CN106454836A - Method and device for enhancing use security of equipment certificate - Google Patents

Abstract

The invention discloses a method and device for enhancing the security of equipment certificate use, and relates to communication technology. The method includes: when a device requests to access a public transmission network, the gateway of the public transmission network acquires the device certificate from the device requesting access. ID and certificate ID; the gateway of the public transmission network judges whether the device requesting access is a legitimate device according to the obtained device ID and/or the relationship between the device ID and the certificate ID; when the gateway of the public transmission network When it is judged that the device requesting access is a legal device, the device requesting access is connected to the public transmission network; otherwise, the device requesting access is denied to access the public transmission network. The invention can improve the security of the digital certificate, can effectively prevent criminals from stealing the certificate of the equipment, and guarantee the access safety of the equipment and the transmission field.

Description

A method and device for enhancing the security of equipment certificate use

technical field

The invention relates to communication technology, in particular to a method and device for enhancing the security of using equipment certificates.

Background technique

A home base station (Home eNodeB, HeNB) is generally placed in an enterprise or a user's home, and may pass through a public transmission network, so it has higher requirements on device security.

The 3rd Generation Partnership Project (3rd Generation Partnership Project, 3GPP) stipulates that HeNB uses Internet Protocol Security (Internet Protocol Security, IPSec) protocol to ensure the authentication and encryption of base station messages, and the negotiation protocol is Internet Key Exchange (Internet Key Exchangev v2, IKEv2), certificates and Universal Subscriber Identity Module (USIM) cards are recommended for authentication. In practical applications, the certificate system based on the public key infrastructure (Public Key Infrastructure, PKI) architecture is too complex, slow to deploy, and poor in application expansion capabilities.

Operators have their own progress in specific PKI deployment. For example, China Mobile's digital certificate system is still under construction, but wireless access equipment (NanoCell) has already begun to be deployed in some provinces. What is the pre-installed operator certificate, and vice versa is the implementation of the online certificate application (CMPV2 protocol) program.

The HeNB base station may pass through the public transmission network. In the case that the existing hardware cannot protect the certificate and private key well, even through the online certificate application scheme, the HeNB certificate may be stolen by illegal users, and there are security problems.

In terms of ensuring the binding relationship between the certificate and the device, 3GPP recommends the dual authentication mode of certificate + USIM, but this implementation method is extremely complicated, and currently there is no device that supports this protocol. On the basis that the dual authentication function has not been realized, how to prevent illegal users from stealing the certificate of the base station and how to ensure the unique association between the certificate and the device is extremely important.

Contents of the invention

The purpose of the present invention is to provide a method and device for enhancing the safety of using certificates of equipment, which can better deny access to the transmission network for equipment illegally using certificates.

According to one aspect of the present invention, a method for enhancing the security of using a device certificate is provided, including:

When a device requests access to a public transport network, the gateway of the public transport network obtains a device ID and a certificate ID from the device requesting access;

The gateway of the public transmission network judges whether the device requesting access is a legitimate device according to the obtained device ID and/or the relationship between the device ID and the certificate ID;

When the gateway of the public transmission network judges that the device requesting access is a legal device, the device requesting access is connected to the public transmission network; otherwise, the device requesting access is denied access The public transport network.

Preferably, the gateway of the public transport network determines whether the device requesting access is a legal device according to the obtained device ID and/or the relationship between the device ID and the certificate ID, including:

The gateway of the public transmission network queries the access state of the device corresponding to the device ID according to the obtained device ID;

If the access state of the device corresponding to the queried device ID is connected, it is judged that the device requesting access is an illegal device; otherwise, it is judged that the device requesting access is an illegal device.

Preferably, the gateway of the public transport network determines whether the device requesting access is a legal device according to the obtained device ID and/or the relationship between the device ID and the certificate ID, including:

Perform consistency verification on the relationship between the device ID and the certificate ID;

When the verification is passed, it is judged that the device requesting access is a legitimate device, otherwise, it is judged that the device requesting access is an illegal device.

Preferably, the gateway of the public transport network determines whether the device requesting access is a legal device according to the obtained device ID and/or the relationship between the device ID and the certificate ID, including:

The gateway of the public transmission network queries the access state of the device corresponding to the device ID according to the obtained device ID;

If the access state of the device corresponding to the queried device ID is not connected, then perform a consistency check on the relationship between the device ID and the certificate ID;

When the verification is passed, it is judged that the device requesting access is a legitimate device, otherwise, it is judged that the device requesting access is an illegal device.

Preferably, the gateway of the public transport network binds the device ID and the certificate ID in advance for consistency verification.

According to another aspect of the present invention, a device for enhancing the security of device certificate use is provided, including:

The gateway obtaining module is used to obtain the device ID and the certificate ID from the device requesting access when the device requests access to the public transmission network;

A gateway judging module, configured to judge whether the device requesting access is a legal device according to the obtained device ID and/or the relationship between the device ID and the certificate ID;

A gateway access processing module, configured to connect the device requesting access to the public transmission network when judging that the device requesting access is a legitimate device, otherwise, rejecting the device requesting access to access The public transport network.

Preferably, the gateway judging module queries the access state of the device corresponding to the device ID according to the obtained device ID, and if the access state of the device corresponding to the queried device ID is connected, then judges The device requesting access is an illegal device, otherwise, it is determined that the device requesting access is an illegal device.

Preferably, the gateway judging module performs a consistency check on the relationship between the device ID and the certificate ID, and if the verification passes, it judges that the device requesting access is a legal device, otherwise, it judges that the device requesting access is an illegal device.

Preferably, the gateway judging module queries the access status of the device corresponding to the device ID according to the obtained device ID, and if the access status of the device corresponding to the queried device ID is not connected, then the The relationship between the device ID and the certificate ID is checked for consistency. When the verification is passed, it is judged that the device requesting access is a legitimate device, otherwise, the device requesting access is judged as an illegal device.

Preferably, it also includes:

The gateway binding module is configured to bind the device ID and the certificate ID in advance for consistency verification.

Compared with the prior art, the beneficial effects of the present invention are:

1. The present invention improves the security of certificates and can effectively prevent criminals from stealing device certificates;

2. Through the binding of certificates and devices, the present invention achieves the purpose of denying devices that illegally use certificates to access the public transmission network, thereby ensuring the access security of the base station and the transmission field.

Description of drawings

Fig. 1 is a functional block diagram of a method for enhancing the security of using a device certificate provided by an embodiment of the present invention;

Fig. 2 is a block diagram of an apparatus for enhancing device certificate use security provided by an embodiment of the present invention;

FIG. 3 is a network diagram of a system for enhancing device certificate use security provided by an embodiment of the present invention;

Fig. 4 is a flow chart of interaction between a base station and a security gateway for enhancing device certificate use security provided by an embodiment of the present invention.

detailed description

The preferred embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described below are only used to illustrate and explain the present invention, and are not intended to limit the present invention.

Fig. 1 is a schematic block diagram of a method for enhancing device certificate use security provided by an embodiment of the present invention. As shown in Fig. 1 , the steps include:

Step S101: When a device requests to access a public transmission network, the gateway of the public transmission network obtains a device ID and a certificate ID from the device requesting access.

Specifically, during the IPSEC negotiation initiated by the device requesting access to the public transport network, the device requesting access to the public transport network sends the device ID and the certificate of the device to the gateway of the public transport network; After receiving the device ID and the device certificate, the gateway obtains the certificate ID from the certificate.

Wherein, the device requesting to access the public transmission network generates the device ID according to its read device asset number (SN), and may also pre-save the device ID locally.

Step S102: The gateway of the public transport network judges whether the device requesting access is a legal device according to the obtained device ID and the relationship between the device ID and the certificate ID.

Specifically, the gateway of the public transport network can determine whether the device requesting access is a legitimate device in the following three ways:

Method 1: The gateway of the public transmission network queries the access state of the device corresponding to the device ID according to the obtained device ID, and if the access state of the device corresponding to the device ID found is connected, Then it is judged that the device requesting access is an illegal device, otherwise, it is judged that the device requesting access is an illegal device.

Method 2: The gateway of the public transmission network performs a consistency check on the relationship between the device ID and the certificate ID, and when the verification passes, it is judged that the device requesting access is a legitimate device, otherwise, it is judged that the requesting access The device is an illegal device.

Method 3: The gateway of the public transmission network queries the access state of the device corresponding to the device ID according to the obtained device ID, and if the access state of the device corresponding to the device ID found is not connected, A consistency check is performed on the relationship between the device ID and the certificate ID, and when the verification is passed, it is judged that the device requesting access is a legitimate device, otherwise, the device requesting access is judged to be an illegal device. That is to say, only when the access state of the device corresponding to the queried device ID is not connected, and the consistency check of the relationship between the device ID and the certificate ID is passed, it is judged that the request for access The device is a legal device.

Further, before step S101, the gateway of the public transport network needs to bind the device ID and certificate ID in advance, so that the pre-bound device ID and certificate ID can be used when performing consistency verification, Determine whether the binding relationship between the received device ID and the certificate ID is legal. If it is legal, the verification is passed. Otherwise, the verification is not passed. In other words, when the access state of the device corresponding to the device ID is not connected, and the relationship between the device ID and the certificate ID is consistent with the pre-saved binding relationship, it is determined that the request for access The device is a legal device, otherwise it is an illegal device.

Step S103: When the gateway of the public transmission network determines that the device requesting access is a legal device, connect the device requesting access to the public transmission network; otherwise, reject the device requesting access The device accesses the public transmission network.

FIG. 2 is a block diagram of an apparatus for enhancing device certificate use security provided by an embodiment of the present invention. As shown in FIG. 2 , it includes: a gateway acquisition module 10 , a gateway judgment module 20 , and a gateway access processing module 30 .

The gateway obtaining module 10 is used to obtain the device ID and the certificate ID from the device requesting access when the device requests access to the public transport network;

The gateway judging module 20 is used to judge whether the device requesting access is a legal device according to the obtained device ID and the relationship between the device ID and the certificate ID;

The gateway access processing module 30 is used for judging that the device requesting access is a legal device, and connecting the device requesting access to the public transmission network; otherwise, rejecting the device requesting access to access The public transport network.

Further, the device also includes:

The gateway binding module 40 is used to bind the device ID and the certificate ID in advance, and save the binding relationship for consistency verification.

The workflow of the device is as follows:

Step 1: During the IPSEC negotiation initiated by the device requesting access to the public transport network, the gateway acquisition module 10 receives the device ID and the certificate of the device sent by the device requesting access to the public transport network, and obtains the certificate from the certificate Certificate ID.

Step 2: The gateway judging module 20 judges whether the device requesting access is a legitimate device.

The specific judgment method can adopt any one of the following three methods:

Mode 1: The gateway judging module 20 queries the access state of the device corresponding to the device ID according to the obtained device ID, and if the access state of the device corresponding to the device ID found is connected, then judges the access status of the device corresponding to the device ID. If the above-mentioned device requesting access is an illegal device, otherwise, it is judged that the device requesting access is an illegal device.

Mode 2: The gateway judging module 20 performs a consistency check on the relationship between the device ID and the certificate ID, that is, uses the binding relationship between the device ID and the certificate ID previously bound and stored by the gateway binding module 40 to verify the device ID. The relationship between the ID and the certificate ID is verified for consistency. If the verification is passed, it is judged that the device requesting access is a legal device, otherwise, the device requesting access is judged as an illegal device.

Mode 3: The gateway judging module 20 queries the access state of the device corresponding to the device ID according to the obtained device ID, and if the access state of the device corresponding to the device ID found is not connected, then the The relationship between the device ID and the certificate ID is checked for consistency. When the verification is passed, it is judged that the device requesting access is a legitimate device, otherwise, the device requesting access is judged to be an illegal device.

Step 3: If the gateway judging module 20 judges that the device requesting access is an illegal device, the gateway access processing module 30 rejects the device requesting access to access the public transmission network, otherwise, the gateway access processing module 30. Connect the device requesting access to the public transmission network.

The devices in the embodiments shown in FIG. 1 and FIG. 2 may refer to all devices that use digital certificates. The base station is taken as an example below, and further description will be made in conjunction with FIG. 3 and FIG. 4 .

Fig. 3 is a network diagram of a system for enhancing device certificate use security provided by an embodiment of the present invention. As shown in Fig. 3, it includes: multiple base stations (AP-A, AP-B, ..., AP -N), in the security gateway (SeGW) of the public transport network, the core network.

1. Security gateway preset related information

The corresponding relationship between the base station and the certificate is pre-configured on the security gateway, specifically, the base station ID and the certificate ID are bound and stored in a database system or other devices.

2. The base station initiates an IPSEC negotiation request to the security gateway

During the IPSEC negotiation process, the base station requesting access to the public transport network will send the unique identifier of the base station (that is, the base station ID, APID) to the security gateway, and at the same time, in the identity authentication phase of IPSEC, the base station certificate will be sent to the security gateway. The security gateway will extract the CN field of the base station certificate from the certificate of the base station, and the CN field can be used to uniquely identify the certificate, that is, obtain the certificate ID.

The IPSEC negotiation request may also be initiated by the security gateway to the base station.

3. Processing of the security gateway

As the first implementation mode, the security gateway queries the APID and CN of the base station requesting to access the public transport network in the preset database system, and if the base station corresponding to the APID is already in the access state, it rejects this request. IPSEC negotiation request, rejecting the access of the base station requesting access to the public transmission network, and reporting an alarm; otherwise, if the base station corresponding to the APID is not in the access state, continue to judge whether the relationship between the APID and the CN meets the requirements, If the consistency requirements of the certificate and the device are met, the verification is passed, and the negotiation with the base station is continued. After the negotiation is successful, the base station requesting access to the public transmission network is successfully accessed, and the security gateway updates the access status of the base station as accepted If the verification fails, the access of the base station requesting to access the public transport network is rejected.

As a second implementation mode, the above-mentioned processing procedure of the security gateway can also be executed in the network management. Specifically, the security gateway sends the APID and CN of the base station requesting to access the public transmission network to the network management, and the base station is pre-configured on the network management. The corresponding relationship with the certificate. For the APID and CN sent by the security gateway, the network management checks the database to determine whether the APID and CN meet the consistency requirements. If they meet the consistency requirements between the certificate and the device, the verification is returned to the security gateway. If the message is passed, otherwise it returns a message that the verification fails; after the security gateway receives the message returned by the network management, if it is a message that passes the verification, it will continue to negotiate. After the negotiation is successful, the request will be connected to the public transmission network The base station accesses the public transmission network; if it is a message that the verification fails, deny the base station requesting to access the public transmission network to access the public transmission network.

Taking the first implementation as an example, Fig. 4 provides a flow chart of interaction between a base station and a security gateway that enhances the security of using device certificates. As shown in Fig. 4, the steps include:

Step 201: Request the base station (LTE-Femto) to access the public transport network to read its SN, and generate an APID according to the SN.

Step 202: The base station requesting access to the public transport network initiates IPSEC negotiation to the gateway (SeGW) of the public transport network, and sends its base station ID (ie APID) and certificate to the gateway during the IKEv2 negotiation.

Step 203: The gateway judges whether the access state of the base station corresponding to the APID is connected, and if so, executes step 204, otherwise executes steps 205, 206, and 207.

Step 204: The gateway refuses to allow the base station requesting to access the public transmission network to access the public transmission network.

Step 205: The gateway fetches the CN field from the certificate.

Step 206: The gateway judges whether the corresponding relationship between the APID and CN of the base station requesting access to the public transport network is legal, and determines whether to continue the negotiation to access the base station requesting access to the public transport network according to the judgment result, or directly refuses to The base station requesting to access the public transmission network accesses the public transmission network.

Step 207: The gateway sends a message of continuing negotiation or denying access to the base station requesting access to the public transport network.

Step 208: After the negotiation is successful, update the access status of the base station requesting to access the public transport network from non-access to access.

It can be seen from the above flow that the present invention has very little impact on the existing flow.

A specific application example is used for further description below.

A database about the relationship between APID and CN is preset on the security gateway, and Table 1 is a partial mapping or binding relationship table.

Table 1. The first mapping relationship table

serial number APID CN access status 1 001E7327042000021 Nodeb01 OFF 2 001E7327042000022 Nodeb02 OFF 3 001E7327042000023 Nodeb03 OFF 4 001E7327042000024 Nodeb04 OFF 5 001E7327042000025 Nodeb05 OFF

1. Application example 1

The API ID of base station A is 001E7327042000021, and uses the digital certificate whose CN is Nodeb01 to initiate an IPSEC negotiation request to the security gateway. According to Table 1, the security gateway determines that the access status of the base station with APID 001E7327042000021 is not connected (OFF) and the relationship between APID and CN of base station A is consistent with the mapping relationship in Table 1, and the verification passes, allowing base station A to access The public transmission network, and the access status in Table 1 is updated to connected (ON), and the database is updated, as shown in Table 2.

Table 2. The second mapping relationship table

serial number APID CN access status 1 001E7327042000021 Nodeb01 ON 2 001E7327042000022 Nodeb02 OFF 3 001E7327042000023 Nodeb03 OFF 4 001E7327042000024 Nodeb04 OFF 5 001E7327042000025 Nodeb05 OFF

2. Application example 2

The APID of base station B is 00000000000021, base station B steals the digital certificate of Nodeb01 whose CN is Nodeb01 of base station A, and initiates an IPSEC negotiation request to the security gateway. After the verification by the security gateway, because the corresponding relationship between APID and CN is invalid, the verification fails, and the security gateway rejects the access of base station B.

3. Application example 3

The APID of base station C is 00000000000031. Base station C stole the digital certificate of base station A whose CN is Nodeb01, forged and reported the APID as 001E7327042000021, and initiated an IPSEC negotiation request to the security gateway. The security gateway judges that the base station whose APID is 001E7327042000021 is already online, so the verification fails, and the security gateway rejects the access of base station C.

4. Application example 4

When expanding capacity, the user adds a new base station D, whose APID is 001E7327042000029, and uses the digital certificate whose CN is Nodeb09. At this time, it is necessary to add the relevant information of this base station on the security gateway first. The updated database is shown in Table 3.

When base station D initiates an IPSEC negotiation request, the security gateway determines that the access status of the base station with APID 001E7327042000029 is not connected (OFF), and the corresponding relationship between APID and CN is legal. At this time, the security gateway passes the verification and allows base station D to access. After the negotiation is successful, the access state in the database is updated from not connected (OFF) to connected (ON), as shown in Table 4 for details.

Table 3. The third mapping relationship table

serial number APID CN access status 1 001E7327042000021 Nodeb01 ON 2 001E7327042000022 Nodeb02 OFF 3 001E7327042000023 Nodeb03 OFF 4 001E7327042000024 Nodeb04 OFF 5 001E7327042000025 Nodeb05 OFF 6 001E7327042000029 Nodeb09 OFF

Table 4. The fourth mapping relationship table

serial number APID CN access status 1 001E7327042000021 Nodeb01 ON 2 001E7327042000022 Nodeb02 OFF 3 001E7327042000023 Nodeb03 OFF 4 001E7327042000024 Nodeb04 OFF 5 001E7327042000025 Nodeb05 OFF 6 001E7327042000029 Nodeb09 ON

5. Application example 5

The APID of base station E is 001E7327042000024, and the digital certificate whose CN is Nodeb04 is used, and it runs normally. The corresponding database on the security gateway is shown in Table 5.

Table 5. The fifth mapping relationship table

serial number APID CN access status 1 001E7327042000021 Nodeb01 ON 2 001E7327042000022 Nodeb02 OFF 3 001E7327042000023 Nodeb03 OFF 4 001E7327042000024 Nodeb04 ON 5 001E7327042000025 Nodeb05 OFF 6 001E7327042000029 Nodeb09 ON

Now because there is a problem with the hardware of base station E, it needs to be returned to the factory for repair, and the repair period is long. Replace base station E with another piece of new hardware (APID is 001E7327042000030), but hope to still use the original certificate of base station E. At this time, you can do the following to achieve expected.

1. Copy the original certificate of base station E to the new hardware,

2. The security gateway modifies the database, and the updated database is shown in Table 6.

Table 6. The sixth mapping table

serial number APID CN access status 1 001E7327042000021 Nodeb01 ON 2 001E7327042000022 Nodeb02 OFF 3 001E7327042000023 Nodeb03 OFF 4 001E7327042000030 Nodeb04 OFF 5 001E7327042000025 Nodeb05 OFF 6 001E7327042000029 Nodeb09 ON

When the device whose APID is 001E7327042000030 initiates an IPSEC negotiation request, the security gateway passes the verification and allows its access. After the negotiation succeeds, the database is updated as shown in Table 7.

Table 7. The seventh mapping relationship table

serial number APID CN access status 1 001E7327042000021 Nodeb01 ON 2 001E7327042000022 Nodeb02 OFF 3 001E7327042000023 Nodeb03 OFF 4 001E7327042000030 Nodeb04 ON 5 001E7327042000025 Nodeb05 OFF 6 001E7327042000029 Nodeb09 ON

In summary, the present invention has the following technical effects:

The present invention utilizes the device ID and/or the binding relationship between the device ID and the certificate ID to determine whether the device requesting access to the public network is a legal device, thereby rejecting the access of illegal devices to the public transmission network, especially rejecting the access of devices that illegally use certificates. Access to the public transmission network improves the security of the certificate and ensures the security of access in the transmission field.

Although the present invention has been described in detail above, the present invention is not limited thereto, and various modifications can be made by those skilled in the art based on the principle of the present invention. Therefore, any modifications made according to the principles of the present invention should be understood as falling within the protection scope of the present invention.

Claims (10)

1. a kind of device certificate that strengthens uses the method for safety it is characterised in that including：

When device request accesses common transmission network, the gateway of described common transmission network is from setting that request accesses Standby acquisition device id and certificate ID；

The gateway of described common transmission network is according to the pass of acquired device id and/or device id and certificate ID System, judges whether the equipment that described request accesses is legitimate device；

When the gateway of described common transmission network judges the equipment of described request access for legitimate device, will be described The equipment that request accesses accesses described common transmission network, conversely, the equipment then refusing described request access accesses Described common transmission network.

2. method according to claim 1 is it is characterised in that the gateway root of described common transmission network According to acquired device id and/or device id and the relation of certificate ID, judge that the equipment that described request accesses is The no step for legitimate device includes：

According to acquired device id, described device id is corresponding sets for inquiry for the gateway of described common transmission network Standby access state；

If the access state of the corresponding equipment of described device id inquiring is to access, judge described request The equipment accessing is illegality equipment, conversely, judging to ask the equipment accessing to be illegality equipment.

3. method according to claim 1 is it is characterised in that the gateway root of described common transmission network According to acquired device id and/or device id and the relation of certificate ID, judge that the equipment that described request accesses is The no step for legitimate device includes：

Consistency desired result is carried out to the relation of described device id and certificate ID；

When verification is passed through, judge that the equipment that described request accesses is legitimate device, conversely, judging that request accesses Equipment be illegality equipment.

4. method according to claim 1 is it is characterised in that the gateway root of described common transmission network According to acquired device id and/or device id and the relation of certificate ID, judge that the equipment that described request accesses is The no step for legitimate device includes：

According to acquired device id, described device id is corresponding sets for inquiry for the gateway of described common transmission network Standby access state；

If the access state of the corresponding equipment of described device id inquiring is not access, to described device id Carry out consistency desired result with the relation of certificate ID；

When verification is passed through, judge that the equipment that described request accesses is legitimate device, conversely, judging that request accesses Equipment be illegality equipment.

5. the method according to claim 3 or 4 is it is characterised in that the net of described common transmission network Close and in advance described device id is bound with certificate ID, for consistency desired result.

6. a kind of device certificate that strengthens uses the device of safety it is characterised in that including：

Gateway acquisition module, for when device request accesses common transmission network, the equipment accessing from request obtains Taking equipment ID and certificate ID；

Gateway judge module, for the relation according to acquired device id and/or device id and certificate ID, Judge whether the equipment that described request accesses is legitimate device；

Gateway accessing processing module, during for judging the equipment of described request access for legitimate device, asks described The equipment asking access accesses described common transmission network, conversely, then refusing the equipment access institute that described request accesses State common transmission network.

7. device according to claim 6 is it is characterised in that described gateway judge module is according to being obtained The device id taking, the access state of the inquiry corresponding equipment of described device id, if the described device id inquiring The access state of corresponding equipment is to access, then judge that the equipment that described request accesses is illegality equipment, conversely, Judge to ask the equipment accessing to be illegality equipment.

8. device according to claim 6 is it is characterised in that described gateway judge module sets to described The relation of standby ID and certificate ID carries out consistency desired result, if verification is passed through, judges setting of described request access Standby for legitimate device, conversely, the equipment judging to ask access is illegality equipment.

9. device according to claim 6 is it is characterised in that described gateway judge module is according to being obtained The device id taking, the access state of the inquiry corresponding equipment of described device id, if the described device id inquiring The access state of corresponding equipment is not access, then carry out concordance to the relation of described device id and certificate ID Verification, when verification is passed through, judges that the equipment that described request accesses is legitimate device, conversely, judging that request connects The equipment entering is illegality equipment.

10. device according to claim 8 or claim 9 is it is characterised in that also include：

Gateway binds module, for being bound described device id with certificate ID in advance, for concordance school Test.