Authentication method, base station, user equipment, and core network element
A base station, user equipment, and a core network element. The authentication method includes: receiving, by the base station, a first message sent by the user equipment, where the first message includes uplink data, a user equipment identifier, and a first authentication result; sending an authentication request message to the core network element; receiving an authentication response message sent by the core network element; and comparing the first authentication result and a second authentication result, and sending the uplink data to the core network element if the first authentication result is the same as the second authentication result. The base station performs security verification on the user equipment, to avoid arrival of data from unauthorized UE at the core network element, improve security, and save a transmission resource in comparison with the prior art.
1. A network device, comprising:
a non-transitory memory storing executable instructions; and
a processer configured to execute the executable instructions to perform operations comprising:
receiving a first message sent by a user equipment, wherein the first message comprises uplink data, a user equipment identifier, and a first authentication result, wherein the first authentication result is determined by the user equipment based on a first response message received by the user equipment from a core network element;
sending an authentication request message to the core network element, wherein the authentication request message comprises at least one of the user equipment identifier, a group identifier of a group to which the user equipment belongs, and a cell identifier of a cell to which the user equipment belongs;
receiving an authentication response message sent by the core network element, wherein the authentication response message comprises a second authentication result, and the second authentication result is an authentication result obtained by the core network element through calculation based on the authentication request message; and
comparing the first authentication result and the second authentication result, and sending the uplink data to the core network element if the first authentication result is the same as the second authentication result.
2. The network device according to claim 1 , wherein the first authentication result is one of:
an authentication result obtained by the user equipment through calculation based on an authentication code and the cell identifier;
an authentication result obtained by the user equipment through calculation based on an authentication code and the group identifier; or
an authentication result obtained by the user equipment through calculation based on an authentication code and the user equipment identifier; and
an authentication result obtained by the user equipment through calculation based on a user equipment key and the user equipment identifier.
3. The network device according to claim 1 , wherein the operations further comprises:
determining based on network load, a service type, or a service data amount, whether to send the uplink data to the core network element.
4. The network device according to claim 3 , wherein the operations further comprises:
if the operations determines not to send the uplink data to a core network element, sending to the user equipment, information indicating that a connectionless transmission request is rejected.
5. A communication device, comprising:
a non-transitory memory storing executable instructions; and
a processer configured to execute the executable instructions to perform operations comprising:
sending a first request message to a core network element, wherein the first request message is used to request a connectionless transmission service;
receiving a response message sent by the core network element, wherein the response message comprises a user equipment identifier allocated by the core network element to the user equipment, or the user equipment identifier and an authentication code allocated by the core network element to the user equipment;
determining a first authentication result based on the response message; and
sending a first message to a base station, wherein the first message comprises uplink data, the user equipment identifier, and the first authentication result,
wherein the base station compares the first authentication result and a second authentication result, and sends the uplink data to the core network element if the first authentication result is the same as the second authentication result and wherein the second authentication result is determined by the core network element based on an authentication request message.
6. The communication device according to claim 5 , wherein the determining of the operations comprises one of:
determining the first authentication result based on the authentication code and a cell identifier of a cell to which the user equipment belongs;
determining the first authentication result based on the authentication code and a group identifier of a group to which the user equipment belongs; and
determining the first authentication result based on the authentication code and the user equipment identifier.
7. The communication device according to claim 5 , wherein the determining of the operations comprises:
determining the first authentication result based on the user equipment identifier and a first key, wherein the first key is a key of the user equipment.
8. The communication device according to claim 5 , wherein the first request message comprises at least one of a service data amount of the user equipment or a service type of the user equipment.
9. A network device, comprising:
a non-transitory memory storing executable instructions; and
a processer configured to execute the executable instructions to perform operations comprising:
receiving an authentication request message sent by a base station, wherein the authentication request message comprises a user equipment identifier allocated by a core network element to user equipment, a group identifier of a group to which user equipment belongs, or a cell identifier of a cell to which user equipment belongs;
determining a first authentication result based on the authentication request message; and
sending the first authentication result to the base station,
wherein the base station compares the first authentication result and a second authentication result, and sends the uplink data to the core network element if the first authentication result is the same as the second authentication result and wherein the second authentication result is determined by the core network element based on an authentication request message.
10. The network device according to claim 9 , wherein before the receiving, the operations further comprises:
receiving a first request message sent by the user equipment, wherein the first request message is used to request a connectionless transmission service;
determining the user equipment identifier based on the first request message; and
sending a first response message to the user equipment, wherein the first response message comprises the user equipment identifier.
11. The network device according to claim 9 , wherein before the receiving, the operations further comprises:
receiving a first request message sent by the user equipment, wherein the first request message is used to request a connectionless transmission service;
determining the user equipment identifier and an authentication code based on the first request message; and
sending a second response message to the user equipment, wherein the second response message comprises the user equipment identifier and the authentication code.
12. The network device according to claim 10 , wherein the determining of the operations comprises:
determining, by the core network element, the first authentication result based on the user equipment identifier and a first key.
13. The network device according to claim 11 , wherein the determining of the operations comprises:
determining the first authentication result based on the authentication code, and the group identifier, the cell identifier, or the user equipment identifier.
14. The network device according to claim 9 , wherein the first request message comprises at least one of a service data amount of the user equipment or a service type of the user equipment, and the operations further comprises:
determining based on the service data amount of the user equipment or the service type of the user equipment, whether to accept a connectionless transmission request of the user equipment.
15. The network device according to claim 14 , wherein the determining, of the operations comprises one of:
if a quantity of connectionless transmission request messages received by the core network element is less than a first preset threshold within a first preset time, determining, by the core network element, to accept the connectionless transmission request of the user equipment;
if the service data amount of the user equipment does not meet a second preset threshold, determining, by the core network element, to accept the connectionless transmission request of the user equipment; and
if the service type of the user equipment is a preset service type, determining, by the core network element, to accept the connectionless transmission request of the user equipment.
16. The network device according to claim 14 , wherein the user equipment identifier is used to instruct the core network element to accept the connectionless transmission request of the user equipment.
17. The network device according to claim 14 , wherein the operations further comprises:
sending a third response message to the user equipment, wherein the third response message comprises information indicating that the connectionless transmission request of the user equipment is rejected.