CN102918878B - File transmitting method and device - Google Patents

Abstract

Embodiments of the present invention provide a message sending method and device, which relate to the field of communications. The method includes: receiving an authentication request from a first user equipment, and sending an authentication request to the home user server of the first user according to the first user ID. The HSS sends a user binding authentication request, so that the HSS of the first user judges whether the binding relationship between the IMSI of the first user equipment and the first user ID is valid according to the saved binding relationship between the IMSI and the user ID; When the HSS of a user determines that the binding relationship between the IMSI of the first user equipment and the first user ID is legal, download the binding relationship between the IMSI of the first user equipment and the first user ID from the HSS of the first user , and after the first user equipment establishes communication with the second user equipment, when receiving the message from the first user equipment, send the message conforming to the downloaded binding relationship to the second user equipment. The invention prevents user identification from being forged during data transmission and improves the security of data transmission.

Description

Message sending method and device

technical field

The invention relates to the communication field, in particular to a message sending method and device.

Background technique

With the emergence of a large number of mobile devices in the Internet, it has become a common situation for a single user to have multiple devices. In order to solve the problems of the Internet in terms of mobility, multi-homing and security, a scheme for separating user ID and address is proposed. UIP (UserIdentifierProtocol, User Identification Protocol), the UIP architecture divides the network into multiple domains, and introduces two global services, namely the mapping service from user identification to address and the data encapsulation/decapsulation service of the domain egress router . Under the UIP architecture, all access users are assigned a unique user ID, and the communication parties establish a connection with their respective user IDs, obtain the address of the peer end through query mapping, and realize the data packet through the encapsulation/decapsulation of the domain egress router. transmission. This solution removes the defect that the current Internet communication is limited to addresses or devices, and can well solve the problems described above such as mobility, multi-homing, and single-user multi-device.

In the process of realizing the present invention, the inventor finds that there are at least the following problems in the prior art:

In the prior art, the UIP deployed in the LTE (Long Term Evolution, Long Term Evolution) architecture cannot prevent the forgery of user IDs during communication. Since the network does not authenticate the user's identity, attackers can freely send messages with forged user identity to achieve the effect of identity forgery, and carry out network attacks on this basis, causing serious consequences and low security.

Contents of the invention

In order to improve the security of data transmission, the embodiments of the present invention provide a message sending method and device. Described technical scheme is as follows:

A message sending method, comprising:

Receive an authentication request from the first user equipment, where the authentication request carries the International Mobile Subscriber Identity IMSI of the first user equipment and a first user identifier, where the first user identifier is used to identify the user who uses the first user equipment the first user of

According to the first user ID, send a user binding authentication request to the home user server HSS of the first user, so that the HSS of the first user judges the first Whether the binding relationship between the IMSI of the user equipment and the first user identifier is legal; the user binding authentication request carries the IMSI of the user equipment and the first user identifier;

When the HSS of the first user determines that the binding relationship between the IMSI of the first user equipment and the first user identifier is legal, download the IMSI of the first user equipment and the first user identifier from the HSS of the first user. The binding relationship of the first user identifier, and after the first user equipment establishes communication with the second user equipment according to the LTE architecture, when receiving a message from the first user equipment, it will comply with the downloaded binding relationship The packet is sent to the second user equipment.

A message sending method, comprising:

receiving a user binding authentication request from the MME; the authentication request carries the IMSI and the first user identifier of the first user equipment;

judging whether the binding relationship between the IMSI of the first user equipment and the first user identifier is legal according to the locally saved binding relationship between the IMSI and the user identifier;

If yes, download the binding relationship between the IMSI of the first user equipment and the first user identifier to the MME, so that after the first user equipment establishes communication with the second user equipment according to the LTE architecture, the When the MME receives the message from the first user equipment, send the message conforming to the downloaded binding relationship to the second user equipment.

A network side device, comprising:

The receiving module is configured to receive an authentication request from the first user equipment, where the authentication request carries the International Mobile Subscriber Identity IMSI of the first user equipment and a first user identifier, and the first user identifier is used to identify the a first user of the first user equipment;

A user binding authentication request sending module, configured to send a user binding authentication request to the home user server HSS of the first user according to the first user identifier, so that the HSS of the first user can use the saved IMSI and user The identification binding relationship determines whether the binding relationship between the IMSI of the first user equipment and the first user identification is legal; the user binding authentication request carries the IMSI of the user equipment and the first user identification;

A download module, configured to download the first user from the HSS of the first user when the HSS of the first user determines that the binding relationship between the IMSI of the first user equipment and the first user identifier is legal A binding relationship between the IMSI of the device and the first user identifier;

A communication establishment module, configured to establish communication between the first user equipment and the second user equipment according to the LTE architecture;

The message processing module is configured to send a message conforming to the downloaded binding relationship to the second user equipment when receiving a message from the first user equipment after the first user equipment establishes communication with the second user equipment. user equipment.

A network side server, comprising:

A receiving module, configured to receive a user binding authentication request from an MME; the authentication request carries the IMSI and the first user identifier of the first user equipment;

A judging module, configured to judge whether the binding relationship between the IMSI of the first user equipment and the first user identifier is legal according to the locally saved binding relationship between the IMSI and the user identifier;

A downloading module, configured to download the IMSI of the first user equipment and the first user ID if the judging result of the judging module is that the binding relationship between the IMSI of the first user equipment and the first user identifier is valid. The identified binding relationship is downloaded to the MME, so that after the first user equipment and the second user equipment establish communication according to the LTE architecture, when the MME receives a message from the first user equipment, it will comply with The downloaded packet of the binding relationship is sent to the second user equipment.

The beneficial effects of the technical solution provided by the embodiments of the present invention are:

By performing binding authentication on the user equipment according to the pre-saved binding relationship between the user equipment and the user, and when the binding relationship authentication of the user equipment is legal, the binding relationship is used to check the validity of the message, which will meet the The message of the binding relationship is sent to the destination device, which prevents the forgery of the user ID during the data transmission process and improves the security of the data transmission.

Description of drawings

FIG. 1 is a flow chart of a message sending method provided in Embodiment 1 of the present invention;

FIG. 2 is a flow chart of a message sending method provided in Embodiment 1 of the present invention;

FIG. 3 is a flow chart of a message sending method provided in Embodiment 1 of the present invention;

FIG. 4 is a schematic structural diagram of a network side device provided by an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a network side device provided by an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a network side device provided by an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a network side device provided by an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of a network side server provided by an embodiment of the present invention;

FIG. 9 is a schematic structural diagram of a network side server provided by an embodiment of the present invention;

FIG. 10 is a schematic structural diagram of a network side server provided by an embodiment of the present invention.

detailed description

In order to make the object, technical solution and advantages of the present invention clearer, the implementation manner of the present invention will be further described in detail below in conjunction with the accompanying drawings.

Fig. 1a is a flowchart of a message sending method provided by an embodiment of the present invention. Referring to Figure 1b, in the LTE network, including: the first user equipment IMSIA1 being used by the first user UIDA, the second user equipment IMSIB1 being used by the second user UIDB, MME (MobilityManagementEntity, mobile management entity)/SGW (ServingGateway, service gateway), the HSS of the first user and the HSS of the second user, the execution subject of this embodiment of the MME is the MME. Referring to FIG. 1, the method includes:

101. Receive an authentication request from a first user equipment, where the authentication request carries an IMSI (International Mobile Subscriber Identity, International Mobile Subscriber Identity) of the first user equipment and a first user identity, where the first user identity is used to identify the first the first user of the user equipment;

In this embodiment, each user in the network is assigned a globally unique user identifier to identify the user identity, which is called a UID (UserIdentifier). Each UIP-supporting user equipment stores its user identifier, that is, the user's UID. The UID can be pre-written into the SIM card of the user equipment, or the user can manually configure the UID into the user equipment. The present invention uses the IMSI (International Mobile Subscriber Identity) in the mobile communication network to identify the user equipment. The user equipment may be a mobile terminal in the network, an entity with a communication function, and the like. The LTE network in this embodiment includes: a first user equipment being used by a first user, a second user equipment being used by a second user, and an MME for relaying. Before this step 101, the communication between the first user equipment and the second user equipment has been established. In order to improve the security of message transmission and prevent the occurrence of user identity forgery during data transmission, the first user equipment needs to pass through the MME Authentication, this process is different from the conventional authentication process in the prior art in that the authentication request sent by the first user equipment also carries the first user identifier.

102. According to the first user ID, send a user binding authentication request to the first user's HSS (Home Subscriber Server, Home Subscriber Server), so that the first user's HSS judges the binding relationship between the IMSI and the user ID stored. Whether the binding relationship between the IMSI of the first user equipment and the first user identifier is legal; the user binding authentication request carries the IMSI of the user equipment and the first user identifier;

Under the LTE architecture, each user corresponds to an HSS, and the HSS of the user may be the HSS to which a device owned by the user belongs.

In this embodiment, the MME queries the HSS corresponding to the first user ID according to the first user ID, and obtains the HSS of the first user. The HSS of the first user stores the binding relationship between the user ID UID and the IMSI. A user can bind multiple user equipments at the same time, that is, one user identifier UID can correspond to multiple IMSIs. The binding relationship is static and can be implemented offline. Preferably, the embodiment of the present invention uses a user binding table to store the binding relationship between the UID and the IMSI of the user equipment. An example of a fixed table, UIDA corresponds to multiple devices, and in Table 1, it is shown that UIDA corresponds to IMSIA1, IMSIB1, and so on.

Table 1

It should be noted that the HHS also maintains the mapping relationship between each user and the user equipment currently used by it, that is, the mapping relationship between the UID and the IMSI. A single user can be mapped to multiple devices at the same time, that is, one UID can correspond to multiple IMSIs. Further, the mapping can be dynamically updated when the user switches the user equipment used.

Preferably, the embodiment of the present invention uses a user mapping table to store the mapping relationship between the UID and the IMSI of the currently used user equipment, see Table 2, Table 2 is an example of the user mapping table, UIDA corresponds to one device, and UIDB corresponds to multiple devices , which is shown in Table 1 as UIDB corresponding to IMSIB1 and IMSIB2.

Table 2

103. When the HSS of the first user determines that the binding relationship between the IMSI of the first user equipment and the first user identifier is legal, download the IMSI of the first user equipment and the first user from the HSS of the first user identified binding relationship, and after the first user equipment establishes communication with the second user equipment, when receiving a message from the first user equipment, send a message conforming to the downloaded binding relationship to the second user equipment.

The method provided in this embodiment performs binding authentication on the user equipment according to the pre-saved binding relationship between the user equipment and the user, and when the binding relationship authentication of the user equipment is legal, uses the binding relationship to authenticate the message Carry out a legality check, send the message that conforms to the binding relationship to the destination device, prevent the forgery of the user ID during the data transmission process, and improve the security of the data transmission.

FIG. 2 is a flowchart of a message sending method provided by an embodiment of the present invention. The interaction subjects in this embodiment are the first user equipment being used by the first user, the HSS of the first user, the second user equipment being used by the second user, the HSS of the second user, and the source MME. Referring to Fig. 2, this embodiment includes:

201. The first user equipment sends an authentication request to the source MME, where the authentication request carries the International Mobile Subscriber Identity IMSI of the first user equipment and a first user identifier, where the first user identifier is used to identify the first user equipment the first user of

In this embodiment of the present invention, when authenticating the user equipment, the difference from the EPS-AKA protocol is that the first user ID is added to the authentication request, and the MME uses the first user ID and the IMSI of the first user equipment to Perform binding authentication on the first user equipment. During the sending process, a new field can be added to the authentication request message, and the UID and IMSI can be placed in the new field of the authentication request message; the UID and IMSI can also be uploaded implicitly, such as uploading some specified characters, and finally The HSS calculates the preset algorithm according to the specified characters to get the final IMSI and UID.

202. The MME receives an authentication request from the first user equipment; the authentication request carries the International Mobile Subscriber Identity IMSI of the first user equipment and a first user identifier, where the first user identifier is used to identify the user who uses the first user equipment. first user;

203. The MME sends a user binding authentication request to the home subscriber server HSS of the first user according to the first user identifier; the user binding authentication request carries the IMSI of the user equipment and the first user identifier;

Those skilled in the art can know that the user ID and the mapping relationship between the user ID and its HHS are stored locally.

204. The HSS of the first user receives the user binding authentication request, and judges whether the binding relationship between the IMSI of the first user equipment and the first user ID is legal according to the stored binding relationship between the IMSI and the user ID;

In this embodiment, the HSS has the function of storing user binding relationships and user mapping relationships. Each HSS stores its static user binding table for its users. The user binding table includes the binding relationship between the user and the user equipment. At the same time, it stores and correctly maintains the user mapping table. The user mapping table includes the user and The mapping relationship between the user equipment being used by the user.

205. The HSS of the first user feeds back the judgment result to the MME;

In this embodiment, if the binding is legal, an authentication success message is returned, otherwise, an authentication failure message is returned and the authentication process ends;

206. When the judging result is that the binding relationship is legal, the MME downloads the binding relationship between the IMSI of the first user equipment and the first user identifier from the HSS of the first user;

207. The MME continues the subsequent process of the EPC-AKA authentication protocol, that is, requests authentication data from the HSS of the user equipment, and completes the challenge-response and key negotiation with the user equipment;

The embodiment of the present invention adds a process of user binding authentication to the authentication flow, and the authentication is completed between the user equipment, the local MME, the user HSS and the HSS of the user's current device.

In this embodiment, with respect to the LTE architecture, during the user binding authentication process, the user equipment carries the user's UID in the authentication request message, and when the MME receives the authentication request, it sends the user binding authentication message to the user HSS; The user HSS queries the local user binding table according to the user UID and judges the binding relationship between the received UID and IMSI, and then returns the judgment result to the MME. Download the binding.

The above authentication process of steps 201-207 can be performed when the first user equipment is connected to the network, and the authentication process only needs to be performed before the first user equipment initiates communication, which is not specifically limited in this embodiment of the present invention.

208. The first user equipment initiates a communication request, and the communication request carries the first user identifier and the second user identifier;

In this embodiment, the source end is the first user equipment, and the destination end is the second user equipment; those skilled in the art may know that the communication request further includes a source port identifier and a destination port identifier.

209. The source MME receives the communication request, and acquires the second user equipment being used by the second user according to the second user identifier;

It should be noted that since the first user equipment has been authenticated legally by the source MME, the source MME allows the first user equipment to establish communication with the second user equipment when receiving the communication request.

Specifically, this step 209 includes: the source MME receives the communication request, and initiates a mapping query to the HSS of the second user according to the second user identifier in the communication request, and the HSS of the second user obtains the first user mapping table according to the stored user mapping table. The IMSI of the user equipment currently used by the user is returned to the source MME; wherein, the user mapping table is the user mapping relationship in step 102, which will not be described in this embodiment. For example, the MME initiates a mapping query to the HSS of the UIDC of the user, and the HHS obtains from Table 2 that the user equipment corresponding to the UIDC is IMSIC1, and then feeds back the IMSIC1 to the first user equipment.

210. Establish communication between the first user equipment and the second user equipment;

Those skilled in the art can know that the process of establishing communication is performed according to the communication process of the LTE architecture itself.

Compared with the LTE architecture, the communication process uses the UIDs of the source user equipment and the destination user equipment to establish a communication connection, and the MME initiates a mapping query according to the UID of the destination user equipment, and obtains the function of the corresponding user equipment IMSI.

When the MME receives the message from the first user equipment, perform step 211;

211. When the MME receives the packet from the first user equipment, the MME sends the packet conforming to the downloaded binding relationship to the second user equipment;

Specifically, when the MME receives a message from the first user equipment, it checks the message according to the downloaded binding relationship, and when the binding relationship between the IMSI and the user identifier contained in the message conforms to the downloaded binding relationship When determining the relationship, the message is sent to the second user equipment; when the binding relationship between the IMSI and the user ID contained in the message does not conform to the downloaded binding relationship, the message is discarded.

If the user binding authentication succeeds, the MME/SGW where the user is located can obtain the corresponding binding relationship from the user HSS. In the subsequent data transmission process, since the user's communication message contains both UID and IMSI information, the MME/SGW at the user's location can check the validity of the corresponding relationship between the UID and IMSI in the user message to prevent user identity forgery occur. If the user sends data with a forged UID, the corresponding packet will be detected as illegal and discarded.

At the data level, the EPS-AKA protocol of LTE itself can generate corresponding keys to protect the integrity and confidentiality of user data communication, and realize the privacy and confidentiality of equipment and user identifiers; the method provided by the invention can simultaneously prevent equipment and Forgery of User IDs. Due to the low security of UIP deployed in the LTE architecture at the control plane, that is, the security of the mapping table maintained by UIP from user identification to its equipment is difficult to guarantee. At the control plane, UIP needs to ensure The correctness of the mapping relationship, that is, the correctness of the user mapping table stored in the user HSS. After the user equipment has passed the user binding authentication, the present invention also includes a user mapping update process, which is completed between the user equipment, the local MME and the user HSS, as shown in Figure 3:

301. When the first user switches from the first user equipment to the third user equipment, the third user equipment sends a mapping update request to the local MME, where the mapping update request carries the first user identifier and the IMSI of the third user equipment; the first user equipment The third user equipment is the user equipment currently used by the first user;

302. When receiving the mapping update request of the first user, check whether the binding relationship between the first mapping identifier and the IMSI of the third user equipment is legal; if yes, perform step 303;

In this embodiment, the mapping update request carries the first user identifier and the IMSI of the third user equipment; the third user equipment is the user equipment currently used by the first user;

303. The MME/SGW forwards the mapping update request to the HSS of the first user, so that the HSS of the first user updates the stored user mapping relationship according to the mapping update request.

The updating described in this embodiment refers to modifying the mapping relationship stored in the HSS to the mapping relationship between the user and the user equipment currently used by the user. After updating the mapping relationship, the HSS of the user returns a confirmation message to the MME, and after receiving the confirmation message, the MME returns a confirmation update message to the third user equipment. Compared with the LTE architecture, during the user mapping update process, the user equipment sends a mapping update request when the user switches to the user equipment, and the MME triggers a packet validity check according to the mapping update request, and further forwards the mapping to the user HSS if it is legal. Update request, the user HSS identifies the mapping update request, updates the local user mapping table, and returns a successful message.

The method provided in this embodiment performs binding authentication on the user equipment according to the pre-saved binding relationship between the user equipment and the user, and when the binding relationship authentication of the user equipment is legal, uses the binding relationship to authenticate the message Carry out a legality check, send the message that conforms to the binding relationship to the destination device, prevent the forgery of the user ID during the data transmission process, and improve the security of the data transmission. Furthermore, after the binding relationship authentication is passed, the user mapping update process is added to ensure the correctness of the mapping relationship between the user and the device currently used by the user, and enhance the security of the UIP scheme data layer and control layer.

FIG. 4 is a schematic structural diagram of a network side device provided by an embodiment of the present invention. Referring to Figure 4, the network side equipment includes:

The receiving module 401 is configured to receive an authentication request from a first user equipment, where the authentication request carries an International Mobile Subscriber Identity IMSI and a first user identifier of the first user equipment, and the first user identifier is used to identify the user a first user of said first user equipment;

A user binding authentication request sending module 402, configured to send a user binding authentication request to the home user server HSS of the first user according to the first user identifier, so that the HSS of the first user can use the stored IMSI and The binding relationship of the user identification determines whether the binding relationship between the IMSI of the first user equipment and the first user identification is legal; the user binding authentication request carries the IMSI of the user equipment and the first user identification;

A downloading module 403, configured to download the first user ID from the HSS of the first user when the HSS of the first user determines that the binding relationship between the IMSI of the first user equipment and the first user ID is legal. A binding relationship between the IMSI of the user equipment and the first user identifier;

a communication establishment module 404, configured to establish communication between the first user equipment and the second user equipment;

The message processing module 405 is configured to, after the first user equipment establishes communication with the second user equipment, when receiving a message from the first user equipment, send a message conforming to the downloaded binding relationship to the second user equipment. Two user equipment.

Referring to FIG. 5, the message processing module 405 specifically includes:

A checking unit 405a, configured to, when receiving a message from the first user equipment, check the message according to the downloaded binding relationship;

The first processing unit 405b is configured to send the message to the second user equipment when the binding relationship between the IMSI and the user identifier included in the message conforms to the downloaded binding relationship;

The second processing unit 405c is configured to discard the message when the binding relationship between the IMSI and the user ID included in the message does not conform to the downloaded binding relationship.

Referring to FIG. 6, the established communication module 404 includes:

The receiving unit 404a is configured to receive a communication request from the first user equipment, where the communication request carries a first user identifier and a second user identifier;

The acquiring unit 404b is configured to acquire a second user equipment being used by the second user according to the second user identifier, so that a communication channel is established between the first user equipment and the second user equipment.

The obtaining unit 404b is specifically configured to initiate a mapping query to the HSS of the second user, so that the HSS of the second user returns the second user equipment being used by the second user according to the stored user mapping relationship.

Referring to Figure 7, the network side device also includes:

The checking module 406 is configured to, when receiving the mapping update request of the first user, the mapping update request carries the first user identifier and the IMSI of a third user equipment; the third user equipment is the first user the currently used user equipment; check whether the binding relationship between the first mapping identifier and the IMSI of the third user equipment is legal,

If so, trigger the forwarding module 407 for forwarding the mapping update request to the HSS of the first user, so that the HSS of the first user updates the stored user mapping relationship according to the mapping update request.

The network side device provided by the embodiment of the present invention performs binding authentication on the user equipment according to the pre-stored binding relationship between the user equipment and the user, and uses the binding relationship when the binding relationship authentication of the user equipment is legal Check the validity of the message, send the message that conforms to the binding relationship to the destination device, prevent the forgery of the user ID during the data transmission process, and improve the security of the data transmission.

FIG. 8 is a schematic structural diagram of a network side server provided by an embodiment of the present invention. Referring to Figure 8, the network side server includes:

The receiving module 801 is configured to receive a user binding authentication request from the MME; the authentication request carries the IMSI and the first user identifier of the first user equipment;

A judging module 802, configured to judge whether the binding relationship between the IMSI of the first user equipment and the first user identifier is legal according to the locally saved binding relationship between the IMSI and the user identifier;

The downloading module 803 is configured to download the IMSI of the first user equipment and the first The binding relationship of the user identifier is downloaded to the MME, so that when the first user equipment establishes communication with the second user equipment, the MME will comply with the downloaded message when receiving the message from the first user equipment. The packet of the binding relationship is sent to the second user equipment.

Referring to Figure 9, the network side server also includes:

The query module 804 is configured to obtain the second user equipment being used by the second user according to the saved user mapping relationship when receiving the mapping query initiated by the MME during the communication channel establishment process, and return the second user equipment to to the MME.

Referring to Figure 10, the network side server also includes:

The update module 805 is configured to, when receiving the mapping update request forwarded by the MME, update the locally stored user mapping relationship according to the mapping update request.

The network side server provided by the embodiment of the present invention performs binding authentication on the user equipment according to the pre-stored binding relationship between the user equipment and the user, and when the binding relationship authentication of the user equipment is valid, the binding relationship Download to the network-side device, so that the network-side device checks the validity of the message according to the binding relationship, and sends the message that conforms to the binding relationship to the destination device, preventing user ID forgery during data transmission, and improving security of data transmission.

The embodiment of the present invention can be realized by software, and the corresponding software program can be stored in a readable storage medium, for example, a hard disk, cache or optical disk of a computer.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection of the present invention. within range.

Claims (16)

1. a file transmitting method, is characterized in that, comprising:

Receive the authentication request from first user equipment, described authentication request carries international mobile subscriber identity IMSI and the first user mark of described first user equipment, and described first user mark is for identifying the first user using described first user equipment;

Identify according to described first user, home subscriber servers HSS to described first user sends the request of user binding authentication, makes the HSS of described first user judge that whether the binding relationship of the IMSI of described first user equipment and described first user mark is legal according to the binding relationship of the IMSI preserved and user ID; IMSI and the first user mark of described first user equipment are carried in the request of described user's binding authentication;

When the HSS of described first user determines that the binding relationship of the IMSI of described first user equipment and described first user mark is legal, the IMSI of described first user equipment and the binding relationship of described first user mark is downloaded from the HSS of described first user, and after described first user equipment and the second subscriber equipment to be set up according to Long Term Evolution LTE framework and communicated, when receiving the message from described first user equipment, the message of the binding relationship meeting download is sent to described second subscriber equipment.

2. method according to claim 1, is characterized in that, when receiving the message from described first user equipment, the message of the binding relationship meeting download being sent to described second subscriber equipment, specifically comprises:

When receiving the message from described first user equipment, described message is checked according to the binding relationship of described download, when the binding relationship of the IMSI comprised in described message and user ID meets the binding relationship of described download, described message is sent to described second subscriber equipment;

When the binding relationship of the IMSI comprised in described message and user ID does not meet the binding relationship of described download, abandon described message.

3. method according to claim 1, is characterized in that, described foundation with the second subscriber equipment communicates, and specifically comprises:

Receive the communication request of described first user equipment, described communication request carries described first user mark, described second user ID;

According to described second user ID, obtain the second subscriber equipment that described second user is using, make to set up communication port between described first user equipment and described second subscriber equipment.

4. method according to claim 3, is characterized in that, obtains the second subscriber equipment that described second user is using, specifically comprises:

HSS to described second user initiates map locating, makes the HSS of described second user return according to user's mapping relations of preserving the second subscriber equipment that described second user using.

5. method according to claim 1, is characterized in that, described method also comprises:

When receiving the map updating request of described first user, check that whether the binding relationship of the IMSI of the first mapped identification and the 3rd subscriber equipment is legal, if, by described map updating request forward to the HSS of described first user, the HSS of described first user is upgraded to user's mapping relations of preserving according to described map updating request; The IMSI of described first user mark and described 3rd subscriber equipment is carried in described map updating request; Described 3rd subscriber equipment is the subscriber equipment of the current use of described first user.

6. a file transmitting method, is characterized in that, comprising:

Receive the user's binding authentication request from MME; IMSI and the first user mark of first user equipment are carried in the request of described user's binding authentication;

The IMSI preserved according to this locality and the binding relationship of user ID judge that whether the binding relationship of the IMSI of described first user equipment and described first user mark is legal;

If, the binding relationship of the IMSI of described first user equipment and described first user mark is downloaded to described MME, make after described first user equipment and the second subscriber equipment to be set up according to Long Term Evolution LTE framework and communicated, when described MME receives the message from described first user equipment, the message of the binding relationship meeting download is sent to described second subscriber equipment.

7. method according to claim 6, is characterized in that, receives the user's binding authentication request from MME, also comprises before:

In communication channel process of establishing, when receiving the map locating that described MME initiates, obtaining according to user's mapping relations of preserving the second subscriber equipment that the second user using, and described second subscriber equipment is returned to described MME.

8. method according to claim 6, is characterized in that, described method also comprises:

When receiving the map updating request that described MME forwards, according to described map updating request, user's mapping relations that this locality is preserved are upgraded.

9. a network equipment, is characterized in that, comprising:

Receiver module, for receiving the authentication request from first user equipment, described authentication request carries international mobile subscriber identity IMSI and the first user mark of described first user equipment, and described first user mark is for identifying the first user using described first user equipment;

User's binding authentication request sending module, for identifying according to described first user, home subscriber servers HSS to described first user sends the request of user binding authentication, makes the HSS of described first user judge that whether the binding relationship of the IMSI of described first user equipment and described first user mark is legal according to the binding relationship of the IMSI preserved and user ID; IMSI and the first user mark of described first user equipment are carried in the request of described user's binding authentication;

Download module, when binding relationship for the IMSI and described first user mark that determine described first user equipment as the HSS of described first user is legal, download the IMSI of described first user equipment and the binding relationship of described first user mark from the HSS of described first user;

Communication building block, for setting up communicating of described first user equipment and the second subscriber equipment according to Long Term Evolution LTE framework;

Message processing module (MPM), after setting up at described first user equipment and described second subscriber equipment and communicating, when receiving the message from described first user equipment, sends to described second subscriber equipment by the message of the binding relationship meeting download.

10. network equipment according to claim 9, is characterized in that, described message processing module (MPM) specifically comprises:

Inspection unit, for when receiving the message from described first user equipment, checks described message according to the binding relationship of described download;

First processing unit, for when the binding relationship of the IMSI comprised in described message and user ID meets the binding relationship of described download, sends to described second subscriber equipment by described message;

Second processing unit, for when the binding relationship of the IMSI comprised in described message and user ID does not meet the binding relationship of described download, abandons described message.

11. network equipments according to claim 9, is characterized in that, institute's communication building block comprises:

Receiving element, for receiving the communication request of described first user equipment, described communication request carries described first user mark, described second user ID;

Acquiring unit, for according to described second user ID, obtains the second subscriber equipment that described second user is using, and makes to set up communication port between described first user equipment and described second subscriber equipment.

12. network equipments according to claim 11, it is characterized in that, described acquiring unit initiates map locating specifically for the HSS to described second user, makes the HSS of described second user return according to user's mapping relations of preserving the second subscriber equipment that described second user using.

13. network equipments according to claim 9, is characterized in that, described network equipment also comprises:

Checking module, for when receiving the map updating request of described first user, check that whether the binding relationship of the IMSI of the first mapped identification and the 3rd subscriber equipment is legal, if, trigger and to be used for described map updating request forward, to the forwarding module of HSS of described first user, the HSS of described first user being upgraded user's mapping relations of preserving according to described map updating request; The IMSI of described first user mark and described 3rd subscriber equipment is carried in described map updating request; Described 3rd subscriber equipment is the subscriber equipment of the current use of described first user.

14. 1 kinds of network side servers, is characterized in that, comprising:

Receiver module, for receiving the user's binding authentication request from MME; IMSI and the first user mark of described first user equipment are carried in the request of described user's binding authentication;

Judge module, the binding relationship for the IMSI that preserves according to this locality and user ID judges that whether the binding relationship of the IMSI of described first user equipment and described first user mark is legal;

Download module, if the judged result for described judge module is that the binding relationship of the IMSI of described first user equipment and described first user mark is legal, the binding relationship of the IMSI of described first user equipment and described first user mark is downloaded to described MME, make after described first user equipment and the second subscriber equipment to be set up according to Long Term Evolution LTE framework and communicated, when described MME receives the message from described first user equipment, the message of the binding relationship meeting download is sent to described second subscriber equipment.

15. network side servers according to claim 14, is characterized in that, described network side server also comprises:

Enquiry module, in communication channel process of establishing, when receiving the map locating that described MME initiates, obtaining according to user's mapping relations of preserving the second subscriber equipment that the second user using, and described second subscriber equipment is returned to described MME.

16. network side servers according to claim 14, is characterized in that, described network side server also comprises:

Update module, for when receiving the map updating request that described MME forwards, upgrades user's mapping relations that this locality is preserved according to described map updating request.