Base station activation method, communication apparatus, and storage medium

Abstract

The application provides a base station activation method, a communication device and a storage medium, and relates to the technical field of communication. The method comprises the following steps: when a base station starts base station activation, an access platform sends a first parameter to the base station; the first parameter comprises a first verification parameter and an authentication parameter; the access platform performs authentication and authentication operations based on the first parameter, and sends a second parameter to the base station; the second parameter comprises a second verification parameter, and the second parameter is used for base station registration; the access platform performs base station registration operations based on the second parameter through an Internet Protocol Security (IPsec) tunnel, and sends a third parameter to the base station; the third parameter comprises a third verification parameter and a cell configuration parameter, and the third parameter is used for base station activation; and the access platform performs base station activation operations based on the third parameter through the IPsec tunnel, so that the base station is activated in a core network device, and the security of the network is improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a base station activation method, communication device, and storage medium. Background Technology

[0002] With the shrinking coverage area of ​​5G high-frequency signals and the surge in indoor service demands, small cell base stations have become a core technology for solving network blind spots and capacity bottlenecks. When deploying small cell base stations, activation is required through an access platform to ensure they can connect to core network equipment.

[0003] In related technologies, small base stations are typically activated in the following ways: First, the small base station obtains the Internet Protocol (IP) address, authentication parameters, and signaling gateway IP address stored in its non-volatile memory. Then, the small base station performs authentication and authorization with the authentication, authorization, and accounting (AAA) server using the authentication parameters. After successful authentication and authorization and the establishment of an Internet Protocol Security (IPsec) tunnel, it registers with the OMC using the OMC IP address and obtains base station activation parameters. Finally, after base station registration, it activates the base station at the signaling gateway using the signaling gateway IP address and base station activation parameters to access the core network equipment.

[0004] However, the OMC IP address, authentication parameters, and signaling gateway IP address are sensitive information. If obtained by an attacker, this sensitive information can be used to attack the network. In the above method, the sensitive information is stored in the non-volatile memory of the small cell. Due to the complex deployment locations of small cells, attackers can easily obtain sensitive information, resulting in poor network security. Summary of the Invention

[0005] This application provides a base station activation method, communication device, and storage medium to address the problem that sensitive information stored in the non-volatile memory of small base stations is easily accessible to attackers due to the complex deployment locations of small base stations, resulting in poor network security, thereby improving network security.

[0006] In a first aspect, this application provides a base station activation method, the method comprising:

[0007] When the base station is activated, the access platform sends a first parameter to the base station; the first parameter includes a first verification parameter and an authentication parameter, and the first parameter is used for authentication and authorization.

[0008] The access platform performs authentication and authorization operations based on the first parameter and sends the second parameter to the base station; the second parameter includes a second verification parameter, which is used for base station registration.

[0009] The access platform performs base station registration operations through an Internet Protocol Security (IPsec) tunnel based on the second parameter and sends the third parameter to the base station. The IPsec tunnel is established by the access platform after authentication and authorization are successful. The third parameter includes a third verification parameter and a cell configuration parameter, and is used to activate the base station.

[0010] The access platform performs base station activation operations through an IPsec tunnel based on a third parameter, enabling the base station to be activated in the core network equipment.

[0011] Secondly, this application provides a base station activation method, the method comprising:

[0012] When the base station starts base station activation, the base station receives the first parameter sent by the access platform; the first parameter includes the first verification parameter and the authentication parameter, and the first parameter is used for authentication and authorization.

[0013] The base station performs authentication and authorization operations based on the first parameter and receives the second parameter sent by the access platform; the second parameter includes a second verification parameter, which is used for base station registration;

[0014] The base station performs base station registration operations through an IPsec tunnel based on the second parameter and receives the third parameter sent by the access platform; wherein, the IPsec tunnel is established by the access platform after authentication and authorization are passed; the third parameter includes a third verification parameter and a cell configuration parameter, and the third parameter is used to activate the base station;

[0015] The base station performs base station activation operations through an IPsec tunnel based on a third parameter, thereby enabling the base station to be activated in the core network equipment.

[0016] Using the base station activation method provided in the first or second aspect, when the base station initiates base station activation, the access platform sends a first parameter to the base station. The first parameter includes a first verification parameter and an authentication parameter. The first parameter is used for authentication and authorization, allowing the access platform to verify the base station's identity before initiating authentication and authorization. If the base station is secure, authentication and authorization are then performed. The access platform performs authentication and authorization operations based on the first parameter and sends a second parameter to the base station. The second parameter includes a second verification parameter, used for base station registration. Before registering the base station, the access platform can verify the base station's identity. If the base station initiating the registration request is secure, base station registration is then performed. The access platform performs base station registration operations through an IPsec tunnel based on the second parameter and sends a third parameter to the base station. The third parameter includes a third verification parameter and cell configuration parameters. The third parameter is used for base station activation, allowing the access platform to verify the base station's identity before activation. If the base station initiating the activation request is secure, base station activation is then performed. The access platform performs base station activation operations through an IPsec tunnel based on the third parameter, enabling base station activation at the core network equipment. Based on this, by introducing a verification parameter mechanism, the security of the base station is confirmed through verification parameters before authentication and authorization, base station registration, and base station activation. This ensures that the corresponding operations are performed only when the base station is secure, preventing attackers from impersonating the base station to attack the network and improving network security. Furthermore, the access platform does not pre-store cell configuration parameters and authentication parameters in the base station's non-volatile memory to increase the difficulty for attackers to obtain sensitive information. Instead, it sends the cell configuration parameters and authentication parameters to the base station only after confirming its security, thereby further enhancing network security.

[0017] Thirdly, this application provides a communication device, comprising: a module for performing a method in any of the possible designs of the first to second aspects described above.

[0018] Fourthly, this application provides a communication system, comprising:

[0019] A base station and an access platform for performing the methods described in the first aspect and any possible design of the first aspect; an access platform and a base station for performing the methods described in the second aspect and any possible design of the second aspect.

[0020] Fifthly, this application provides a communication device including a processor. The processor is configured to invoke a stored computer program or computer instructions, causing the processor to implement any possible design method of any one of the first or second aspects.

[0021] Optionally, the communication device may also include a transceiver, and the processor is used to control the transceiver to send and receive signals.

[0022] Sixthly, this application provides a communication device including at least one memory and at least one processor. The memory is used to store computer-executable programs or instructions; the processor is used to invoke the computer-executable programs or instructions in the memory, causing the communication device to execute any possible design method of any one of the first to second aspects.

[0023] Alternatively, the processor may be coupled to the memory via an interface.

[0024] In a seventh aspect, this application provides a computer-readable storage medium having a computer-executable program or instructions stored thereon, wherein the computer-executable program or instructions, when executed by a processor, cause a communication device to implement any possible design method of any one of the first to second aspects.

[0025] Eighthly, this application provides a chip, including: an interface circuit and a logic circuit, wherein the interface circuit is used to receive signals from other chips outside the chip and transmit them to the logic circuit, or to send signals from the logic circuit to other chips outside the chip, and the logic circuit is used to implement any possible design method in any one of the first to second aspects.

[0026] Ninthly, this application provides a computer program product comprising: execution instructions stored in a readable storage medium, at least one processor of a communication device being able to read the execution instructions from the readable storage medium, and the at least one processor executing the execution instructions causing the communication device to implement any possible design method of any one of the first to second aspects. Attached Figure Description

[0027] Figure 1 This is a signaling interaction diagram of a conventional base station activation method provided in an embodiment of this application.

[0028] Figure 2 This is a schematic diagram of the structure of a communication system provided in an embodiment of this application.

[0029] Figure 3 This is a schematic diagram of the structure of a communication system provided in an embodiment of this application.

[0030] Figure 4 This is a signaling interaction diagram of a base station activation method provided in an embodiment of this application.

[0031] Figure 5This is a signaling interaction diagram of a method for sending a first parameter according to an embodiment of this application.

[0032] Figure 6 This is a signaling interaction diagram of a method for performing authentication and authorization operations and sending a second parameter, provided as an embodiment of this application.

[0033] Figure 7 This is a signaling interaction diagram of a method for performing base station registration operations and sending third parameters, provided in an embodiment of this application.

[0034] Figure 8 This is a signaling interaction diagram of a method for performing a base station activation operation according to an embodiment of this application.

[0035] Figure 9 This is a signaling interaction diagram of a method for updating verification parameters provided in an embodiment of this application.

[0036] Figure 10 This is a signaling interaction diagram of a method for updating verification parameters provided in an embodiment of this application.

[0037] Figure 11 This is a schematic diagram of the structure of a communication device provided in an embodiment of this application.

[0038] Figure 12 This is a schematic diagram of the hardware structure of a communication device provided in an embodiment of this application. Detailed Implementation

[0039] In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c alone can mean: a alone, b alone, c alone, a combination of a and b, a combination of a and c, a combination of b and c, or a, b, and c, where a, b, and c can be single or multiple. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0040] The terms “center,” “longitudinal,” “lateral,” “up,” “down,” “left,” “right,” “front,” and “rear,” etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0041] The terms "connected" and "connected" should be interpreted broadly. For example, in circuit structures, "connected" or "connected" can refer not only to physical connections but also to electrical or signal connections. This could be a direct connection (physical connection) or an indirect connection via at least one intermediate component, as long as the circuit is connected. It could also refer to the internal connection between two components. Similarly, a signal connection can refer to a connection via a circuit or a medium, such as radio waves. Those skilled in the art will understand the specific meaning of these terms in this application based on the specific circumstances.

[0042] In related technologies, such as Figure 1 As shown, the method for activating a base station includes the following steps:

[0043] S1. The base station obtains the OMC IP address, signaling gateway IP address, and authentication parameters.

[0044] Before activating a base station, the following parameters need to be configured in the base station's non-volatile memory: OMC IP address, signaling gateway IP address, and authentication parameters, so that IPsec tunnels can be established, base station registered, and base station activated based on these parameters.

[0045] The base station obtains the OMC IP address, signaling gateway IP address, and authentication parameters from non-volatile memory.

[0046] S2. The base station performs authentication and authorization on the AAA server through the security gateway based on the authentication parameters.

[0047] S3. The base station and the security gateway establish an IPsec tunnel.

[0048] S4. After authentication and authorization are successful and an IPsec tunnel is established, the base station registers with the OMC through the security gateway based on the OMC IP address and obtains the base station activation parameters.

[0049] S5. After the base station registration is completed, the base station activates itself through the security gateway via the signaling gateway based on the signaling gateway IP address and base station activation parameters, so that the base station can complete the base station activation in the core network equipment.

[0050] However, the OMC IP address, authentication parameters, and signaling gateway IP address are sensitive information. If obtained by an attacker, they can use this sensitive information to simulate an IPSec client, establish an IPSec tunnel with the security gateway, and then use this established IPSec tunnel to attack the signaling gateway and OMC. If the signaling gateway is compromised, the attacker can damage it, causing the base station's services to stop, or use the signaling gateway as a springboard to attack core network equipment. If the OMC is compromised, the attacker will gain management and control privileges over the OMC, remotely modify the base station's configuration, causing abnormal base station services, and may also extract the base station's communication data, resulting in users' calls being eavesdropped on.

[0051] In the above method, sensitive information is stored in the non-volatile memory of the small base station. Due to the complex deployment location of the small base station, attackers can easily obtain sensitive information, resulting in poor network security.

[0052] Furthermore, before the aforementioned sensitive information is configured in the base station's non-volatile memory, the sensitive information is transmitted by the administrator via email or paper, which can easily lead to leakage during the transmission process, making it easy for attackers to obtain the sensitive information and resulting in poor network security.

[0053] For example, this application provides a base station activation method, a communication system, a communication device, a computer-readable storage medium, and a chip. By introducing a verification code mechanism when the base station initiates base station activation, the security of the base station is verified before authentication and authorization, IPsec tunnel establishment, base station registration, and base station activation. Only when the base station is secure are the corresponding operations performed, thereby improving network security. Furthermore, sensitive information is transmitted interactively between the access platform and the base station, eliminating the need for persistent storage of sensitive information by the base station. This transforms statically stored sensitive information into dynamically transmitted information during interaction, increasing the difficulty for attackers to crack the sensitive information and thus improving network security.

[0054] Please see Figure 2 , Figure 2 This is a schematic diagram of a communication system provided in one embodiment of this application. Figure 2 As shown, the communication system may include: a base station 11 and an access platform 12.

[0055] Among them, base station 11 can be a micro cell, pico cell, or femtocell. A micro cell is a small base station with a small coverage area, typically used for indoor or small area coverage. A pico cell has a slightly larger coverage area than a micro cell and is suitable for medium-sized areas, such as small offices or shopping malls. A femtocell is mainly used in homes or small businesses, with a very small coverage area, typically within tens of meters.

[0056] Base station 11 can also be an access point, an access network device, or a device in the access network that communicates with a wireless terminal via one or more sectors on the air interface. Base station 11 can be used to convert received air frames to and from IP packets, and acts as a router between the wireless terminal and the rest of the access network, which may include an Internet Protocol (IP) network. Base station 11 can also coordinate the attribute management of the air interface. For example, base station 11 can be a backpack base station, a satellite, a drone, a base transceiver station (BTS) in Global System for Mobile Communication (GSM) or Code Division Multiple Access (CDMA), a base station (NodeB, NB) in Wideband Code Division Multiple Access (WCDMA), an evolved Node B (eNB or eNodeB) in Long Term Evolution (LTE), or a terminal, relay station, or access point that performs base station functions in V2X (vehicular to everything), Device-to-Device (D2D), and Machine-to-Machine (M2M) communications, or a base station in a 5G mobile communication system, such as a gNB, or a base station in a 6G mobile communication system, without limitation.

[0057] The access platform 12 is used to provide services such as base station registration and base station activation for the base station 11.

[0058] Among them, such as Figure 2 As shown, the communication system provided in this application may further include core network equipment 13.

[0059] The core network equipment 13 can be, for example, equipment in the core network (CN) of an existing mobile communication architecture or equipment in the core network of a future mobile communication architecture. The core network, as a bearer network, provides an interface to the data network, offering terminal devices communication connections, authentication, management, policy control, and the ability to carry data services. The CN can further include: a mobility management entity (MME), a serving gateway (SGW), a packet data network gateway (PGW), a home subscriber server (HSS), an access and mobility management function (AMF), a session management function (SMF), an authentication server function (AUSF), a policy control function (PCF), and a user plane function (UPF), among other network elements.

[0060] Based on the above exemplary description, the structure of the access platform 12 can be as follows: Figure 3 As shown. Please refer to [the original text]. Figure 3 , Figure 3 This is a schematic diagram of a communication system provided in one embodiment of this application. Figure 3 As shown, the access platform 12 includes the following network elements: initialization server 121, security gateway 122, AAA server 123, signaling gateway 124, and OMC 125.

[0061] Among them, the initialization server 121, security gateway 122, AAA server 123, signaling gateway 124 and OMC 125 are all connected to each other.

[0062] The initialization server 121 provides services to the base station 11 when it initially accesses the access platform 12. The security gateway 122 enables communication and data exchange between the base station 11 and other network elements in the access platform 12. The AAA server 123 performs authentication and authorization. The signaling gateway 124 activates the base station between the base station 11 and the core network equipment 13. The OMC 125 enables base station registration.

[0063] Based on the foregoing description, the following embodiments of this application will be based on having Figure 3 Taking the communication system with the structure shown as an example, the base station activation method provided in this application will be described in detail.

[0064] Please see Figure 4 , Figure 4 This is a signaling interaction diagram of a base station activation method provided in one embodiment of this application. Figure 4 As shown, the base station activation method of this application may include:

[0065] S101. When the base station is activated, the access platform sends the first parameter to the base station.

[0066] Correspondingly, when the base station is activated, it receives the first parameter sent by the access platform.

[0067] During initial deployment, base stations need to be activated to enable them to provide services to terminal devices. When activating a base station, it provides parameters such as its device identifier to the access platform, allowing the platform to assign initial parameters.

[0068] The first parameter includes a first verification parameter and an authentication parameter. The first parameter is used for authentication and authentication.

[0069] The first verification parameter is a parameter generated by the access platform and assigned to the base station to verify the security of the base station before authentication and authorization, so that the access platform can determine whether the base station is secure, thereby helping to improve network security.

[0070] The first verification parameter may include a verification code. The verification code can be, for example, a numeric verification code, an alphanumeric verification code, or a mixed alphanumeric verification code. The access platform can generate the first verification parameter using a random number generation algorithm or a time-based one-time password algorithm (TOTP) to improve its security.

[0071] The access platform informs the base station of the first verification parameters, which the base station then sends back to the access platform during authentication and authorization. The access platform can determine the identity of the base station based on the first verification parameters, thereby improving network security.

[0072] Among them, authentication parameters are used by the access platform to verify the legitimacy of the base station. Authentication parameters may include the International Mobile Subscriber Identity (IMSI), authentication key Ki, and OPC, etc.

[0073] The access platform does not pre-store authentication parameters in the base station's non-volatile memory, making it more difficult for attackers to obtain sensitive information. Instead, it sends the authentication parameters to the base station when the base station is activated, thereby improving network security.

[0074] Based on this, when the base station is activated, the access platform sends the first parameter to the base station. After receiving the first parameter, the base station can make authentication and authorization requests based on the first parameter, and the access platform can perform authentication and authorization operations according to the first parameter.

[0075] S102. The access platform performs authentication and authorization operations based on the first parameter.

[0076] Correspondingly, the base station performs authentication and authorization operations based on the first parameter.

[0077] The authentication and authorization process consists of two parts: security verification and authentication and authorization.

[0078] Among them, security verification refers to the process by which the access platform verifies the identity of the base station before authentication and authorization, thereby determining whether the base station is allowed to perform authentication and authorization.

[0079] Specifically, when a base station decides to perform authentication and authorization operations, it sends an authentication and authorization request to the access platform and sends the first parameter to the access platform. The access platform can determine whether to allow the base station to perform authentication and authorization based on the first verification parameter.

[0080] Below, we introduce a method for determining whether a base station is allowed to perform authentication and authorization based on a first verification parameter.

[0081] Specifically, the access platform can determine whether the first verification parameter is valid. If the first verification parameter is valid, the access platform determines that the base station is allowed to perform authentication and authorization. If the first verification parameter is invalid, the access platform determines that the base station is not allowed to perform authentication and authorization.

[0082] The access platform can determine whether the first verification parameter is valid or invalid in multiple ways.

[0083] As a feasible implementation, when the access platform sends the first verification parameter to the base station, the first verification parameter may include not only a verification code but also a validity period, which indicates the time during which the first verification parameter is valid. Based on this, after receiving the first verification parameter sent by the base station, the access platform can determine whether the first verification parameter was received within the time indicated by the validity period. If the access platform receives the first verification parameter within the time indicated by the validity period, the access platform determines that the first verification parameter is valid; if the access platform receives the first verification parameter outside the time indicated by the validity period, the access platform determines that the first verification parameter is invalid.

[0084] As another feasible implementation, the access platform can determine whether the first verification parameter received from the base station is consistent with the first verification parameter sent to the base station. If the first verification parameter received from the base station is inconsistent with the first verification parameter sent to the base station, the access platform determines that the first verification parameter is invalid. If the first verification parameter received from the base station is consistent with the first verification parameter sent to the base station, the access platform determines that the first verification parameter is valid.

[0085] Based on this, before performing authentication and authorization, the access platform can verify the identity of the base station through the first verification parameter. Only after confirming that the base station initiating the authentication and authorization request is secure can authentication and authorization be performed, thus preventing attackers from impersonating base stations to attack the network and improving network security.

[0086] Among them, authentication and authorization refer to the access platform's identification of the base station and the allocation of operation permissions.

[0087] Specifically, the access platform authenticates and authorizes the base station based on the authentication parameters, and returns the authentication and authorization results to the base station so that the base station can know the results and register the base station.

[0088] The authentication and authorization results include: successful authentication and authorization, and unsuccessful authentication and authorization. Successful authentication and authorization indicates that the access platform has determined the base station's identity is secure, completed authentication and authorization, and allows the base station to initiate a base station registration request; in other words, the access platform can receive the base station registration request sent by the base station. Unsuccessful authentication and authorization indicates that the access platform has determined the base station's identity is insecure, and does not allow the base station to register; in other words, the access platform does not receive the base station registration request sent by the base station.

[0089] After authentication and authorization are successful, the access platform can establish an IPSec tunnel between the base station and the access platform. An IPSec tunnel is a virtual communication channel built on the IPSec protocol, used to achieve secure data transmission in insecure public networks. In subsequent processes, the base station can utilize the IPSec tunnel for services such as base station registration and activation.

[0090] When authentication and authorization are deemed unacceptable, or when authentication and authorization fail, the access platform can temporarily or permanently refuse the base station's next authentication and authorization request by means of freezing or blacklisting, thereby preventing attackers from repeatedly attacking the network and causing network congestion. Freezing refers to refusing any interaction with the base station for a certain period, while blacklisting refers to permanently refusing any interaction with the base station.

[0091] Based on this, the base station and the access platform perform authentication and authorization operations based on the first parameter. The access platform performs authentication and authorization if it determines that authentication and authorization are allowed.

[0092] S103, The access platform sends the second parameter to the base station.

[0093] Correspondingly, the base station receives the second parameter sent by the access platform.

[0094] After authentication and authorization are successful, the access platform needs to generate a second parameter for base station registration and send the second parameter to the base station so that the base station can register.

[0095] The second parameter includes the second verification parameter.

[0096] The second verification parameter is a parameter generated by the access platform and assigned to the base station to verify the security of the base station before base station registration, so that the access platform can determine whether the base station is secure, thereby helping to improve network security.

[0097] The second verification parameter may include a verification code. The verification code can be, for example, a numeric verification code, an alphanumeric verification code, or a mixed alphanumeric verification code. The access platform can generate the second verification parameter using a random number generation algorithm or TOTP (Transfer to Protocol Validation), thereby improving the security of the second verification parameter.

[0098] The access platform informs the base station of the second verification parameters, which the base station then sends to the access platform during base station registration. The access platform can determine the identity of the base station based on the second verification parameters, thereby improving network security.

[0099] The access platform can send the second parameter to the base station in various ways.

[0100] As a feasible approach, the access platform performs authentication and authorization operations. After successful authentication and authorization, the access platform sends a message indicating successful authentication and authorization to the base station. The access platform can include a second parameter in this message, thereby saving signaling resources.

[0101] As another feasible implementation, the access platform performs authentication and authorization operations, and after the authentication and authorization are successful, the access platform sends the second parameter to the base station separately.

[0102] Based on this, after authentication and authorization are successful, the access platform sends a second parameter to the base station. Once the base station receives the second parameter, it can initiate a base station registration request based on the second parameter, and the access platform can perform the base station registration operation according to the second parameter.

[0103] S104. The access platform performs base station registration operations through an IPsec tunnel based on the second parameter.

[0104] Correspondingly, the base station performs base station registration operations through the IPsec tunnel based on the second parameter.

[0105] The base station registration process consists of two parts: security verification and base station registration.

[0106] Security verification refers to the process by which the access platform verifies the identity of a base station before it registers, thereby determining whether or not the base station is allowed to register.

[0107] Specifically, when a base station decides to perform a base station registration operation, it sends a base station registration request to the access platform through an IPsec tunnel and sends a second parameter to the access platform. The access platform can then determine whether to allow the base station to register using the second verification parameter.

[0108] The specific method for determining whether a base station is allowed to register using the second verification parameter is similar to the method for determining whether a base station is allowed to perform authentication and authorization using the first verification parameter. Please refer to the description related to the first verification parameter in S102, which will not be repeated here.

[0109] Therefore, before registering a base station, the access platform can verify the identity of the base station through a second verification parameter. Only when the base station that initiated the registration request is confirmed to be secure will the base station registration be carried out, thus preventing attackers from impersonating base stations to attack the network and thereby improving network security.

[0110] Among them, base station registration refers to the access platform configuring parameters and allocating logical resources for base stations to ensure that base stations can be activated on the access platform and that core network equipment can improve services for base stations.

[0111] Specifically, after determining that the base station is allowed to register, the access platform registers the base station and returns the registration result to the base station through the IPsec tunnel so that the base station can know the result and activate the base station.

[0112] The results of base station registration include: base station registration completed and base station registration unsuccessful. Base station registration completed means that the access platform has determined the base station's identity is secure and has completed registration, and allows the base station to initiate a base station activation request; or, the access platform can receive the base station's activation request. Base station registration unsuccessful means that the access platform has determined the base station's identity is insecure and does not allow the base station to initiate a base station activation request; or, other problems occurred during the base station registration process, causing registration failure.

[0113] When a base station is determined not to register, or when registration fails, the access platform can temporarily or permanently reject subsequent registration requests from the base station by freezing or blacklisting it, thereby preventing repeated attacks and network congestion. Furthermore, the access platform can also release the IPsec tunnel to disconnect the communication channel between the base station and the access platform, further ensuring network security.

[0114] Based on this, the base station and the access platform perform a base station registration operation based on the second parameter. If the access platform determines that base station registration is allowed, it will proceed with the base station registration.

[0115] S105, The access platform sends the third parameter to the base station.

[0116] Correspondingly, the base station receives the third parameter sent by the access platform.

[0117] After the base station registration is completed, the access platform needs to generate a third parameter for base station activation and send the third parameter to the base station so that the base station can activate the base station.

[0118] The third parameter includes the third verification parameter and the cell configuration parameter.

[0119] The third verification parameter is a parameter generated by the access platform and assigned to the base station to verify the security of the base station before base station activation, so that the access platform can determine whether the base station is secure, thereby helping to improve network security.

[0120] The third verification parameter may include a verification code. The verification code can be, for example, a numeric verification code, an alphanumeric verification code, or a mixed alphanumeric verification code. The access platform can generate the third verification parameter using a random number generation algorithm or TOTP (Transfer to Protocol Validation), thereby improving the security of the third verification parameter.

[0121] The access platform informs the base station of the third verification parameters, which the base station then sends to the access platform during base station activation. The access platform can determine the identity of the base station based on the third verification parameters, thereby improving network security.

[0122] Cell configuration parameters are used by the access platform for base station activation. These parameters may include the Evolved Universal Terrestrial Radio Access Network (EUTRAN) cell identifier (ECI), physical cell identifier (PCI), and tracking area code (TAC). The ECI is a code used to identify the cell and is used by core network equipment for accurate cell location. The PCI is the physical layer identifier used to distinguish neighboring cells. The TAC is used to delineate the tracking area.

[0123] The access platform can send third parameters to the base station in various ways.

[0124] As a feasible approach, the access platform performs base station registration. After the base station registration is successful, the access platform sends a base station registration completion message to the base station. The access platform can include a third parameter in the base station registration completion message, thereby saving signaling resources.

[0125] As another feasible implementation, the access platform performs the base station registration operation, and after the base station registration is successful, the access platform sends a third parameter to the base station separately.

[0126] The access platform does not pre-store cell configuration parameters in the base station's non-volatile memory, making it more difficult for attackers to obtain sensitive information. Instead, it sends the cell configuration parameters to the base station after the base station registration is completed, thereby improving network security.

[0127] Based on this, after the access platform successfully registers with the base station, it sends a third parameter to the base station. Once the base station receives the third parameter, it can send a request to activate the base station based on the third parameter. The access platform can then perform the base station activation operation according to the third parameter.

[0128] S106. The access platform performs base station activation operations through an IPsec tunnel based on a third parameter, so that the base station can be activated in the core network equipment.

[0129] Correspondingly, the base station performs base station activation operations through an IPsec tunnel based on a third parameter, so that the base station can be activated in the core network equipment.

[0130] The base station activation process consists of two parts: security verification and base station activation.

[0131] Among them, security verification refers to the process by which the access platform verifies the identity of the base station before it is activated, thereby determining whether the base station is allowed to activate.

[0132] Specifically, when a base station decides to perform a base station activation operation, it sends a base station activation request to the access platform through an IPsec tunnel and sends a third parameter to the access platform. The access platform can then determine whether to allow the base station to perform base station activation based on the third verification parameter.

[0133] The specific method for determining whether to allow a base station to activate itself using the third verification parameter is similar to the method for determining whether to allow a base station to perform authentication and authorization using the first verification parameter. Please refer to the description related to the first verification parameter in S102, which will not be repeated here.

[0134] Based on this, before activating a base station, the access platform can verify the identity of the base station through a third verification parameter. Only after confirming that the base station initiating the activation request is secure can the base station be activated, thus preventing attackers from impersonating base stations to attack the network and improving network security.

[0135] Base station activation refers to the operation of connecting the base station to the core network equipment through the access platform, ensuring that the base station is activated in the core network equipment, thereby enabling the core network equipment to provide services to the base station.

[0136] Specifically, after determining that the base station is allowed to activate, the access platform interacts with the core network equipment according to the cell configuration parameters to activate the base station, and returns the activation result to the base station through the IPsec tunnel so that the base station can know the result.

[0137] The results of base station activation include: successful activation and unsuccessful activation. Successful activation indicates that the access platform has determined the base station's identity is secure and activation has been completed. Unsuccessful activation indicates that the access platform has determined the base station's identity is insecure and will not allow activation, or that other problems occurred during the activation process, causing activation to fail.

[0138] When it is determined that base station activation is not permitted, or when base station activation fails, the access platform can temporarily or permanently reject the base station's next activation request by freezing or blacklisting it, thereby preventing repeated attacks on the network and causing network congestion. Furthermore, the access platform can also disconnect the communication channel between the base station and the access platform by releasing the IPsec tunnel, further ensuring network security.

[0139] Based on this, the base station and the access platform perform a base station activation operation based on a third parameter. If the access platform determines that base station activation is allowed, it activates the base station so that the core network equipment can provide services to the base station.

[0140] In this embodiment, when the base station initiates base station activation, the access platform sends a first parameter to the base station. The first parameter includes a first verification parameter and an authentication parameter. The first parameter is used for authentication and authorization, allowing the access platform to verify the base station's identity before initiating authentication and authorization. If the base station is secure, authentication and authorization are then performed. The access platform performs authentication and authorization operations based on the first parameter and sends a second parameter to the base station. The second parameter includes a second verification parameter, used for base station registration. Before registering the base station, the access platform can verify the base station's identity. If the base station initiating the registration request is secure, base station registration is then performed. The access platform performs base station registration operations through an IPsec tunnel based on the second parameter and sends a third parameter to the base station. The third parameter includes a third verification parameter and cell configuration parameters. The third parameter is used for base station activation, allowing the access platform to verify the base station's identity before activation. If the base station initiating the activation request is secure, base station activation is then performed. The access platform performs base station activation operations through an IPsec tunnel based on the third parameter, enabling base station activation at the core network equipment. Based on this, by introducing a verification parameter mechanism, the security of the base station is confirmed through verification parameters before authentication and authorization, base station registration, and base station activation. This ensures that the corresponding operations are performed only when the base station is secure, preventing attackers from impersonating the base station to attack the network and improving network security. Furthermore, the access platform does not pre-store cell configuration parameters and authentication parameters in the base station's non-volatile memory to increase the difficulty for attackers to obtain sensitive information. Instead, it sends the cell configuration parameters and authentication parameters to the base station only after confirming its security, thereby further enhancing network security.

[0141] Based on the above exemplary description, the access platform may include the following network elements: an initialization server, a security gateway, an AAA server, a signaling gateway, and an OMC. When the base station is activated, the access platform can do so through the following... Figure 5 The first parameter is sent to the base station in the manner shown.

[0142] Please see Figure 5 , Figure 5 This application provides a signaling interaction diagram for a method of sending a first parameter according to an embodiment of the present application. For the sake of simplicity, Figure 5Other network elements besides the initialization server, security gateway, and AAA server are not shown. Figure 5 As shown, the method includes:

[0143] S201, The base station sends the first information to the initialization server.

[0144] Correspondingly, the initialization server receives the first information sent by the base station.

[0145] The first information is used to request the first parameter, and the first information carries the equipment identifier of the base station.

[0146] The base station sends the first information to the initialization server, so that the initialization server knows that the first parameter needs to be allocated to the base station, and knows which base station needs to be allocated the first parameter based on the device identifier.

[0147] S202. The access platform generates authentication parameters and first verification parameters based on the device identifier.

[0148] Specifically, the access platform can generate authentication parameters and first verification parameters in two ways: Method 1: S2021 to S2022 and Method 2: S2023 to S2024.

[0149] S2021. Initialize the server to generate authentication parameters based on the device identifier.

[0150] S2022, The security gateway generates the first verification parameter based on the device identifier obtained from the initialization server and sends it to the initialization server.

[0151] After receiving the first information, the initialization server generates a set of authentication parameters for the base station indicated by the device identifier carried in the first information, and sends the device identifier to the security gateway. The security gateway generates the first verification parameters for the base station indicated by the device identifier and then sends them to the initialization server.

[0152] Furthermore, after generating the authentication parameters, the initialization server can send them to the AAA server so that the AAA server can perform authentication and authorization based on the authentication parameters during the authentication and authorization process. Of course, the AAA server can also generate authentication parameters itself based on the device identifier obtained from the initialization server; this application does not impose any restrictions on this.

[0153] There is no specific order for S2021 and S2022. S2021 can be executed first and then S2022, or S2022 can be executed first and then S2021. Of course, S2021 and S2022 can also be executed simultaneously. This application does not impose any restrictions on this.

[0154] S2023, the AAA server generates authentication parameters based on the device identifier obtained from the initialization server and sends them to the initialization server.

[0155] S2024. The security gateway generates the first verification parameter based on the device identifier obtained from the initialization server and sends it to the initialization server.

[0156] After receiving the first information, the initialization server sends the device identifier to the AAA server and the security gateway respectively. The AAA server generates a set of authentication parameters for the base station indicated by the device identifier based on the device identifier and sends it to the initialization server. The security gateway generates the first verification parameters for the base station indicated by the device identifier based on the device identifier and sends it to the initialization server.

[0157] There is no specific order for S2023 and S2024. S2023 can be executed first and then S2024, or S2024 can be executed first and then S2023. Of course, S2023 and S2024 can also be executed simultaneously. This application does not impose any restrictions on this.

[0158] Based on this, the server is initialized to obtain authentication parameters and first verification parameters.

[0159] S203. If it is determined that the allocation of the first parameter to the base station is allowed, the initialization server sends the first parameter to the base station.

[0160] Correspondingly, the base station receives the first parameter sent by the initialization server when it determines that it is permissible to allocate the first parameter to the base station.

[0161] Specifically, the initialization server determines whether to allow the allocation of the first parameter to the base station. After receiving the first information, the initialization server can determine whether the device identifier is correct. If the device identifier is correct, the initialization server determines that the allocation of the first parameter to the base station is allowed.

[0162] For example, the device identifier carried in the first information is compared with the device identifiers in the device identifier set pre-stored in the access platform. If a device identifier identical to the one carried in the first information exists in the device identifier set, the initialization server determines that the device identifier is correct and allows the allocation of the first parameter to the base station. If no device identifier identical to the one carried in the first information exists in the device identifier set, the initialization server determines that the device identifier is incorrect and does not allow the allocation of the first parameter to the base station.

[0163] It should be noted that the initialization server can immediately determine whether to allow the allocation of the first parameter to the base station upon receiving the first information, and then proceed with the process of generating authentication parameters and the first verification parameters, thereby saving network resources. Alternatively, it can determine whether to allow the allocation of the first parameter to the base station after generating the authentication parameters and the first verification parameters; this application does not impose any restrictions on this.

[0164] If it is determined that the allocation of the first parameter to the base station is permitted, the initialization server sends the first parameter to the base station, so that the base station can perform authentication and authorization based on the first parameter.

[0165] If it is determined that allocating the first parameter to the base station is not allowed, the initialization server rejects the base station's request to allocate the first parameter. The initialization server can use methods such as freezing or blacklisting to temporarily or permanently reject the base station's next request to allocate the first parameter, thereby preventing attackers from repeatedly attacking the network and causing network congestion.

[0166] Therefore, the access platform generates authentication parameters only when the base station requests the allocation of the first parameter, and does not pre-store the authentication parameters in the base station's non-volatile memory. This increases the difficulty for attackers to obtain sensitive information and improves network security. Furthermore, a first verification parameter is generated simultaneously. Based on this first verification parameter, the access platform can confirm the base station's security before performing authentication and authorization, further enhancing network security.

[0167] Based on the above exemplary description, the access platform can be accessed through the following means: Figure 6 As shown, authentication and authorization operations are performed based on the first parameter, and the second parameter is sent to the base station.

[0168] Please see Figure 6 , Figure 6 This application provides a signaling interaction diagram for a method of performing authentication and authorization operations and sending a second parameter, as shown in an embodiment of the present application. For the sake of simplicity, Figure 6 Other network elements besides the security gateway and AAA server are not shown.

[0169] like Figure 6 As shown, the method includes:

[0170] S301, The base station sends the second information to the security gateway.

[0171] Correspondingly, the security gateway receives the second information sent by the base station.

[0172] The second information is used to request authentication and authorization, and carries the device identifier, the first verification parameter, and authentication data.

[0173] Among them, the device identifier is used by the network elements in the access platform to identify the identity of the base station, ensuring that the access platform knows which base station needs to be authenticated and authorized.

[0174] The first verification parameter is used by the security gateway to determine the security of the base station. Authentication and authorization are then performed only when the base station is secure, thereby improving network security.

[0175] The authentication data is calculated by the base station based on the authentication parameters. After receiving the authentication parameters sent by the initialization server, the base station can calculate the authentication data based on the authentication parameters, so that the access platform can perform authentication and authorization based on the authentication data.

[0176] The second piece of information is sent by the base station based on the IP address of the security gateway. The base station can obtain the IP address of the security gateway in various ways.

[0177] As a feasible implementation, the initialization server can send the IP address of the security gateway to the base station before the base station performs authentication and authorization operations. For example, the initialization server can send the IP address of the security gateway to the base station when sending the first parameter. This eliminates the need to pre-store the IP address of the security gateway in the base station's non-volatile memory, increasing the difficulty for attackers to obtain the IP address of the security gateway and improving network security.

[0178] As another feasible approach, the IP address of the security network can be pre-configured in the base station before it is activated.

[0179] S302. The security gateway determines whether to allow the base station to perform authentication and authorization based on the first verification parameter and the device identifier.

[0180] When it is determined that the base station is allowed to perform authentication and authorization, the security gateway executes S303. When it is determined that the base station is not allowed to perform authentication and authorization, the security gateway executes S308.

[0181] Specifically, the security gateway can determine whether the first verification parameter is valid and whether the base station is online based on the device identifier. If the first verification parameter is valid and the base station is offline, the security gateway determines that the base station is allowed to perform authentication and authorization. If the first verification parameter is invalid and / or the base station is online, the security gateway determines that the base station is not allowed to perform authentication and authorization.

[0182] The security gateway can query the status of the base station indicated by the device identifier based on the device identifier. If the base station indicated by the device identifier is found to be online, the security gateway determines that the base station indicated by the device identifier is online. At this time, the base station initiating the authentication and authorization request may be a fake base station, and the security gateway will not allow authentication and authorization to be performed, thereby improving network security. Otherwise, the security gateway determines that the base station is offline.

[0183] The security gateway can determine whether the first verification parameter is valid or invalid in multiple ways.

[0184] As a feasible implementation, the first verification parameter includes a first verification code and its validity period. The validity period of the first verification code indicates the time during which the first verification code is valid. After receiving the first verification parameter sent by the base station, the security gateway can determine whether the first verification parameter was received within the time indicated by the validity period based on the validity period of the first verification code. If the first verification parameter was received within the time indicated by the validity period, it means that the base station initiated the authentication and authorization request immediately or within a short interval after receiving the first parameter. Attackers would find it difficult to crack the first parameter within this timeframe; therefore, the security gateway can consider the base station secure.

[0185] The validity period of the first verification code can be set to 1 minute.

[0186] Based on this, if the security gateway receives the first verification parameter within the time indicated by the validity period of the first verification code, the security gateway determines that the first verification parameter is valid; if the security gateway receives the first verification parameter outside the time indicated by the validity period of the first verification code, the security gateway determines that the first verification parameter is invalid.

[0187] As another feasible implementation, the first verification parameter includes a first verification code. The security gateway can determine whether the first verification code received from the base station is consistent with the first verification code sent to the base station. If the first verification code received from the base station is inconsistent with the first verification code sent to the base station, the access platform determines that the first verification parameter is invalid. If the first verification code received from the base station is consistent with the first verification code sent to the base station, the access platform determines that the first verification parameter is valid.

[0188] In addition, the security gateway can also combine the above two methods to determine whether the first verification parameter is received within the validity period indicated by the validity period, and whether the first verification code received from the base station is consistent with the first verification code sent to the base station. Only when both conditions are met—that the first verification parameter is received within the validity period indicated by the first verification code and that the first verification code received from the base station is consistent with the first verification code sent to the base station—can the first verification parameter be determined to be valid. This improves the accuracy of the judgment and further enhances the security of the network.

[0189] S303, the security gateway sends third-party information to the AAA server.

[0190] The third information is used to request authentication and authorization, and it carries authentication data and device identification.

[0191] After the security gateway determines that the base station is secure, it sends an authentication and authorization request to the AAA server, and sends the authentication data and device identifier to the AAA server so that the AAA server can perform authentication and authorization based on the device identifier and authentication data.

[0192] In some examples, the security gateway can send third information to the AAA server based on second information and a preset relationship, whereby the preset relationship indicates the correspondence between the types of information received by the security gateway and the network elements.

[0193] The preset relationships can be shown in Table 1 below:

[0194] Table 1

[0195] Authentication and authorization requests AAA server Base station registration request OMC Base station activation request Signaling gateway

[0196] In Table 1, when the security gateway receives an authentication and authorization request, it can send the request to the AAA server. When the security gateway receives a base station registration request, it can send the request to the OMC. When the security gateway receives a base station activation request, it can send the request to the signaling gateway.

[0197] In S301, the information received by the security gateway is the second information, which is used to request authentication and authorization. Therefore, the security gateway needs to send the third information to the AAA server.

[0198] Based on this, the base station does not need to indicate the IP address of the AAA server to the security gateway. The security gateway has the IP address of the AAA server pre-stored and determines which network element to send the third-party information to based on the preset relationship. In other words, the base station does not need to know the IP address of the AAA server, and attackers cannot obtain the IP address of the AAA server from the base station side, thereby further improving the security of the network.

[0199] The S304 and AAA servers perform authentication and authorization based on authentication parameters, authentication data, and device identifiers.

[0200] Specifically, the AAA server determines the authentication parameters corresponding to the device identifier based on the device identifier, and calculates another set of authentication data based on the authentication parameters. The AAA server then performs authentication and authorization based on this other set of authentication data and the authentication data calculated by the base station.

[0201] After confirming that authentication and authorization have been successful, the S305 and AAA servers send the fourth piece of information to the security gateway.

[0202] The fourth piece of information is used to indicate whether authentication and authorization have been successful.

[0203] After successful authentication and authorization, the AAA server needs to notify the security gateway so that the security gateway can establish an IPsec tunnel.

[0204] S306. The security gateway completes the establishment of the IPsec tunnel and generates the second parameter based on the device identifier.

[0205] After the security gateway is notified that authentication and authorization have been successful, it establishes an IPsec tunnel.

[0206] Furthermore, the security gateway can generate a second parameter, which includes a second verification parameter, so that the base station can verify the security of the base station based on the second verification parameter before registering the base station.

[0207] S307. The security gateway sends information indicating that authentication and authorization have been passed to the base station, and also sends the second parameter.

[0208] Correspondingly, the base station receives the information indicating successful authentication and authorization sent by the security gateway, as well as the second parameter sent by the gateway.

[0209] Based on this, the base station can know that authentication and authorization have been passed, as well as obtain the second parameter, in order to initiate base station registration.

[0210] Specifically, the access platform can send information indicating successful authentication and authorization, as well as the second parameter, through two methods: a: S3071 and b: S3072 to S3073.

[0211] S3071, The security gateway sends the fifth message to the base station.

[0212] Correspondingly, the base station receives the fifth piece of information sent by the security gateway.

[0213] The fifth piece of information is used to indicate whether authentication and authorization have been successful.

[0214] The fifth piece of information carries the second parameter.

[0215] Security gateways can directly carry the second parameter in existing authentication and authorization signaling, thereby saving signaling resources.

[0216] S3072, The security gateway sends the fifth message to the base station.

[0217] Correspondingly, the base station receives the fifth piece of information sent by the security gateway.

[0218] The fifth piece of information is used to indicate whether authentication and authorization have been successful.

[0219] S3073, The security gateway sends the second parameter to the base station.

[0220] Correspondingly, the base station receives the second parameter sent by the security gateway.

[0221] The security gateway can also add signaling to send the second parameter separately.

[0222] S3072 and S3073 do not have a specific order. S3072 can be executed first and then S3073, or S3073 can be executed first and then S3072. Of course, S3072 and S3073 can also be executed simultaneously. This application does not impose any restrictions on this.

[0223] S308, the security gateway denies base station access.

[0224] A security gateway determines that it will not allow base stations to perform authentication and authorization. This means that the base station may have been controlled by an attacker, or the attacker may have obtained sensitive information. The attacker could use this sensitive information to impersonate the base station and launch an attack on the security gateway. Therefore, the security gateway can refuse the base station's access, ensuring network security. Furthermore, the security gateway can also use blacklisting or freezing to ensure network security.

[0225] Based on the above exemplary description, the access platform can be accessed through the following means: Figure 7 As shown, the base station registration operation is performed through the IPsec tunnel based on the second parameter, and the third parameter is sent to the base station.

[0226] Please see Figure 7 , Figure 7 This is a signaling interaction diagram of a method for performing base station registration and sending third parameters according to an embodiment of this application. For the sake of simplicity, Figure 7 Other network elements besides the security gateway and OMC are not shown. Figure 7 As shown, the method includes:

[0227] S401. The base station sends the sixth information to the security gateway based on the IPsec tunnel.

[0228] Correspondingly, the security gateway receives the sixth piece of information sent by the base station based on the IPsec tunnel.

[0229] The sixth piece of information is used to request base station registration, and it carries the second verification parameters and the device identifier.

[0230] Among them, the device identifier is used by the network elements in the access platform to identify the identity of the base station, ensuring that the access platform knows which base station needs to be registered.

[0231] The second verification parameter is used by the security gateway to determine the security of the base station. The base station is then registered only if it is secure, thereby improving network security.

[0232] The sixth piece of information is sent by the base station based on the IP address of the security gateway. The method by which the base station obtains the IP address of the security gateway is described in section S301 and will not be repeated here.

[0233] S402. The security gateway determines whether to allow the base station to register based on the second verification parameter.

[0234] When it is determined that base station registration is permitted, the security gateway executes S403. When it is determined that base station registration is not permitted, the security gateway executes S408.

[0235] In some examples, the second verification parameter includes a second verification code and the validity period of the second verification code.

[0236] The validity period of the second verification code can be set to 1 minute.

[0237] In other examples, the second verification parameter includes a second verification code.

[0238] The security gateway determines whether to allow the base station to register based on the second verification parameter, which is similar to the way the security gateway determines whether to allow the base station to perform authentication and authorization based on the first verification parameter. Please refer to the description in S302, which will not be repeated here.

[0239] S403, The security gateway sends the seventh message to the OMC.

[0240] The seventh piece of information is used to request base station registration, and it carries the device identifier.

[0241] After the security gateway determines that the base station is secure, it sends a request to the OMC to register the base station and sends the device identifier to the OMC so that the OMC can register the base station based on the device identifier.

[0242] Security gateways can send the seventh message in a variety of ways.

[0243] In some examples, the security gateway can send a seventh message to the OMC based on the sixth message and a preset relationship, which is used to indicate the correspondence between the types of information received by the security gateway and the network elements.

[0244] The preset relationships can be as shown in Table 1 above.

[0245] Referring to Table 1, in 401, the information received by the security gateway is the sixth message, which is used to request base station registration. Therefore, the security gateway needs to send the seventh message to the OMC.

[0246] Based on this, the base station does not need to indicate the OMC's IP address to the security gateway. The security gateway has the OMC's IP address pre-stored in its memory. The security gateway determines which network element to send the seventh information to based on the preset relationship. In other words, the base station does not need to know the OMC's IP address, and attackers cannot obtain the OMC's IP address from the base station side, thereby further improving network security.

[0247] In other examples, the fifth message also carries the first IP address, which indicates the address of the OMC, and the sixth message also carries the first IP address, so that the security gateway can send the seventh message to the OMC based on the first IP address.

[0248] When the security gateway sends the fifth information to the base station, it can also send the first IP address to the base station. This allows the base station to include the first IP address when sending the sixth information to the security gateway, thus enabling the security gateway to know which network element to which to send the base station registration request and directly send the seventh information to the OMC based on the first IP address.

[0249] S404 and OMC register base stations based on equipment identifiers.

[0250] S405 and OMC generate cell configuration parameters based on the device identifier and send the eighth message to the security gateway.

[0251] The eighth piece of information is used to indicate that the base station registration is complete, and it carries the cell configuration parameters.

[0252] After base station registration is complete, the OMC needs to allocate cell configuration parameters to the base station so that the base station can activate itself based on these parameters. The OMC can include the cell configuration parameters in the existing signaling information indicating the base station registration completion, thereby saving network resources.

[0253] S406. The security gateway generates third verification parameters based on the device identifier.

[0254] After receiving the eighth message, the security gateway also needs to generate a third verification parameter for the base station so that the base station can verify its security before activating the base station.

[0255] S407, The security gateway sends the ninth message to the base station.

[0256] Correspondingly, the base station receives the ninth message sent by the security gateway.

[0257] The ninth information is used to indicate that the base station registration is complete, and the ninth information carries the third parameter.

[0258] The security gateway can directly carry third parameters in the signaling that has been registered with the existing base station, thereby saving signaling resources.

[0259] In addition, the security gateway can also send third verification parameters to the base station independently via separate information, and this application does not impose any restrictions on this.

[0260] S408, Security Gateway releases IPsec tunnel.

[0261] When a security gateway determines that a base station should not register, it means that the base station may have been controlled by an attacker, or that the attacker has obtained sensitive information and launched an attack on the security gateway. Therefore, the security gateway can release the IPsec tunnel to ensure network security. In addition, the security gateway can also use blacklisting or freezing to ensure network security.

[0262] Based on the above exemplary description, the access platform can be accessed through the following means: Figure 8 As shown, the base station activation operation is performed via an IPsec tunnel based on a third parameter.

[0263] Please see Figure 8 , Figure 8 This application provides a signaling interaction diagram of a method for performing base station activation operation according to an embodiment of the present application. For the sake of simplicity, Figure 8 Other network elements besides the security gateway and signaling gateway are not shown. Figure 8 As shown, the method includes:

[0264] S501, The base station sends the tenth information to the security gateway based on the IPsec tunnel.

[0265] Correspondingly, the security gateway receives the tenth message sent by the base station based on the IPsec tunnel.

[0266] The tenth message is used to request base station activation, and it carries the third parameter.

[0267] The third verification parameter is used by the security gateway to determine the security of the base station. The base station is activated only when it is secure, thereby improving network security.

[0268] Among them, the cell configuration parameters are used by the access platform and core network equipment to activate the base station.

[0269] The tenth piece of information is sent by the base station based on the IP address of the security gateway. The method by which the base station obtains the IP address of the security gateway is described in section S301 and will not be repeated here.

[0270] S502, the security gateway determines whether to allow the base station to activate the base station based on the third verification parameter.

[0271] When it is determined that the base station is allowed to activate, the security gateway executes S503; when it is determined that the base station is not allowed to activate, the security gateway executes S507.

[0272] In some examples, the third verification parameter includes a third verification code and the validity period of the third verification code.

[0273] The validity period of the third verification code can be set to 1 minute.

[0274] In other examples, the third verification parameter includes a third verification code.

[0275] The security gateway determines whether to allow the base station to activate itself based on the third verification parameter, which is similar to the way the security gateway determines whether to allow the base station to perform authentication and authorization based on the first verification parameter. Please refer to the description in S302, which will not be repeated here.

[0276] S503, the security gateway sends the eleventh message to the signaling gateway.

[0277] The eleventh message is used to request base station activation and carries cell configuration parameters.

[0278] After the security gateway determines that the base station is allowed to activate, it sends a request for base station activation to the signaling gateway and sends the cell configuration parameters to the signaling gateway so that the signaling gateway can activate the base station in the core network equipment according to the cell configuration parameters.

[0279] In some examples, the security gateway can send eleventh information to the signaling gateway based on the tenth information and a preset relationship, whereby the preset relationship is used to indicate the correspondence between the types of information received by the security gateway and the network elements.

[0280] The preset relationships can be as shown in Table 1 above.

[0281] Referring to Table 1, in 501, the information received by the security gateway is the tenth message, which is used to request base station activation. Therefore, the security gateway needs to send the eleventh message to the signaling gateway.

[0282] Based on this, the base station does not need to indicate the IP address of the signaling gateway to the security gateway. The security gateway has the IP address of the signaling gateway pre-stored in its memory. The security gateway determines which network element to send the eleventh message to based on the preset relationship. In other words, the base station does not need to know the IP address of the signaling gateway, and attackers cannot obtain the IP address of the signaling gateway from the base station side, thereby further improving network security.

[0283] In other examples, the ninth message also carries a second IP address, which is used to indicate the address of the signaling gateway. The security gateway can send the eleventh message to the signaling gateway based on the second IP address.

[0284] When the security gateway sends the ninth information to the base station, it can also send the second IP address to the base station. This allows the base station to include the second IP address when sending the tenth information to the security gateway. As a result, the security gateway can determine which network element needs to be sent the request to activate the base station and directly send the eleventh information to the signaling gateway based on the second IP address.

[0285] S504, the signaling gateway activates the base station in the core network equipment according to the cell configuration parameters.

[0286] Based on the cell configuration parameters, the signaling gateway calculates the parameters related to base station activation and sends these parameters to the core network equipment, which then activates the base station. Upon successful base station activation, the core network equipment sends an activation success message to the signaling gateway, thus informing the gateway that the base station has been successfully activated and enabling the core network equipment to provide services to the base station.

[0287] S505, the signaling gateway sends the twelfth message to the security gateway.

[0288] The twelfth piece of information is used to indicate that the base station has been successfully activated.

[0289] S506. The security gateway forwards the twelfth information to the base station so that the base station can complete the base station activation in the core network equipment.

[0290] Correspondingly, the base station receives the twelfth information forwarded by the security gateway, enabling the base station to complete base station activation in the core network equipment.

[0291] S507, Security Gateway releases IPsec tunnel.

[0292] When a security gateway determines that base station activation is not permitted, it means the base station may have been controlled by an attacker, or the attacker has obtained sensitive information and launched an attack on the security gateway. Therefore, the security gateway can release the IPsec tunnel to ensure network security. Furthermore, the security gateway can also use blacklisting or freezing to ensure network security.

[0293] Based on the above exemplary description, the first information also carries the location information of the base station, and the access platform can determine whether to allow the allocation of the first parameter to the base station in various ways.

[0294] As a feasible implementation, the initialization server determines whether to allow the allocation of the first parameter to the base station based on the location information.

[0295] As another feasible implementation, the initialization server sends location information to the OMC, and the OMC determines whether to allow the allocation of the first parameter to the base station based on the location information.

[0296] Specifically, the initialization server or OMC determines whether the location of the base station has changed based on the location information. If the location of the base station has changed, it means that the base station may no longer be safe. The initialization server or OMC can then determine that the first parameter should not be assigned to the base station.

[0297] Based on the above exemplary description, the first verification parameter includes a first verification code and the validity period of the first verification code, the second verification parameter includes a second verification code and the validity period of the second verification code, and the third verification parameter includes a third verification code and the validity period of the third verification code.

[0298] The validity periods of the first verification code, the second verification code, and the third verification code may be the same or different, and this application does not impose any restrictions on this.

[0299] The validity period can be, for example, 1 minute, thereby shortening the time it takes for attackers to crack verification parameters and sensitive information, and improving network security.

[0300] Based on this, the access platform can determine the validity of each verification parameter by combining each verification code and its corresponding validity period, thereby improving the accuracy of determining whether authentication and authorization, base station registration, or base station activation are allowed, and further enhancing network security.

[0301] In addition, the access platform should ensure that the first, second, and third verification codes are unique. When performing authentication and authorization, base station registration, and base station activation, if the access platform receives multiple identical verification codes, it should only ensure that the first received verification code is valid, and subsequent codes should be rejected. That is, it should ensure uniqueness and only protect the device that is performing authentication and authorization, base station registration, and base station activation for the first time.

[0302] Based on the above exemplary description, if the security gateway or OMC does not receive a request for base station registration during the validity period of the second verification code, the security gateway releases the IPsec tunnel. If the security gateway does not receive a request for base station activation during the validity period of the third verification code, the security gateway releases the IPsec tunnel.

[0303] Therefore, if a base station receives a second or third verification code but does not initiate a base station registration request or a base station activation request within the validity period, the base station may be insecure. The security gateway can release the IPsec tunnel to ensure network security.

[0304] Based on the above exemplary description, the access platform can be accessed through the following means: Figure 9 The first verification parameter, the second verification parameter, and the third verification parameter are updated in the manner shown.

[0305] Please see Figure 9 , Figure 9 A signaling interaction diagram for a method of updating verification parameters provided in one embodiment of this application is shown below for simplification. Figure 9 Other network elements besides the security gateway are not shown. Figure 9 As shown, the method includes:

[0306] S601. After authentication and authorization are successful, the security gateway updates the first verification parameters according to the first preset period and sends the updated first verification parameters to the base station.

[0307] Correspondingly, the base station receives the updated first verification parameters sent by the security gateway.

[0308] The first preset period can be 1 minute, 5 minutes, etc.

[0309] After authentication and authorization are successful, the security gateway updates the first verification parameters according to the first preset period. This ensures that the base station can receive the latest and valid first verification parameters. When the base station reconnects without restarting, it can use the updated first verification parameters to re-authenticate and authorize without regenerating the first verification parameters, thus saving the time of non-restart reconnection and improving the user experience while ensuring network security.

[0310] S602. After the base station registration is completed, the security gateway updates the second verification parameters according to the second preset period and sends the updated second verification parameters to the base station.

[0311] Correspondingly, the base station receives the updated second verification parameters sent by the security gateway.

[0312] The second preset period can be 1 minute, 5 minutes, etc.

[0313] After the base station registration is completed, the security gateway updates the second verification parameters according to the second preset period. This ensures that the base station can receive the latest and valid second verification parameters. When the base station reconnects without restarting, it can re-register with the updated second verification parameters without having to regenerate the second verification parameters. This saves time on non-restart reconnection and improves user experience while ensuring network security.

[0314] S603. After the base station is activated, the security gateway updates the third verification parameters according to the third preset period and sends the updated third verification parameters to the base station.

[0315] Correspondingly, the base station receives the updated third verification parameters sent by the security gateway.

[0316] The third preset period can be 1 minute, 5 minutes, etc.

[0317] After the base station is activated, the security gateway updates the third verification parameters according to the third preset period. This ensures that the base station can receive the latest and valid third verification parameters. When the base station reconnects without restarting, the updated third verification parameters can be used to reactivate the base station without regenerating the third verification parameters, thus saving the time of reconnection without restarting and improving the user experience while ensuring network security.

[0318] In S601 to S603, the first preset period, the second preset period, and the third preset period may be the same or different, and this application does not impose any restrictions on this.

[0319] Therefore, when a base station experiences a non-reboot reconnection, it may lead to IPsec tunnel interruption, base station deregistration, or base station deactivation. If the IPsec tunnel is interrupted, the access platform can perform authentication and authorization operations based on the updated first verification parameters to re-establish the IPsec tunnel. If the base station deregisters, the access platform can perform base station registration operations based on the updated second verification parameters to re-register the base station. If the base station deactivates, the access platform can perform base station activation operations based on the updated third verification parameters to re-activate the base station. The access platform does not need to regenerate the first, second, and third verification parameters, saving the time required for non-reboot reconnection and thus improving user experience while ensuring network security.

[0320] Based on the above exemplary description, please refer to Figure 10 , Figure 10 A signaling interaction diagram for a method of updating verification parameters provided in one embodiment of this application is shown below for simplification. Figure 10 Other network elements besides the security gateway are not shown. Figure 10 As shown, the methods for updating verification parameters also include:

[0321] S601a: After receiving the updated first verification parameter, the base station sends the fifteenth message to the security gateway.

[0322] Correspondingly, the security gateway receives the fifteenth message sent by the base station after receiving the updated first verification parameter. The fifteenth message is used to indicate that the base station has received the updated first verification parameter.

[0323] S602a: After receiving the updated second verification parameters, the base station sends the sixteenth message to the security gateway.

[0324] Correspondingly, the security gateway receives the sixteenth message sent by the base station after receiving the updated second verification parameters. The sixteenth message is used to indicate that the base station has received the updated second verification parameters.

[0325] S603a: After receiving the updated third verification parameters, the base station sends the seventeenth message to the security gateway.

[0326] Correspondingly, the security gateway receives the seventeenth message sent by the base station after receiving the updated third verification parameter. The seventeenth message is used to indicate that the base station has received the updated third verification parameter.

[0327] Thus, the security gateway can know that the base station can normally receive the updated first verification parameter, the updated second verification parameter, or the updated third verification parameter.

[0328] If the base station fails to send the fifteenth, sixteenth, or seventeenth information to the security gateway, it indicates that the base station may have been hijacked or forged by an attacker, or that the attacker has disrupted communication on the base station side, rendering the base station insecure. Therefore, based on this, upon not receiving the fifteenth, sixteenth, or seventeenth information, the security gateway can release the IPsec tunnel, disconnecting the communication channel with the base station to prevent attackers from using the IPsec tunnel to attack the access platform, thereby ensuring network security. Furthermore, the security gateway can also use blacklisting or freezing methods to ensure network security.

[0329] Based on the above exemplary description, the first information also carries the location information and / or startup time of the base station. Before the access platform allocates the first parameter to the base station, the initialization server can send a twelfth message to the administrator. The twelfth message is used to inquire whether the administrator allows the allocation of the first parameter to the base station identified by the device identifier, which is located at the location indicated by the location information and started at the startup time. The initialization server receives a thirteenth message sent by the administrator. The thirteenth message is used to indicate whether the allocation of the first parameter to the base station is allowed or not allowed.

[0330] In this context, "administrator" refers to the base station's management personnel or the base station's asset owner. Sending the twelfth message to the administrator means sending the twelfth message to the administrator's terminal device, enabling the administrator to receive the twelfth message.

[0331] The twelfth message can be in the form of SMS, web page reminder, or official account reminder. For example, if the location information is A, the startup time is X hours Y minutes Z seconds, and the device identifier is B, then the twelfth message can be: Base station B installed in location A is powered on at X hours Y minutes Z seconds and requests the allocation of the first parameter. Is it allowed?

[0332] Based on the twelfth piece of information, the administrator can determine whether to allow the allocation of the first parameter to the base station and send the thirteenth piece of information to the initialization server, so that the initialization server knows whether the allocation of the first parameter to the base station is allowed or not. Based on this, the access platform can also determine whether to allow the allocation of the first parameter to the base station through the thirteenth piece of information sent by the administrator, further improving network security.

[0333] In addition to the initialization server being able to send the twelfth message, the twelfth message can also be sent by the AAA server or the OMC.

[0334] Specifically, the initialization server sends the fourteenth message to the OMC or AAA server, which carries location information and / or startup time; the OMC or AAA server sends the twelfth message to the administrator, which asks whether the administrator is allowed to allocate the first parameter to the base station that is started at the location indicated by the location information and / or at the startup time, and is identified as the device identifier; the OMC or AAA server receives the thirteenth message sent by the administrator, which indicates whether the allocation of the first parameter to the base station is allowed or not.

[0335] Based on the above exemplary description, after the IPsec tunnel is established, the security gateway sends query information to the OMC or signaling gateway according to the fourth preset period. When the security gateway determines that the base station is offline for a preset period of time, it releases the IPsec tunnel.

[0336] The query information is used to query the status of the base station, which includes connected, active, and offline states.

[0337] The fourth preset period can be 1 minute or 5 minutes, etc.

[0338] Therefore, if the security gateway determines that the base station is offline within a preset time period, the base station may be insecure. In this case, the security gateway can release the IPsec tunnel or freeze or blacklist it to prevent attackers from launching attacks on the access platform and improve network security.

[0339] For example, this application also provides an access platform.

[0340] The access platform can exist independently or be integrated into other devices. It can communicate with the base stations mentioned above to implement the operations corresponding to the access platform in any of the above method embodiments.

[0341] As an example, the access platform is used to execute the aforementioned... Figures 4 to 10 The actions performed by the access platform in the illustrated embodiment.

[0342] An access platform is used to send a first parameter to the base station when the base station initiates base station activation. The first parameter includes a first verification parameter and an authentication parameter, which are used for authentication and authorization. The access platform is used to perform authentication and authorization operations based on the first parameter and send a second parameter to the base station. The second parameter includes a second verification parameter, which is used for base station registration. The access platform is used to perform base station registration operations through an Internet Protocol Security (IPsec) tunnel based on the second parameter and send a third parameter to the base station. The IPsec tunnel is established by the access platform after authentication and authorization are successful. The third parameter includes a third verification parameter and a cell configuration parameter, which are used for base station activation. The access platform is used to perform base station activation operations through the IPsec tunnel and based on the third parameter, so that the base station can be activated in the core network equipment. In some embodiments, the access platform includes the following network elements: an initialization server, a security gateway, an Authentication, Authorization, Accounting (AAA) server, a signaling gateway, and an Operation and Maintenance Center (OMC). When the base station initiates base station activation, the access platform sends the first parameter to the base station, including:

[0343] In some examples, the access platform includes the following network elements: an initialization server, a security gateway, an authentication, authorization, and accounting (AAA) server, a signaling gateway, and an operation and maintenance center (OMC); the initialization server is used to receive first information sent by the base station, the first information being used to request first parameters, the first information carrying the base station's device identifier; the initialization server is used to generate authentication parameters based on the device identifier, or the AAA server generates authentication parameters based on the device identifier obtained from the initialization server and sends them to the initialization server, and the security gateway generates first verification parameters based on the device identifier obtained from the initialization server and sends them to the initialization server; if it is determined that the allocation of the first parameters to the base station is permitted, the initialization server is used to send the first parameters to the base station.

[0344] In some examples, the security gateway receives second information from the base station, which requests authentication and authorization. This second information carries a device identifier, first verification parameters, and authentication data, calculated by the base station based on the authentication parameters. The security gateway then determines whether to allow the base station to perform authentication and authorization based on the first verification parameters and the device identifier. Upon determining that authentication and authorization are allowed, the security gateway sends third information to the AAA server, which also requests authentication and authorization and carries authentication data and the device identifier. The AAA server performs authentication and authorization based on the authentication parameters, authentication data, and the device identifier. After confirming successful authentication and authorization, the AAA server sends fourth information to the security gateway, indicating successful authentication and authorization. The security gateway completes the establishment of the IPsec tunnel and generates second parameters based on the device identifier. Finally, the security gateway sends fifth information to the base station, indicating successful authentication and authorization and carrying the second parameters. Alternatively, the security gateway sends fifth information to the base station, indicating successful authentication and authorization, and then sends the second parameters to the base station.

[0345] In some examples, a security gateway is specifically used to send third information to an AAA server based on second information and a preset relationship, whereby the preset relationship indicates the correspondence between the types of information received by the security gateway and network elements.

[0346] In some examples, the security gateway receives a sixth message sent by the base station via an IPsec tunnel. This sixth message requests base station registration and carries a second authentication parameter and a device identifier. The security gateway then determines whether to allow the base station to register based on the second authentication parameter. When it is determined that base station registration is allowed, the security gateway sends a seventh message to the OMC (Optical Management Center). This seventh message requests base station registration and carries a device identifier. The OMC performs base station registration based on the device identifier. The OMC generates cell configuration parameters based on the device identifier and sends an eighth message to the security gateway. This eighth message indicates that base station registration is complete and carries the cell configuration parameters. The security gateway generates a third authentication parameter based on the device identifier. Finally, the security gateway sends a ninth message to the base station, indicating that base station registration is complete and carrying the third parameter.

[0347] In some examples, the security gateway is specifically used to send the seventh information to the OMC based on the sixth information and a preset relationship, which indicates the correspondence between the types of information received by the security gateway and the network elements.

[0348] In some examples, the fifth message also carries a first Internet Protocol (IP) address, which indicates the address of the OMC; the sixth message also carries the first IP address, a security gateway, specifically used to send the seventh message to the OMC based on the first IP address.

[0349] In some examples, the security gateway receives a tenth message sent by the base station via an IPsec tunnel. This tenth message requests base station activation and carries a third parameter. The security gateway then determines whether to allow the base station to activate based on the third verification parameter. When it is determined that base station activation is allowed, the security gateway sends an eleventh message to the signaling gateway. This eleventh message requests base station activation and carries cell configuration parameters. The signaling gateway then activates the base station in the core network equipment according to the cell configuration parameters. The signaling gateway then sends a twelfth message to the security gateway, indicating successful base station activation. The security gateway then forwards the twelfth message to the base station so that the base station completes activation in the core network equipment.

[0350] In some examples, the security gateway is specifically used to send eleventh information to the signaling gateway based on the tenth information and a preset relationship, whereby the preset relationship indicates the correspondence between the types of information received by the security gateway and the network elements.

[0351] In some examples, the ninth message also carries a second IP address, which is used to indicate the address of the signaling gateway; the tenth message also carries a second IP address, the security gateway, which is specifically used to send the eleventh message to the signaling gateway based on the second IP address.

[0352] In some examples, the first information also carries the location information of the base station, and the initialization server is also used, or the OMC is also used, to determine whether to allow the allocation of the first parameter to the base station based on the location information obtained from the initialization server.

[0353] In some examples, the first verification parameter includes a first verification code and the validity period of the first verification code; the second verification parameter includes a second verification code and the validity period of the second verification code; and the third verification parameter includes a third verification code and the validity period of the third verification code.

[0354] In some examples, after authentication and authorization are successful, the security gateway is also used to update the first verification parameter according to a first preset period and send the updated first verification parameter to the base station; after the base station registration is completed, the security gateway is also used to update the second verification parameter according to a second preset period and send the updated second verification parameter to the base station; after the base station is activated, the security gateway is also used to update the third verification parameter according to a third preset period and send the updated third verification parameter to the base station.

[0355] In some examples, the first information also carries the location information and / or startup time of the base station. The initialization server is also used to send a twelfth information to the administrator, which asks whether the administrator is allowed to allocate the first parameter to the base station identified by the device identifier at the location indicated by the location information and the startup time. The initialization server is also used to receive a thirteenth information sent by the administrator, which indicates whether the allocation of the first parameter to the base station is allowed or not allowed.

[0356] In some examples, the first information also carries the location information and / or startup time of the base station. The initialization server is also used to send a fourteenth information to the OMC or AAA server, which carries the location information and / or startup time. The OMC or AAA server is also used to send a twelfth information to the administrator, which asks whether the administrator is allowed to allocate the first parameter to the base station that is started at the location indicated by the location information and / or at the startup time, and is identified as a device identifier. The OMC or AAA server is also used to receive a thirteenth information sent by the administrator, which indicates whether the allocation of the first parameter to the base station is allowed or not allowed.

[0357] In some examples, the security gateway is also used to release the IPsec tunnel when it is determined that the base station is not allowed to register.

[0358] In some examples, the security gateway is also used to release the IPsec tunnel when it is determined that base station activation is not allowed.

[0359] In some examples, if the security gateway or OMC does not receive a request for base station registration within the validity period of the second verification code, the security gateway is also used to release the IPsec tunnel.

[0360] In some examples, if the security gateway does not receive a request for base station activation within the validity period of the third verification code, the security gateway is also used to release the IPsec tunnel.

[0361] In some examples, the security gateway is also configured to receive a fifteenth message sent by the base station after receiving the updated first authentication parameter, the fifteenth message indicating that the base station has received the updated first authentication parameter; the security gateway is also configured to receive a sixteenth message sent by the base station after receiving the updated second authentication parameter, the sixteenth message indicating that the base station has received the updated second authentication parameter; and the security gateway is also configured to receive a seventeenth message sent by the base station after receiving the updated third authentication parameter, the seventeenth message indicating that the base station has received the updated third authentication parameter.

[0362] In some examples, the security gateway is also used to release the IPsec tunnel if the fifteenth, sixteenth, or seventeenth messages are not received.

[0363] In some examples, when a base station experiences a non-reboot reconnection, the access platform is also used to perform authentication and authorization operations based on the updated first verification parameters, perform base station registration operations based on the updated second verification parameters, and perform base station activation operations based on the updated third verification parameters.

[0364] In some examples, the security gateway is also used to send query information to the OMC or signaling gateway according to a fourth preset period after the IPsec tunnel is established. The query information is used to query the status of the base station, which includes connected state, active state, and offline state. The security gateway is also used to release the IPsec tunnel when it is determined that the base station is in an offline state for a preset period of time.

[0365] It should be understood that the corresponding processes performed by each unit have been described in detail in the above method embodiments, and will not be repeated here for the sake of brevity.

[0366] By way of example, this application also provides a communication device.

[0367] Figure 11 This is a schematic diagram of the structure of a communication device provided in an embodiment of this application.

[0368] like Figure 11 As shown, the communication device 100 can exist independently or be integrated into other devices. It can communicate with the access platform mentioned above to implement the operation corresponding to the base station in any of the above method embodiments.

[0369] The communication device 100 may include a transceiver unit 101 and a processing unit 102. The transceiver unit 101 can implement corresponding communication functions. The transceiver unit 101 may also be referred to as a communication interface or a communication unit. The processing unit 102 is used for data processing.

[0370] Optionally, the communication device 100 may further include a storage unit, which can be used to store instructions and / or data. The processing unit 102 can read the instructions and / or data in the storage unit so that the communication device 100 can implement the aforementioned method embodiments.

[0371] The communication device 100 can be used to perform the actions performed by the base station in the aforementioned method embodiments. The communication device 100 can be a base station or a component configurable on a base station. The transceiver unit 101 is used to perform transceiver-related operations of the base station in the aforementioned method embodiments.

[0372] Optionally, the transceiver unit 101 may include a sending unit and a receiving unit. The sending unit is used to perform the sending operation in the foregoing method embodiments. The receiving unit is used to perform the receiving operation in the foregoing method embodiments.

[0373] It should be noted that the communication device 100 may include a transmitting unit but not a receiving unit. Alternatively, the communication device 100 may include a receiving unit but not a transmitting unit. Specifically, it depends on whether the above-described scheme executed by the communication device 100 includes both transmitting and receiving actions.

[0374] As an example, the communication device 100 is used to perform the foregoing. Figures 4 to 10 The actions performed by the base station in the illustrated embodiment.

[0375] The communication device 100 may include a transceiver unit 101 and a processing unit 102.

[0376] When the base station is activated, the transceiver unit 101 is used to receive the first parameter sent by the access platform; the first parameter includes a first verification parameter and an authentication parameter, and the first parameter is used for authentication and authorization.

[0377] Processing unit 102 is used to perform authentication and authorization operations based on the first parameter; transceiver unit 101 is used to receive the second parameter sent by the access platform; the second parameter includes a second verification parameter, which is used for base station registration.

[0378] The processing unit 102 is used to perform base station registration operation through the IPsec tunnel based on the second parameter, and the transceiver unit 101 is used to receive the third parameter sent by the access platform; wherein, the IPsec tunnel is established by the access platform after authentication and authorization are passed; the third parameter includes the third verification parameter and the cell configuration parameter, and the third parameter is used to activate the base station;

[0379] Processing unit 102 is used to perform base station activation operation through IPsec tunnel based on third parameters, so that the base station is activated in the core network equipment.

[0380] In some examples, the access platform includes the following network elements: an initialization server, a security gateway, an AAA server, a signaling gateway, and an OMC; a transceiver unit 101, specifically used to send first information to the initialization server, the first information being used to request first parameters, the first information carrying the device identifier of the base station; the transceiver unit 101, specifically used to receive the first parameters sent by the initialization server when it is determined that the allocation of the first parameters to the base station is permitted; wherein, the step of determining the first parameters includes: the initialization server receiving the first information sent by the base station, the first information being used to request the first parameters, the first information carrying the device identifier of the base station; the initialization server generating authentication parameters based on the device identifier, or the AAA server generating authentication parameters based on the device identifier obtained from the initialization server and sending them to the initialization server; and the security gateway generating first verification parameters based on the device identifier obtained from the initialization server and sending them to the initialization server.

[0381] In some examples, transceiver unit 101 is specifically used to send second information to the security gateway. The second information is used to request authentication and authorization. The second information carries a device identifier, first verification parameters, and authentication data, which is calculated by the base station based on the authorization parameters. Transceiver unit 101 is specifically used to receive fifth information sent by the security gateway. The fifth information is used to indicate that authentication and authorization have passed. The fifth information carries second parameters. The steps for determining the second parameters include: the security gateway determines whether to allow the base station to perform authentication and authorization based on the first verification parameters and the device identifier; when it is determined that the base station is allowed to perform authentication and authorization, the security gateway sends third information to the AAA server. The third information is used to request authentication and authorization. The third information carries authentication data and the device identifier; the AAA server performs authentication and authorization based on the authorization parameters, authentication data, and device identifier; after determining that authentication and authorization have passed, the AAA server sends fourth information to the security gateway. The fourth information is used to indicate that authentication and authorization have passed; the security gateway completes the establishment of the IPsec tunnel and generates the second parameters based on the device identifier.

[0382] In some examples, transceiver unit 101 is specifically used to send a sixth message to the security gateway based on the IPsec tunnel. The sixth message is used to request base station registration and carries a second authentication parameter and a device identifier. Transceiver unit 101 is specifically used to receive a ninth message sent by the security gateway. The ninth message is used to indicate that the base station registration is complete and carries a third parameter. The steps for determining the third parameter include: the security gateway determines whether to allow the base station to register based on the second authentication parameter; when it determines that the base station is allowed to register, the security gateway sends a seventh message to the OMC. The seventh message is used to request base station registration and carries a device identifier; the OMC registers the base station based on the device identifier; the OMC generates cell configuration parameters based on the device identifier and sends an eighth message to the security gateway. The eighth message is used to indicate that the base station registration is complete and carries a cell configuration parameter; the security gateway generates a third authentication parameter based on the device identifier; the security gateway sends a ninth message to the base station. The ninth message is used to indicate that the base station registration is complete and carries a third parameter.

[0383] In some examples, the fifth message also carries the first IP address, which indicates the address of the OMC; the sixth message also carries the first IP address so that the security gateway can send the seventh message to the OMC based on the first IP address.

[0384] In some examples, transceiver unit 101 is specifically used to send tenth information to the security gateway based on the IPsec tunnel. The tenth information is used to request base station activation and carries a third parameter. Transceiver unit 101 is specifically used to receive twelfth information forwarded by the security gateway so that the base station can complete base station activation in the core network equipment. The steps for determining the twelfth information include: the security gateway determines whether to allow the base station to activate based on the third verification parameter; when it is determined that the base station can activate, the security gateway sends eleventh information to the signaling gateway. The eleventh information is used to request base station activation and carries cell configuration parameters; the signaling gateway activates the base station in the core network equipment according to the cell configuration parameters; the signaling gateway sends the twelfth information to the security gateway, which indicates that the base station activation was successful.

[0385] In some examples, the ninth message also carries a second IP address, which indicates the address of the signaling gateway; the tenth message also carries a second IP address so that the security gateway can send the eleventh message to the signaling gateway based on the second IP address.

[0386] In some examples, the first information also carries the location information of the base station so that the initialization server, or the OMC, can determine whether to allow the allocation of the first parameter to the base station based on the location information obtained from the initialization server.

[0387] In some examples, the first verification parameter includes a first verification code and the validity period of the first verification code; the second verification parameter includes a second verification code and the validity period of the second verification code; and the third verification parameter includes a third verification code and the validity period of the third verification code.

[0388] In some examples, after authentication and authorization are successful, the transceiver unit 101 is further configured to receive an updated first verification parameter sent by the security gateway, the updated first verification parameter being obtained by the security gateway updating the first verification parameter according to a first preset period; after the base station registration is completed, the transceiver unit 101 is further configured to receive an updated second verification parameter sent by the security gateway, the updated second verification parameter being obtained by the security gateway updating the second verification parameter according to a second preset period; after the base station activation is completed, the transceiver unit 101 is further configured to receive an updated third verification parameter sent by the security gateway, the updated third verification parameter being obtained by the security gateway updating the third verification parameter according to a third preset period.

[0389] In some examples, the first information also carries the location information and / or startup time of the base station, so that the initialization server sends a twelfth message to the administrator, the twelfth message being used to inquire whether the administrator allows the allocation of the first parameter to a base station identified as a device identifier that is started at the location indicated by the location information and at the startup time; the initialization server receives a thirteenth message sent by the administrator, the thirteenth message being used to indicate whether the allocation of the first parameter to the base station is allowed or not allowed; or, so that the initialization server sends a fourteenth message to the OMC or AAA server, the fourteenth message carrying the location information and / or startup time; the OMC or AAA server sends a twelfth message to the administrator, the twelfth message being used to inquire whether the administrator allows the allocation of the first parameter to a base station identified as a device identifier that is started at the location indicated by the location information and / or at the startup time; the OMC or AAA server receives a thirteenth message sent by the administrator, the thirteenth message being used to indicate whether the allocation of the first parameter to the base station is allowed or not allowed.

[0390] In some examples, transceiver unit 101 is further configured to send a fifteenth message to the security gateway after receiving the updated first authentication parameter, the fifteenth message indicating that the base station has received the updated first authentication parameter; transceiver unit 101 is further configured to send a sixteenth message to the security gateway after receiving the updated second authentication parameter, the sixteenth message indicating that the base station has received the updated second authentication parameter; transceiver unit 101 is further configured to send a seventeenth message to the security gateway after receiving the updated third authentication parameter, the seventeenth message indicating that the base station has received the updated third authentication parameter.

[0391] In some examples, when a base station reconnects without restarting, the processing unit 102 is also used to perform authentication and authorization operations based on the updated first verification parameters, perform base station registration operations based on the updated second verification parameters, and perform base station activation operations based on the updated third verification parameters.

[0392] By way of example, this application also provides a communication device.

[0393] Figure 12 This is a schematic diagram of the hardware structure of a communication device provided in an embodiment of this application.

[0394] The communication device 200 includes a processor 201 coupled to a memory for storing computer programs or instructions and / or data. The processor 201 is used to execute the computer programs or instructions and / or data stored in the memory, so that the methods in the preceding method embodiments are executed.

[0395] Optionally, the communication device 200 may include one or more processors 201.

[0396] Optionally, such as Figure 12 As shown, the communication device 200 may also include a memory 202.

[0397] Optionally, the communication device 200 may include one or more memory 202s.

[0398] Alternatively, the memory 202 can be integrated with the processor 201, or it can be set separately.

[0399] like Figure 12 As shown, the communication device 200 may further include a transceiver 203 for receiving and / or transmitting signals. For example, the processor 201 is used to control the transceiver 203 to receive and / or transmit signals.

[0400] As one approach, the communication device 200 is used to implement the operation of the base station or access platform in the method embodiments described above.

[0401] For example, processor 201 is used to implement the processing-related operations performed by the base station or access platform in the above method embodiments, and transceiver 203 is used to implement the transmission-reception-related operations performed by the base station or access platform in the above method embodiments.

[0402] The above Figure 12In the communication device shown, the device in transceiver 203 used for receiving power can be considered a receiving unit, and the device in transceiver 203 used for transmitting can be considered a transmitting unit. That is, transceiver 203 can include a receiver and a transmitter. Transceiver 203 can also be called a transceiver unit, transceiver circuit, etc. Receiver can also be called a receiver, receiving unit, receiver, or receiving circuit, etc. Transmitter can also be called a transmitter, transmitter, transmitting unit, or transmitting circuit, etc. Processor 201 has processing functions and can be called a processing unit. Memory 202 is used to store computer program code and data; memory 202 can also be called a storage unit.

[0403] When the communication device 200 is a chip, the chip includes a transceiver, a memory, and a processor. The transceiver can be an input / output circuit or a communication interface; the processor is a processor, microprocessor, or integrated circuit integrated on the chip. In the above method embodiments, the transmitting operation of the base station or access platform can be understood as the output of the chip, and the receiving operation of the base station or access platform in the above method embodiments can be understood as the input of the chip.

[0404] For example, this application also provides a computer-readable storage medium having computer instructions stored thereon for implementing the methods executed by a base station or access platform in the above method embodiments.

[0405] For example, when the computer program is executed by a computer, it enables the computer to implement the method executed by the base station or access platform in the above method embodiments.

[0406] For example, this application also provides a computer program product containing instructions that, when executed by a computer, cause the computer to implement the method performed by the base station or access platform in the above method embodiments.

[0407] For example, this application also provides a communication system including a base station and an access platform. The base station is used to execute the processes executed by the base station in the preceding embodiments. The access platform is used to execute the processes executed by the access platform in the preceding embodiments.

[0408] For example, this application also provides a chip device including a processor for calling computer programs or computer instructions stored in the memory to cause the processor to execute the base station activation method of the above embodiments.

[0409] In one possible implementation, the input of the chip device corresponds to the above. Figures 4 to 10 The receiving operation in the illustrated embodiment corresponds to the output of the chip device described above. Figures 4 to 10 The sending operation in the illustrated embodiment.

[0410] Optionally, the processor is coupled to the memory via an interface.

[0411] Optionally, the chip device may also include a memory that stores computer programs or computer instructions.

[0412] The processor mentioned above can be a general-purpose central processing unit, a microprocessor, a baseband processor, an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of a program for controlling the methods of the preceding embodiments. The memory mentioned above can be read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions, such as random access memory (RAM).

[0413] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the explanations and beneficial effects of the relevant content in any of the communication devices provided above can be referred to the corresponding method embodiments provided above, and will not be repeated here.

[0414] In this application, the base station or access platform may include a hardware layer, an operating system layer running on top of the hardware layer, and an application layer running on top of the operating system layer. The hardware layer may include hardware such as a central processing unit (CPU), a memory management unit (MMU), and memory (also known as main memory). The operating system layer may be any one or more computer operating systems that implement business processing through processes, such as Linux, Unix, Android, iOS, or Windows. The application layer may include applications such as browsers, address books, word processing software, and instant messaging software.

[0415] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0416] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0417] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0418] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the essential contribution of the technical solution of this application, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the processes of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks.

[0419] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A base station activation method, characterized in that, The method includes: When the base station is activated, the access platform sends a first parameter to the base station; the first parameter includes a first verification parameter and an authentication parameter, and the first parameter is used for authentication and authorization. The access platform performs authentication and authorization operations based on the first parameter and sends a second parameter to the base station; the second parameter includes a second verification parameter, which is used for base station registration. The access platform performs base station registration operations through an Internet Protocol Security (IPsec) tunnel based on the second parameter, and sends a third parameter to the base station; wherein, the IPsec tunnel is established by the access platform after authentication and authorization are passed; the third parameter includes a third verification parameter and a cell configuration parameter, and the third parameter is used for base station activation; The access platform performs base station activation operations through the IPsec tunnel based on the third parameter, so that the base station is activated in the core network equipment.

2. The method according to claim 1, characterized in that, The access platform includes the following network elements: initialization server, security gateway, authentication, authorization and accounting (AAA) server, signaling gateway, and operation and maintenance center (OMC); When the base station is activated, the access platform sends a first parameter to the base station, including: The initialization server receives first information sent by the base station, the first information being used to request the first parameter, and the first information carrying the device identifier of the base station; The initialization server generates the authentication parameters based on the device identifier, or the AAA server generates the authentication parameters based on the device identifier obtained from the initialization server and sends them to the initialization server, and the security gateway generates the first verification parameters based on the device identifier obtained from the initialization server and sends them to the initialization server; If it is determined that the allocation of the first parameter to the base station is permitted, the initialization server sends the first parameter to the base station.

3. The method according to claim 2, characterized in that, The access platform performs authentication and authorization operations based on the first parameter, and sends a second parameter to the base station, including: The security gateway receives second information sent by the base station. The second information is used to request authentication and authorization. The second information carries the device identifier, the first verification parameter, and authentication data. The authentication data is calculated by the base station based on the authorization parameter. The security gateway determines whether to allow the base station to perform authentication and authorization based on the first verification parameter and the device identifier. When the security gateway determines that the base station is allowed to perform authentication and authorization, it sends third information to the AAA server. The third information is used to request authentication and authorization, and the third information carries the authentication data and the device identifier. The AAA server performs authentication and authorization based on the authentication parameters, the authentication data, and the device identifier; After confirming that authentication and authorization have passed, the AAA server sends a fourth message to the security gateway, which indicates that authentication and authorization have passed. The security gateway completes the establishment of the IPsec tunnel and generates the second parameter based on the device identifier; The security gateway sends a fifth message to the base station, the fifth message indicating that authentication and authorization have been passed, and the fifth message carries the second parameter; or, the security gateway sends a fifth message to the base station, the fifth message indicating that authentication and authorization have been passed, and the security gateway sends the second parameter to the base station.

4. The method according to claim 3, characterized in that, The security gateway sends third information to the AAA server, including: The security gateway sends the third information to the AAA server based on the second information and the preset relationship, wherein the preset relationship is used to indicate the correspondence between the type of information received by the security gateway and the network element.

5. The method according to claim 3, characterized in that, The access platform performs base station registration operations through an IPsec tunnel based on the second parameter, and sends a third parameter to the base station, including: The security gateway receives the sixth information sent by the base station based on the IPsec tunnel. The sixth information is used to request base station registration and carries the second verification parameter and the device identifier. The security gateway determines whether to allow the base station to register based on the second verification parameter. When the security gateway determines that the base station is allowed to register, it sends a seventh message to the OMC. The seventh message is used to request base station registration and carries the device identifier. The OMC registers the base station based on the device identifier; The OMC generates the cell configuration parameters based on the device identifier and sends the eighth information to the security gateway. The eighth information is used to indicate that the base station registration is complete and carries the cell configuration parameters. The security gateway generates the third verification parameter based on the device identifier; The security gateway sends a ninth message to the base station, the ninth message indicating that the base station registration is complete, and the ninth message carries the third parameter.

6. The method according to claim 5, characterized in that, The security gateway sends a seventh message to the OMC, including: The security gateway sends the seventh information to the OMC based on the sixth information and the preset relationship, wherein the preset relationship is used to indicate the correspondence between the type of information received by the security gateway and the network element.

7. The method according to claim 5, characterized in that, The fifth information also carries a first Internet Protocol (IP) address, which is used to indicate the address of the OMC; the sixth information also carries the first IP address, and the security gateway sends seventh information to the OMC, including: The security gateway sends the seventh information to the OMC based on the first IP address.

8. The method according to claim 5, characterized in that, The access platform performs base station activation operations through the IPsec tunnel based on the third parameter, including: The security gateway receives the tenth information sent by the base station based on the IPsec tunnel. The tenth information is used to request base station activation, and the tenth information carries the third parameter. The security gateway determines whether to allow the base station to activate itself based on the third verification parameter. When it is determined that the base station is allowed to activate, the security gateway sends an eleventh message to the signaling gateway. The eleventh message is used to request base station activation and carries the cell configuration parameters. The signaling gateway activates the base station in the core network equipment according to the cell configuration parameters; The signaling gateway sends a twelfth message to the security gateway, the twelfth message being used to indicate that the base station has been successfully activated; The security gateway forwards the twelfth information to the base station so that the base station can complete base station activation in the core network equipment.

9. The method according to claim 8, characterized in that, The security gateway sends the eleventh message to the signaling gateway, including: The security gateway sends the eleventh information to the signaling gateway based on the tenth information and the preset relationship, wherein the preset relationship is used to indicate the correspondence between the type of information received by the security gateway and the network element.

10. The method according to claim 8, characterized in that, The ninth piece of information also carries a second IP address, which is used to indicate the address of the signaling gateway; The tenth information also carries the second IP address, and the security gateway sends the eleventh information to the signaling gateway, including: The security gateway sends the eleventh message to the signaling gateway based on the second IP address.

11. The method according to claim 2, characterized in that, The first information also carries the location information of the base station, and the method further includes: The initialization server determines whether to allow the allocation of the first parameter to the base station based on the location information; or, the OMC determines whether to allow the allocation of the first parameter to the base station based on the location information obtained from the initialization server.

12. The method according to claim 8, characterized in that, The first verification parameter includes a first verification code and the validity period of the first verification code; the second verification parameter includes a second verification code and the validity period of the second verification code; and the third verification parameter includes a third verification code and the validity period of the third verification code.

13. The method according to claim 12, characterized in that, The method further includes: After authentication and authorization are successful, the security gateway updates the first verification parameter according to a first preset period and sends the updated first verification parameter to the base station. After the base station registration is completed, the security gateway updates the second verification parameter according to the second preset period and sends the updated second verification parameter to the base station; After the base station is activated, the security gateway updates the third verification parameter according to the third preset period and sends the updated third verification parameter to the base station.

14. The method according to claim 2, characterized in that, The first information also carries the location information of the base station and / or the start time of the base station, and the method further includes: The initialization server sends a twelfth message to the administrator, which asks whether the administrator allows the allocation of the first parameter to the base station identified by the device identifier at the location indicated by the location information and started at the startup time. The initialization server receives a thirteenth message sent by the administrator, the thirteenth message being used to indicate whether the allocation of the first parameter to the base station is permitted or not permitted.

15. The method according to claim 2, characterized in that, The first information also carries the location information of the base station and / or the start time of the base station, and the method further includes: The initialization server sends the fourteenth message to the OMC or the AAA server, the fourteenth message carrying the location information and / or the startup time; The OMC or the AAA server sends a twelfth message to the administrator, the twelfth message being used to ask the administrator whether to allow the allocation of the first parameter to the base station that is started at the location indicated by the location information and / or at the start time, and identified as the device identifier; The OMC or the AAA server receives a thirteenth message sent by the administrator, the thirteenth message being used to indicate whether the allocation of the first parameter to the base station is permitted or not permitted.

16. The method according to claim 5, characterized in that, When it is determined that the base station is not allowed to register, the method further includes: The security gateway releases the IPsec tunnel.

17. The method according to claim 8, characterized in that, When it is determined that the base station is not allowed to activate, the method further includes: The security gateway releases the IPsec tunnel.

18. The method according to claim 12, characterized in that, The method further includes: If the security gateway or the OMC does not receive a request for base station registration during the validity period of the second verification code, the security gateway releases the IPsec tunnel.

19. The method according to claim 12, characterized in that, The method further includes: If the security gateway does not receive a request for base station activation within the validity period of the third verification code, the security gateway releases the IPsec tunnel.

20. The method according to claim 13, characterized in that, The method further includes: The security gateway receives the fifteenth message sent by the base station after receiving the updated first verification parameter, the fifteenth message being used to indicate that the base station has received the updated first verification parameter; The security gateway receives a sixteenth message sent by the base station after receiving the updated second verification parameters, the sixteenth message indicating that the base station has received the updated second verification parameters; The security gateway receives the seventeenth message sent by the base station after receiving the updated third verification parameter. The seventeenth message is used to indicate that the base station has received the updated third verification parameter.

21. The method according to claim 20, characterized in that, If the fifteenth, sixteenth, or seventeenth information is not received, the method further includes: The security gateway releases the IPsec tunnel.

22. The method according to claim 13, characterized in that, The method further includes: When the base station reconnects without restarting, the access platform performs authentication and authorization operations according to the updated first verification parameters, performs base station registration operations according to the updated second verification parameters, and performs base station activation operations according to the updated third verification parameters.

23. The method according to claim 3, characterized in that, The method further includes: After the IPsec tunnel is established, the security gateway sends query information to the OMC or signaling gateway according to a fourth preset period. The query information is used to query the status of the base station, and the status of the base station includes connected state, active state, and offline state. The security gateway releases the IPsec tunnel when it determines that the base station is offline for a preset period of time.

24. A base station activation method, characterized in that, The method includes: When the base station starts base station activation, the base station receives a first parameter sent by the access platform; the first parameter includes a first verification parameter and an authentication parameter, and the first parameter is used for authentication and authentication. The base station performs authentication and authorization operations based on the first parameter and receives the second parameter sent by the access platform; the second parameter includes a second verification parameter, which is used for base station registration; The base station performs a base station registration operation through an IPsec tunnel based on the second parameter, and receives a third parameter sent by the access platform; wherein, the IPsec tunnel is established by the access platform after authentication and authorization are passed; the third parameter includes a third verification parameter and a cell configuration parameter, and the third parameter is used for base station activation; The base station performs a base station activation operation through the IPsec tunnel based on the third parameter, so that the base station is activated in the core network equipment.

25. The method according to claim 24, characterized in that, The access platform includes the following network elements: initialization server, security gateway, AAA server, signaling gateway, and OMC; When the base station initiates base station activation, the base station receives a first parameter sent by the access platform, including: The base station sends first information to the initialization server. The first information is used to request the first parameter and carries the device identifier of the base station. The base station receives the first parameter sent by the initialization server when it determines that it is permissible to allocate the first parameter to the base station; The step of determining the first parameter includes: the initialization server receiving first information sent by the base station, the first information being used to request the first parameter, the first information carrying the device identifier of the base station; the initialization server generating the authentication parameter based on the device identifier, or the AAA server generating the authentication parameter based on the device identifier obtained from the initialization server and sending it to the initialization server; and the security gateway generating the first verification parameter based on the device identifier obtained from the initialization server and sending it to the initialization server.

26. The method according to claim 25, characterized in that, The base station performs authentication and authorization operations based on the first parameter, and receives a second parameter sent by the access platform, including: The base station sends a second message to the security gateway. The second message is used to request authentication and authorization. The second message carries the device identifier, the first verification parameter, and authentication data. The authentication data is calculated by the base station based on the authorization parameter. The base station receives the fifth information sent by the security gateway, the fifth information being used to indicate that authentication and authorization have been passed, and the fifth information carrying the second parameter; The determination step of the second parameter includes: the security gateway determining whether to allow the base station to perform authentication and authorization based on the first verification parameter and the device identifier; when it is determined that the base station can perform authentication and authorization, the security gateway sends third information to the AAA server, the third information being used to request authentication and authorization, and the third information carrying the authentication data and the device identifier; the AAA server performs authentication and authorization based on the authorization parameter, the authentication data, and the device identifier; after determining that the authentication and authorization are successful, the AAA server sends fourth information to the security gateway, the fourth information being used to indicate that the authentication and authorization are successful; the security gateway completes the establishment of the IPsec tunnel and generates the second parameter based on the device identifier.

27. The method according to claim 26, characterized in that, The base station performs a base station registration operation through an IPsec tunnel based on the second parameter, and receives a third parameter sent by the access platform, including: The base station sends a sixth message to the security gateway based on the IPsec tunnel. The sixth message is used to request base station registration and carries the second verification parameter and the device identifier. The base station receives the ninth information sent by the security gateway. The ninth information is used to indicate that the base station registration is complete, and the ninth information carries the third parameter. The determination step of the third parameter includes: the security gateway determining whether to allow the base station to register based on the second verification parameter; when it is determined that the base station is allowed to register, the security gateway sends a seventh message to the OMC, the seventh message being used to request base station registration, and the seventh message carrying the device identifier; the OMC registers the base station based on the device identifier; the OMC generates the cell configuration parameters based on the device identifier and sends an eighth message to the security gateway, the eighth message being used to indicate that the base station registration is complete, and the eighth message carrying the cell configuration parameters; the security gateway generates the third verification parameter based on the device identifier; the security gateway sends a ninth message to the base station, the ninth message being used to indicate that the base station registration is complete, and the ninth message carrying the third parameter.

28. The method according to claim 27, characterized in that, The fifth information also carries a first IP address, which is used to indicate the address of the OMC; the sixth information also carries the first IP address, so that the security gateway can send the seventh information to the OMC based on the first IP address.

29. The method according to claim 27, characterized in that, The base station performs a base station activation operation through the IPsec tunnel based on the third parameter, including: The base station sends a tenth message to the security gateway based on the IPsec tunnel. The tenth message is used to request base station activation and carries the third parameter. The base station receives the twelfth information forwarded by the security gateway, so that the base station can complete base station activation in the core network equipment; The step of determining the twelfth information includes: the security gateway determining whether to allow the base station to activate based on the third verification parameter; when it is determined that the base station can activate, the security gateway sends an eleventh information to the signaling gateway, the eleventh information being used to request base station activation, the eleventh information carrying the cell configuration parameters; the signaling gateway activating the base station in the core network equipment according to the cell configuration parameters; and the signaling gateway sending a twelfth information to the security gateway, the twelfth information indicating successful base station activation.

30. The method according to claim 29, characterized in that, The ninth message also carries a second IP address, which is used to indicate the address of the signaling gateway; the tenth message also carries the second IP address, so that the security gateway can send the eleventh message to the signaling gateway based on the second IP address.

31. The method according to claim 25, characterized in that, The first information also carries the location information of the base station, so that the initialization server can determine whether to allow the allocation of the first parameter to the base station based on the location information, or so that the OMC can determine whether to allow the allocation of the first parameter to the base station based on the location information obtained from the initialization server.

32. The method according to claim 29, characterized in that, The first verification parameter includes a first verification code and the validity period of the first verification code; the second verification parameter includes a second verification code and the validity period of the second verification code; and the third verification parameter includes a third verification code and the validity period of the third verification code.

33. The method according to claim 32, characterized in that, The method further includes: After authentication and authorization are successful, the base station receives the updated first verification parameter sent by the security gateway. The updated first verification parameter is obtained by the security gateway updating the first verification parameter according to a first preset period. After the base station registration is completed, the base station receives the updated second verification parameters sent by the security gateway. The updated second verification parameters are obtained by the security gateway updating the second verification parameters according to a second preset period. After the base station is activated, the base station receives the updated third verification parameters sent by the security gateway. The updated third verification parameters are obtained by the security gateway by updating the third verification parameters according to a third preset period.

34. The method according to claim 25, characterized in that, The first information also carries the location information of the base station and / or the start time of the base station, so that the initialization server sends a twelfth information to the administrator, the twelfth information being used to ask the administrator whether to allow the allocation of the first parameter to the base station identified by the device identifier at the location indicated by the location information and started at the start time; The initialization server receives a thirteenth message sent by the administrator, the thirteenth message being used to indicate whether the allocation of the first parameter to the base station is permitted or not permitted; or, This causes the initialization server to send fourteenth information to the OMC or the AAA server, the fourteenth information carrying the location information and / or the startup time; The OMC or the AAA server sends a twelfth message to the administrator, which inquires whether the administrator should allow the allocation of the first parameter to the base station that is activated at the location indicated by the location information and / or at the activation time, and is identified as the device identifier; the OMC or the AAA server receives a thirteenth message from the administrator, which indicates whether the allocation of the first parameter to the base station is allowed or not allowed.

35. The method according to claim 33, characterized in that, The method further includes: After receiving the updated first verification parameter, the base station sends the fifteenth message to the security gateway, the fifteenth message indicating that the base station has received the updated first verification parameter; After receiving the updated second verification parameters, the base station sends a sixteenth message to the security gateway, the sixteenth message indicating that the base station has received the updated second verification parameters; After receiving the updated third verification parameters, the base station sends a seventeenth message to the security gateway, the seventeenth message indicating that the base station has received the updated third verification parameters.

36. The method according to claim 33, characterized in that, The method further includes: When the base station reconnects without restarting, the base station performs authentication and authorization operations according to the updated first verification parameters, performs base station registration operations according to the updated second verification parameters, and performs base station activation operations according to the updated third verification parameters.

37. A communication device, characterized in that, The apparatus includes: a module for performing the method as described in any one of claims 1-23; or a module for performing the method as described in any one of claims 24-36.

38. A communication device, characterized in that, include: processor; The processor is configured to execute a computer-executable program or instructions in memory, causing the communication device to perform the method according to any one of claims 1-23; or, causing the communication device to perform the method according to any one of claims 24-36.

39. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer-executable program or instructions configured to perform the method according to any one of claims 1-23; or, the computer-executable program or instructions are configured to perform the method according to any one of claims 24-36.

40. A computer program product, characterized in that, include: An execution instruction is stored in a readable storage medium, at least one processor of the communication device reads the execution instruction from the readable storage medium, and at least one processor executes the execution instruction to cause the communication device to implement the method of any one of claims 1-23, or at least one processor executes the execution instruction to cause the communication device to implement the method of any one of claims 24-36.

Images