CN101959190A - Method, device and system for controlling access to a cell - Google Patents

Abstract

The embodiment of the invention discloses method, device and system for controlling an access subdistrict, wherein a network side sets an authentication parameter through a first algorithm, and a first terminal can fail to return authentication, thus, the first terminal can judge the failure of network authentication and does not try to access a first subdistrict in a certain period in order to avoid that the first terminal can not be accessed into a control process through the first subdistrict positioned behind an authentication process, and the first terminal gives up reselection tries to the first subdistrict and all other subdistricts having the same frequency with the first subdistrict in a time span which can reach 20 minutes or 5 minutes.

Description

Method, device and system for controlling access to a cell

technical field

The present invention relates to the communication field, in particular to a method, device and system for controlling access to a cell.

Background technique

When a terminal residing in the GERAN (GSM EDGE Radio Access Network, GSM EDGE Radio Access Network) network performs cell reselection, if the UTRAN (Universal Terrestrial Radio Access Network, Global Terrestrial Radio Access Network) cell with the strongest signal When the list of forbidden Location Areas for roaming (List of forbidden Location Areas for roaming) or non-equivalent registered PLMN (Public Land Mobile-communication Network, public land mobile communication network) makes the terminal unsuitable for accessing the cell, the terminal will Reselection to all cells on the frequency point where the cell is located is prohibited within a time period of up to 20 minutes. Similarly, when the terminal resides on the GERAN network, the EUTRAN (Evolved Universal Terrestrial Radio Access Network, Evolved Global Terrestrial Radio Access Network) cell with the strongest signal belongs to the tracking area list (List offorbidden Tracking Areas for roaming) or a non-equivalent registered PLMN and the terminal is not suitable for accessing the cell, the terminal will be prohibited from reselecting to all the cells on the frequency point where the cell is located for a maximum of 20 minutes.

A similar mechanism exists for terminals residing in the UTRAN/EUTRAN network, the difference is that the time for being prohibited from reselecting to the corresponding frequency point is 5 minutes.

A home base station cell called CSG (Closed Subscriber Group) cell will be deployed within the coverage of the current GERAN/UTRAN/E-UTRAN macro cell. The home base station using UTRAN access technology is called Home NodeB, or HNB for short, and uses EUTRAN The home base station of the access technology is called HomeeNodeB, HeNB for short. For HNB or HeNB, only a small number of signed terminals can access it, which is called closed access (Closed Access), and this type of cell is called CSG cell; for a small number of signed terminals, priority access and priority guarantee of QoS (Quality of Service, quality of service), under the premise of ensuring the access of subscribers and their QoS, other terminals can also access, which is called hybrid access (HybridAccess), and this type of cell is called Hybrid (hybrid) cell, for a small number of contracted The terminal regards the Hybrid cell as a CSG cell, and regards the Hybrid cell as a macro cell for other terminals.

A large number of CSG cells are deployed within the coverage area of a macro cell. These CSG cells may be deployed on dedicated frequency points or may be deployed on the same frequency point as macro cells and/or hybrid cells. For a given terminal, only Access to very few CSG cells, or none of them. At present, if a terminal tries to access a CSG cell, but the terminal is not a subscriber of the CSG cell, and the terminal cannot pass the access control of the network, then, according to the return message of the network access control, the terminal will The location area is added to the list of location areas prohibited from roaming, or the tracking area is added to the list of tracking areas prohibited from roaming, so the terminal will be prohibited from accessing other cells of the frequency point where the CSG cell is located (for example, macro cell, Hybrid cell, subscribed CSG cell) up to 20 minutes (when the terminal resides on the GERAN network) or 5 minutes (when the terminal resides on the UTRAN network or EUTRAN network).

It can be seen from this that if the user attempts to access the CSG cell but is rejected, it will not be able to access all the cells of the corresponding frequency point for a maximum of 20 minutes or 5 minutes. This problem is called the 20-minute problem in GERAN. Since this problem also exists in the UTRAN/EUTRAN network, but the prohibition time is different, here, it is collectively referred to as the 20-minute problem.

Since a large number of CSG cells are deployed in a macro cell, and only a few or no CSG cells allow terminals to access, the large number of CSG cells will make terminals frequently try to access CSG cells, and only a few or no CSG cells in the macro cell No CSG cell allows the terminal to access. Due to the 20-minute problem, it is difficult for the terminal to obtain services from other cells at the frequency point where the CSG is deployed for a long time.

Contents of the invention

Embodiments of the present invention provide a method, device and system for controlling access to a cell. Adopt the following technical solutions:

A method for controlling access to a cell, comprising: receiving a first message sent by a first terminal in a first cell, the first cell includes a CSG cell or a hybrid cell, and the first message indicates that the first terminal sends a message to the first cell. The network to which the first cell belongs initiates location registration or a service request; corresponding to receiving the first message, it is determined that the first terminal is an old terminal, the old terminal is a terminal that cannot identify the first cell and the old The user of the terminal is not a subscriber of the first cell; according to the fact that the first terminal is the old terminal, use a first algorithm to generate an authentication parameter, and send the authentication parameter to the first terminal to indicate the The first terminal authenticates the network to which the first cell belongs according to the authentication parameter; wherein the first algorithm is used to enable the first terminal to authenticate the first cell according to the authentication parameter The result of the authentication performed by the network to which it belongs is an authentication failure, and the authentication failure prohibits the first terminal from accessing the first cell within a preset time.

An apparatus, the apparatus is located on the network side, and the apparatus includes: a message receiving module, configured to receive a first message sent by a first terminal in a first cell, the first cell includes a CSG cell or a hybrid cell, and the first The message indicates that the first terminal initiates a location registration or a service request to the network to which the first cell belongs; the terminal type determining module corresponds to the first message received by the message receiving module, and is used to determine the first terminal It is an old terminal, the old terminal cannot identify the first cell and the user of the old terminal is not a subscriber of the first cell; the authentication parameter generation and sending module is used to determine the module according to the terminal type determining that the first terminal is the old terminal, using a first algorithm to generate an authentication parameter, and sending the authentication parameter to the first terminal to instruct the first terminal to perform authentication on the performing authentication on the network to which the first cell belongs; wherein the first algorithm is used to make the result of the first terminal authenticating the network to which the first cell belongs according to the authentication parameter be an authentication failure, The authentication failure prohibits the first terminal from accessing the first cell within a preset time.

A communication system, the communication system includes: a device and a first terminal, wherein the device is used to receive a first message sent by the first terminal in a first cell, and the first cell includes a CSG cell or a hybrid cell , the first message indicates that the first terminal initiates a location registration or service request to the network to which the first cell belongs; corresponding to receiving the first message, the device determines that the first terminal is an old terminal, so The old terminal cannot identify the first cell and is not a user of the old terminal and is a subscriber of the first cell; according to the fact that the first terminal is the old terminal, the device uses a first algorithm to generate an authentication parameter, and send the authentication parameter to the first terminal to instruct the first terminal to authenticate the network to which the first cell belongs according to the authentication parameter; wherein, the first algorithm is used for Making the first terminal authenticate the network to which the first cell belongs according to the authentication parameter as an authentication failure, and the authentication failure prohibits the first terminal from accessing the network within a preset time. Describe the first district.

The method, device, and system for controlling access to a cell provided by the embodiments of the present invention aim at a first cell including a CSG cell or a hybrid cell, when a first terminal that cannot identify the first cell and is not a subscriber of the first cell enters the cell After the first cell, the first terminal initiates a location registration or service request to the network side. Correspondingly, the network side generates authentication parameters according to the first algorithm and sends the authentication parameters to the first terminal. Perform authentication calculation and return an authentication message to the network side. Since the network side sets the authentication parameters through the first algorithm, the first terminal can return the authentication failure, so that the first terminal can judge that the network authentication fails, and no longer try to access the first cell within a certain period of time , which avoids the 20 minute problem.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without any creative effort.

Figure 1 shows a schematic diagram of a system including a terminal and a network side;

FIG. 2 shows a schematic flow diagram of a method for controlling access to a CSG cell provided in an embodiment;

Figure 3 shows a block diagram of a device provided in an embodiment, the device is located on the network side;

Fig. 4 shows a schematic diagram of a communication system provided in an embodiment.

Detailed ways

FIG. 1 shows a schematic diagram of a system 1000 by way of example, and the system 1000 includes a first terminal 1006 and a network side 1002 . System 1000 may include one or more terminals 1006 .

The first terminal 1006 is a type of terminal. The term "terminal" may refer to any portable or mobile device that can receive or transmit wireless signals with one or more wireless communication devices or wireless communication networks. For example, the terminal can be a wireless device (Radio device), a cellular phone device (Cellular telephone device), a computer device (Computing device), a personal communication device (Personal communication system device) or any other mobile device equipped with wireless communication.

The network side 1002 includes a first cell 1004 . The network side 1002 is not limited to only one first cell 1004 , but may include multiple first cells 1004 . The first cell may be a CSG cell or a hybrid cell, or may be a home base station cell.

The term "network side" may refer to a device located on the network side. The device may be one or a combination of a home base station, a home base station gateway, a mobile switching center in the core network, or a serving general packet radio service support node in the core network.

The first terminal 1006 may perform wireless signal reception or transmission with the network side 1002 . The system 1000 may be located in the GERAN network, the UTRAN network or the E-UTRAN network, and the first cell 1004 is located within the macro cell coverage of the GERAN network, the UTRAN network or the E-UTRAN network.

For ease of description, a CSG cell is used as an example for illustration.

For terminals that support the EUTRAN network, that is, terminals that may access the HeNB CSG cell, such terminals can be divided into two categories, one is the terminal that supports the minimum set of CSG, and this type of terminal can identify the CSG cell. In reselection mode or manual reselection mode, neither will attempt to access the CSG cell of the HeNB, so that the 20-minute problem will not occur; the other type is a terminal that supports CSG capabilities. , if the attempt to access is unsuccessful, the network will return the newly defined reason value to avoid the 20-minute problem. Therefore, when a terminal supporting the EUTRAN network tries to access the CSG cell of the HeNB, the 20-minute problem will not occur.

For a terminal that supports the UTRAN network and may access the HNB CSG cell, if it supports the CSG minimum set or supports the CSG capability, the 20-minute problem will not occur. If the terminal cannot identify the CSG cell and the user of the terminal is not a subscriber of the CSG cell, when the terminal tries to reselect to access the CSG cell, the terminal will have a 20-minute problem. In the embodiment of the present invention, for the convenience of description , and this type of terminal can be called an "old terminal". For an old terminal, if it tries to access the CSG cell of the HNB, the network will reject its access, and a 20-minute problem may occur depending on the value of the reason for the rejection.

Correspondingly, unless otherwise specified, the terminals involved in the embodiments of the present invention refer to old terminals. The first terminal 1006 is an old terminal.

After the terminal reselects or selects a CSG cell of an HNB, it can perform access control through the AS (Access Stratum, access stratum) process or through the NAS (Non-Access Stratum, non-access stratum) process. The technical solutions provided by the embodiments of the present invention are at the NAS layer. The process of triggering access control through the NAS layer can be divided into two categories, one is the process related to location registration, such as the location update (Location Updating) process, GPRS Attach (Attach) process, routing area update (RoutingArea Updating) process; The other type is the process related to business initiation, such as Service Request (business request) process, CM Service Request process, etc. In both types of NAS processes, the core network may trigger authentication procedures. If the terminal (including the old terminal and all other terminals that will not have the 20-minute problem) authenticates the network, the terminal fails to pass the authentication on the network side, that is, when the terminal fails to authenticate the network side, the terminal will use the current cell Forbidden for a period of time, no more attempts to access the cell will be made within this period of time. Therefore, in the above two types of NAS processes, when the terminal cannot identify the CSG cell and is not a subscriber of the CSG cell, that is, when the terminal is the first terminal 1006, the network side can trigger the authentication process, and specifically Setting the authentication parameters of the authentication process makes the first terminal 1006 fail to authenticate the network, so that the first terminal 1006 prohibits the CSG cell for a period of time, thus avoiding the problem of 20 minutes. In the current authentication process, the network side uses the algorithm agreed with the first terminal 1006 to set the authentication parameters, and the first terminal 1006 uses the same algorithm to calculate the authentication parameters after receiving the authentication parameters sent by the network side. In this embodiment of the present invention, the network side adopts a specific algorithm different from the algorithm agreed upon by the first terminal 1006 to set the authentication parameters. The algorithm is the second algorithm, and the network side uses the first algorithm to make the first terminal 1006 use authentication parameters to authenticate the network and the result is authentication failure, so that the first terminal 1006 prohibits the CSG cell for a period of time. Time to avoid the 20 minute problem.

The method, device and system for controlling access to a cell will be described in detail below in conjunction with the embodiments described by way of example. Apparently, these embodiments are only some of the embodiments of the present invention, but not all of them. Based on these embodiments, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts fall within the protection scope of the present invention.

Those skilled in the art can understand that the methods in the embodiments of the present invention can be implemented in different ways. For example, these methods may be implemented by program instructions in hardware, software, or a combination of hardware and software. When the program instructions are executed, the methods included in the embodiments of the present invention are executed. For the way of adopting hardware implementation, one or more processing modules in the embodiment of the present invention can be implemented in one or more circuit modules, and the circuit modules can be application specific integrated circuits (Application Specific Integrated Circuits, ASICs), digital signal processors (Digital Signal Processors, DSPs), digital signal processing devices (Digital Signal Processing Devices, DSPDs), programmable logic devices (Programmable Logic Devices, PLDs), field programmable gate arrays (Field Programmable Gate Arrays, FPGAs), processors, control processor, microprocessor, microcontroller, or other electronic devices that are designed and can be used to execute the methods in the embodiments of the present invention.

In the manner of software implementation, the methods in the embodiments of the present invention may be implemented using one or more modules, for example, may be implemented in a process-based or function-based modular manner. These program instructions can be embodied on any computer or machine readable medium. For example, the readable medium may be various mediums capable of storing program codes such as memory, ROM, RAM, magnetic disk or optical disk. Memory can be located inside the processor or outside the processor. Here, memory refers to any type of long-term memory, short-term memory, erasable memory, non-erasable memory, or other types of memory.

As shown in Figure 2, an embodiment provides a method for controlling access to a cell, the method includes:

110. The network side receives a first message sent by the first terminal in the first cell, where the first cell includes a CSG cell or a hybrid cell, and the first message indicates that the first terminal initiates a location registration or a service request to the network side.

After the first terminal enters the first cell, the first terminal may trigger two types of NAS processes, including a process related to location registration and a process related to service initiation. The location registration initiated by the first terminal to the network side may trigger a procedure related to location registration, and the service request initiated by the first terminal to the network side may trigger a procedure related to service initiation. Location registration-related procedures include location update procedure, GPRS attach procedure, routing area update procedure, etc. When the first terminal enters the first cell, the first terminal can send a location updating request (Location Updating Request) message to the network side; when the terminal enters the first cell and initiates a service, the terminal can send a call management service request message to the network side (CM Service Request) message. The first message may be any one of the following messages: location update request message, routing area update request message, service request message, call management service request message, attach request message, detach request message and connection reestablishment request message.

115. Corresponding to receiving the first message, the network side determines that the first terminal is an old terminal.

The term "old terminal" may be defined as a terminal that cannot identify the first cell and whose user is not a subscriber of the first cell.

After receiving the first message, the network side may trigger an Identification (identification) process. The network receives the first message sent by the first terminal, determines that the first terminal is located in the first cell when sending the first message, and obtains the version information of the first terminal according to the capabilities of the first terminal and judges that the first terminal cannot identify the first cell. The IMSI of the first terminal determines that the user of the first terminal is not a subscriber of the first cell. That is, at this moment, the network side determines that the first terminal is an old terminal.

120. According to the fact that the first terminal is an old terminal, the network side uses the first algorithm to generate authentication parameters, and sends the authentication parameters to the first terminal to instruct the first terminal to authenticate the network to which the first cell belongs according to the authentication parameters.

The network to which the first cell belongs may be an access network of the first cell, or may be a core network of the first cell. Both the access network of the first cell and the core network of the first cell may be regarded as the network side.

The network side selects a first algorithm that is different from the algorithm agreed by the first terminal to set the authentication parameters. The purpose of using the first algorithm is that the authentication parameters generated by the network side through the first algorithm can be used by the first terminal for the first cell to which the first terminal belongs. When the network performs authentication, the authentication result of the first terminal to the first cell may be an authentication failure, so that the first terminal may be prohibited from accessing the CSG cell within a preset time.

The authentication parameter generated by the first algorithm may be included in the authentication request message sent by the network side to the first terminal. Include the key sequence number (Ciphering Key Sequence Number, CKSN) in the authentication request message, and the value of the key sequence number is one of 000 to 110. The authentication request message can also be an Authentication And Ciphering Request (Authentication And Ciphering Request) message. In the subsequent description, only the Authentication And Ciphering Request message is used as an example for illustration, and the authentication and encryption request message can also be used in the embodiment of the present invention. Similar methods will not be repeated here. In addition to the key serial number, the authentication parameter may only include the authentication parameter RAND ("random number"), or the authentication parameter may also include the authentication parameter RAND and the authentication parameter AUTN ("authentication").

The authentication parameter RAND can be selected by the network side, and if the network side has saved the RAND parameter, the saved value can be used. Alternatively, the authentication parameter RAND may also be directly randomly selected by the network side to a valid parameter value with the same bit length, and the first algorithm may be a random algorithm.

The MAC ("Media Access Control") and SQN ("Synchronization") parameters in the authentication parameter AUTN can be randomly selected by the network side, and the first algorithm can be a random algorithm. If the network side is an MSC (MobileSwitching Center, Mobile Switching Center) or core network SGSN (Serving GPRS SupportNode, Serving General Packet Radio Service Support Node) selection, then select the value of terminal authentication failure, or do not carry this parameter value in the first authentication request message.

130. The first terminal receives the authentication parameter sent by the network side, and determines, according to the authentication parameter, that the authentication result of the network to which the first cell belongs is an authentication failure.

After receiving the authentication request message including the authentication parameter sent by the network side, the first terminal uses an algorithm agreed with the network side to use the authentication parameter to authenticate the network to which the first cell belongs. Since the network side uses a first algorithm different from the algorithm agreed with the first terminal when generating the authentication parameters, the first terminal uses the algorithm agreed with the network side to use the authentication parameters to verify the identity of the network to which the first cell belongs. The authentication result after authentication is authentication failure. When the first algorithm used by the network side is a random algorithm, the first terminal may pass the verification of the authentication parameter set by the random algorithm. At this point, the first terminal will return an authentication response message. When the network side receives the authentication response message, the network side will re-use the first algorithm to generate a new authentication parameter and send it to the first terminal, instructing the first terminal to identify the network to which the first cell belongs according to the new authentication parameter. Authentication is performed until the first terminal no longer sends an authentication response message to the network side, that is, the network side receives the authentication failure message sent by the first terminal. The authentication failure message may include any one of "MAC failure", "synchronization failure" and "GSM authentication unacceptable".

The network side may continuously use the first algorithm to generate the authentication parameter, and send the authentication parameter to the first terminal to instruct the first terminal to perform authentication on the network to which the first cell belongs. When the first terminal sends authentication failure messages to the network side for 3 or more consecutive times, the first terminal and the network side consider that the first terminal has failed to authenticate the network to which the first cell belongs. At this time, the network side may not Then continue to send the authentication parameter generated by the first algorithm to the first terminal.

Optionally, when the first terminal sends the authentication failure message to the network side for the first time, the first terminal may start the timer at the same time. When the first terminal receives the authentication request message sent by the network side again, the first terminal stops the timer. If the first terminal fails to receive the authentication request message sent by the network side when the timer expires, the first terminal may consider that authentication to the network has failed. Therefore, when the network side receives the authentication failure message, the authentication request may not be sent any more, and the timer is used to control the first terminal so that the first terminal considers that authentication of the network to which the first cell belongs fails. In this manner, the signaling interaction between the network side and the terminal can be reduced.

140. The first terminal is prohibited from accessing the first cell within a preset time according to its failure to authenticate the network to which the first cell belongs.

When the first terminal sends more than three consecutive authentication failure messages, the first terminal has judged that the authentication of the first cell has failed, and it will not try to access the first cell within a preset time. The preset time can be determined according to the actual situation. set up. Correspondingly, because the first terminal cannot pass the first cell access control process after the authentication process, it is avoided that the first terminal prohibits access to other cells with the same frequency as the first cell, that is, avoids 20 minute question.

In the method for controlling access to a cell provided in this embodiment, after the first terminal enters the first cell, if the network side learns that the first terminal is not a subscriber of the CSG cell and the user of the first terminal is not a subscriber of the first cell , the network side sends the authentication parameter to the first terminal, and the first terminal authenticates the network to which the first cell belongs according to the authentication parameter. The network side uses the first algorithm to set the authentication parameters, so that the first terminal can authenticate the network to which the first cell belongs, and the result is that the authentication fails, so that the first terminal does not try to access the network within a certain period of time. the first cell. Correspondingly, it prevents the first terminal from being prohibited from accessing other cells with the same frequency as the first cell, and solves the 20-minute problem that makes it difficult for the first terminal to obtain the macro cell or contracted CSG cell or CSG cell at the frequency where the first cell is deployed. The problem of the service of other types of cells contracted.

As shown in FIG. 3 , a device 200 is provided in yet another embodiment. The device 200 is located on the network side, and the specific type of the device 200 is not limited. For example, the device 200 may be a home base station, or a home base station gateway, or a mobile switching center in the core network, or a serving general packet radio service support node in the core network one or a combination of more than one. The device 200 can complete all functions of the network side in the foregoing method embodiments. The device 200 includes: a message receiving module 210 , a terminal type determining module 220 and an authentication parameter generating and sending module 230 .

The message receiving module 210 is configured to receive a first message sent by a first terminal in a first cell, the first cell includes a CSG cell or a hybrid cell, and the first message indicates that the first terminal initiates a location to the network to which the first cell belongs Registration or service request; the terminal type determination module 220 corresponds to the first message received by the message receiving module 210, and is used to determine that the first terminal is an old terminal, the old terminal is a terminal that cannot identify the first cell and the user of the old terminal is not The subscriber of the first cell; the authentication parameter generation and sending module 230 is used to determine the first terminal as an old terminal according to the terminal type determination module 220, use the first algorithm to generate the authentication parameter, and send the authentication parameter to the second A terminal instructs the first terminal to authenticate the network to which the first cell belongs according to the authentication parameter; wherein, the first algorithm is used to make the first terminal authenticate the network to which the first cell belongs according to the authentication parameter. authorization failure, the authentication failure prohibits the first terminal from accessing the first cell within a preset time.

Further, the first message includes: one of a location update request message, a routing area update request message, a service request message, a call management service request message, an attach request message, a detach request message, and a connection reestablishment request message.

Further, the first algorithm includes: a random algorithm, which is used to randomly select at least one of the value of the authentication parameter RAND, the value of the authentication parameter SQN, and the value of the authentication parameter MAC.

Further, in addition to the key serial number, the authentication parameter may only include the authentication parameter RAND; or, the authentication parameter may include at least one of the authentication parameter SQN and the authentication parameter MAC and the authentication parameter RAND.

Further, the authentication parameter generation and sending module 230 uses the first algorithm to generate the authentication parameter, and sends the authentication parameter to the terminal to instruct the terminal to authenticate the network to which the first cell belongs according to the authentication parameter, including: authentication parameter generation and The sending module 230 continues the process of using the first algorithm to generate the authentication parameter and sending the authentication parameter to the first terminal until the message receiving module 210 continuously receives at least 3 authentication failure messages sent by the first terminal.

The apparatus 200 provided in this embodiment uses the first algorithm to set the authentication parameters, so that the first terminal can authenticate the network to which the first cell belongs, and the result of the authentication failure is that the first terminal is in a certain No more attempts to access the first cell within the time period. Correspondingly, it prevents the first terminal from prohibiting access to other cells with the same frequency as the first cell, and solves the 20-minute problem that makes it difficult for the first terminal to obtain the macro cell or contracted CSG at the frequency where the first cell is deployed. Issues with service in a cell or other type of cell contracted.

As shown in FIG. 4, a communication system 300 is provided in another embodiment, and the communication system 300 includes a device 310 and a first terminal 320, wherein,

The device 310 is configured to receive a first message sent by the first terminal 320 in a first cell, where the first cell includes a CSG cell or a hybrid cell, and the first message indicates that the first terminal 320 initiates location registration to the network to which the first cell belongs or Service request; corresponding to receiving the first message, the device 310 determines that the first terminal 320 is an old terminal, the old terminal is a terminal that cannot identify the first cell and the user of the old terminal is not a subscriber of the first cell; according to The first terminal 320 is an old terminal, and the device 310 uses the first method to generate an authentication parameter, and sends the authentication parameter to the first terminal 320, instructing the first terminal 320 to perform authentication on the network to which the first cell belongs according to the authentication parameter; Wherein, the first algorithm is used to make the result of the first terminal 320 authenticating the network to which the first cell belongs according to the authentication parameter be an authentication failure, and the authentication failure prohibits the first terminal 320 from accessing the network within a preset time. First district.

Further, the first message may include: one of a location update request message, a routing area update request message, a service request message, a call management service request message, an attach request message, a detach request message, and a connection reestablishment request message.

Further, the first algorithm may include: a random algorithm, which is used to randomly select at least one of the value of the authentication parameter RAND, the value of the authentication parameter SQN, and the value of the authentication parameter MAC.

Further, in addition to including the key serial number in the authentication parameter, the authentication parameter may only include the authentication parameter RAND; or, the authentication parameter may also include at least one of the authentication parameter SQN and the authentication parameter MAC and the authentication parameter RAND .

Further, the device 310 uses the first algorithm to generate an authentication parameter, and sends the authentication parameter to the first terminal 320 to instruct the first terminal 320 to authenticate the network to which the first cell belongs according to the authentication parameter, including: The device 310 continues the process of using the first algorithm to generate the authentication parameter and sending the authentication parameter to the first terminal 320 until at least 3 authentication failure messages sent by the first terminal 320 are continuously received.

The device 310 is located on the network side. The device 310 may be one or a combination of a home base station, a home base station gateway, a mobile switching center in the core network, or a serving GPRS support node in the core network. Further, the device 310 can complete all functions of the network side in the foregoing method embodiments.

In the communication system 300 provided in this embodiment, the device 310 sets the authentication parameters by using the first algorithm, so that the first terminal 320 can authenticate the network to which the first cell belongs, and the result is that the authentication fails, Therefore, the first terminal 320 does not attempt to access the first cell within a certain period of time. Correspondingly, because the first terminal 320 cannot pass the first cell access control process after the authentication process, it is avoided that the first terminal 320 also prohibits access to other cells with the same frequency as the first cell. The 20-minute problem makes it difficult for the first terminal 320 to obtain services from the macro cell at the frequency point where the first cell is deployed, the subscribed CSG cell, or other types of cells subscribed to.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. Should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (15)

1. A method for controlling access to a cell, comprising:

receiving a first message sent by a first terminal in a first cell, wherein the first cell comprises a CSG cell or a hybrid cell, and the first message indicates that the first terminal initiates a position registration or a service request to a network to which the first cell belongs;

correspondingly receiving the first message, determining that the first terminal is an old terminal, wherein the old terminal is a terminal which cannot identify the first cell and a user of the old terminal is not a subscriber of the first cell;

generating an authentication parameter by using a first algorithm according to the condition that the first terminal is the old terminal, and sending the authentication parameter to the first terminal to indicate the first terminal to authenticate the network to which the first cell belongs according to the authentication parameter;

the first algorithm is used for enabling the result of authentication of the network to which the first cell belongs by the first terminal according to the authentication parameters to be authentication failure, and the authentication failure prohibits the first terminal from accessing the first cell within preset time.

2. The method of claim 1, wherein the first message comprises: one of a location update request message, a routing area update request message, a service request message, a call management service request message, an attach request message, a detach request message, and a connection reestablishment request message.

3. The method of claim 1, wherein the first algorithm comprises: a random algorithm for randomly selecting at least one of a value of an authentication parameter RAND, a value of an authentication parameter SQN, and a value of an authentication parameter MAC.

4. The method according to claim 1, characterized in that said authentication parameters comprise authentication parameters RAND; or,

the authentication parameters comprise at least one of an authentication parameter SQN and an authentication parameter MAC and an authentication parameter RAND.

5. The method of claim 1, wherein the generating authentication parameters using the first algorithm and sending the authentication parameters to the terminal to instruct the terminal to authenticate a network to which the first cell belongs according to the authentication parameters comprises:

and continuing the process of generating authentication parameters by using the first algorithm and sending the authentication parameters to the first terminal until at least 3 authentication failure messages sent by the first terminal are continuously received.

6. An apparatus, wherein the apparatus is located on a network side, the apparatus comprising:

a message receiving module, configured to receive a first message sent by a first terminal in a first cell, where the first cell includes a CSG cell or a hybrid cell, and the first message indicates that the first terminal initiates a location registration or a service request to a network to which the first cell belongs;

a terminal type determining module, configured to determine, corresponding to the first message received by the message receiving module, that the first terminal is an old terminal, where the old terminal is a subscriber who cannot identify the first cell and a user of the old terminal is not the first cell;

an authentication parameter generating and sending module, configured to determine, according to the terminal type determining module, that the first terminal is the old terminal, generate an authentication parameter using a first algorithm, and send the authentication parameter to the first terminal, so that the first terminal instructs the first terminal to authenticate a network to which the first cell belongs according to the authentication parameter;

the first algorithm is used for enabling the result of authentication of the network to which the first cell belongs by the first terminal according to the authentication parameters to be authentication failure, and the authentication failure prohibits the first terminal from accessing the first cell within preset time.

7. The apparatus of claim 6, wherein the first message comprises: one of a location update request message, a routing area update request message, a service request message, a call management service request message, an attach request message, a detach request message, and a connection reestablishment request message.

8. The apparatus of claim 6, wherein the first algorithm comprises: a random algorithm for randomly selecting at least one of a value of an authentication parameter RAND, a value of an authentication parameter SQN, and a value of an authentication parameter MAC.

9. The apparatus of claim 6, wherein the authentication parameters comprise authentication parameters RAND; or,

the authentication parameters comprise at least one of an authentication parameter SQN and an authentication parameter MAC and an authentication parameter RAND.

10. The apparatus of claim 6, wherein the module for generating and sending the authentication parameters generates authentication parameters using the first algorithm, and sends the authentication parameters to the terminal to instruct the terminal to authenticate the network to which the first cell belongs according to the authentication parameters, comprising:

the authentication parameter generating and sending module continues to use the first algorithm to generate authentication parameters and send the authentication parameters to the first terminal until the message receiving module continuously receives authentication failure messages sent by the first terminal for at least 3 times.

11. A communication system, comprising: an apparatus and a first terminal, wherein,

the apparatus is configured to receive a first message sent by a first terminal in a first cell, where the first cell includes a CSG cell or a hybrid cell, and the first message indicates that the first terminal initiates a location registration or a service request to a network to which the first cell belongs; in response to receiving the first message, the apparatus determines that the first terminal is an old terminal, the old terminal being a subscriber to the first cell that is unable to identify the first cell and is not a user of the old terminal; according to the fact that the first terminal is the old terminal, the device generates authentication parameters by using a first algorithm and sends the authentication parameters to the first terminal to indicate the first terminal to authenticate the network to which the first cell belongs according to the authentication parameters;

the first algorithm is used for enabling the result of authentication of the network to which the first cell belongs by the first terminal according to the authentication parameters to be authentication failure, and the authentication failure prohibits the first terminal from accessing the first cell within preset time.

12. The communication system of claim 11, wherein the first message comprises: one of a location update request message, a routing area update request message, a service request message, a call management service request message, an attach request message, a detach request message, and a connection reestablishment request message.

13. The method of claim 11, wherein the first algorithm comprises: a random algorithm for randomly selecting at least one of a value of an authentication parameter RAND, a value of an authentication parameter SQN, and a value of an authentication parameter MAC.

14. The communication system according to claim 11, wherein said authentication parameters comprise an authentication parameter RAND; or,

the authentication parameters comprise at least one of an authentication parameter SQN and an authentication parameter MAC and an authentication parameter RAND.

15. The communication system of claim 11, wherein the apparatus generates authentication parameters using a first algorithm and sends the authentication parameters to the first terminal to instruct the first terminal to authenticate the network to which the first cell belongs according to the authentication parameters, comprising:

the device continues the process of generating authentication parameters by using the first algorithm and sending the authentication parameters to the first terminal until at least 3 authentication failure messages sent by the first terminal are continuously received.

Images