;

Obtaining a bandwidth resource allocated by the target domain primary node;

Communicating with the target domain master node by using the bandwidth resource allocated by the target domain master node before completing the authentication with the target domain master node, where the terminal transmits the frame when communicating with the target domain master node Cluster public key encryption.

In a possible implementation manner, after using the bandwidth resource allocated by the target domain master node to communicate with the target domain master node for a preset time, determining, according to a preset rule, whether the target domain security controller or The target domain master node performs authentication;

If the preset rule is met, the target domain security controller or the target domain master node is authenticated.

In a possible implementation manner, the preset rule is:

The terminal is in a domain where the target domain primary node is located, and the terminal does not currently need to perform domain switching; or

The terminal is in the domain where the target domain primary node is located, and the signal to noise ratio of the signal received by the target domain primary node is greater than a preset threshold, and the terminal does not currently need to perform domain switching.

In a possible implementation manner, after the target domain master node is selected, if the terminal needs to perform domain switching, the method further includes:

Transmitting, by the terminal, a handover request to the target domain primary node, where the handover request includes the end Short address of the end, current domain master node information, and bandwidth resource request information;

Receiving a handover response of the target domain primary node;

And if the target domain master node accepts the handover request of the terminal, acquiring the bandwidth resource allocated by the target domain master node.

In a possible implementation manner, after the target domain master node is selected, if the terminal needs to perform domain switching, the method further includes:

Transmitting, by the terminal, a handover request to a current domain primary node, where the handover request includes a short address of the terminal, the target domain primary node information, and bandwidth resource request information;

Receiving a handover response of the current domain master node;

And if the current domain master node accepts the handover request of the terminal, acquiring the bandwidth resource allocated by the target domain master node.

In a possible implementation manner, if the terminal uses the bandwidth resource allocated by the target domain master node to communicate with the target domain master node for a preset time, determine the need and the target domain security according to a preset rule. The controller or the target domain master node performs authentication, and the terminal sends a registration request to the target domain master node, performs registration, and acquires a new short address allocated by the target domain node;

After the registration is successful, the authentication request is sent to the target domain security controller or the target domain master node for authentication;

After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses.

In a possible implementation manner, after the target domain master node is selected, if the terminal needs to perform domain switching, the method further includes:

Sending, by the terminal, a re-registration request to the target domain primary node, where the re-registration request includes a short address, current domain primary node information, and bandwidth resource request information of the terminal;

Receiving a re-registration response of the target domain master node;

And if the target domain master node accepts the re-registration request of the terminal, acquiring a bandwidth resource and a new short address allocated by the target domain master node.

In a possible implementation manner, after the target domain master node is selected, if the terminal needs to perform domain switching, the method further includes:

Transmitting, by the terminal, a re-registration request to a current domain master node, where the re-registration request includes a short address of the terminal, the target domain primary node information, and bandwidth resource request information;

Receiving a re-registration response of the current domain master node;

And if the current domain master node accepts the re-registration request of the terminal, acquiring a bandwidth resource and a new short address allocated by the target domain master node.

In a possible implementation, after the bandwidth resource allocated by the target domain master node is used to communicate with the target domain master node, the method further includes:

Notifying the current domain master node to release the allocated resources for the terminal, the allocated resources including the allocated short address and the allocated bandwidth resource.

In a possible implementation manner, the short address of the terminal is grouped by the global master node for all available short addresses, and then one of the packets corresponding to the current domain master node is allocated to the current domain master node, and then The current domain master node selects and assigns to the terminal from the corresponding group.

In a possible implementation manner, the terminal uses a short address of the terminal when communicating with the current domain master node, and uses the new short address when the terminal communicates with the target domain master node;

After the terminal communicates with the target domain master node by using the bandwidth resource allocated by the target domain master node to reach a preset time, determining, according to a preset rule, the required domain security controller or the target domain master node If the authentication is performed, the terminal sends an authentication request to the target domain security controller or the target domain master node to perform authentication;

After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses.

In a possible implementation manner, the cluster public key is generated by a global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

In a possible implementation manner, the cluster public key is obtained when the terminal is authenticated by the current domain security controller or the current domain master node when entering the network; or

The cluster public key is obtained when the terminal is authenticated by the current domain master node and the primary security controller, and the primary security controller is used to perform unified authentication on the terminals joining all the domains of the cluster, and the unified authentication is performed. The latter terminal does not need to be authenticated again when performing intra-cluster handover.

In a possible implementation manner, before selecting the target domain master node, the method further includes:

Receiving, by the terminal, a cluster that is sent by the current domain master node by using a media access plan frame or a dedicated message Information about the primary domain of other domains.

A second aspect of the present invention provides a handover method applied to an optical wireless communication system, including:

If the terminal needs to perform domain switching, the target domain master node allocates bandwidth resources to the terminal after agreeing to the handover;

Communicating with the terminal using the allocated bandwidth resource and the cluster public key before completing the authentication with the terminal, wherein the frame transmitted by the target domain master node when communicating with the terminal adopts a cluster public key encryption.

In a possible implementation manner, the cluster public key is obtained when the terminal authenticates with the current domain security controller or the current domain master node when the terminal enters the network;

The cluster public key is generated by the global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

In a possible implementation manner, the short address used by the terminal to communicate with the domain master node is grouped by the global master node for all available short addresses, and then the packets are correspondingly allocated to the domain master nodes, when When the terminal and one of the domain master nodes successfully register, the terminal is selected and assigned to the terminal by the domain master node from the group allocated by the global master node.

A third aspect of the present invention provides a terminal, which is applied to an optical wireless system, and includes:

a selecting unit, configured to select a target domain master node if the terminal needs to perform domain switching;

An obtaining unit, configured to acquire a bandwidth resource allocated by the target domain primary node;

a communication unit, configured to communicate with the target domain master node by using a bandwidth resource allocated by the target domain master node before completing the authentication with the target domain master node, where the terminal and the target domain master node Frames transmitted during communication are encrypted using the cluster public key.

In a possible implementation manner, the terminal further includes:

a determining unit, configured to determine, according to a preset rule, whether the target domain security controller or the target domain is required, after the communication with the target domain master node is used to reach a preset time by using the bandwidth resource allocated by the target domain master node The primary node performs authentication;

The communication unit is further configured to perform authentication with the target domain security controller or the target domain master node if the preset rule is met.

In a possible implementation manner, the preset rule is:

The terminal is in a domain where the target domain primary node is located, and the terminal does not currently need to perform domain switching; or

The terminal is in the domain where the target domain primary node is located, and the signal to noise ratio of the signal received by the target domain primary node is greater than a preset threshold, and the terminal does not currently need to perform domain switching.

In a possible implementation manner, the communication unit is further configured to:

After the selecting unit selects the target domain primary node, sending a handover request to the target domain primary node, where the handover request includes the short address of the terminal, current domain primary node information, and bandwidth resource request information;

Receiving a handover response of the target domain primary node;

And if the target domain master node accepts the handover request of the terminal, instructing the acquiring unit to acquire the bandwidth resource allocated by the target domain primary node.

In a possible implementation manner, the communication unit is further configured to:

After the selecting unit selects the target domain primary node, sending a handover request to the current domain primary node, where the handover request includes the short address of the terminal, the target domain primary node information, and bandwidth resource request information;

Receiving a handover response of the current domain master node;

If the current domain master node accepts the handover request of the terminal, the acquiring unit is instructed to acquire the bandwidth resource allocated by the target domain master node.

In a possible implementation manner, if the terminal uses the bandwidth resource allocated by the target domain master node to communicate with the target domain master node for a preset time, determine the need and the target domain security according to a preset rule. The controller or the target domain master node performs authentication, and the communication unit is further configured to send a registration request to the target domain master node, perform registration, and acquire a new short address allocated by the target domain node;

After the registration is successful, the authentication request is sent to the target domain security controller or the target domain master node for authentication;

After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses.

In a possible implementation manner, the communication unit is further configured to:

After the selection unit selects the target domain primary node, sending a re-injection to the target domain primary node The request for re-registration includes the short address of the terminal, current domain master node information, and bandwidth resource request information;

Receiving a re-registration response of the target domain master node;

And if the target domain master node accepts the re-registration request of the terminal, instructing the acquiring unit to acquire the bandwidth resource and the new short address allocated by the target domain primary node.

In a possible implementation manner, the communication unit is further configured to:

After the selecting unit selects the target domain master node, sending a re-registration request to the current domain master node, where the re-registration request includes the short address, the current domain master node information, and the bandwidth resource request information of the terminal;

Receiving a re-registration response of the target domain master node;

And if the target domain master node accepts the re-registration request of the terminal, instructing the acquiring unit to acquire the bandwidth resource and the new short address allocated by the target domain primary node.

In a possible implementation, after the bandwidth resource allocated by the target domain master node is used to communicate with the target domain master node, the communication unit is further configured to:

Notifying the current domain master node to release the allocated resources for the terminal, the allocated resources including the allocated short address and the allocated bandwidth resource.

In a possible implementation manner, the short address of the terminal is grouped by the global master node for all available short addresses, and then one of the packets corresponding to the current domain master node is allocated to the current domain master node, and then The current domain master node selects and assigns to the terminal from the corresponding group.

In a possible implementation, the communication unit is further configured to use a short address of the terminal when communicating with the current domain master node, and use the new short address when communicating with the target domain master node;

After the terminal communicates with the target domain master node by using the bandwidth resource allocated by the target domain master node to reach a preset time, determining, according to a preset rule, the required domain security controller or the target domain master node And performing the authentication, where the communication unit is further configured to send an authentication request to the target domain security controller or the target domain master node to perform authentication;

After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses.

In a possible implementation manner, the cluster public key is generated by a global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

In a possible implementation manner, the cluster public key is obtained when the terminal is authenticated by the current domain security controller or the current domain master node when entering the network; or

The cluster public key is obtained when the terminal is authenticated by the current domain master node and the primary security controller, and the primary security controller is used to perform unified authentication on the terminals joining all the domains of the cluster, and the unified authentication is performed. The latter terminal does not need to be authenticated again when performing intra-cluster handover.

In a possible implementation manner, before the target domain master node is selected, the selecting unit is further configured to receive information about other domain master nodes in the cluster that are sent by the current domain master node by using a media access plan frame or a dedicated message.

A fourth aspect of the present invention provides a terminal, which is applied to an optical wireless communication system, and includes:

a processor, a memory, an interface circuit, and a bus, wherein the processor, the memory, and the interface circuit are connected by a bus, wherein the memory is configured to store a set of program codes, and the processor is configured to call the program code stored in the memory , do the following:

If the terminal needs to perform domain switching, select the target domain primary node;

Obtaining a bandwidth resource allocated by the target domain primary node;

Communicating with the target domain master node by using the bandwidth resource allocated by the target domain master node before completing the authentication with the target domain master node, where the terminal transmits the frame when communicating with the target domain master node Cluster public key encryption.

In a possible implementation manner, the processor is further configured to:

After the communication with the target domain master node reaches the preset time by using the bandwidth resource allocated by the target domain master node, it is determined according to a preset rule whether the target domain security controller or the target domain master node needs to be authenticated;

If the preset rule is met, the target domain security controller or the target domain master node is authenticated.

In a possible implementation manner, the preset rule is:

The terminal is in a domain where the target domain primary node is located, and the terminal does not currently need to perform domain switching; or

The terminal is in the domain where the target domain primary node is located, and the signal to noise ratio of the signal received by the target domain primary node is greater than a preset threshold, and the terminal does not currently need to perform domain switching.

In a possible implementation manner, after the target domain master node is selected, if the terminal needs to perform domain switching, the processor is further configured to:

Sending a handover request to the target domain primary node, where the handover request includes a short address, current domain primary node information, and bandwidth resource request information of the terminal;

Receiving a handover response of the target domain primary node;

And if the target domain master node accepts the handover request of the terminal, acquiring the bandwidth resource allocated by the target domain master node.

In a possible implementation manner, after the target domain master node is selected, if the terminal needs to perform domain switching, the processor is further configured to:

Sending a handover request to the current domain master node, where the handover request includes a short address of the terminal, the target domain primary node information, and bandwidth resource request information;

Receiving a handover response of the current domain master node;

And if the current domain master node accepts the handover request of the terminal, acquiring the bandwidth resource allocated by the target domain master node.

In a possible implementation manner, if the terminal uses the bandwidth resource allocated by the target domain master node to communicate with the target domain master node for a preset time, determine the need and the target domain security according to a preset rule. The controller or the target domain master node performs authentication, and the processor is further configured to send a registration request to the target domain master node, perform registration, and acquire a new short address allocated by the target domain node;

After the registration is successful, the authentication request is sent to the target domain security controller or the target domain master node for authentication;

After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses.

In a possible implementation manner, after the target domain master node is selected, if the terminal needs to perform domain switching, the processor is further configured to:

Sending a re-registration request to the target domain primary node, where the re-registration request includes a short address, current domain primary node information, and bandwidth resource request information of the terminal;

Receiving a re-registration response of the target domain master node;

If the target domain master node accepts the re-registration request of the terminal, acquiring the target domain master The bandwidth resource allocated by the node and the new short address.

In a possible implementation manner, after the target domain master node is selected, if the terminal needs to perform domain switching, the processor is further configured to:

Sending a re-registration request to the current domain master node, where the re-registration request includes the short address of the terminal, the target domain primary node information, and bandwidth resource request information;

Receiving a re-registration response of the current domain master node;

And if the current domain master node accepts the re-registration request of the terminal, acquiring a bandwidth resource and a new short address allocated by the target domain master node.

In a possible implementation, after the bandwidth resource allocated by the target domain master node is used to communicate with the target domain master node, the processor is further configured to:

Notifying the current domain master node to release the allocated resources for the terminal, the allocated resources including the allocated short address and the allocated bandwidth resource.

In a possible implementation manner, the short address of the terminal is grouped by the global master node for all available short addresses, and then one of the packets corresponding to the current domain master node is allocated to the current domain master node, and then The current domain master node selects and assigns to the terminal from the corresponding group.

In a possible implementation manner, the terminal uses a short address of the terminal when communicating with the current domain master node, and uses the new short address when the terminal communicates with the target domain master node;

After the terminal communicates with the target domain master node by using the bandwidth resource allocated by the target domain master node to reach a preset time, determining, according to a preset rule, the required domain security controller or the target domain master node And performing the authentication, where the processor is further configured to send an authentication request to the target domain security controller or the target domain master node for authentication;

After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses.

In a possible implementation manner, the cluster public key is generated by a global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

In a possible implementation manner, the cluster public key is obtained when the terminal is authenticated by the current domain security controller or the current domain master node when entering the network; or

The cluster public key is the current domain master node and the primary security controller when the terminal enters the network. When the authentication is performed, the primary security controller is used to perform unified authentication on the terminals that join all the domains of the cluster, and the terminal after the unified authentication does not need to be authenticated again when performing intra-cluster handover.

In a possible implementation, before selecting the target domain master node, the processor is further configured to:

Receiving information of the other domain master nodes in the cluster sent by the current domain master node through the media access plan frame or the dedicated message.

A fifth aspect of the present invention provides a domain master node, which is applied to an optical wireless communication system, and includes:

An allocating unit, configured to: if the terminal needs to perform domain switching, the domain master node allocates a bandwidth resource to the terminal after agreeing to the handover;

a communication unit, configured to communicate with the terminal by using the allocated bandwidth resource and a cluster public key before completing the authentication with the terminal;

The domain master node is a target domain master node that performs domain switching on the terminal, and the frame transmitted by the target domain master node when communicating with the terminal is encrypted by using a cluster public key.

In a possible implementation manner, the cluster public key is obtained when the terminal authenticates with the current domain security controller or the current domain master node when the terminal enters the network;

The cluster public key is generated by the global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

In a possible implementation manner, the short address used by the terminal to communicate with the domain master node is grouped by the global master node for all available short addresses, and then the packets are correspondingly allocated to the domain master nodes, when When the terminal and one of the domain master nodes successfully register, the terminal is selected and assigned to the terminal by the domain master node from the group allocated by the global master node.

A sixth aspect of the present invention provides a domain master node, which is applied to an optical wireless communication system, and includes:

a processor, a memory, an interface circuit, and a bus, wherein the processor, the memory, and the interface circuit are connected by a bus, wherein the memory is configured to store a set of program codes, and the processor is configured to call the program code stored in the memory , do the following:

If the terminal needs to perform domain switching, the processor allocates a bandwidth resource to the terminal after agreeing to the handover;

Communicating with the terminal using the allocated bandwidth resource and the cluster public key before completing the authentication with the terminal, wherein the frame transmitted by the processor when communicating with the terminal adopts a cluster common Key encryption.

In a possible implementation manner, the cluster public key is obtained when the terminal authenticates with the current domain security controller or the current domain master node when the terminal enters the network;

The cluster public key is generated by the global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

In a possible implementation manner, the short address used by the terminal to communicate with the domain master node is grouped by the global master node for all available short addresses, and then the packets are correspondingly allocated to the domain master nodes, when When the terminal and one of the domain master nodes successfully register, the terminal is selected and assigned to the terminal by the domain master node from the group allocated by the global master node.

In a seventh aspect, the embodiment of the present invention provides a computer storage medium, the computer storage medium comprising a set of program code, for performing the method according to any implementation manner of the first aspect of the embodiment of the present invention.

In a seventh aspect, the present invention provides a computer storage medium comprising a set of program code for performing a method as described in any one of the first aspects of the embodiments of the present invention.

In an eighth aspect, the embodiment of the present invention provides a computer storage medium, the computer storage medium comprising a set of program code, for performing the method according to any implementation manner of the second aspect of the embodiment of the present invention.

Embodiments of the present invention have the following beneficial effects:

When the terminal needs to perform domain switching, the terminal may communicate with the target domain master node by using the bandwidth resource allocated by the target domain master node and the cluster public key before completing the authentication with the target domain master node; In the initial stage of the switchover, secure communication can be ensured without re-registration authentication, which avoids interruption of the current DM link during the authentication process, which causes service interruption, reduces service interruption time caused by handover, and ensures security during handover. The process of determining whether to perform authentication is performed only when the preset rule is met, and the target DM is authenticated. Otherwise, the authentication is not performed, so that the EP does not execute when it "passes quickly" in a certain domain during the handover process. The registration authentication process reduces signaling overhead and avoids waste of resources. By short-addressing and then allocating, it is possible to avoid a short address conflict problem that may occur when the EP is simultaneously communicating with two or more DMs at the same time, or when two or more domains are simultaneously in the handover process.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings to be used in the embodiments will be briefly described below. Obviously, the drawings in the following description are only some of the present invention. For the embodiments, those skilled in the art can obtain other drawings according to the drawings without any creative work.

1 is a schematic diagram of a system architecture for coordinating a topology in a visible light communication network;

2 is a schematic flowchart of a first embodiment of a handover method according to the present invention;

3 is a schematic flowchart of a second embodiment of a handover method according to the present invention;

4 is a schematic flowchart of a third embodiment of a handover method according to the present invention;

FIG. 5 is a schematic flowchart diagram of a fourth embodiment of a handover method according to the present invention; FIG.

6 is a schematic flowchart of a fifth embodiment of a handover method according to the present invention;

FIG. 7 is a schematic flowchart diagram of a sixth embodiment of a handover method according to the present invention; FIG.

FIG. 8 is a schematic flowchart diagram of a seventh embodiment of a handover method according to the present invention; FIG.

9 is a schematic flowchart of an eighth embodiment of a handover method according to the present invention;

10 is a schematic structural diagram of a first embodiment of a terminal according to the present invention;

11 is a schematic structural diagram of a second embodiment of a terminal according to the present invention;

12 is a schematic structural diagram of a first embodiment of a domain master node according to the present invention;

FIG. 13 is a schematic structural diagram of a second embodiment of a domain master node according to the present invention.

detailed description

The terms "comprising" and "comprising" and variations of the invention are intended to be in the meaning For example, a process, method, system, product, or device that comprises a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units not listed, or, optionally, Other steps or units inherent to these processes, methods, products or devices.

With the rapid development of optical wireless communication, its indoor applications will become more and more extensive. The optical wireless communication may be a visible light communication, an infrared communication, or the like. For the convenience of description, the embodiment of the present invention is described by using visible light communication. Those skilled in the art should understand that the embodiment in the embodiment of the present invention can also be used. It is applicable to other optical wireless communication systems, and is not limited in any embodiment of the present invention.

Since the terminals in the optical wireless communication network are mobile and the service requirements of each terminal may also change, the terminals in the optical wireless communication network need to perform domain switching to ensure the normal operation of the existing services. Please refer to FIG. 1 , which is a schematic diagram of a system architecture for coordinating a topology in a visible light communication network.

The equipment involved is as follows:

DM: The primary node of the domain, which is also the network access point, is responsible for managing the registration, resource scheduling, coordination, and handover of new devices in the domain.

Current DM: The DM of the domain to which the EP is connected before the handover.

Target DM: The DM of the domain to which the EP is to be switched.

EP: The terminal performs network access and data transmission through a link such as visible light communication or infrared communication with the DM. The product form may be a mobile phone, a pad, a notebook computer or the like.

GM: The global master node coordinates the operation of multiple domains through the backhaul link and the defined interface with the DM, such as interference coordination and handover. The GM can also act as a public security controller for multiple domains, responsible for the security certification of all domains and their nodes that are coordinated.

GW: Gateway, the source of the EP's business. The EP accesses the network through the AP, and the data source of the AP may be a gateway.

SC: The security controller, the entity responsible for security authentication and key management in the domain, generally belongs to the same node as the DM, and may belong to different nodes.

As shown in Figure 1, a GM is included, and DM1-DM3 has three DMs. Domain1 corresponding to DM1 is connected to EP1 and EP2, Domain 2 corresponding to DM2 is connected to EP3, and Domain3 corresponding to DM3 is connected to EP4. The three domains form a cluster. When EP1 needs to switch from Domain1 to Domain2 or Domain3, it can communicate with the target DM after it needs to register and authenticate with the target DM. This will cause the service with the current DM to be interrupted, and new registration will be performed each time. And the authentication, the delay is also very large, which is not conducive to the good conduct of the business, and is not conducive to the user experience.

The switching method of this aspect will be described in detail below with reference to FIGS. 2-8.

2 is a schematic flowchart of a first embodiment of a handover method according to the present invention. In this embodiment, the handover method includes the following steps:

S201. If the terminal needs to perform domain switching, select the target domain primary node.

When selecting the target DM, the EP may select according to factors such as the signal to noise ratio (SNR) of the received neighbor DM signal and the bandwidth resource utilization (bandwidth availability) in the domain of the neighbor DM. For example, if the SNR of the signal of the neighboring DM is high, the neighboring DM may be selected to perform the handover. If the SNR of the signal of the neighboring DM is low, the neighboring DM handover with a higher SNR may not be switched or selected. If the bandwidth resource utilization is low, you can select the neighbor DM to switch. If the bandwidth resource utilization of the neighbor DM is high, you can switch or select other neighbor DMs with lower bandwidth resource utilization.

Optionally, before selecting the target domain primary node, the terminal may receive information about other domains in the cluster that are sent by the current domain primary node by using a Media Access Plan (MAP) frame or a dedicated message, where the information includes other The domain master node information may also include terminal information of other domains in the cluster. After obtaining the information, the terminal may select the reference information of the target domain master node when the domain is switched, and may also determine the available range of the cluster public key, and the terminal may initiate a handover to the domain within the usable range.

Specifically, before determining that the UE needs to switch, the EP should obtain other domain information in the cluster from the current DM, in particular, information about the DM, such as a Media Access Control (MAC) address, and may also include parameters of other domains. Information about each EP. The information is sent by the GM to the DM of each domain. The DM of each domain can send the information of other domains of the cluster to the EP of the local domain through the MAP frame or a dedicated message. The EP can only perform handover according to the method described in the embodiment of the present invention when other domains in the cluster are detected.

S202. Acquire a bandwidth resource allocated by the target domain primary node.

After the target DM is selected by the EP, the information exchange with the current DM and the target DM is performed to confirm the handover, and the bandwidth resource allocated by the target DM is obtained.

S203. Communicate with the target domain master node by using the bandwidth resource allocated by the target domain master node before completing the authentication with the target domain master node.

The frame transmitted when the terminal communicates with the target domain master node is encrypted by using a cluster public key.

In the conventional manner, it is necessary to perform communication with the target DM after the authentication with the target DM is completed, but in the present embodiment, by introducing the cluster public key, the EP can perform the target DM before the authentication with the target DM is completed. Secure communication.

In a coordinated topology network, multiple domains are coordinated by the same GM to form a cluster. Each cluster has A public encryption key, called a cluster public key, can be used for inter-domain communication or "temporary transfer" state encrypted communication when switching. The method for generating the cluster public key may be, but not limited to, one of the following methods:

The cluster public key is generated by the global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

Optionally, the GM may also periodically update the cluster public key and deliver the updated cluster public key to each EP in time.

The EP obtains the cluster public key in such a manner that the SC or DM sends the cluster public key to the EP after each EP is successfully authenticated. When the SC and the DM are in the same node, it is equivalent to the DM being sent to the EP. When the SC and the DM are not in the same node, it is preferably sent by the SC to the EP, but may also be sent by the SC to the DM and sent by the DM to the EP. But no matter how it is sent, the frame carrying the cluster public key is encrypted.

Optionally, before the EP communicates with the DM according to the bandwidth resource allocated by the target DM, a process of establishing a service flow with the target DM or establishing a communication link may be required. After the service flow or the communication link is established, the target DM starts to perform the scheduling of the bandwidth resource. Generally, the scheduling information is sent in the MAP frame.

It should be noted that only the authenticated EP can obtain the cluster public key. For example, if EP1 is already authenticated in Domain1, EP1 can obtain the cluster public key. When switching to Domain2, it can use the cluster public key to perform service transmission in the "temporary transmission" state when switching. In the "transfer" state, frames that communicate with the target DM are encrypted using the cluster public key. And in the VLC network, optionally, the two logical functional entities of the DM and the SC are at the same node. It can also not be on the same node.

In addition, the solution of the embodiment of the present invention is also applicable to a VLC network of a non-coordinating topology. A VLC network with a non-coordinating topology refers to an entity that is not responsible for centralized coordination among multiple VLC networks. The difference is that the "cluster public key" is obtained in a different way. It can be generated and generated by adjacent domains and then delivered to each authenticated EP.

In this embodiment, a handover method is provided. When a terminal needs to perform domain handover, the terminal may use the bandwidth resource and the cluster public key allocated by the target domain primary node before completing the authentication with the target domain primary node. Communicating with the target domain master node; thereby enabling the EP to be in the initial stage of handover No need to re-register the authentication, you can ensure secure communication, avoid interruption of the current DM link during the authentication process, cause service interruption, reduce the service interruption time caused by handover, and ensure secure transmission during handover.

In addition, for the cluster public key, it may be acquired when the terminal authenticates with the current domain security controller or the current domain master node when entering the network.

In addition, the terminal may be obtained when the terminal is authenticated by the current domain master node and the primary security controller, and the primary security controller is used to perform unified authentication on the terminals that join all the domains of the cluster, and the unified authentication is performed. The terminal does not need to be authenticated again when performing intra-cluster switching.

That is, there may be one SC in the cluster as a security controller of the full cluster, which may be located in the same device as the GM, or may not be in the same device, or may be served by the GM as the SC. Each DM communicates with the SC over a backhaul link. When the EP enters the network, it authenticates with the SC or GM through the DM, so that the key that can be encrypted when communicating with other DMs is obtained, and in the handover process, it is not necessary to perform authentication again within the scope of the cluster. It should be noted that the premise of not requiring re-authentication is that the EP key is still valid or still in the validity period. If the EP key has expired, it may still need to be authenticated again.

A unified cluster-wide authentication is proposed, so that the EP can ensure secure communication without re-authentication during the handover process, and avoid interruption of the current DM link during the authentication process, resulting in service interruption. It also makes the EP not perform the registration authentication process when the device quickly "passes" a certain domain during the handover process, which can reduce the signaling overhead.

And for the case where the EP "fastly passes" a certain domain during the handover process, that is, during the terminal movement process, it may only pass through a certain domain. For example, when EP1 wants to switch to Domain3, it needs to pass through Domain2, if it is to The DM2 is registered and verified, and the process is complicated and expensive, resulting in waste of resources. Moreover, this situation is more serious due to the smaller coverage of the VLC domain. In this case, the handover method described in FIG. 3 can also be used for handover.

Referring to FIG. 3, it is a schematic flowchart of a second embodiment of a handover method according to the present invention. In this embodiment, the method includes the following steps:

S301. If the terminal needs to perform domain switching, select the target domain primary node.

When selecting the target DM, the EP may select according to factors such as the signal to noise ratio (SNR) of the received neighbor DM signal and the bandwidth resource utilization (bandwidth availability) in the domain of the neighbor DM. For example, if the signal of the neighbor DM is higher, the SNR can be selected. If the neighbor DM performs the handover and the SNR of the neighbor DM is low, you can switch or select other neighbor DMs with higher SNR. If the bandwidth of the neighbor DM is lower, you can select the neighbor DM to switch. If the bandwidth resource utilization rate of the neighboring DM is higher, the neighboring DM switch with lower bandwidth resource utilization in other domains may not be switched.

Before determining that the UE needs to switch, the EP should obtain other domain information in the cluster from the current DM, especially the information of the DM (such as the MAC address), and may also include the parameters of other domains and the information of each EP. The information is sent by the GM to the DM of each domain. The DM of each domain can send the information of other domains of the cluster to the EP of the local domain through a Media Access Plan (MAP) frame or a dedicated message. The EP can only perform handover according to the method described in the embodiment of the present invention when other domains in the cluster are detected.

S302. Acquire a bandwidth resource allocated by the target domain primary node.

After the target DM is selected by the EP, the information exchange with the current DM and the target DM is performed to confirm the handover, and the bandwidth resource allocated by the target DM is obtained.

S303. Communicate with the target domain master node by using the bandwidth resource allocated by the target domain master node before completing the authentication with the target domain master node.

The frame transmitted when the terminal communicates with the target domain master node is encrypted by using a cluster public key.

In the conventional manner, it is necessary to perform communication with the target DM after the authentication with the target DM is completed, but in the present embodiment, by introducing the cluster public key, the EP can perform the target DM before the authentication with the target DM is completed. Communication.

In a coordinated topology network, multiple domains are coordinated by the same GM to form a cluster. Each cluster has a common encryption key, which can be called a cluster public key, which can be used for inter-domain communication or "temporary transmission" state encrypted communication when switching. The method for generating the cluster public key may be, but not limited to, one of the following methods:

The cluster public key is generated by the global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

Optionally, the GM may also periodically update the cluster public key and deliver the updated cluster public key to each EP in time.

The EP obtains the cluster public key in such a manner that the SC or DM sends the cluster public key to the EP after each EP is successfully authenticated. When the SC and the DM are in the same node, it is equivalent to the DM. EP. When the SC and the DM are not in the same node, it is preferably sent by the SC to the EP, but may also be sent by the SC to the DM and sent by the DM to the EP. But no matter how it is sent, the frame carrying the cluster public key is encrypted.

Optionally, before the EP communicates with the DM according to the bandwidth resource allocated by the target DM, a process of establishing a service flow with the target DM or establishing a communication link may be required. After the service flow or the communication link is established, the target DM starts to perform the scheduling of the bandwidth resource. Generally, the scheduling information is sent in the MAP frame.

It should be noted that only the authenticated EP can obtain the cluster public key. For example, if EP1 is already authenticated in Domain1, EP1 can obtain the cluster public key. When switching to Domain2, it can use the cluster public key to switch. The service transmission in the "temporary transmission" state is "temporary transmission". In the state, frames that communicate with the target DM are encrypted using the cluster public key. And in the VLC network, optionally, the two logical functional entities of the DM and the SC are at the same node. It can also not be on the same node.

S304, after using the bandwidth resource allocated by the target domain master node and the cluster public key to communicate with the target domain master node for a preset time, determining, according to a preset rule, whether the target domain security controller or the target domain security controller is required The target domain master node performs authentication.

The preset time can be implemented by setting a timer, and the preset time can be the end of the timer, for example, becoming 0. Since the EP is in the mobile state, it will be removed from the domain of the target DM. At this time, the set timer Timer should be reset.

S305. If the preset rule is met, perform authentication with the target domain security controller or the target domain master node.

Optionally, the preset rule may be:

The terminal is in the domain where the primary node of the target domain is located, and the terminal does not need to perform domain switching at present; or

The terminal is in the domain where the target domain primary node is located, and the signal to noise ratio of the signal received by the target domain primary node is greater than a preset threshold, and the terminal does not currently need to perform domain switching.

The domain in which the terminal is located in the target domain primary node indicates that the terminal is still in the signal coverage of the target primary domain primary node, and maintains the communication link connection with the target domain primary node. If the terminal needs to perform domain switching, refer to the content in step S201, for example, according to the neighbor DM signal. The SNR or the bandwidth resource utilization of the neighboring DM and other factors determine whether a handover is required, which is not limited in the embodiment of the present invention.

When the preset rule is not met, the terminal may not authenticate with the target DM. In this way, when more than two domains are continuously passed during the terminal mobile process, a large number of unnecessary registration and authentication processes are avoided, which can save a lot of resources and overhead, and improve the user experience.

In this embodiment, a handover method is provided. When a terminal needs to perform domain handover, the terminal may use the bandwidth resource and the cluster public key allocated by the target domain primary node before completing the authentication with the target domain primary node. Communicate with the target domain master node; so that the EP can ensure secure communication without re-registration authentication in the initial stage of handover, avoiding interruption of the current DM link during the authentication process, causing service interruption and reducing the handover band. The service interruption time of the incoming network ensures the secure transmission during the handover process. The judgment process of whether to perform the authentication is added to the target DM only when the preset rule is met. Otherwise, the authentication is not performed, so that the EP is in the handover process. When the path of a certain domain is fast, the registration authentication process is no longer performed, which reduces signaling overhead and avoids waste of resources.

For the specific information interaction process in the handover process, a detailed description will be given below with reference to FIG. 4-8.

Referring to FIG. 4, it is a schematic flowchart of a third embodiment of the handover method according to the present invention. In this embodiment, after the terminal needs to perform domain switching, the target domain master node is selected, and the method further includes:

Transmitting, by the terminal, a handover request to the target domain primary node, where the handover request includes a short address, current domain primary node information, and bandwidth resource request information of the terminal;

Receiving a handover response of the target domain primary node;

And if the target domain master node accepts the handover request of the terminal, acquiring the bandwidth resource allocated by the target domain master node.

After the terminal communicates with the target domain master node by using the bandwidth resource allocated by the target domain master node to reach a preset time, determining, according to a preset rule, the required domain security controller or the target domain master node And performing authentication, the terminal sends a registration request to the target domain primary node, performs registration, and acquires a new short address allocated by the target domain node;

After the registration is successful, the authentication request is sent to the target domain security controller or the target domain master node for authentication;

After the authentication succeeds, the current domain node is notified to release the allocated resources of the terminal, where the The allocated resources include the assigned short address.

Optionally, the short address of the terminal is grouped by the global primary node for all available short addresses, and then one of the packets corresponding to the current domain primary node is allocated to the current domain primary node, and then the current domain is The master node selects from the corresponding group and assigns to the terminal.

As shown in FIG. 4, the method specifically includes the following steps:

S401, the EP determines that it needs to switch, and selects the target DM.

When the target DM is selected, the EP may select according to factors such as the SNR of the received neighbor DM signal and the bandwidth resource utilization (bandwidth availability) in the domain of the neighbor DM.

Before determining that the UE needs to switch, the EP should obtain other domain information in the cluster from the DM, especially the information of the DM (such as the MAC address), and may also include the parameters of other domains and the information of each EP. The information is sent by the GM to the DM of each domain. The DM of each domain can send the information of other domains of the cluster to the EP of the local domain through the MAP frame or a dedicated message. The EP can only switch according to the present invention when other domains in the cluster are detected.

It should be noted that the EP may select multiple target DMs. For the convenience of description, the present embodiment describes a target DM as an example.

S402. The EP sends a handover request to the target DM.

The switch request should contain:

The EP's own node information, such as the Media Access Control (MAC) address, is the physical address, the short address (DEVICE_ID), and so on.

The "current DM information" is information of the DM before the handover, information of the domain to which it belongs, and the like.

The bandwidth resource request information is used to request the target DM to allocate bandwidth resources for the EP.

In order to ensure fast and successful transmission of the handover request, dedicated resources may be allocated in the MAC period. The dedicated resources may be dedicated to the handover process or may be used for contention, but the messages in the handover process are transmitted with the highest priority. For example, in the MAC cycle, an Inter-Domain Communication Channel (IDCC) is reserved. In the IDCC, the message of the handover process is sent with the highest priority.

Regarding the short address DEVICE_ID, this embodiment is optimized and described as follows:

In the coordinated topology network, the GM is responsible for managing and allocating the total available DEVICE_ID. For example, there are 255 available DEVICE_IDs, and the GM groups the available DEVICE_IDs. Groups are assigned to a domain and sent to the DM of each domain. After receiving the EP registration, each domain DM can only specify the DEVICE_ID that can be used in its own DEVICE_ID group for the EP.

S403. After receiving the handover request, the target DM determines whether to accept the request, and replies to the handover response.

The switch response should include: whether to accept the switch request, reason, etc.

After receiving the handover request, the target DM may request the gateway (GW) to switch the downlink data service transmission path of the EP from the current DM to the target DM.

The target DM may determine whether to accept the handover request of the EP according to the downlink data transmission path switching situation (such as whether it is successful), the bandwidth resource availability in the local domain, and the like.

If the target DM indicates to accept the handover of the EP in the handover response, the corresponding bandwidth resource should be allocated to the EP. The target DM generally delivers the scheduling information of the bandwidth resource allocated to the EP through the MAP frame, and may also be delivered by using a handover response or other message.

S404. After receiving the handover response of the target DM reply, and indicating that the handover is successful, the EP may enter a “temporary transmission” state. In this state, the cluster public key is used to communicate with the target DM according to the resource allocated by the target DM. , continue the original business transmission.

In the "temporary transfer" state, frames that communicate with the target DM are encrypted using the cluster public key.

For a cluster public key, in a coordinated topology network, multiple domains are coordinated by the same GM to form a cluster. Each cluster has a common encryption key, called a cluster public key, that can be used for inter-domain communication or "temporary transmission" state encrypted communication when switching. The method for generating the cluster public key may be, but not limited to, one of the following methods:

The cluster public key is generated by the global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

The GM can also periodically update the cluster public key and deliver the updated cluster public key to each EP in time.

The EP obtains the cluster public key in such a manner that the SC or DM sends the cluster public key to the EP after each EP is successfully authenticated. When the SC and the DM are in the same node, it is equivalent to the DM being sent to the EP. When the SC and the DM are not in the same node, it is preferably sent by the SC to the EP, but may also be sent by the SC to the DM and sent by the DM to the EP. But no matter how it is sent, the frame carrying the cluster public key is plus Send secretly.

Optionally, before the EP communicates with the DM according to the resources allocated by the target DM, a process of establishing a service flow with the target DM or establishing a communication link may be required. After the service flow or the communication link is established, the target DM starts to perform the scheduling of the bandwidth resource. Generally, the scheduling information is sent in the MAP frame.

Only the authenticated EP can obtain the cluster public key.

Generally, in a VLC network, two logical functional entities, DM and SC, are on the same node. It can also not be on the same node.

S405. Optionally, the EP may send a handover indication to the current DM, and notify the current DM that the DM has been switched to the domain where the new target DM is located. After receiving the handover indication, the current DM releases the bandwidth resource originally allocated to the EP.

After entering the "temporary transmission" state for a preset time, the S406 determines whether the formal registration and authentication can be performed according to a preset rule. Perform the registration and certification process if needed.

The preset rules can be but are not limited to:

The terminal is in a domain where the target domain primary node is located, and the terminal does not currently need to perform domain switching; or

The terminal is in the domain where the target domain primary node is located, and the signal to noise ratio of the signal received by the target domain primary node is greater than a preset threshold, and the terminal does not currently need to perform domain switching.

The preset time can be implemented by setting a timer, and the preset time can be the end of the timer, for example, becoming 0. Since the EP is in the mobile state, it will be removed from the domain of the target DM. At this time, the set timer Timer should be reset.

S407. The terminal initiates a registration request to the target DM.

S408. The target DM replies to the registration response to the terminal. If the registration is agreed, the terminal needs to be assigned a new short address and is included in the registration response.

S409. The terminal initiates an authentication request to the target DM or the target SC. Not shown in the target SC map, it can be integrated with the target DM, or it can be set independently.

S410. The target DM or the target SC performs an authentication process according to the received authentication request.

S411. After the authentication succeeds, the terminal notifies the current DM to release the short address that has been allocated by the terminal.

S412. The current DM releases the short address allocated to the terminal, and the handover is completed.

After receiving the registration request sent by the handover EP, and after the EP completes the authentication, the target DM may send a notification to the current DM through the GM or backhaul link, so that the current DM can release all resources allocated to the handover EP. Especially DEVICE_ID. It is also possible that the terminal directly sends a message to the current DM to notify the current DM to release all resources allocated to the terminal, in particular DEVICE_ID.

When the EP leaves the target DM when the timer is not finished, and switches to the target DM2, it is also executed according to the above procedure, except that since the target DM does not need to allocate a short address for the EP, it is not necessary to release the corresponding DEVICE_ID resource.

Since the communication between the EP and the DM is only required to be supported in the general VLC domain, the key acquisition and authentication process can be integrated and optimized.

In this embodiment, by proposing the cluster public key, the EP can ensure secure communication without re-registration authentication in the initial stage of the handover, and avoid interruption of the current DM link during the authentication process, thereby causing service interruption.

By proposing the preset time and the judging process, the EP does not perform the registration authentication process when the device quickly "passes" a certain domain during the handover process, thereby reducing the signaling overhead.

The DEVICE_ID allocation method is proposed to avoid the problem of ID conflict that may occur when the EP is simultaneously communicating with two (multiple) DMs at the same time, or in two (multiple) domains at the same time.

Therefore, by using the handover method of this embodiment, the service interruption time brought by the handover can be reduced. Ensure secure transmission during the handover process.

5 is a schematic flowchart of a fourth embodiment of a handover method according to the present invention. In this embodiment, after the terminal needs to perform domain handover, the target domain master node is selected, and the method further includes:

Transmitting, by the terminal, a handover request to a current domain primary node, where the handover request includes a short address of the terminal, the target domain primary node information, and bandwidth resource request information;

Receiving a handover response of the current domain master node;

And if the current domain master node accepts the handover request of the terminal, acquiring the bandwidth resource allocated by the target domain master node.

After the terminal communicates with the target domain master node by using the bandwidth resource allocated by the target domain master node to reach a preset time, determining, according to a preset rule, the required domain security controller or the target domain master node Performing authentication, the terminal sends a registration request to the target domain master node, Row registration, obtaining a new short address assigned by the target domain node;

After the registration is successful, the authentication request is sent to the target domain security controller or the target domain master node for authentication;

After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses.

Optionally, the short address of the terminal is grouped by the global primary node for all available short addresses, and then one of the packets corresponding to the current domain primary node is allocated to the current domain primary node, and then the current domain is The master node selects from the corresponding group and assigns to the terminal.

As shown in FIG. 5, the method specifically includes the following steps:

S501, the EP determines that it needs to switch, and selects the target DM.

When the target DM is selected, the EP may select according to factors such as the SNR of the received neighbor DM signal and the bandwidth resource utilization (bandwidth availability) in the domain of the neighbor DM.

Before determining that the UE needs to switch, the EP should obtain other domain information in the cluster from the DM, especially the information of the DM (such as the MAC address), and may also include the parameters of other domains and the information of each EP. The information is sent by the GM to the DM of each domain. The DM of each domain can send the information of other domains of the cluster to the EP of the local domain through the MAP frame or a dedicated message. The EP can only switch according to the present invention when other domains in the cluster are detected.

The EP can select multiple target DMs. This embodiment is described by taking a target DM as an example.

S502. The EP sends a handover request to the current DM.

The switch request contains:

EP's own node information, such as MAC address, DEVICE_ID, etc.

"Target DM information" is the target DM information to be switched, the information of the domain to which it belongs, etc.

The bandwidth resource request information is used to request the target DM to allocate bandwidth resources for the EP.

Regarding the short address DEVICE_ID, this embodiment is optimized and described as follows:

In the coordinated topology network, the GM is responsible for managing and allocating the total available DEVICE_ID. For example, there are 255 available DEVICE_IDs. The GM groups the available DEVICE_IDs, each group is assigned to one domain, and is sent to each domain's DM. . After receiving the EP registration, each domain DM can only specify the DEVICE_ID that can be used in its own DEVICE_ID group for the EP.

S503. After receiving the handover request, the current DM determines whether to accept the request, and replies to the response. Change the response.

In the switch response, it should contain:

Whether to accept the switch request, reason, etc.

After receiving the handover request, the current DM may request the GW to switch the downlink data service transmission path of the EP from the current DM to the target DM through the GM or the backhaul link.

The current DM may determine whether to accept the handover request of the EP according to the downlink data transmission path switching situation (such as whether it is successful), the feedback result of the target DM (for example, whether its bandwidth resource is available), or the like.

S504. The target DM allocates a bandwidth resource to the terminal.

If the current DM indicates to accept the handover of the EP in the handover response, it means that the target DM should allocate the corresponding bandwidth resource for the EP. The target DM generally delivers the scheduling information of the bandwidth resource allocated to the EP through the MAP frame, and may also be delivered by using a handover response or other message.

S505. After receiving the handover response of the current DM reply, and indicating that the handover is successful, the EP should enter a “temporary transmission” state. In this state, the cluster public key is used to communicate with the target DM according to the resource allocated by the target DM. , continue the original business transmission.

In the "temporary transfer" state, frames that communicate with the target DM are encrypted using the cluster public key.

For cluster public keys:

In a coordinated topology network, multiple domains are coordinated by the same GM to form a cluster. Each cluster has a common encryption key, called a cluster public key, that can be used for inter-domain communication or "temporary transmission" state encrypted communication when switching. The method for generating the cluster public key may be, but not limited to, one of the following methods:

The cluster public key is generated by the global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

The GM can also periodically update the cluster public key and deliver the updated cluster public key to each EP in time.

The EP obtains the cluster public key in such a manner that the SC or DM sends the cluster public key to the EP after each EP is successfully authenticated. When the SC and the DM are in the same node, it is equivalent to the DM being sent to the EP. When the SC and the DM are not in the same node, it is preferably sent by the SC to the EP, but may also be sent by the SC to the DM and sent by the DM to the EP. But no matter how it is sent, the frame carrying the cluster public key is encrypted.

Optionally, before the EP communicates with the DM according to the resources allocated by the target DM, a process of establishing a service flow with the target DM or establishing a communication link may be required. After the service flow or the communication link is established, the target DM starts to perform the scheduling of the bandwidth resource. Generally, the scheduling information is sent in the MAP frame.

Only the authenticated EP can obtain the cluster public key.

Generally, in a VLC network, two logical functional entities, DM and SC, are on the same node. Of course, you can also not be on the same node.

S506. Optionally, the EP may send a handover indication to the current DM, and notify the current DM that the DM has successfully switched to the domain where the new target DM is located. After receiving the handover indication, the current DM releases the bandwidth resource originally allocated to the EP.

After the S501 and the EP enter the "temporary transmission" state and reach the preset time, it is determined according to the preset rule whether the formal registration and authentication can be performed. Perform the registration and certification process if needed.

The preset rule may be, but is not limited to, the terminal is in a domain where the target domain primary node is located, and the terminal does not currently need to perform domain switching; or

The terminal is in the domain where the target domain primary node is located, and the signal to noise ratio of the signal received by the target domain primary node is greater than a preset threshold, and the terminal does not currently need to perform domain switching.

The preset time can be implemented by setting a timer, and the preset time can be the end of the timer, for example, becoming 0. Since the EP is in the mobile state, it will be removed from the domain of the target DM. At this time, the set timer Timer should be reset.

S508. The terminal initiates a registration request to the target DM.

S509. The target DM replies to the registration response to the terminal. If the registration is agreed, the terminal needs to be assigned a new short address and is included in the registration response.

S510. The terminal initiates an authentication request to the target DM or the target SC. Not shown in the target SC map, it can be integrated with the target DM, or it can be set independently.

S511. The target DM or the target SC performs an authentication process according to the received authentication request.

S512: After the authentication succeeds, the terminal notifies the current DM to release the short address that has been allocated by the terminal.

S513. The current DM releases the short address allocated to the terminal, and the handover is completed.

After receiving the registration request sent by the handover EP, and after the EP completes the authentication, the target DM may send a notification to the current DM through the GM or backhaul link, so that the current DM can be released. All resources assigned to the switch EP, especially DEVICE_ID. It is also possible that the terminal directly sends a message to the current DM to notify the current DM to release all resources allocated to the terminal, in particular DEVICE_ID.

When the EP leaves the target DM when the timer is not finished, and switches to the target DM2, it is also executed according to the above procedure, except that since the target DM does not need to allocate a short address for the EP, it is not necessary to release the corresponding DEVICE_ID resource.

In this embodiment, by proposing the cluster public key, the EP can ensure secure communication without re-registration authentication in the initial stage of the handover, and avoid interruption of the current DM link during the authentication process, thereby causing service interruption.

By proposing the preset time and the judging process, the EP does not perform the registration authentication process when the device quickly "passes" a certain domain during the handover process, thereby reducing the signaling overhead.

The DEVICE_ID allocation method is proposed to avoid the problem of ID conflict that may occur when the EP is simultaneously communicating with two (multiple) DMs at the same time, or in two (multiple) domains at the same time.

Therefore, by using the handover method of this embodiment, the service interruption time brought by the handover can be reduced. Ensure secure transmission during the handover process.

6 is a schematic flowchart of a fifth embodiment of a handover method according to the present invention. In this embodiment, after the domain is switched, the target domain master node is selected, and the method further includes:

Sending, by the terminal, a re-registration request to the target domain primary node, where the re-registration request includes a short address, current domain primary node information, and bandwidth resource request information of the terminal;

Receiving a re-registration response of the target domain master node;

And if the target domain master node accepts the re-registration request of the terminal, acquiring a bandwidth resource and a new short address allocated by the target domain master node.

After the bandwidth resource allocated by the target domain master node is used to communicate with the target domain master node, the method further includes:

Notifying the current domain master node to release the allocated resources for the terminal, the allocated resources including the allocated short address and the allocated bandwidth resource.

Optionally, the short address of the terminal is grouped by the global primary node for all available short addresses, and then one of the packets corresponding to the current domain primary node is allocated to the current domain primary node, and then the current domain is The master node selects from the corresponding group and assigns to the terminal. Of course, you can also The grouping of the short addresses is not limited in any embodiment of the present invention.

As shown in FIG. 6, the method specifically includes the following steps:

S601, the EP determines that it needs to switch, and selects the target DM.

When the target DM is selected, the EP may select according to factors such as the SNR of the received neighbor DM signal and the bandwidth resource utilization (bandwidth availability) in the domain of the neighbor DM.

Before determining that the UE needs to switch, the EP should obtain other domain information in the cluster from the DM, especially the information of the DM (such as the MAC address), and may also include the parameters of other domains and the information of each EP. The information is sent by the GM to the DM of each domain. The DM of each domain can send the information of other domains of the cluster to the EP of the local domain through the MAP frame or a dedicated message. The EP can only switch according to the present invention when other domains in the cluster are detected.

The EP can select multiple target DMs. This embodiment is described by taking a target DM as an example.

S602. The EP sends a re-registration request to the target DM.

The re-registration request should include:

EP's own node information, such as MAC address, DEVICE_ID, etc.

The "current DM information" is the DM information before the handover, the information of the domain to which it belongs, and the like.

The bandwidth resource request information is used to request the target DM to allocate bandwidth resources for the EP.

It should be noted that, compared with the embodiment shown in FIG. 4, the re-registration request is slightly different from the handover request in the embodiment of FIG. 4. In addition to the function of the handover request, the main difference from the handover request is that the re-registration request is sent, which is equivalent to the registration process. After the DM receives it, the corresponding operation should be registered for the EP.

S603. After receiving the re-registration request, the target DM determines whether to accept the request and responds to the re-registration response.

The re-registration response should include:

Whether to accept the re-registration request, reason, etc. And the new DEVICE_ID assigned to the EP in the registration response.

After receiving the re-registration request, the target DM may request the GW to switch the downlink data service transmission path of the EP from the current DM to the target DM.

The target DM may determine whether to accept the re-registration request of the EP according to the downlink data transmission path switching situation (such as whether it is successful), the availability of bandwidth resources in the domain, and the like.

If the target DM indicates to accept the handover of the EP in the re-registration response, the corresponding bandwidth resource and the new DEVICE_ID should be allocated to the EP. The target DM generally delivers the scheduling information of the bandwidth resource allocated to the EP through the MAP frame, and may also be delivered by re-registering the response or other messages.

S604. After receiving the re-registration response of the target DM reply, and indicating that the handover is successful, the EP may enter a “temporary transmission” state. In this state, according to the resource allocated by the target DM, the cluster public key is used to perform the target DM. Communication, the original service transmission is continued, and the new DEVICE_ID assigned to the EP by the target DM mentioned in step S503 should be used.

In the "temporary transfer" state, frames that communicate with the target DM are encrypted using the cluster public key.

For cluster public keys:

In a coordinated topology network, multiple domains are coordinated by the same GM to form a cluster. Each cluster has a common encryption key, called a cluster public key, that can be used for inter-domain communication or "temporary transmission" state encrypted communication when switching. The method for generating the cluster public key may be, but not limited to, one of the following methods:

The cluster public key is generated by the global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

The GM can also periodically update the cluster public key and deliver the updated cluster public key to each EP in time.

The EP obtains the cluster public key in such a manner that the SC or DM sends the cluster public key to the EP after each EP is successfully authenticated. When the SC and the DM are in the same node, it is equivalent to the DM being sent to the EP. When the SC and the DM are not in the same node, it is preferably sent by the SC to the EP, but may also be sent by the SC to the DM and sent by the DM to the EP. But no matter how it is sent, the frame carrying the cluster public key is encrypted.

Optionally, before the EP communicates with the DM according to the resources allocated by the target DM, a process of establishing a service flow with the target DM or establishing a communication link may be required. After the service flow or the communication link is established, the target DM starts to perform the scheduling of the bandwidth resource. Generally, the scheduling information is sent in the MAP frame.

Only the authenticated EP can obtain the cluster public key.

Generally, in a VLC network, two logical functional entities, DM and SC, are on the same node. Of course, you can also not be on the same node.

S605. Optionally, the EP may send a handover indication to the current DM, to notify the current DM that the DM has been switched to the domain where the new target DM is located. After receiving the handover indication, the current DM releases the bandwidth resource, DEVICE_ID, and the like originally allocated to the EP.

S606. After the EP enters the Temporary Transfer state and reaches a preset time, it determines whether the authentication can be performed according to a preset rule. If necessary, perform the authentication process.

The preset rule may be, but is not limited to, the terminal is in a domain where the target domain primary node is located, and the terminal does not currently need to perform domain switching; or

The terminal is in the domain where the target domain primary node is located, and the signal to noise ratio of the signal received by the target domain primary node is greater than a preset threshold, and the terminal does not currently need to perform domain switching.

The preset time can be implemented by setting a timer, and the preset time can be the end of the timer, for example, becoming 0. Since the EP is in the mobile state, it will be removed from the domain of the target DM. At this time, the set timer Timer should be reset.

When the EP leaves the target DM when the timer Timer is not finished, and switches to the target DM2, it can also be executed according to the above process.

S607. The terminal sends an authentication request to the target DM or the target SC. Not shown in the target SC map, it can be integrated with the target DM, or it can be set independently.

S608. The target DM or the target SC performs the authentication process. After the authentication is passed, the handover is completed.

In this embodiment, by proposing the cluster public key, the EP can ensure secure communication without re-registration authentication in the initial stage of the handover, and avoid interruption of the current DM link during the authentication process, thereby causing service interruption.

By proposing the preset time and the judging process, the EP does not perform the registration authentication process when the AP quickly "passes" a certain domain during the handover process, which can reduce the signaling overhead.

7 is a schematic flowchart of a sixth embodiment of a handover method according to the present invention. In this embodiment, after the target domain master node is selected, the terminal includes:

Sending, by the terminal, a re-registration request to the current domain master node, where the re-registration request includes the short address of the terminal, the target domain primary node information, and bandwidth resource request information;

Receiving a re-registration response of the current domain master node;

And if the current domain master node accepts the re-registration request of the terminal, acquiring a bandwidth resource and a new short address allocated by the target domain master node.

After the bandwidth resource allocated by the target domain master node is used to communicate with the target domain master node, the method further includes:

Notifying the current domain master node to release the allocated resources for the terminal, the allocated resources including the allocated short address and the allocated bandwidth resource.

Optionally, the short address of the terminal is grouped by the global primary node for all available short addresses, and then one of the packets corresponding to the current domain primary node is allocated to the current domain primary node, and then the current domain is The master node selects from the corresponding group and assigns to the terminal. Of course, the short addresses may not be grouped, and the embodiment of the present invention does not limit the present invention.

As shown in FIG. 7, the method specifically includes the following steps:

S701, the EP determines that it needs to switch, and selects the target DM.

When the target DM is selected, the EP may select according to factors such as the SNR of the received neighbor DM signal and the bandwidth resource utilization (bandwidth availability) in the domain of the neighbor DM.

Before determining that the UE needs to switch, the EP should obtain other domain information in the cluster from the DM, especially the information of the DM (such as the MAC address), and may also include the parameters of other domains and the information of each EP. The information is sent by the GM to the DM of each domain. The DM of each domain can send the information of other domains of the cluster to the EP of the local domain through the MAP frame or a dedicated message. The EP can only switch according to the present invention when other domains in the cluster are detected.

The EP can select multiple target DMs. This embodiment is described by taking a target DM as an example.

S702. The EP sends a re-registration request to the current DM.

The re-registration request contains:

EP's own node information, such as MAC address, DEVICE_ID, etc.

The "target DM information" is the target DM information to be switched, the information of the domain to which it belongs, and the like.

The bandwidth resource request information is used to request the target DM to allocate bandwidth resources for the EP.

Regarding the short address DEVICE_ID, this embodiment is optimized and described as follows:

In the coordinated topology network, the GM is responsible for managing and allocating the total available DEVICE_ID. For example, there are 255 available DEVICE_IDs. The GM groups the available DEVICE_IDs, each group is assigned to one domain, and is sent to each domain's DM. . After receiving the EP registration, each domain DM can only specify the DEVICE_ID that can be used in its own DEVICE_ID group for the EP.

S703. After receiving the re-registration request, the current DM determines whether to accept the request, and answers Re-register the response.

The re-registration response should include:

Whether to accept the re-registration request, reason, etc.

S704. The target DM allocates a bandwidth resource and a new short address for the EP.

After receiving the re-registration request, the current DM may request the GW to switch the downlink data service transmission path of the EP from the current DM to the target DM through the GM or backhaul link.

The current DM may determine whether to accept the handover request of the EP according to the downlink data transmission path switching situation (such as whether it is successful), the feedback result of the target DM (for example, whether its bandwidth resource is available), or the like. The target DM should include the new DEVICE_ID assigned to the EP in the feedback result. At this time, the current DM can release the previous DEVICE_ID assigned to the EP. EP starts using the new DEVICE_ID.

If the current DM indicates to accept the handover of the EP in the re-registration response, it means that the target DM should allocate the corresponding bandwidth resource for the EP. The target DM generally delivers the scheduling information of the bandwidth resource allocated to the EP through the MAP frame, and may also be delivered by re-registering the response or other messages.

S705. After receiving the re-registration response of the current DM reply, and indicating that the handover is successful, the EP may enter a “temporary transmission” state. In this state, according to the resource allocated by the target DM, the cluster public key is used to perform the target DM. Communication, continue the original service transmission.

In the "temporary transfer" state, frames that communicate with the target DM are encrypted using the cluster public key.

For cluster public keys:

In a coordinated topology network, multiple domains are coordinated by the same GM to form a cluster. Each cluster has a common encryption key, called a cluster public key, that can be used for inter-domain communication or "temporary state" state encrypted communication when switching. The method for generating the cluster public key may be, but not limited to, one of the following methods:

The cluster public key is generated by the global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

The GM can also periodically update the cluster public key and deliver the updated cluster public key to each EP in time.

The EP obtains the cluster public key in such a manner that the SC or DM sends the cluster public key to the EP after each EP is successfully authenticated. When the SC and the DM are in the same node, it is equivalent to the DM. EP. When the SC and the DM are not in the same node, it is preferably sent by the SC to the EP, but may also be sent by the SC to the DM and sent by the DM to the EP. But no matter how it is sent, the frame carrying the cluster public key is encrypted.

Optionally, before the EP communicates with the DM according to the resources allocated by the target DM, a process of establishing a service flow with the target DM or establishing a communication link may be required. After the service flow or the communication link is established, the target DM starts to perform the scheduling of the bandwidth resource. Generally, the scheduling information is sent in the MAP frame.

Only the authenticated EP can obtain the cluster public key.

Generally, in a VLC network, two logical functional entities, DM and SC, are on the same node. Of course, you can also not be on the same node.

S706. Optionally, the EP may send a handover indication to the current DM, and notify the current DM that the DM has successfully switched to the domain where the new target DM is located. After receiving the handover indication, the current DM releases the bandwidth resource short address originally allocated to the EP.

After entering the "temporary transmission" state for a preset time, the S707 determines whether the formal authentication can be performed according to a preset rule. If necessary, perform the authentication process.

The preset rule may be, but is not limited to, the terminal is in a domain where the target domain primary node is located, and the terminal does not currently need to perform domain switching; or

The terminal is in the domain where the target domain primary node is located, and the signal to noise ratio of the signal received by the target domain primary node is greater than a preset threshold, and the terminal does not currently need to perform domain switching.

The preset time can be implemented by setting a timer, and the preset time can be the end of the timer, for example, becoming 0. Since the EP is in the mobile state, it will be removed from the domain of the target DM. At this time, the set timer Timer should be reset.

When the EP leaves the target DM when the timer Timer is not finished, and switches to the target DM2, it can also be executed according to the above process.

S708. The terminal sends an authentication request to the target DM or the target SC. Not shown in the target SC map, it can be integrated with the target DM, or it can be set independently.

The S709, the target DM, or the target SC performs the authentication process. After the authentication is passed, the handover is completed.

In this embodiment, by proposing the cluster public key, the EP can ensure secure communication without re-registration authentication at the initial stage of handover, and avoid interruption with the current DM link during the authentication process. Caused a disruption in business transmission.

By proposing the preset time and the judging process, the EP does not perform the registration authentication process when the device quickly "passes" a certain domain during the handover process, thereby reducing the signaling overhead.

The DEVICE_ID allocation method is proposed to avoid the problem of ID conflict that may occur when the EP is simultaneously communicating with two (multiple) DMs at the same time, or in two (multiple) domains at the same time.

Therefore, by using the handover method of this embodiment, the service interruption time brought by the handover can be reduced. Ensure secure transmission during the handover process.

FIG. 8 is a schematic flowchart of a seventh embodiment of a handover method according to the present invention. In this embodiment, after the target domain master node is selected, the terminal includes:

Sending, by the terminal, a re-registration request to the current domain master node, where the re-registration request includes the short address of the terminal, the target domain primary node information, and bandwidth resource request information;

Receiving a re-registration response of the current domain master node;

And if the current domain master node accepts the re-registration request of the terminal, acquiring a bandwidth resource and a new short address allocated by the target domain master node.

After the bandwidth resource allocated by the target domain master node is used to communicate with the target domain master node, the method further includes:

Notifying the current domain master node to release the allocated resources for the terminal, the allocated resources including the allocated short address and the allocated bandwidth resource.

When the terminal communicates with the current domain master node, based on the short address of the terminal, when the terminal communicates with the target domain master node, based on the new short address;

After the terminal communicates with the target domain master node by using the bandwidth resource allocated by the target domain master node to reach a preset time, determining, according to a preset rule, the required domain security controller or the target domain master node If the authentication is performed, the terminal sends an authentication request to the target domain security controller or the target domain master node to perform authentication;

After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses.

As shown in FIG. 8, the method specifically includes the following steps:

S801, the EP determines that it needs to switch, and selects the target DM.

When the target DM is selected, the EP can according to the SNR of the received neighbor DM signal, neighbors The bandwidth resource utilization (bandwidth availability) in the DM domain is selected.

Before determining that the UE needs to switch, the EP should obtain other domain information in the cluster from the DM, especially the information of the DM (such as the MAC address), and may also include the parameters of other domains and the information of each EP. The information is sent by the GM to the DM of each domain. The DM of each domain can send the information of other domains of the cluster to the EP of the local domain through the MAP frame or a dedicated message. The EP can only switch according to the present invention when other domains in the cluster are detected.

The EP can select multiple target DMs. This embodiment is described by taking a target DM as an example.

S802. The EP sends a re-registration request to the current DM.

The re-registration request contains:

EP's own node information, such as MAC address, DEVICE_ID, etc.

The "target DM information" is the target DM information to be switched, the information of the domain to which it belongs, and the like.

The bandwidth resource request information is used to request the target DM to allocate bandwidth resources for the EP.

S803. After receiving the re-registration request, the current DM determines whether to accept the request and responds to the re-registration response.

In the switch response, it should contain:

Whether to accept the switch request, reason, etc.

S804. The target DM allocates a bandwidth resource and a new short address for the EP.

After receiving the re-registration request, the current DM may request the GW to switch the downlink data service transmission path of the EP from the current DM to the target DM through the GM or backhaul link.

The current DM may determine whether to accept the handover request of the EP according to the downlink data transmission path switching situation (such as whether it is successful), the feedback result of the target DM (for example, whether its bandwidth resource is available), or the like. The target DM should include the new DEVICE_ID assigned to the EP in the feedback result. At this time, the current DM can release the previous DEVICE_ID assigned to the EP. EP starts using the new DEVICE_ID.

If the current DM indicates to accept the handover of the EP in the handover response, it means that the target DM should allocate the corresponding bandwidth resource for the EP. The target DM generally delivers the scheduling information of the bandwidth resource allocated to the EP through the MAP frame, and may also be delivered by re-registering the response or other messages.

In the process of steps S803 and S804, the EP communicates with the current DM, uses the DEVICE_ID assigned to the EP before the current DM, communicates with the target DM, and uses the target DM to allocate a new EP. DEVICE_ID.

S805. After receiving the re-registration response of the current DM reply, and indicating that the handover is successful, the EP may enter a “temporary transmission” state. In this state, according to the resource allocated by the target DM, the cluster public key is used to perform the target DM. Communication, continue the original service transmission.

In the "temporary transfer" state, frames that communicate with the target DM are encrypted using the cluster public key.

For cluster public keys:

In a coordinated topology network, multiple domains are coordinated by the same GM to form a cluster. Each cluster has a common encryption key, called a cluster public key, that can be used for inter-domain communication or "temporary state" state encrypted communication when switching. The method for generating the cluster public key may be, but not limited to, one of the following methods:

The cluster public key is generated by the global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

The GM can also periodically update the cluster public key and deliver the updated cluster public key to each EP in time.

The EP obtains the cluster public key in such a manner that the SC or DM sends the cluster public key to the EP after each EP is successfully authenticated. When the SC and the DM are in the same node, it is equivalent to the DM being sent to the EP. When the SC and the DM are not in the same node, it is preferably sent by the SC to the EP, but may also be sent by the SC to the DM and sent by the DM to the EP. But no matter how it is sent, the frame carrying the cluster public key is encrypted.

Optionally, before the EP communicates with the DM according to the resources allocated by the target DM, a process of establishing a service flow with the target DM or establishing a communication link may be required. After the service flow or the communication link is established, the target DM starts to perform the scheduling of the bandwidth resource. Generally, the scheduling information is sent in the MAP frame.

Only the authenticated EP can obtain the cluster public key.

Generally, in a VLC network, two logical functional entities, DM and SC, are on the same node. Of course, you can also not be on the same node.

S806. Optionally, the EP may send a handover indication to the current DM, to notify the current DM that the DM has successfully switched to the domain where the new target DM is located. After receiving the handover indication, the current DM releases the bandwidth resource originally allocated to the EP.

S807: After entering the "temporary transmission" state for a preset time, the EP determines whether the formal authentication can be performed according to a preset rule. If necessary, perform the authentication process.

S808. The terminal sends an authentication request to the target DM or the target SC. Not shown in the target SC map, it can be integrated with the target DM, or it can be set independently.

S809. The target DM or the target SC performs an authentication process according to the received authentication request.

S810. After the authentication succeeds, the terminal notifies the current DM to release the short address that has been allocated by the terminal.

S811, the current DM releases the short address allocated to the terminal, and the handover is completed.

After the target DM completes the authentication, the target DM may send a notification to the current DM through the GM or backhaul link, so that the current DM can release all resources allocated to the handover EP, in particular, the DEVICE_ID. It is also possible that the terminal directly sends a message to the current DM to notify the current DM to release all resources allocated to the terminal, in particular DEVICE_ID.

The preset rule may be, but is not limited to, the terminal is in a domain where the target domain primary node is located, and the terminal does not currently need to perform domain switching; or

The terminal is in the domain where the target domain primary node is located, and the signal to noise ratio of the signal received by the target domain primary node is greater than a preset threshold, and the terminal does not currently need to perform domain switching.

The preset time can be implemented by setting a timer, and the preset time can be the end of the timer, for example, becoming 0. Since the EP is in the mobile state, it will be removed from the domain of the target DM. At this time, the set timer Timer should be reset.

When the EP leaves the target DM when the timer Timer is not finished, and switches to the target DM2, it can also be executed according to the above process.

In this embodiment, by proposing the cluster public key, the EP can ensure secure communication without re-registration authentication in the initial stage of the handover, and avoid interruption of the current DM link during the authentication process, thereby causing service interruption.

By proposing the preset time and the judging process, the EP does not perform the registration authentication process when the device quickly "passes" a certain domain during the handover process, thereby reducing the signaling overhead.

Therefore, by using the handover method of this embodiment, the service interruption time brought by the handover can be reduced. Ensure secure transmission during the handover process.

It should be noted that the present embodiment is different from the embodiment shown in FIG. 7 in that optimization regarding the DEVICE_ID is not performed. After steps S705-S709, the EP should use the new DEVICE_ID. In steps S803-S804, the EP communicates with the current DM, communicates with the target DM using the previous DEVICE_ID, and uses the new DEVICE_ID. In step S806, after the target DM completes the authentication, the target DM may send a notification to the current DM through the GM or backhaul link, so that the current DM can release all resources allocated to the handover EP, in particular, the DEVICE_ID.

9 is a schematic flowchart of an eighth embodiment of a handover method according to the present invention. In this embodiment, the following steps are included:

S901. If the terminal needs to perform domain switching, the target domain master node allocates bandwidth resources to the terminal after agreeing to the handover.

S902: Communicate with the terminal by using the allocated bandwidth resource and the cluster public key before completing the authentication with the terminal.

The frame transmitted by the target domain master node when communicating with the terminal is encrypted by using a cluster public key.

Optionally, the cluster public key is obtained when the terminal authenticates with the current domain security controller or the current domain master node when the terminal enters the network;

The cluster public key is generated by the global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

The short address used by the terminal to communicate with the domain master node is grouped by the global master node for all available short addresses, and then the packets are correspondingly assigned to the domain master nodes, and the terminal and one of the domain master nodes are successfully registered. The time is then selected and assigned to the terminal by the domain master node from the group allocated by the global master node.

10 is a schematic diagram of a composition of a first embodiment of a terminal according to the present invention; in this embodiment, the terminal includes:

The selecting unit 100 is configured to select a target domain master node if the terminal needs to perform domain switching;

The obtaining unit 200 is configured to acquire a bandwidth resource allocated by the target domain master node;

The communication unit 300 is configured to communicate with the target domain master node by using the bandwidth resource allocated by the target domain master node before completing the authentication with the target domain master node, where the terminal and the target domain master Frames transmitted during node communication are encrypted using the cluster public key.

Optionally, the terminal further includes:

a determining unit 400, configured to use the bandwidth resource allocated by the target domain master node and the target After the domain master node communicates for a preset time, it is determined according to a preset rule whether it is required to perform authentication with the target domain security controller or the target domain master node;

The communication unit 300 is further configured to perform authentication with the target domain security controller or the target domain primary node if the preset rule is met.

Optionally, the preset rule is:

The terminal is in a domain where the target domain primary node is located, and the terminal does not currently need to perform domain switching; or

The terminal is in the domain where the target domain primary node is located, and the signal to noise ratio of the signal received by the target domain primary node is greater than a preset threshold, and the terminal does not currently need to perform domain switching.

Optionally, the communication unit 300 is further configured to:

After the selecting unit 100 selects the target domain primary node, sending a handover request to the target domain primary node, where the handover request includes the short address of the terminal, current domain primary node information, and bandwidth resource request information;

Receiving a handover response of the target domain primary node;

If the target domain master node accepts the handover request of the terminal, the acquiring unit 200 is instructed to acquire the bandwidth resource allocated by the target domain master node.

Optionally, the communication unit 300 is further configured to:

After the selecting unit 100 selects the target domain master node, sending a handover request to the current domain master node, where the handover request includes the short address of the terminal, the target domain master node information, and bandwidth resource request information;

Receiving a handover response of the current domain master node;

If the current domain master node accepts the handover request of the terminal, the acquiring unit 200 is instructed to acquire the bandwidth resource allocated by the target domain master node.

Optionally, if the terminal communicates with the target domain master node by using the bandwidth resource allocated by the target domain master node to reach a preset time, determining, according to a preset rule, a required domain security controller or the target domain The target domain master node performs authentication, and the communication unit 300 is further configured to send a registration request to the target domain master node, perform registration, and acquire a new short address allocated by the target domain node;

After the registration is successful, an authentication request is sent to the target domain security controller or the target domain master node. Authenticate;

After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses.

Optionally, the communication unit 300 is further configured to:

After the selecting unit 100 selects the target domain master node, sending a re-registration request to the target domain master node, where the re-registration request includes the short address, the current domain master node information, and the bandwidth resource request information of the terminal;

Receiving a re-registration response of the target domain master node;

If the target domain master node accepts the re-registration request of the terminal, the acquiring unit 200 is instructed to acquire the bandwidth resource and the new short address allocated by the target domain master node.

Optionally, the communication unit 300 is further configured to:

After the selecting unit 100 selects the target domain master node, sending a re-registration request to the current domain master node, where the re-registration request includes the short address, the current domain master node information, and the bandwidth resource request information of the terminal;

Receiving a re-registration response of the target domain master node;

If the target domain master node accepts the re-registration request of the terminal, the acquiring unit 200 is instructed to acquire the bandwidth resource and the new short address allocated by the target domain master node.

Optionally, after the communication with the target domain master node is performed by using the bandwidth resource allocated by the target domain master node, the communication unit 300 is further configured to:

Notifying the current domain master node to release the allocated resources for the terminal, the allocated resources including the allocated short address and the allocated bandwidth resource.

Optionally, the short address of the terminal is grouped by the global primary node for all available short addresses, and then one of the packets corresponding to the current domain primary node is allocated to the current domain primary node, and then the current domain is The master node selects from the corresponding group and assigns to the terminal.

Optionally, the communication unit 300 is further configured to use a short address of the terminal when communicating with the current domain master node, and use the new short address when communicating with the target domain master node;

After the terminal communicates with the target domain master node by using the bandwidth resource allocated by the target domain master node to reach a preset time, determining, according to a preset rule, the required domain security controller or the target domain master node For authentication, the communication unit 300 is also used to target the domain security controller or The target domain master node sends an authentication request and performs authentication;

After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses.

Optionally, the cluster public key is generated by a global primary node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

Optionally, the cluster public key is obtained when the terminal is authenticated by the current domain security controller or the current domain master node when entering the network; or

The cluster public key is obtained when the terminal is authenticated by the current domain master node and the primary security controller, and the primary security controller is used to perform unified authentication on the terminals joining all the domains of the cluster, and the unified authentication is performed. The latter terminal does not need to be authenticated again when performing intra-cluster handover.

Optionally, before the target domain master node is selected, the selecting unit is further configured to receive information of the other domain master nodes in the cluster that are sent by the current domain master node by using a media access plan frame or a dedicated message.

FIG. 11 is a schematic diagram of a composition of a second embodiment of a terminal according to the present invention; in this embodiment, the terminal includes:

The processor 110, the memory 120, the interface circuit 130, and the bus 140 are connected by a bus 140, wherein the memory 120 is configured to store a set of program codes, and the processor 110 For invoking the program code stored in the memory 120, the following operations are performed:

If the terminal needs to perform domain switching, select the target domain primary node;

Obtaining a bandwidth resource allocated by the target domain primary node;

Communicating with the target domain master node by using the bandwidth resource allocated by the target domain master node before completing the authentication with the target domain master node, where the terminal transmits the frame when communicating with the target domain master node Cluster public key encryption.

Optionally, the processor 110 is further configured to:

After the communication with the target domain master node reaches the preset time by using the bandwidth resource allocated by the target domain master node, it is determined according to a preset rule whether the target domain security controller or the target domain master node needs to be authenticated;

If the preset rule is met, the target domain security controller or the target domain master node is Line certification.

Optionally, the preset rule is:

The terminal is in a domain where the target domain primary node is located, and the terminal does not currently need to perform domain switching; or

The terminal is in the domain where the target domain primary node is located, and the signal to noise ratio of the signal received by the target domain primary node is greater than a preset threshold, and the terminal does not currently need to perform domain switching.

Optionally, after the target domain master node is selected, if the terminal needs to perform domain switching, the processor 110 is further configured to:

Sending a handover request to the target domain primary node, where the handover request includes a short address, current domain primary node information, and bandwidth resource request information of the terminal;

Receiving a handover response of the target domain primary node;

And if the target domain master node accepts the handover request of the terminal, acquiring the bandwidth resource allocated by the target domain master node.

Optionally, after the target domain master node is selected, if the terminal needs to perform domain switching, the processor 110 is further configured to:

Sending a handover request to the current domain master node, where the handover request includes a short address of the terminal, the target domain primary node information, and bandwidth resource request information;

Receiving a handover response of the current domain master node;

And if the current domain master node accepts the handover request of the terminal, acquiring the bandwidth resource allocated by the target domain master node.

Optionally, if the terminal communicates with the target domain master node by using the bandwidth resource allocated by the target domain master node to reach a preset time, determining, according to a preset rule, a required domain security controller or the target domain The target domain master node performs authentication, and the processor 110 is further configured to send a registration request to the target domain master node, perform registration, and acquire a new short address allocated by the target domain node;

After the registration is successful, the authentication request is sent to the target domain security controller or the target domain master node for authentication;

After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses.

Optionally, after the target domain master node is selected, if the terminal needs to perform domain switching, the processing is performed. The device 110 is also used to:

Sending a re-registration request to the target domain primary node, where the re-registration request includes a short address, current domain primary node information, and bandwidth resource request information of the terminal;

Receiving a re-registration response of the target domain master node;

And if the target domain master node accepts the re-registration request of the terminal, acquiring a bandwidth resource and a new short address allocated by the target domain master node.

Optionally, after the target domain master node is selected, if the terminal needs to perform domain switching, the processor 110 is further configured to:

Sending a re-registration request to the current domain master node, where the re-registration request includes the short address of the terminal, the target domain primary node information, and bandwidth resource request information;

Receiving a re-registration response of the current domain master node;

And if the current domain master node accepts the re-registration request of the terminal, acquiring a bandwidth resource and a new short address allocated by the target domain master node.

Optionally, after the bandwidth resource allocated by the target domain master node is used to communicate with the target domain master node, the processor 110 is further configured to:

Notifying the current domain master node to release the allocated resources for the terminal, the allocated resources including the allocated short address and the allocated bandwidth resource.

Optionally, the short address of the terminal is grouped by the global primary node for all available short addresses, and then one of the packets corresponding to the current domain primary node is allocated to the current domain primary node, and then the current domain is The master node selects from the corresponding group and assigns to the terminal.

Optionally, the terminal uses a short address of the terminal when communicating with the current domain master node, and uses the new short address when the terminal communicates with the target domain master node;

After the terminal communicates with the target domain master node by using the bandwidth resource allocated by the target domain master node to reach a preset time, determining, according to a preset rule, the required domain security controller or the target domain master node The processor 110 is further configured to send an authentication request to the target domain security controller or the target domain master node for authentication;

After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses.

Optionally, the cluster public key is generated by a global primary node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

Optionally, the cluster public key is obtained when the terminal is authenticated by the current domain security controller or the current domain master node when entering the network; or

The cluster public key is obtained when the terminal is authenticated by the current domain master node and the primary security controller, and the primary security controller is used to perform unified authentication on the terminals joining all the domains of the cluster, and the unified authentication is performed. The latter terminal does not need to be authenticated again when performing intra-cluster handover.

Optionally, before selecting the target domain master node, the processor 110 is further configured to:

Receiving information of the other domain master nodes in the cluster sent by the current domain master node through the media access plan frame or the dedicated message.

Referring to FIG. 12, it is a schematic diagram of a composition of a primary node of a target domain according to the present invention. In this embodiment, the target domain master node includes:

The allocating unit 500 is configured to: if the terminal needs to perform domain switching, the domain master node allocates a bandwidth resource to the terminal after agreeing to the handover;

The communication unit 600 is configured to communicate with the terminal by using the allocated bandwidth resource and the cluster public key before completing the authentication with the terminal;

The domain master node is a target domain master node that performs domain switching on the terminal, and the frame transmitted by the target domain master node when communicating with the terminal is encrypted by using a cluster public key.

Optionally, the cluster public key is obtained when the terminal authenticates with the current domain security controller or the current domain master node when the terminal enters the network;

The cluster public key is generated by the global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

Optionally, the short address used by the terminal to communicate with the domain master node is grouped by the global master node for all available short addresses, and then the packets are correspondingly allocated to each domain master node, when the terminal and one of the domains are When the primary node registers successfully, it is selected and assigned to the terminal by the domain master node from the group allocated by the global primary node.

FIG. 13 is a schematic diagram of a composition of a second embodiment of a target domain primary node according to the present invention; in this embodiment, the target domain primary node includes:

The processor 210, the memory 220, the interface circuit 230, and the bus 240, the processor 210, the memory 220, and the interface circuit 230 are connected by a bus 240, wherein the memory 220 is used to store a set of program codes, and the processor 210 For invoking the program code stored in the memory 220, the following operations are performed:

If the terminal needs to perform domain switching, the processor 210 allocates a bandwidth resource to the terminal after agreeing to the handover;

Communicating with the terminal using the allocated bandwidth resource and the cluster public key before completing the authentication with the terminal.

The frame transmitted when the processor communicates with the terminal is encrypted by using a cluster public key.

Optionally, the cluster public key is obtained when the terminal authenticates with the current domain security controller or the current domain master node when the terminal enters the network;

The cluster public key is generated by the global master node; or

The cluster public key is generated by a global master node and each domain master node; or

The cluster public key is generated by the global master node and the security controller of each domain.

Optionally, the short address used by the terminal to communicate with the domain master node is grouped by the global master node for all available short addresses, and then the packets are correspondingly allocated to each domain master node, when the terminal and one of the domains are When the primary node registers successfully, it is selected and assigned to the terminal by the domain master node from the group allocated by the global primary node.

The terminal introduced in this embodiment may be used to implement some or all of the processes in the method embodiment of the present invention, which are described in conjunction with FIG. 2 and FIG. 8, and perform some or all of the functions of the device embodiment introduced by the present invention in conjunction with FIG. The target domain master node introduced in this embodiment may be used to implement some or all of the processes in the method embodiment described in conjunction with FIG. 9 of the present invention, and perform some or all of the functions of the device embodiment introduced by the present invention in conjunction with FIG. I will not repeat them here.

In one or more examples, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored on or transmitted as one or more instructions or code via a computer-readable medium and executed by a hardware-based processing unit. The computer readable medium can comprise a computer readable storage medium (which corresponds to a tangible medium such as a data storage medium) or a communication medium comprising, for example, any medium that facilitates transfer of the computer program from one place to another in accordance with a communication protocol. . In this manner, the computer readable medium can generally correspond to (1) non Instantaneous tangible computer readable storage medium, or (2) communication medium such as a signal or carrier wave. Data storage media may be any available media that can be accessed by one or more computers or one or more processors to retrieve instructions, code and/or data structures for use in carrying out the techniques described herein. The computer program product can comprise a computer readable medium.

By way of example and not limitation, certain computer-readable storage media may comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage or other magnetic storage device, flash memory, or may be used to store instructions or data structures. Any other medium in the form of the desired program code and accessible by the computer. Also, any connection is properly termed a computer-readable medium. For example, if you use coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technology (eg, infrared, radio, and microwave) to send commands from a website, server, or other remote source, coaxial cable , fiber optic cable, twisted pair, DSL, or wireless technologies (eg, infrared, radio, and microwave) are included in the definition of the media. However, it should be understood that computer readable storage media and data storage media do not include connections, carrier waves, signals, or other transient media, but rather non-transitory tangible storage media. As used herein, a magnetic disk and an optical disk include a compact disk (CD), a laser disk, an optical disk, a digital video disk (DVD), a flexible disk, and a Blu-ray disk, wherein the disk usually reproduces data magnetically, and the disk passes the laser Optically copy data. Combinations of the above should also be included within the scope of computer readable media.

One or more processors, such as one or more digital signal processors (DSPs), general purpose microprocessors, application specific integrated circuits (ASICs), field programmable logic arrays (FPGAs), or other equivalent integrated or discrete logic circuits To execute the instructions. Accordingly, the term "processor," as used herein, may refer to any of the foregoing structures or any other structure suitable for implementing the techniques described herein. In addition, in some aspects, the functionality described herein may be provided within dedicated hardware and/or software modules configured for encoding and decoding, or incorporated in a combined codec. Moreover, the techniques can be fully implemented in one or more circuits or logic elements.

The techniques of the present invention can be broadly implemented by a variety of devices or devices, including a wireless handset, an integrated circuit (IC), or a collection of ICs (eg, a chipset). Various components, modules or units are described in this disclosure to emphasize functional aspects of the apparatus configured to perform the disclosed techniques, but are not necessarily required to be implemented by different hardware units. Rather, as described above, various units may be combined in a codec hardware unit, or by an interoperable hardware unit (including one or as described above) A collection of multiple processors) is provided in conjunction with suitable software and/or firmware.

It is to be understood that the phrase "one embodiment" or "an embodiment" or "an" Thus, "in one embodiment" or "in an embodiment" or "an" In addition, these particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

In the various embodiments of the present invention, it should be understood that the size of the sequence numbers of the above processes does not mean the order of execution, and the order of execution of each process should be determined by its function and internal logic, and should not be taken to the embodiments of the present invention. The implementation process constitutes any limitation.

Additionally, the terms "system" and "network" are used interchangeably herein. It should be understood that the term "and/or" herein is merely an association relationship describing an associated object, indicating that there may be three relationships, for example, A and/or B, which may indicate that A exists separately, and A and B exist simultaneously. There are three cases of B alone. In addition, the character "/" in this article generally indicates that the contextual object is an "or" relationship.

In the embodiments provided herein, it should be understood that "B corresponding to A" means that B is associated with A, and B can be determined from A. However, it should also be understood that determining B from A does not mean that B is only determined based on A, and that B can also be determined based on A and/or other information.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both, for clarity of hardware and software. Interchangeability, the composition and steps of the various examples have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division, and the actual implementation may have another The manner of division, such as multiple units or components, may be combined or integrated into another system, or some features may be omitted or not performed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the appended claims.

Claims (51)

A switching method is applied to an optical wireless communication system, and includes: If the terminal needs to perform domain switching, select the target domain primary node; Obtaining a bandwidth resource allocated by the target domain primary node; Communicating with the target domain master node by using the bandwidth resource allocated by the target domain master node before completing the authentication with the target domain master node, where the terminal transmits the frame when communicating with the target domain master node Cluster public key encryption. The switching method according to claim 1, wherein After the communication with the target domain master node reaches the preset time by using the bandwidth resource allocated by the target domain master node, it is determined according to a preset rule whether the target domain security controller or the target domain master node needs to be authenticated; If the preset rule is met, the target domain security controller or the target domain master node is authenticated. The switching method according to claim 2, wherein the preset rule is: The terminal is in a domain where the target domain primary node is located, and the terminal does not currently need to perform domain switching; or The terminal is in the domain where the target domain primary node is located, and the signal to noise ratio of the signal received by the target domain primary node is greater than a preset threshold, and the terminal does not currently need to perform domain switching. The handover method according to claim 1, wherein after the target domain master node is selected, if the terminal needs to perform domain handover, the method further includes: Transmitting, by the terminal, a handover request to the target domain primary node, where the handover request includes a short address, current domain primary node information, and bandwidth resource request information of the terminal; Receiving a handover response of the target domain primary node; And if the target domain master node accepts the handover request of the terminal, acquiring the bandwidth resource allocated by the target domain master node. The handover method according to claim 1, wherein after the target domain master node is selected, if the terminal needs to perform domain handover, the method further includes: Transmitting, by the terminal, a handover request to a current domain primary node, where the handover request includes a short address of the terminal, the target domain primary node information, and bandwidth resource request information; Receiving a handover response of the current domain master node; And if the current domain master node accepts the handover request of the terminal, acquiring the bandwidth resource allocated by the target domain master node. The handover method according to claim 4 or 5, wherein, if the terminal uses the bandwidth resource allocated by the target domain master node to communicate with the target domain master node for a preset time, according to the preset The rule determines that the target domain security controller or the target domain primary node needs to be authenticated, and the terminal sends a registration request to the target domain primary node to perform registration, and acquires a new short address allocated by the target domain node; After the registration is successful, the authentication request is sent to the target domain security controller or the target domain master node for authentication; After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses. The handover method according to claim 1, wherein after the target domain master node is selected, if the terminal needs to perform domain handover, the method further includes: Sending, by the terminal, a re-registration request to the target domain primary node, where the re-registration request includes a short address, current domain primary node information, and bandwidth resource request information of the terminal; Receiving a re-registration response of the target domain master node; And if the target domain master node accepts the re-registration request of the terminal, acquiring a bandwidth resource and a new short address allocated by the target domain master node. The handover method according to claim 1, wherein after the target domain master node is selected, if the terminal needs to perform domain handover, the method further includes: Sending, by the terminal, a re-registration request to the current domain master node, where the re-registration request includes the short address of the terminal, the target domain primary node information, and bandwidth resource request information; Receiving a re-registration response of the current domain master node; And if the current domain master node accepts the re-registration request of the terminal, acquiring a bandwidth resource and a new short address allocated by the target domain master node. The handover method according to claim 7 or 8, wherein after the communication with the target domain master node is performed by using the bandwidth resource allocated by the target domain master node, the method further includes: Notifying the current domain master node to release the allocated resources for the terminal, the allocated resources including the allocated short address and the allocated bandwidth resource. The handover method according to any one of claims 4, 5, 7, or 8, wherein the short address of the terminal is grouped by the global master node for all available short addresses, and then one of the terminals is associated with the current domain. The packet corresponding to the node is allocated to the current domain master node, and then the current domain master node selects and allocates the corresponding group to the terminal. The handover method according to claim 7 or 8, wherein the terminal uses a short address of the terminal when communicating with the current domain master node, and uses the terminal when the terminal communicates with the target domain master node. State the new short address; After the terminal communicates with the target domain master node by using the bandwidth resource allocated by the target domain master node to reach a preset time, determining, according to a preset rule, the required domain security controller or the target domain master node If the authentication is performed, the terminal sends an authentication request to the target domain security controller or the target domain master node to perform authentication; After the authentication succeeds, the current domain master node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses. The switching method according to claim 1, wherein The cluster public key is generated by the global master node; or The cluster public key is generated by a global master node and each domain master node; or The cluster public key is generated by the global master node and the security controller of each domain. The switching method according to claim 1, wherein The cluster public key is obtained when the terminal is authenticated by the current domain security controller or the current domain master node when entering the network; or The cluster public key is obtained when the terminal is authenticated by the current domain master node and the primary security controller, and the primary security controller is used to perform unified authentication on the terminals joining all the domains of the cluster, and the unified authentication is performed. The latter terminal does not need to be authenticated again when performing intra-cluster handover. The handover method according to claim 1, further comprising: before selecting the target domain master node, further comprising: The terminal receives information of other domain master nodes in the cluster that are sent by the current domain master node through the media access plan frame or the dedicated message. A switching method is applied to an optical wireless communication system, and includes: If the terminal needs to perform domain switching, the target domain master node allocates bandwidth resources to the terminal after agreeing to the handover; Communicating with the terminal using the allocated bandwidth resource and the cluster public key before completing the authentication with the terminal, wherein the frame transmitted by the target domain master node when communicating with the terminal adopts a cluster public key encryption. The handover method according to claim 15, wherein the cluster public key is obtained when the terminal authenticates with the current domain security controller or the current domain master node when the terminal enters the network; The cluster public key is generated by the global master node; or The cluster public key is generated by a global master node and each domain master node; or The cluster public key is generated by the global master node and the security controller of each domain. The handover method according to claim 15, wherein the short address used by the terminal for communicating with the domain master node is grouped by the global master node for all available short addresses, and then the packet pair is Assigned to each domain master node, when the terminal and one of the domain master nodes successfully register, the domain master node selects and assigns to the terminal from the group allocated by the global master node. A terminal applied to an optical wireless communication system, comprising: a selecting unit, configured to select a target domain master node if the terminal needs to perform domain switching; An obtaining unit, configured to acquire a bandwidth resource allocated by the target domain primary node; a communication unit, configured to communicate with the target domain master node by using a bandwidth resource allocated by the target domain master node before completing the authentication with the target domain master node, where the terminal and the target domain master node Frames transmitted during communication are encrypted using the cluster public key. The terminal according to claim 18, wherein the terminal further comprises: a determining unit, configured to determine, according to a preset rule, whether the target domain security controller or the target domain is required, after the communication with the target domain master node is used to reach a preset time by using the bandwidth resource allocated by the target domain master node The primary node performs authentication; The communication unit is further configured to perform authentication with the target domain security controller or the target domain master node if the preset rule is met. The terminal according to claim 19, wherein the preset rule is: The terminal is in a domain where the target domain primary node is located, and the terminal does not currently need to perform domain switching; or The terminal is in the domain where the target domain primary node is located, and the signal to noise ratio of the signal received by the target domain primary node is greater than a preset threshold, and the terminal does not currently need to perform domain switching. The terminal according to claim 18, wherein the communication unit is further configured to: After the selecting unit selects the target domain primary node, sending a handover request to the target domain primary node, where the handover request includes the short address of the terminal, current domain primary node information, and bandwidth resource request information; Receiving a handover response of the target domain primary node; If the target domain master node accepts the handover request of the terminal, instructing the acquiring unit to acquire The bandwidth resource allocated by the target domain master node. The terminal according to claim 18, wherein the communication unit is further configured to: After the selecting unit selects the target domain primary node, sending a handover request to the current domain primary node, where the handover request includes the short address of the terminal, the target domain primary node information, and bandwidth resource request information; Receiving a handover response of the current domain master node; If the current domain master node accepts the handover request of the terminal, the acquiring unit is instructed to acquire the bandwidth resource allocated by the target domain master node. The terminal according to claim 21 or 22, wherein, if the terminal uses the bandwidth resource allocated by the target domain master node to communicate with the target domain master node for a preset time, according to a preset rule Determining that the target domain security controller or the target domain primary node needs to be authenticated, the communication unit is further configured to send a registration request to the target domain primary node, perform registration, and acquire a new one allocated by the target domain node. Short address After the registration is successful, the authentication request is sent to the target domain security controller or the target domain master node for authentication; After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses. The terminal according to claim 18, wherein the communication unit is further configured to: After the selecting unit selects the target domain master node, sending a re-registration request to the target domain master node, where the re-registration request includes the short address of the terminal, current domain master node information, and bandwidth resource request information; Receiving a re-registration response of the target domain master node; And if the target domain master node accepts the re-registration request of the terminal, instructing the acquiring unit to acquire the bandwidth resource and the new short address allocated by the target domain primary node. The terminal according to claim 18, wherein the communication unit is further configured to: After the selecting unit selects the target domain master node, sending a re-registration request to the current domain master node, where the re-registration request includes the short address, the current domain master node information, and the bandwidth resource request information of the terminal; Receiving a re-registration response of the target domain master node; And if the target domain master node accepts the re-registration request of the terminal, instructing the acquiring unit to acquire the bandwidth resource and the new short address allocated by the target domain primary node. The terminal according to claim 24 or 25, wherein after the communication with the target domain master node is performed by using the bandwidth resource allocated by the target domain master node, the communication unit is further configured to: Notifying the current domain master node to release the allocated resources for the terminal, the allocated resources including the allocated short address and the allocated bandwidth resource. The terminal according to any one of claims 21, 22, 24, 25, wherein the short address of the terminal is grouped by the global master node for all available short addresses, and then one of the terminals is associated with the current domain master node. A corresponding group is allocated to the current domain master node, and the current domain master node selects and assigns to the terminal from the corresponding group. The terminal according to claim 24 or 25, wherein the communication unit is further configured to use a short address of the terminal when communicating with the current domain master node, and use the terminal when communicating with the target domain master node. State the new short address; After the terminal communicates with the target domain master node by using the bandwidth resource allocated by the target domain master node to reach a preset time, determining, according to a preset rule, the required domain security controller or the target domain master node And performing the authentication, where the communication unit is further configured to send an authentication request to the target domain security controller or the target domain master node to perform authentication; After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses. The terminal of claim 18, wherein The cluster public key is generated by the global master node; or The cluster public key is generated by a global master node and each domain master node; or The cluster public key is generated by the global master node and the security controller of each domain. The terminal of claim 18, wherein The cluster public key is obtained when the terminal is authenticated by the current domain security controller or the current domain master node when entering the network; or The cluster public key is obtained when the terminal is authenticated by the current domain master node and the primary security controller, and the primary security controller is used to perform unified authentication on the terminals joining all the domains of the cluster, and the unified authentication is performed. The latter terminal does not need to be authenticated again when performing intra-cluster handover. The terminal according to claim 18, wherein the selecting unit is further configured to receive another domain master node in the cluster that is sent by the current domain master node through a media access plan frame or a dedicated message before selecting the target domain master node. Information. A terminal applied to an optical wireless communication system, comprising: a processor, a memory, an interface circuit, and a bus, wherein the processor, the memory, and the interface circuit are connected by a bus, wherein the memory is configured to store a set of program codes, and the processor is configured to call the program code stored in the memory , do the following: If the terminal needs to perform domain switching, select the target domain primary node; Obtaining a bandwidth resource allocated by the target domain primary node; Communicating with the target domain master node by using the bandwidth resource allocated by the target domain master node before completing the authentication with the target domain master node, where the terminal transmits the frame when communicating with the target domain master node Cluster public key encryption. The terminal according to claim 32, wherein the processor is further configured to: After the communication with the target domain master node reaches the preset time by using the bandwidth resource allocated by the target domain master node, it is determined according to a preset rule whether the target domain security controller or the target domain master node needs to be authenticated; If the preset rule is met, the target domain security controller or the target domain master node is Line certification. The terminal according to claim 33, wherein the preset rule is: The terminal is in a domain where the target domain primary node is located, and the terminal does not currently need to perform domain switching; or The terminal is in the domain where the target domain primary node is located, and the signal to noise ratio of the signal received by the target domain primary node is greater than a preset threshold, and the terminal does not currently need to perform domain switching. The terminal according to claim 32, wherein after the target domain master node is selected, if the terminal needs to perform domain switching, the processor is further configured to: Sending a handover request to the target domain primary node, where the handover request includes a short address, current domain primary node information, and bandwidth resource request information of the terminal; Receiving a handover response of the target domain primary node; And if the target domain master node accepts the handover request of the terminal, acquiring the bandwidth resource allocated by the target domain master node. The terminal according to claim 32, wherein after the target domain master node is selected, if the terminal needs to perform domain switching, the processor is further configured to: Sending a handover request to the current domain master node, where the handover request includes a short address of the terminal, the target domain primary node information, and bandwidth resource request information; Receiving a handover response of the current domain master node; And if the current domain master node accepts the handover request of the terminal, acquiring the bandwidth resource allocated by the target domain master node. The terminal according to claim 35 or claim 36, wherein, if the terminal communicates with the target domain master node by using the bandwidth resource allocated by the target domain master node for a preset time, according to a preset rule Determining that the target domain security controller or the target domain primary node needs to be authenticated, the processor is further configured to send a registration request to the target domain primary node, perform registration, and acquire a new one allocated by the target domain node. Short address After the registration is successful, the authentication request is sent to the target domain security controller or the target domain master node for authentication; After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses. The terminal according to claim 32, wherein after the target domain master node is selected, if the terminal needs to perform domain switching, the processor is further configured to: Sending a re-registration request to the target domain primary node, where the re-registration request includes a short address, current domain primary node information, and bandwidth resource request information of the terminal; Receiving a re-registration response of the target domain master node; And if the target domain master node accepts the re-registration request of the terminal, acquiring a bandwidth resource and a new short address allocated by the target domain master node. The terminal according to claim 32, wherein after the target domain master node is selected, if the terminal needs to perform domain switching, the processor is further configured to: Sending a re-registration request to the current domain master node, where the re-registration request includes the short address of the terminal, the target domain primary node information, and bandwidth resource request information; Receiving a re-registration response of the current domain master node; And if the current domain master node accepts the re-registration request of the terminal, acquiring a bandwidth resource and a new short address allocated by the target domain master node. The terminal according to claim 38 or 39, wherein after the communication with the target domain master node is performed by using the bandwidth resource allocated by the target domain master node, the processor is further configured to: Notifying the current domain master node to release the allocated resources for the terminal, the allocated resources including the allocated short address and the allocated bandwidth resource. The terminal according to any one of claims 35, 36, 38, 39, wherein the short address of the terminal is grouped by the global master node for all available short addresses, and then one of the terminals is associated with the current domain master node. Corresponding packets are assigned to the current domain master node, and then by the current domain master node The corresponding group is selected and assigned to the terminal. The terminal according to claim 38 or 39, wherein the terminal uses a short address of the terminal when communicating with the current domain master node, and uses the terminal when the terminal communicates with the target domain master node. New short address; After the terminal communicates with the target domain master node by using the bandwidth resource allocated by the target domain master node to reach a preset time, determining, according to a preset rule, the required domain security controller or the target domain master node And performing the authentication, where the processor is further configured to send an authentication request to the target domain security controller or the target domain master node for authentication; After the authentication succeeds, the current domain node is notified to release the allocated resources for the terminal, and the allocated resources include the allocated short addresses. The terminal of claim 32, wherein: The cluster public key is generated by the global master node; or The cluster public key is generated by a global master node and each domain master node; or The cluster public key is generated by the global master node and the security controller of each domain. The terminal of claim 42, wherein The cluster public key is obtained when the terminal is authenticated by the current domain security controller or the current domain master node when entering the network; or The cluster public key is obtained when the terminal is authenticated by the current domain master node and the primary security controller, and the primary security controller is used to perform unified authentication on the terminals joining all the domains of the cluster, and the unified authentication is performed. The latter terminal does not need to be authenticated again when performing intra-cluster handover. The terminal according to claim 32, wherein before selecting the target domain master node, the processor is further configured to: Receiving information of the other domain master nodes in the cluster sent by the current domain master node through the media access plan frame or the dedicated message. A domain master node is applied to an optical wireless communication system, and includes: An allocating unit, configured to: if the terminal needs to perform domain switching, the domain master node allocates a bandwidth resource to the terminal after agreeing to the handover; a communication unit, configured to communicate with the terminal by using the allocated bandwidth resource and a cluster public key before completing the authentication with the terminal; The domain master node is a target domain master node that performs domain switching on the terminal, and the frame transmitted by the target domain master node when communicating with the terminal is encrypted by using a cluster public key. The domain master node according to claim 46, wherein the cluster public key is obtained when the terminal authenticates with the current domain security controller or the current domain master node when the terminal enters the network; The cluster public key is generated by the global master node; or The cluster public key is generated by a global master node and each domain master node; or The cluster public key is generated by the global master node and the security controller of each domain. The domain master node according to claim 46, wherein the short address used by the terminal to communicate with the domain master node is grouped by the global master node for all available short addresses, and then the packets are correspondingly assigned to the domains. The master node selects and allocates to the terminal by the domain master node from the group allocated by the global master node when the terminal and one of the domain master nodes successfully register. A domain master node is applied to an optical wireless communication system, and includes: a processor, a memory, an interface circuit, and a bus, wherein the processor, the memory, and the interface circuit are connected by a bus, wherein the memory is configured to store a set of program codes, and the processor is configured to call the program code stored in the memory , do the following: If the terminal needs to perform domain switching, the processor allocates a bandwidth resource to the terminal after agreeing to the handover; Before the authentication with the terminal is completed, the allocated bandwidth resource and the cluster public key are used to communicate with the terminal, wherein the frame transmitted when the processor communicates with the terminal is encrypted by using a cluster public key. The domain master node according to claim 49, wherein the cluster public key is obtained when the terminal authenticates with the current domain security controller or the current domain master node when the terminal enters the network; The cluster public key is generated by the global master node; or The cluster public key is generated by a global master node and each domain master node; or The cluster public key is generated by the global master node and the security controller of each domain. The domain master node according to claim 49, wherein the short address used by the terminal for communicating with the domain master node is grouped by the global master node for all available short addresses, and then the packets are correspondingly assigned to the domains. The master node selects and allocates to the terminal by the domain master node from the group allocated by the global master node when the terminal and one of the domain master nodes successfully register.

Images