Femtocell position verification method and device, node and storage medium

Abstract

The embodiment of the invention discloses a home base station position verification method and device, a node and a storage medium. The method comprises the following steps: a second node obtains first position information of a first node; based on the first position information and first information obtained in advance, performing position verification on the first node to obtain a position verification result; the first information represents the signing position of the first node.

Description

Technical Field

[0001] The present invention relates to the field of network information security, and in particular to a method, device, node and storage medium for verifying the location of a home base station. Background Art

[0002] In the 3rd Generation Partnership Project (3GPP), Femto is called Home(e)Node B(H(e)NB), i.e., home base station. Operators need to restrict the use of Femto base stations (or home base stations) to specific locations for security, supervision, and billing considerations.

[0003] At present, the solution adopted for location access restriction is that the Femto base station reports its location-related information, which is forwarded to the Femto network management through the security gateway, and the Femto network management performs location verification to achieve control of the access area restriction of the Femto base station. The current solution is equivalent to the "access first, then verification" method, which first allows the Femto base station to access the core network or network management system through the security gateway, and then the network management performs location restriction verification and control. The disadvantage of this method is that if the location verification fails, since the Femto base station has been connected to the core network, the illegal Femto base station may pose a threat and impact to the network during the access and location verification window period. Summary of the invention

[0004] In order to solve the existing technical problems, the embodiments of the present invention provide a method, device, node and storage medium for verifying the location of a home base station.

[0005] To achieve the above object, the technical solution of the embodiment of the present invention is implemented as follows:

[0006] In a first aspect, an embodiment of the present invention provides a method for verifying the location of a home base station, the method being applied to a second node, the method comprising:

[0007] Obtaining first location information of a first node;

[0008] Based on the first location information and the pre-acquired first information, a location check is performed on the first node to obtain a location check result; the first information represents the contracted location of the first node.

[0009] In the above solution, the method further includes: obtaining second information by preconfiguration, where the second information includes the first information; or,

[0010] Second information sent by a third node is received, where the second information includes the first information.

[0011] In the above solution, the second information also includes a verification strategy, and the verification strategy includes at least one of the following: a request frequency for location information, a type of location information, and a location verification method.

[0012] In the above solution, before obtaining the first location information of the first node, the method further includes:

[0013] Perform identity authentication with the first node, and / or establish a secure tunnel with the first node.

[0014] In the above solution, before obtaining the first location information of the first node, the method further includes:

[0015] A first request is sent to the first node to request first location information of the first node, where the first request includes a type of location information.

[0016] In the above scheme, obtaining the first location information of the first node includes: during the authentication process with the first node, receiving a first message sent by the first node, the first message including the first location information and authentication information of the first node.

[0017] In the above scheme, the first message includes a notification payload, and the notification payload includes a message type field and a data field. The value of the message type field is used to indicate that the first message is used to transmit location information, and the data field carries the first location information.

[0018] In the above solution, the first location information includes at least one of the following information of the first node: an Internet Protocol (IP) address, a first geographical location, and a first identifier of an associated macro base station;

[0019] And / or, the first information includes at least one of the following information of the first node: a second geographical location, a second identifier of an associated macro base station.

[0020] In the above scheme, when the first location information is the first geographical location and the first information is the second geographical location, or when the first location information is the first identifier of the associated macro base station and the first information is the second identifier of the associated macro base station, the location verification is performed on the first node based on the first location information and the pre-configured first information to obtain the location verification result, including: comparing the first location information and the first information, and after the comparison is consistent, determining that the location verification passes.

[0021] In the above solution, when the first location information is an IP address and the first information is a second geographical location, performing location verification on the first node based on the first location information and the preconfigured first information to obtain a location verification result includes:

[0022] Querying the fourth node to obtain the geographical location corresponding to the IP address;

[0023] The geographic location is compared with the first information, and after the comparison is consistent, it is determined that the location verification has passed.

[0024] In a second aspect, an embodiment of the present invention further provides a method for verifying the location of a home base station, the method being applied to a first node, the method comprising:

[0025] First location information is sent to a second node, so that the second node can perform location verification based on the first location information and pre-acquired first information, wherein the first information represents a contracted location of the first node.

[0026] In the above solution, before sending the first location information to the second node, the method further includes:

[0027] Perform identity authentication with the second node, and / or establish a secure tunnel with the second node.

[0028] In the above solution, before sending the first location information to the second node, the method further includes:

[0029] A first request sent by the second node is received to request first location information of the first node, where the first request includes a type of location information.

[0030] In the above scheme, sending the first location information to the second node includes: during the identity authentication process with the second node, sending a first message to the second node, the first message including the first location information and authentication information of the first node.

[0031] In the above scheme, the first message includes a notification payload, and the notification payload includes a message type field and a data field. The value of the message type field is used to indicate that the first message is used to transmit location information, and the data field carries the first location information.

[0032] In the above solution, the first location information includes at least one of the following information of the first node:

[0033] An Internet Protocol (IP) address, a first geographic location, and a first identifier of an associated macro base station.

[0034] In a third aspect, an embodiment of the present invention further provides a home base station location verification device, the device is applied to a second node, and the device includes: a first communication unit and a first processing unit; wherein,

[0035] The first communication unit is used to obtain first location information of the first node;

[0036] The first processing unit is used to perform a position verification on the first node based on the first position information and pre-acquired first information to obtain a position verification result; the first information represents the contracted position of the first node.

[0037] In a fourth aspect, an embodiment of the present invention further provides a home base station location verification device, which is applied to a first node, and includes: a second communication unit, used to send first location information to a second node, so that the second node can perform a location verification based on the first location information and pre-acquired first information, wherein the first information represents the contracted location of the first node.

[0038] In a fifth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect or the second aspect of the embodiment of the present invention.

[0039] In a sixth aspect, an embodiment of the present invention further provides a communication device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method described in the first aspect or the second aspect of the embodiment of the present invention are implemented.

[0040] In a seventh aspect, an embodiment of the present invention further provides a computer program product, comprising computer program instructions, which enable a computer to execute the steps of the method described in the first aspect or the second aspect of the embodiment of the present invention.

[0041] In the home base station location verification method, device, node and storage medium provided by the embodiment of the present invention, the second node obtains the first location information of the first node; based on the first location information and the first information obtained in advance, the first node is positionally verified to obtain a location verification result; the first information indicates the contracted location of the first node. Since the second node is the first checkpoint for the first node to access the core network, if the second node fails to pass the location verification of the first node, the first node will be denied access to the core network, thereby minimizing the threat and impact of illegal base stations on the core network. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A schematic diagram of a network architecture applied in an embodiment of the present invention;

[0043] Figure 2 FIG. 1 is a flow chart of a method for verifying a location of a home base station according to an embodiment of the present invention. Figure 1 ;

[0044] Figure 3 A schematic diagram of a message format in a method for verifying a home base station location according to an embodiment of the present invention;

[0045] Figure 4 FIG. 1 is a flow chart of a method for verifying a location of a home base station according to an embodiment of the present invention. Figure 2 ;

[0046] Figure 5 The interactive process diagram of the method for verifying the location of a home base station according to an embodiment of the present invention is as follows: Figure 1 ;

[0047] Figure 6 The interactive process diagram of the method for verifying the location of a home base station according to an embodiment of the present invention is as follows: Figure 2 ;

[0048] Figure 7 The structure diagram of the home base station location verification device according to an embodiment of the present invention is as follows: Figure 1 ;

[0049] Figure 8 The structure diagram of the home base station location verification device according to an embodiment of the present invention is as follows: Figure 2 ;

[0050] Fig. 9 The figure is a schematic diagram of the hardware composition structure of a node according to an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0052] The technical solution of the embodiment of the present invention can be applied to various communication systems, for example: a global system of mobile communication (GSM) system, a long term evolution (LTE) system or a 5G system, etc. Optionally, the 5G system or 5G network may also be referred to as a new radio (NR) system or NR network.

[0053] Exemplarily, the communication system applied in the embodiment of the present invention may include a network device and a terminal device (also referred to as a terminal, a communication terminal, etc.); the network device may be a device that communicates with the terminal device. Among them, the network device can provide communication coverage within a certain area, and can communicate with terminals located in the area. Optionally, the network device may be a base station in each communication system, such as an evolved base station (eNB, Evolutional Node B) in an LTE system, and a base station (gNB) in a 5G system or an NR system.

[0054] It should be understood that the device with communication function in the network / system in the embodiment of the present application can be referred to as a communication device. The communication device may include a network device and a terminal with communication function, and the network device and the terminal device may be the specific devices described above, which will not be repeated here; the communication device may also include other devices in the communication system, such as a network controller, a mobile management entity and other network entities, which are not limited in the embodiment of the present invention.

[0055] It should be understood that the terms "system" and "network" are often used interchangeably in this article. The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0056] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable in appropriate circumstances, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein, for example. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, the process, method, system, product or equipment comprising a series of steps or units need not be limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0057] Figure 1 Schematic diagram of network architecture applied in the embodiment of the present invention; Figure 1As shown in the figure, the Femto access network mainly includes: H(e)NB, security gateway (S(e)GW), home base station gateway (H(e)NB GW) and network management system. H(e)NB is a private device of the user, which is connected to the security gateway through the public Internet Protocol (IP) network. In other words, there is an insecure link between H(e)NB and the security gateway, and the security gateway connects H(e)NB to the core network. User equipment (UE) is connected to H(e)NB to access the network through H(e)NB.

[0058] Among them, H(e)NB can also be called home base station, Femto base station, 5G NR Femto base station, etc.

[0059] The network management system is specifically a home base station network management system, which can be denoted as H(e)MS.

[0060] In other optional embodiments, the network may further include other network elements, such as the authentication, authorization, accounting (AAA) server (AAA Server) / home subscriber server (HSS) shown in the figure, or may also include network elements not shown in the figure, which are not described in detail in this embodiment.

[0061] An embodiment of the present invention provides a method for verifying the location of a home base station. Figure 2 FIG. 1 is a flow chart of a method for verifying a location of a home base station according to an embodiment of the present invention. Figure 1 ;like Figure 2 As shown, the method includes:

[0062] Step 101: The second node obtains first location information of the first node;

[0063] Step 102: Based on the first location information and pre-acquired first information, perform a location verification on the first node to obtain a location verification result; the first information represents the contracted location of the first node.

[0064] In this embodiment, the first node is a node or device connected to the terminal. Figure 1 In the system architecture shown, the first node may be a home base station (or a 5G NR Femto base station, H(e)NB, etc.). In addition, the first node may also be connected to a second node via a link, and the second node is a gateway node. Figure 1In the system architecture shown, the second node may be a security gateway (S(e)GW). It can be understood that the second node is the first node that the first node accesses the core network, that is, the first node can interact with other nodes in the core network only after accessing the second node.

[0065] In this embodiment, the first location information is the location information of the current location of the first node, and the first location information can directly or indirectly indicate the current location or area of ​​the first node.

[0066] In this embodiment, the first information indicates the contract signing position of the first node. Optionally, the first information can directly indicate the contract signing position of the first node, or can indirectly indicate the contract signing position of the first node, or can approximately indicate the contract signing position of the first node.

[0067] According to the technical solution of the embodiment of the present invention, the second node verifies the position of the first node. Since the second node is the first checkpoint for the first node to access the core network, if the second node fails to verify the position of the first node, the first node will be denied access to the core network, thereby minimizing the threat and impact of illegal base stations on the core network.

[0068] In some optional embodiments of the present invention, the method further includes: obtaining second information in a preconfigured manner, the first information including the first information; or receiving second information sent by a third node, the first information including the first information.

[0069] In this embodiment, the second node may obtain the first information in two ways: one way is to statically configure or store the first information in the second node by preconfiguration; the other way is for the third node to dynamically send or configure the first information to the second node.

[0070] In this embodiment, the third node may be a home base station network management system or H(e)MS, or may be other network elements of the core network, as long as it has the function of determining the corresponding geographical location using an IP address, and this embodiment does not limit this.

[0071] In some optional embodiments, the second information further includes a verification strategy, and the verification strategy includes at least one of the following: a request frequency for location information, a type of location information, and a location verification method.

[0072] In this embodiment, in addition to configuring the contracted location of the first node (ie, the first information) through static preconfiguration or dynamic configuration, a verification strategy is also included. The verification strategy includes at least one of the following: request frequency of location information, type of location information, and location verification method.

[0073] In this embodiment, the request frequency of the location information may also be referred to as the frequency of requesting location information reporting. As an implementation method, the request frequency of the location information may include an absolute time, for example, multiple time points. When the current time reaches each time point, the second node may use an existing processing flow or a newly added processing flow to request the first node to report the first location information. As another implementation method, the request frequency of the location information may also include an initial time and a time interval, so as to determine multiple time points according to the initial time and the time interval, thereby requesting the first node to report the first location information.

[0074] In this embodiment, the type of location information specifically indicates the type of first location information reported by the first node, and the first location information can directly or indirectly indicate the geographical location or area where the first node is located. In some optional embodiments, the type of location information includes at least one of the following: an IP address, a geographical location, and an identifier of an associated macro base station.

[0075] The geographical location may be obtained by satellite positioning, and may also be referred to as a satellite positioning location. The satellite positioning location may specifically be location information obtained by positioning using a global positioning system (GPS), a Beidou satellite navigation positioning system, or the like. In other optional embodiments, the geographical location may also be obtained using other positioning methods, which is not limited in this embodiment.

[0076] The identifier of the associated macro base station may specifically refer to the identifier of the macro base station that is closest to the first node, which can indirectly indicate the approximate geographical location or area where the first node is located.

[0077] In this embodiment, the location verification method is related to the type of location information, and different types of location information have different location verification methods. For example, if the type of location information is geographic location, and the first information is also geographic location, the second node can directly compare the first location information with the first information based on the type of geographic location, thereby verifying the location of the first node. For another example, if the type of location information is an IP address, and the first information is a geographic location, the second node needs to first determine the geographic location corresponding to the IP address, and then compare it with the first information based on the geographic location, thereby verifying the location of the first node. It can be understood that the location verification method is a processing method or process associated with the type of location information.

[0078] In this embodiment, the second node may obtain the first location information of the first node in two ways. One is to perform the location check of the first node by the second node after completing the authentication between the first node and the second node, that is, the second node first performs the authentication of the first node and then performs the location check. The other is to perform the location check simultaneously during the authentication process of the first node and the second node.

[0079] With respect to the first implementation, in some optional embodiments, before obtaining the first location information of the first node, the method further includes: performing identity authentication with the first node, and / or establishing a secure tunnel with the first node.

[0080] In this embodiment, before the second node obtains the first location information of the first node, identity authentication is performed between the second node and the first node, specifically, the second node authenticates the identity of the first node, and the first node authenticates the identity of the second node; and / or, a secure tunnel is established between the second node and the first node. Exemplarily, the secure tunnel can be an Internet Protocol Security (IPSec) tunnel.

[0081] In some optional embodiments, before obtaining the first location information of the first node, the method further includes: sending a first request to the first node to request the first location information of the first node, wherein the first request includes a type of location information.

[0082] In this embodiment, before the second node obtains the first location information of the first node, or in other words, after the second node performs identity authentication with the first node and / or establishes a secure tunnel with the first node, the second node sends a first request to the first node to request the first location information of the first node. After receiving the first request, the first node sends the first location information to the second node.

[0083] Among them, the first request includes the type of location information configured in the verification strategy, so that the second node can obtain the first location information of the corresponding type, and perform location verification on the first location information reported by the first node according to the location verification method configured in the verification strategy.

[0084] For the second implementation, in some optional embodiments, obtaining the first location information of the first node includes: during the authentication process with the first node, receiving a first message sent by the first node, the first message including the first location information and authentication information of the first node.

[0085] In this embodiment, the second node may receive the first location information sent by the first node through an existing message in the authentication process during the authentication process with the first node. In this embodiment, the first node may pre-configure or set a processing rule, that is, during the authentication process between the first node and the second node, the first location information of the first node is carried in a designated message according to the processing rule. In some optional embodiments, the authentication process between the second node and the first node includes the second node authenticating the identity of the first node, and the first node authenticating the identity of the second node. In the above process, the first node needs to send its own authentication information to the second node so that the second node can authenticate the first node based on the authentication information of the first node. Then, the message in which the first node sends the authentication information to the second node may carry the first location information of the first node.

[0086] In this embodiment, the type of the first location information reported by the first node can be pre-agreed with the second node; or, during the authentication process of the first node, the second node requests and informs the first node of the type of reported location information through an existing message.

[0087] In some optional embodiments, the authentication process of the second node and the first node may be based on the Internet Key Exchange version 2 (IKEv2) protocol. During the IKEv2 handshake process, the first node actively reports the first location information. Specifically, when the first node initially accesses, after completing the IKE_SA_INIT process to establish a preliminary security association with the second node, in the IKE_AUTH stage, the first node carries the first location information through an IKE_AUTH request. Then the first message in this embodiment may specifically be an IKE_AUTH request.

[0088] In some optional embodiments, the first message includes a notification payload, and the notification payload includes a message type field and a data field, the value of the message type field is used to indicate that the first message is used to transmit location information, and the data field carries the first location information.

[0089] In this embodiment, the Notify Payload is one of the Payloads supported by IKEv2 and is used to transmit informational data to the IKE peer. In the embodiment of the present invention, the payload (Notify Payload) in the message is used to carry the first location information. Among them, the value 0-16383 of the Notify Message Type field of the Notify Payload is reserved for reporting error information. In the embodiment of the present invention, the Notify Message Type field adopts a value greater than 16383 to indicate the message delivery location information.

[0090] Figure 3 FIG. 4 is a schematic diagram of a message format in a method for verifying a home base station location according to an embodiment of the present invention; Figure 3 As shown, it is a schematic diagram of the format of the notification payload (Notify Payload). Among them, there are a Notify Message Type field and a Notification Data field; when the Notify Message Type field adopts a value greater than 16383 (the value can be pre-agreed by the first node and the second node, or agreed upon by the protocol), the Notification Data field is used to carry the first location information of the first node.

[0091] In some optional embodiments, the first location information includes but is not limited to at least one of the following information of the first node: an Internet Protocol (IP) address, a first geographic location, a first identifier of an associated macro base station; and / or, the first information includes at least one of the following information of the first node: a second geographic location, a second identifier of an associated macro base station.

[0092] In this embodiment, the first geographical location is the current geographical location of the first node, and the second geographical location is the geographical location of the first node when signing the contract. Both the first geographical location and the second geographical location can be obtained by satellite positioning, and can also be referred to as satellite positioning location. The satellite positioning location can specifically be location information obtained by positioning using a GPS positioning system, a Beidou satellite navigation positioning system, or the like. In other optional embodiments, the first geographical location can also be obtained using other positioning methods, which is not limited in this embodiment.

[0093] In this embodiment, the first identifier of the associated macro base station may specifically refer to the identifier of the macro base station closest to the first node, which can indirectly indicate the current approximate geographical location or area of ​​the first node. The second identifier of the associated macro base station may specifically refer to the identifier of the macro base station closest to the first node when the first node signed the contract, which can indirectly indicate the approximate geographical location or area of ​​the first node when the first node signed the contract.

[0094] In some optional embodiments of the present invention, when the first location information is a first geographical location and the first information is a second geographical location, or when the first location information is a first identifier of an associated macro base station and the first information is a second identifier of an associated macro base station, the location verification is performed on the first node based on the first location information and the pre-configured first information to obtain a location verification result, including: comparing the first location information and the first information, and determining that the location verification passes after the comparison is consistent.

[0095] In this embodiment, when the first location information reported by the first node is the first geographical location, that is, when the type of location information requested by the second node is a geographical location, or when the second node and the first node pre-agreed that the type of location information is a geographical location, the type of the contracted location (i.e., the first information) of the first node configured in the second node is also a geographical location. After receiving the first location information, the second node can directly compare the first location information with the second geographical location in the first information, and after the comparison is consistent, it can be determined that the location verification of the first node has passed. Correspondingly, after the comparison is inconsistent, it is determined that the location verification of the first node has failed.

[0096] In this embodiment, when the first location information reported by the first node is the first identifier of the associated macro base station, that is, when the type of location information requested by the second node is the identifier of the associated macro base station, or when the second node and the first node pre-agree that the type of location information is the identifier of the associated macro base station, the type of the contracted location of the first node configured in the second node (that is, the first information) is also the identifier of the associated macro base station. After receiving the first location information, the second node can directly compare the first location information (that is, the first identifier of the associated macro base station) with the second identifier of the associated macro base station in the first information. After the comparison is consistent, it can be determined that the location verification of the first node has passed. Correspondingly, after the comparison is inconsistent, it is determined that the location verification of the first node has failed.

[0097] In some other optional embodiments of the present invention, when the first location information is an IP address and the first information is a second geographic location, the location verification is performed on the first node based on the first location information and the preconfigured first information to obtain a location verification result, including: querying a fourth node to obtain the geographic location corresponding to the IP address; comparing the geographic location and the first information, and determining that the location verification has passed after the comparison is consistent.

[0098] In this embodiment, when the first location information reported by the first node is an IP address, since the IP address is a logical address assigned to a device in the network, the first information of the first node configured in the second node (i.e., the second location information) is a second geographical location, and the second node needs to query the fourth node based on the IP address to obtain the geographical location corresponding to the IP address, and then compare the geographical location obtained from the query with the second geographical location. After the comparison is consistent, it can be determined that the location verification of the first node has passed. Correspondingly, after the comparison is inconsistent, it is determined that the location verification of the first node has failed.

[0099] Optionally, the fourth node may specifically be a home base station network management system or H(e)MS.

[0100] In this embodiment, the first location information reported by the first node includes but is not limited to at least one of the following: an Internet Protocol (IP) address, a first geographic location, and an identifier of an associated macro base station; when the first node reports multiple types of first location information, the second node may compare and verify the multiple types of first location information with the same type of second location information, or perform operations on the first location information and then compare and verify it with the same type of second location information to obtain a verification result, thereby improving the accuracy of location verification.

[0101] Based on the above embodiments, an embodiment of the present invention further provides a method for verifying the location of a home base station. Figure 4 FIG. 1 is a flow chart of a method for verifying a location of a home base station according to an embodiment of the present invention. Figure 2 ;like Figure 4 As shown, the method includes:

[0102] Step 201: A first node sends first location information to a second node, so that the second node can perform location verification based on the first location information and pre-acquired first information, where the first information indicates a contracted location of the first node.

[0103] In this embodiment, the first node is a node or device connected to the terminal. Figure 1In the system architecture shown, the first node may be a home base station (or a 5G NR Femto base station, H(e)NB, etc.). In addition, the first node may also be connected to a second node via a link, and the second node is a gateway node. Figure 1 In the system architecture shown, the second node may be a security gateway (S(e)GW). It can be understood that the second node is the first node that the first node accesses the core network, that is, the first node can interact with other nodes in the core network only after accessing the second node.

[0104] In this embodiment, the first location information is the location information of the current location of the first node, and the first location information can directly or indirectly indicate the current location or area of ​​the first node.

[0105] In this embodiment, the first information represents the contract location information of the first node. Optionally, the first information can directly represent the contract location of the first node, or can indirectly represent the contract location of the first node, or can approximately represent the contract location of the first node.

[0106] According to the technical solution of the embodiment of the present invention, the second node verifies the position of the first node. Since the second node is the first checkpoint for the first node to access the core network, if the second node fails to verify the position of the first node, the first node will be denied access to the core network, thereby minimizing the threat and impact of illegal base stations on the core network.

[0107] In this embodiment, the first node may send the first location information to the second node in two ways. One is that after the authentication between the first node and the second node is completed, the second node performs the location verification of the first node, that is, the second node first performs the identity authentication of the first node and then performs the location verification. The other is that during the identity authentication process of the first node and the second node, the location verification is performed at the same time.

[0108] With respect to the first implementation mode, before sending the first location information to the second node, the method further includes: performing identity authentication with the second node, and / or establishing a secure tunnel with the second node.

[0109] In this embodiment, before the first node sends the first location information to the second node, identity authentication is performed between the second node and the first node, specifically, the second node authenticates the identity of the first node, and the first node authenticates the identity of the second node; and / or, a secure tunnel is established between the second node and the first node. Exemplarily, the secure tunnel can be an IPSec tunnel.

[0110] In some optional embodiments, before the first node sends the first location information to the second node, the method further includes: receiving a first request sent by the second node to request the first location information of the first node, wherein the first request includes a type of location information.

[0111] In this embodiment, before the first node sends the first location information to the second node, or in other words, after the second node performs identity authentication with the first node and / or establishes a secure tunnel with the first node, the second node sends a first request to the first node to request the first location information of the first node. After receiving the first request, the first node sends the first location information to the second node.

[0112] Among them, the first request includes the type of location information configured in the verification strategy, so that the second node can obtain the first location information of the corresponding type, and perform location verification on the first location information reported by the first node according to the location verification method configured in the verification strategy.

[0113] For the second implementation, sending the first location information to the second node includes: during an identity authentication process with the second node, sending a first message to the second node, the first message including the first location information and authentication information of the first node.

[0114] In this embodiment, the second node may send the first location information of the first node to the second node through an existing message in the authentication process during the authentication process with the first node. In this embodiment, the first node may pre-configure or set a processing rule, that is, during the authentication process between the first node and the second node, the first location information of the first node is carried in a designated message according to the processing rule. In some optional embodiments, the authentication process between the second node and the first node includes the second node authenticating the identity of the first node, and the first node authenticating the identity of the second node. In the above process, the first node needs to send its own authentication information to the second node so that the second node can authenticate the first node based on the authentication information of the first node. Then, the message in which the first node sends the authentication information to the second node may carry the first location information of the first node.

[0115] In this embodiment, the type of the first location information reported by the first node may be pre-agreed with the second node; or, during the authentication process with the first node, the second node requests and informs the first node of the type of reported location information through an existing message.

[0116] In some optional embodiments, the authentication process of the second node and the first node may be based on the IKEv2 protocol. During the IKEv2 handshake process, the first node actively reports the first location information. Specifically, when the first node initially accesses, after completing the IKE_SA_INIT process with the second node to establish a preliminary security association, in the IKE_AUTH stage, the first node carries the first location information through an IKE_AUTH request. Then the first message in this embodiment may specifically be an IKE_AUTH request.

[0117] In some optional embodiments, the first message includes a message type field and a payload field, the value of the message type field is used to indicate that the first message is used to transmit location information, and the payload field carries the first location information.

[0118] In this embodiment, the notification payload (Notify Payload) is one of the Payloads supported by IKEv2, and is used to transmit informational data (informational data) to the IKE peer. In the embodiment of the present invention, the payload (Notify Payload) in the message is used to carry the first location information. Among them, the value 0-16383 of the Notify Message Type (Notify Message Type) field of the Notify Payload (Notify Payload) is reserved for reporting error information. In the embodiment of the present invention, the Notify Message Type (Notify Message Type) field adopts a value greater than 16383 to indicate the message delivery location information. The format of the notification payload (Notify Payload) can be specifically referred to. Figure 3 shown.

[0119] In some optional embodiments, the first location information includes at least one of the following information of the first node: an IP address, a first geographical location, and a first identifier of an associated macro base station.

[0120] In this embodiment, the first geographical location is the geographical location where the first node is currently located, and the first geographical location can be obtained by satellite positioning, and can also be called a satellite positioning location. The satellite positioning location can specifically be location information obtained by positioning using a GPS positioning system, a Beidou satellite navigation positioning system, or the like. In other optional embodiments, the first geographical location can also be obtained using other positioning methods, which is not limited in this embodiment.

[0121] In this embodiment, the first identifier of the associated macro base station may specifically refer to the identifier of the macro base station that is closest to the first node, which can indirectly indicate the current approximate geographical location or area of ​​the first node.

[0122] The following is a detailed description of the home base station location verification method of an embodiment of the present invention with reference to specific examples. In the following examples, the first node is H(e)NB, 5G NR Femto base station or home base station (only H(e)NB is used as an example in the figure) and the second node is a security gateway.

[0123] Example 1

[0124] In this example, the security gateway acts as a verification node to verify the location information of the H(e)NB, rather than the Femto network management in the existing standard. Specifically, after the H(e)NB and the security gateway complete the two-way authentication and establish the IPSec tunnel, the security gateway will then verify the location of the H(e)NB. After the location verification is passed, the security gateway will forward the subsequent signaling and service data from this H(e)NB to the core network.

[0125] Figure 5 The interactive process diagram of the method for verifying the location of a home base station according to an embodiment of the present invention is as follows: Figure 1 ;like Figure 5 As shown, the method includes:

[0126] Step 300a: The security gateway statically configures the subscription location information and verification strategy of the H(e)NB.

[0127] Step 300b: Dynamically deliver the subscription location information and verification strategy of the H(e)NB through the Femto network management or other core network elements.

[0128] In this example, the subscribed location information of the H(e)NB may be equivalent to the second location information in the above embodiment. The verification strategy may specifically include at least one of the following: a request frequency for location information, a type of location information, and a location verification method.

[0129] In this example, the H(e)NB's contract location information and location verification policy can be statically stored in the security gateway in a pre-configured manner (see step 300a), or the H(e)NB's contract location information and location verification policy can be sent to the security gateway in a dynamic configuration manner through a Femto network management or other core network elements (see step 300b).

[0130] Step 301: The H(e)NB and the security gateway perform two-way identity authentication and establish an IPSec connection.

[0131] Step 302: The security gateway requests the H(e)NB to report location information according to the verification strategy.

[0132] Here, optionally, the request message may include the type of location information.

[0133] Step 303: The H(e)NB sends a response message to the security gateway, and the response message includes location information.

[0134] Here, the position information may be equivalent to the first position information in the above embodiment.

[0135] Step 304: The security gateway verifies the location of the H(e)NB according to the verification strategy.

[0136] Here, when the location information reported by the H(e)NB is an IP address, the security gateway interacts with the H(e)MS to query the location information corresponding to the IP address.

[0137] Here, the security gateway compares the obtained H(e)NB location information with the subscribed location information. If the comparison is consistent, it is determined that the location verification has passed; otherwise, if the comparison is inconsistent, it is determined that the location verification has failed.

[0138] Step 305: If the location verification fails, the security gateway replies to the H(e)NB with a location verification failure response message, and according to local policies, may refuse to forward any subsequent messages from the H(e)NB and report to the H(e)MS.

[0139] Example 2

[0140] In this example, the security gateway acts as a verification node to verify the location information of the H(e)NB, rather than the Femto network management in the existing standard. Specifically, if IPSec is used for security protection between the H(e)NB and the security gateway, during the IKEv2 handshake phase between the H(e)NB and the security gateway, after the security gateway completes the identity authentication of the H(e)NB, the security gateway continues to verify the location of the H(e)NB. When both are verified, the IKEv2 handshake is successful, and then an IPSec tunnel is established, and the security gateway connects the H(e)NB to the core network.

[0141] Figure 6 The interactive process diagram of the method for verifying the location of a home base station according to an embodiment of the present invention is as follows: Figure 2 ;like Figure 6 As shown, the method includes:

[0142] Step 400a: The security gateway statically configures the subscription location information of the H(e)NB and the verification strategy.

[0143] Step 400b: Dynamically send the subscription location information and verification strategy of the H(e)NB through the Femto network management or other core network elements.

[0144] In this example, the subscribed location information of the H(e)NB may be equivalent to the second location information in the above embodiment. The verification strategy may specifically include at least one of the following: a request frequency for location information, a type of location information, and a location verification method.

[0145] In this example, the H(e)NB's contract location information and location verification policy can be statically stored in the security gateway in a pre-configured manner (see step 300a), or the H(e)NB's contract location information and location verification policy can be sent to the security gateway in a dynamic configuration manner through a Femto network management or other core network elements (see step 300b).

[0146] Step 401: H(e)NB securely starts and performs device integrity check. If the integrity check fails, subsequent steps are not executed.

[0147] Step 402: The H(e)NB sends an IKE_SA_INIT request to the security gateway, so that the H(e)NB initiates authentication of the security gateway to the H(e)NB.

[0148] Step 403: The security gateway sends an IKE_SA_INIT response to the H(e)NB, and requests a digital certificate from the H(e)NB.

[0149] Step 404: In the first message of the IKE_AUTH phase, the H(e)NB sends an IKE_AUTH request message to the security gateway, and the message carries authentication information and location information.

[0150] Here, the H(e)NB may carry an ID in the IDi Payload of the request message, carry LOCATION_INFO in the Notify Payload, and carry authentication data in the AUTH Payload, etc. Among them, LOCATION_INFO may be the location information of the H(e)NB.

[0151] Here, the authentication information may be a digital certificate of the H(e)NB.

[0152] Step 405: The security gateway verifies the authentication information of the H(e)NB, such as verifying the digital certificate of the H(e)NB, and performs identity authentication on it.

[0153] Step 406: The security gateway verifies the location of the H(e)NB according to the verification strategy.

[0154] Here, when the location information reported by the H(e)NB is an IP address, the security gateway interacts with the H(e)MS to query the location information corresponding to the IP address.

[0155] Here, the security gateway verifies the location of the H(e)NB by comparing the LOCATION_INFO carried in the received Notify Payload with the locally stored H(e)NB's contracted location information. If the comparison is consistent, the location verification is determined to have passed; otherwise, if the comparison is inconsistent, the location verification is determined to have failed.

[0156] Step 407: If the verifications in steps 405 and 406 are both passed, the security gateway sends an IKE_AUTH response message to the H(e)NB, carrying the authentication information of the security gateway, such as ID, digital certificate, SA and other IKEv2 parameters, and the IKEv2 negotiation ends.

[0157] Step 408: The H(e)NB verifies the authentication information of the security gateway, such as verifying the ID and digital certificate of the security gateway.

[0158] Based on the above embodiments, an embodiment of the present invention further provides a device for verifying the location of a home base station, and the device is applied to a second node. Figure 7 The structure diagram of the home base station location verification device according to an embodiment of the present invention is as follows: Figure 1 ;like Figure 7 As shown, the device includes: a first communication unit 11 and a first processing unit 12; wherein,

[0159] The first communication unit 11 is used to obtain first location information of the first node;

[0160] The first processing unit 12 is used to perform a position verification on the first node based on the first position information and pre-acquired first information to obtain a position verification result; the first information represents the contracted position of the first node.

[0161] In some optional embodiments of the present invention, the first processing unit 12 is further configured to obtain second information in a preconfigured manner, where the second information includes second location information of the first node; or

[0162] The first communication unit 11 is further configured to receive second information sent by a third node, where the second information includes second location information of the first node.

[0163] In some optional embodiments of the present invention, the second information further includes a verification strategy, and the verification strategy includes at least one of the following: a request frequency for location information, a type of location information, and a location verification method.

[0164] In some optional embodiments of the present invention, the first processing unit 12 is also used to perform identity authentication between the first communication unit 11 and the first node before the first communication unit 11 obtains the first location information of the first node, and / or establish a secure tunnel with the first node.

[0165] In some optional embodiments of the present invention, the first communication unit 11 is further used to send a first request to the first node to request the first location information of the first node before obtaining the first location information of the first node, wherein the first request includes the type of location information.

[0166] In some optional embodiments of the present invention, the first communication unit 11 is used to receive a first message sent by the first node during an authentication process with the first node, where the first message includes the first location information and authentication information of the first node.

[0167] In some optional embodiments of the present invention, the first message includes a notification payload, the notification payload includes a message type field and a data field, the value of the message type field is used to indicate that the first message is used to transmit location information, and the data field carries the first location information.

[0168] In some optional embodiments of the present invention, the first location information includes but is not limited to at least one of the following information of the first node: an IP address, a first geographical location, a first identifier of an associated macro base station; and / or, the first information includes at least one of the following information of the first node: a second geographical location, a second identifier of an associated macro base station.

[0169] In some optional embodiments of the present invention, when the first location information is a first geographical location and the first information is a second geographical location, or when the first location information is a first identifier of an associated macro base station and the first information is a second identifier of an associated macro base station, the first processing unit 12 is used to compare the first location information and the first information, and after the comparison is consistent, determine that the location verification has passed.

[0170] In some optional embodiments of the present invention, when the first location information is an IP address and the first information is a second geographic location, the first processing unit 12 is used to query the fourth node through the first communication unit 11 to obtain the geographic location corresponding to the IP address; compare the geographic location and the first information, and after the comparison is consistent, determine that the location verification has passed.

[0171] In an embodiment of the present invention, the first processing unit 12 in the device can be implemented by a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU) or a programmable gate array (FPGA) in actual applications; the first communication unit 11 in the device can be implemented by a communication module (including: basic communication kit, operating system, communication module, standardized interface and protocol, etc.) and a transceiver antenna in actual applications.

[0172] The embodiment of the present invention further provides a device for verifying the location of a home base station, and the device is applied to a first node. Figure 8 The structure diagram of the home base station location verification device according to an embodiment of the present invention is as follows: Figure 2 ;like Figure 8 As shown, the device includes: a second communication unit 21, used to send first location information to a second node, so that the second node can perform location verification based on the first location information and pre-acquired first information, and the first information represents the contracted location of the first node.

[0173] In some optional embodiments of the present invention, the device also includes a second processing unit 22, which is used to perform identity authentication between the second communication unit 21 and the second node, and / or establish a secure tunnel with the second node before the second communication unit 21 sends the first location information to the second node.

[0174] In some optional embodiments of the present invention, the second communication unit 21 is further used to receive a first request sent by the second node to request the first location information of the first node before sending the first location information to the second node, wherein the first request includes the type of location information.

[0175] In some optional embodiments of the present invention, the second communication unit 21 is used to send a first message to the second node during identity authentication with the second node, where the first message includes the first location information and authentication information of the first node.

[0176] In some optional embodiments of the present invention, the first message includes a notification payload, the notification payload includes a message type field and a data field, the value of the message type field is used to indicate that the first message is used to transmit location information, and the data field carries the first location information.

[0177] In some optional embodiments of the present invention, the first location information includes at least one of the following information of the first node: an IP address, a first geographical location, and a first identifier of an associated macro base station.

[0178] In an embodiment of the present invention, the second processing unit 22 in the device can be implemented by a CPU, a DSP, an MCU or an FPGA in actual applications; the second communication unit 21 in the device can be implemented by a communication module (including: a basic communication kit, an operating system, a communication module, a standardized interface and protocol, etc.) and a transceiver antenna in actual applications.

[0179] It should be noted that: the home base station location verification device provided in the above embodiment only uses the division of the above program modules as an example when performing home base station location verification. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the home base station location verification device provided in the above embodiment and the home base station location verification method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0180] An embodiment of the present invention further provides a node, which may be the first node or the second node in the above embodiment. Fig. 9 FIG. 1 is a schematic diagram of the hardware structure of a node according to an embodiment of the present invention. Fig. 9 As shown, the node includes a memory 32, a processor 31, and a computer program stored in the memory 32 and executable on the processor 31. When the processor 31 executes the program, the steps of the method for verifying the location of a home base station applied to a first node or a second node according to an embodiment of the present invention are implemented.

[0181] Optionally, the node may further include at least one network interface 33. The various components in the node are coupled together via a bus system 34. It is understood that the bus system 34 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 34 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig. 9 Various buses are labeled as bus system 34 .

[0182] It can be understood that the memory 32 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memory 32 described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0183] The method disclosed in the above embodiment of the present invention can be applied to the processor 31, or implemented by the processor 31. The processor 31 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 31 or the instruction in the form of software. The above processor 31 can be a general-purpose processor, a DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 31 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present invention. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present invention, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 32. The processor 31 reads the information in the memory 32 and completes the steps of the above method in combination with its hardware.

[0184] In an exemplary embodiment, the node may be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), FPGA, general purpose processor, controller, MCU, microprocessor, or other electronic components to execute the aforementioned method.

[0185] In an exemplary embodiment, the present invention also provides a computer-readable storage medium, such as a memory 32 including a computer program, which can be executed by a processor 31 of a node to complete the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM; or it can be various devices including one or any combination of the above memories.

[0186] The computer-readable storage medium provided by the embodiment of the present invention stores a computer program, which, when executed by a processor, implements the steps of the method for verifying the location of a first node or a home base station of the first node applied by the embodiment of the present invention.

[0187] The embodiment of the present application further provides a computer program product, including a computer program, and the computer program can be executed by a node (such as the processor 31 of the node) to complete the steps of any of the above-mentioned methods for verifying the location of a home base station.

[0188] The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0189] The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0190] The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0191] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0192] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0193] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0194] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium, which, when executed, executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, disks or optical disks.

[0195] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0196] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for verifying the location of a home base station, characterized in that: The method is applied to the second node, and the method includes: Obtaining first location information of a first node; Based on the first location information and the pre-acquired first information, a location check is performed on the first node to obtain a location check result; the first information represents the contracted location of the first node.

2. The method according to claim 1, characterized in that The method further comprises: The second information is obtained by preconfiguration, where the second information includes the first information; or the second information sent by a third node is received, where the second information includes the first information.

3. The method according to claim 2, characterized in that The second information also includes a verification strategy, and the verification strategy includes at least one of the following: a request frequency for location information, a type of location information, and a location verification method.

4. The method according to any one of claims 1 to 3, characterized in that: Before obtaining the first location information of the first node, the method further includes: Perform identity authentication with the first node, and / or establish a secure tunnel with the first node.

5. The method according to claim 4, characterized in that Before obtaining the first location information of the first node, the method further includes: A first request is sent to the first node to request first location information of the first node, where the first request includes a type of location information.

6. The method according to any one of claims 1 to 3, characterized in that: The obtaining the first location information of the first node includes: During the authentication process with the first node, a first message sent by the first node is received, where the first message includes the first location information and authentication information of the first node.

7. The method according to claim 6, characterized in that The first message includes a notification payload, and the notification payload includes a message type field and a data field. The value of the message type field is used to indicate that the first message is used to transmit location information, and the data field carries the first location information.

8. The method according to any one of claims 1 to 3, characterized in that: The first location information includes at least one of the following information of the first node: an Internet Protocol IP address, a first geographical location, and a first identifier of an associated macro base station; And / or, the first information includes at least one of the following information of the first node: a second geographical location, a second identifier of an associated macro base station.

9. The method according to claim 8, characterized in that When the first location information is a first geographical location and the first information is a second geographical location, or when the first location information is a first identifier of an associated macro base station and the first information is a second identifier of an associated macro base station, performing a location check on the first node based on the first location information and the pre-configured first information to obtain a location check result includes: The first location information and the first information are compared, and after the comparison is consistent, it is determined that the location verification has passed.

10. The method according to claim 8, characterized in that In a case where the first location information is an IP address and the first information is a second geographical location, performing location verification on the first node based on the first location information and the preconfigured first information to obtain a location verification result includes: Querying the fourth node to obtain the geographical location corresponding to the IP address; The geographic location is compared with the first information, and after the comparison is consistent, it is determined that the location verification has passed.

11. A method for verifying the location of a home base station, characterized in that: The method is applied to a first node, and the method comprises: First location information is sent to a second node, so that the second node can perform location verification based on the first location information and pre-acquired first information, wherein the first information represents a contracted location of the first node.

12. The method according to claim 11, characterized in that Before sending the first location information to the second node, the method further includes: Perform identity authentication with the second node, and / or establish a secure tunnel with the second node.

13. The method according to claim 12, characterized in that Before sending the first location information to the second node, the method further includes: A first request sent by the second node is received to request first location information of the first node, where the first request includes a type of location information.

14. The method according to claim 11, characterized in that The sending the first location information to the second node includes: During identity authentication with the second node, a first message is sent to the second node, where the first message includes the first location information and authentication information of the first node.

15. The method according to claim 14, characterized in that The first message includes a notification payload, and the notification payload includes a message type field and a data field. The value of the message type field is used to indicate that the first message is used to transmit location information, and the data field carries the first location information.

16. The method according to claim 11, characterized in that The first location information includes at least one of the following information of the first node: An Internet Protocol IP address, a first geographic location, and a first identifier of an associated macro base station.

17. A home base station location verification device, characterized in that: The device is applied to a second node, and comprises: a first communication unit and a first processing unit; wherein, The first communication unit is used to obtain first location information of the first node; The first processing unit is used to perform a position verification on the first node based on the first position information and pre-acquired first information to obtain a position verification result; the first information represents the contracted position of the first node.

18. A home base station location verification device, characterized in that: The device is applied to a first node, and includes: a second communication unit, used to send first location information to a second node, so that the second node can perform location verification based on the first location information and pre-acquired first information, wherein the first information represents a contracted location of the first node.

19. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method described in any one of claims 1 to 10 are implemented; or, when the program is executed by a processor, the steps of the method described in any one of claims 11 to 16 are implemented.

20. A communication device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method described in any one of claims 1 to 10 are implemented; or, when the processor executes the program, the steps of the method described in any one of claims 11 to 16 are implemented.

21. A computer program product, characterized in that The method comprises computer program instructions, which enable a computer to execute the steps of the method according to any one of claims 1 to 10; or, the computer program instructions enable a computer to execute the steps of the method according to any one of claims 11 to 16.

Images