WO2009018778A1 - Method, device and system for non-card device accessing personal network - Google Patents

Abstract

A method, a device and a system for the non-card device accessing personal network are provided, enabling the non-card device to register to personal network. The non-card device permitted to access personal network is distributed a personal network element identifier by judging whether to permit the non-card device to access personal network or not, sending personal network element identifier to the non-card device permitted to access personal network. A personal network management and a connection system are also provided.

Description

 Method, device and system for accessing personal network without card device

 This application claims the priority of the Chinese patent application filed on August 7, 2007, the Chinese Patent Office, the application number is 200710075709.8, and the invention is entitled "Methods, devices and systems for accessing personal networks without card devices." This is incorporated herein by reference.

Technical field

 The present invention relates to the field of communications, and in particular, to a technology for a cardless device to access a personal network.

Background technique

 With the development of communication technology, many contracted users now have more than one device for mobile communication services, and the subscribers can connect all the devices they own into a personal network (Personal Network, referred to as "PN").

 The PN is composed of a personal area network (PAN), and the PAN includes at least one user equipment (User Equipment, with a Universal Subscriber Identity Module ("USIM"). Referred to as "UF,", it can also include other cardless devices, such as Mobile Equipment ("ME"), Terminal Equipment ("TE"), and Mobile Termination (MT). Ordinary devices such as PCs. When there is only one active UE in a PAN, the UE can also be regarded as a constituent element of the PN.

In PN, various terminal devices (such as TE, ME, etc.) are called Personal Network Elements ("PNE";), and PN also includes Personal Network Management (PNM). _{0 The} PNM entity manages the various services required by the subscriber by managing the PNEs belonging to the same subscriber PN. The PNM entity can be a Personal Network Management Application Server ("PNM AS") in the network. Its functions mainly include the establishment, configuration and management of personal networks, registration and personalization of service terminals, and Secure connections between personal network elements, etc.

 In the process of implementing the present invention, the inventors have found that at least the following problems exist in the prior art: The prior art can only solve the problem that a terminal with a USIM accesses a PN, whereas in the prior art, only a cardless device is defined by a PNM entity. Business needs, but there is no effective solution for how cardless devices can access PN.

Summary of the invention In view of this, the main purpose of the embodiments of the present invention is to provide a method, device and system for a cardless device to access a personal network, so that the cardless device can be registered to the personal network.

 To achieve the above objective, in one aspect, an embodiment of the present invention provides a method for a cardless device to access a personal network, including the following steps:

 Determine whether card-free devices are allowed to access the personal network.

 A cardless device that allows access is assigned a personal network element identity, and the personal network element identity is sent to the cardless device that is allowed to access.

 In another aspect, the embodiment of the present invention further provides a personal network management entity, including: a determining unit: configured to determine whether a cardless device is allowed to access a personal network;

 The allocating unit is configured to: assign a personal network element identifier to the cardless device that is allowed to access; and send a unit: to send the personal network element identifier allocated by the allocating unit to the cardless device that is allowed to access.

 In another aspect, an embodiment of the present invention further provides an access system, including:

 The network entity is configured to connect a cardless device and a personal network management entity;

 The cardless device is configured to send an identity identifier to the personal network management entity by using the network entity;

 The personal network management entity is configured to determine whether the cardless device is allowed to access the personal network, and perform a corresponding access operation on the cardless device that is allowed to access.

 By comparison, it can be found that one of the above technical solutions has the following advantages or advantages compared with the prior art:

 The embodiment of the present invention determines whether the cardless device allows access to the personal network according to the identity identification identifier, or determines whether the cardless device allows access to the individual by using the authentication process of the cardless device. Network; assign a personal network element identifier to the cardless device that is allowed to access, and send the personal network element identifier to the cardless device that is allowed to access. It solves the problem of registering a cardless device to a personal network and provides a secure registration method that allows users to securely access the personal network.

DRAWINGS

1 is a flowchart of a method for a cardless device to access a personal network according to an embodiment of the present invention; FIG. 2 is a flow chart of a method for a cardless device to access a personal network according to a first embodiment of the present invention; 3 is a flow chart of a method for a cardless device to access a personal network according to a second embodiment of the present invention; FIG. 4 is a flow chart of a method for a cardless device to access a personal network according to a third embodiment of the present invention; FIG. 6 is a flowchart of a method for a cardless device to access a personal network according to a fifth embodiment of the present invention; FIG. 7 is a sixth flowchart of a method for accessing a personal network according to a fifth embodiment of the present invention; FIG. 8 is a flowchart of a method for a cardless device to access a personal network according to a seventh embodiment of the present invention; FIG. 9 is a flowchart according to an eighth embodiment of the present invention. FIG. 10 is a flowchart of a method for a cardless device to access a personal network according to a ninth embodiment of the present invention; FIG. 11 is a cardless device access according to a tenth embodiment of the present invention; FIG. 12 is a flowchart of a method for a cardless device to access a personal network according to an eleventh embodiment of the present invention;

 13 is a flow chart showing a method of accessing a personal network by a cardless device according to a twelfth embodiment of the present invention;

 14 is a structural diagram of a personal network management entity according to an embodiment of the present invention;

 Figure 15 is a block diagram of an access system in accordance with an embodiment of the present invention.

detailed description

 The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

 In the process of a cardless device accessing a personal network, a cardless device needs to perform a registration process. Registration refers to the process of an entity joining a PN. This entity can be either a device or a group of devices. The registration process ensures that the device to be registered is licensed by the signing user, and the device is authenticated by a secure method to join the PN of the signing user. Once each device is successfully registered, the PNM entity assigns the device a personal network element identifier. This identity determines the identity of the device in the PN.

 An embodiment of the present invention provides a method for a cardless device to access a personal network. As shown in FIG. 1 , FIG. 1 is a flowchart of a method for a cardless device to access a personal network according to an embodiment of the present invention, including the following steps:

 In step 101, it is determined whether the cardless device is allowed to access the personal network;

The network side obtains the identity identifier of the cardless device, and determines whether the cardless device is allowed to access the personal network according to the identity identification identifier; or, the network side authenticates the cardless device, and determines Whether to allow the cardless device to access the personal network;

 The identification identifier is generally a device identification code of the cardless device. It is necessary to specifically indicate that the device identification code is used to correspond to the personal network element identifier sent by the personal network management entity in the future, so that the PNM AS can be saved and managed. Therefore, the device identification code is not limited herein, as long as the identifier that uniquely distinguishes the cardless device in a personal network can be used as the identity identifier of the cardless device;

 In step 102, the cardless device that is allowed to access is assigned a personal network element identifier; wherein the personal network element identifier is an identification number that identifies the cardless device in the personal network. It may be a PNE identifier (PNE identifier) in the embodiment of the present invention, but is merely a name adopted for convenience of description. This name is not intended to limit the scope of application of the embodiments of the present invention, i.e., there may be no PNE identifier names in some systems, but the technical solutions in the embodiments of the present invention cannot be considered to be applicable to these systems. Alternatively, the PNE identifier may be a unique number in the entire PN. In another case, in order to save the cell space, the PNE identifier is the same number in different PANs, but after adding different PAN identifiers, it becomes the entire PN. The unique identification number.

 In step 103, a personal network element identification is sent to the cardless device that is allowed to access. Sending the personal network element identifier to the cardless device in one of the following manners: the personal network management entity directly sends the personal network element identifier to the cardless device that is allowed to access;

 The personal network management entity notifies the personal network element identifier to the network application function entity, and the network application function entity sends the personal network element identifier to the cardless device that is allowed to access;

 Sending, by the personal network management entity, the personal network element identifier to the user equipment, where the user equipment sends the personal network element identifier to the cardless device that is allowed to access;

 Transmitting, by the personal network management entity, the personal network element identifier to a network application function entity, where the network application function entity sends the personal network element identifier to a user equipment, where the user equipment sends the personal network element identifier Give the cardless device that is allowed to access.

The embodiment of the present invention is specifically described. The user side of the embodiment of the present invention includes a personal area network ("PAN") composed of devices, including at least one A UE with a Universal Subscriber Identity Module ("USIM") may also include other cardless devices, such as Mobile Equipment ("ME"), and Terminal Equipment (referred to as Terminal Equipment). "TE"), mobile terminal (Mobile Termination, referred to as "MT"), PC, printer, scanner and other common equipment. In this embodiment, a cardless device selects a typical wireless local area network (WLAN) device as an example.

 It should be noted that, in the PN, more than one PAN may be present in the PN. For the sake of convenience, the embodiment of the present invention includes a PAN in the PN, and the PAN includes the UE and the PAN. The case of a cardless device. It should be noted that, in the embodiment of the present invention, the case where there are multiple PANs and UEs in the PN can still be applied, so that the technical solutions in the embodiments of the present invention cannot be considered to be applicable to these systems.

 The network side of the first embodiment of the present invention includes a personal network management entity (Personal Network Management, referred to as "ΡΝΜ"), a network application function entity (Network Application Function (NAF), and a bootstrap server function entity ( Bootstrapping Server Function, Referred to as "BSF"), the Home Subscriber Server ("HSS"), where the PNM entity can be a Personal Network Management Application Server (PNM AS) in the network, or other completions. The entity of the personal network management function.

 It should be noted that the PNMAS, HSS, BSF, NAF, etc. in the embodiments of the present invention are merely names used for convenience of description. These names are not limited to the scope of the embodiments of the present invention, that is, in some systems, there may be no names of entities such as PNMAS, HSS, BSF, NAF entities, etc., but the technical solution in the embodiments of the present invention cannot be considered as Can be applied to these systems.

 In this embodiment, when the PNM AS and the NAF function are separated, that is, the PNM AS and the NAF function entities exist in the network at the same time, the PNM AS functions as an authentication function, and the NAF functions as an authorization function. The WLAN device is self-registered, and the network side uses the Generic Bootstrapping Architecture ("GBA") authentication registration request message. Specifically as shown in Figure 2.

In step 201, the UE, the BSF, and the HSS perform a GBA process, and the UE and the BSF generate a shared key Ks. GBA technology can check and verify the identity of users of application services, and provide secure communication keys for users to access application services. Because GBA technology belongs to the field of communication security technology. Standardized technology, therefore, the details of the GBA technology are not repeated in this embodiment;

 In step 202, based on the shared key Ks in step 201, the BSF derives the key Ks_NAF, and the derived key may also be the case of GBA U Ks_int-NAF, or may be the case of GBA-ME.

Ks — ext — keys such as NAF.

 In step 203, the BSF sends the derived key Ks_NAF to the NAF;

 In step 204, the NAF receives the ^"green key Ks_NAF sent by the BSF, and saves the ^" birth key Ks_NAF;

 In step 205, the UE derives the key Ks_NAF based on the shared key Ks in step 201. In step 206, the UE transmits the derived key Ks_NAF to the WLAN device in the PAN through the local interface. Through this step, the NAF and the WLAN device have the shared key Ks-NAF; in particular, the shared key used to establish the secure channel here may be Ks-NAF, or may be derived based on Ks-NAF. Keys; it should be noted that the local interface has been defined by related specifications, and is a technology known in the art, and will not be described here;

 In this step, the UE sends the smear key Ks-NAF to the WLAN device in the PAN through the local interface, and optionally sends related parameters, which can establish related parameters of the security channel, or are related to specific service applications. Related parameters, or other related parameters.

 In step 207, the NAF and the WLAN device establish a secure channel based on the shared key Ks_NAF, which may be a pre-shared key transport layer security ("PSK TLS"), or IP security channel (IP security, referred to as "Ipsec"), or other types of security channels; in particular, the technology for establishing a secure channel belongs to the well-known technology in the industry, so the details of the secure channel technology are not described herein; Operation, communication between the NAF and the WLAN device can be performed through this secure channel;

 In step 208, the WLAN device sends a registration request to the NAF, where the registration request may include, but is not limited to, an identification identifier of the WLAN device, which is a device identification code of the WLAN device in this embodiment; The identification code is used to correspond to the PNE identifier (PNE identifier) issued by the PNM AS in the future, which facilitates the PNM storage management. Therefore, the WLAN device identification code is not limited to this, as long as it can be in a PN. The only identifier that distinguishes this cardless device can be used as the identity of the WLAN device;

In step 209, after receiving the registration request from the WLAN device, the NAF sends the request to the PNM AS. The indication indicates that the PNM AS allocates a PNE identifier (PNE identifier, PEL for short) to the WLAN device, and sends the WLAN device identification code; the PNE identifier is unique in the PN, and the identity of the PNE in the PN is determined. And location;

 It should be noted that the PNE identifier in the embodiment of the present invention is merely a name adopted for convenience of description. This name is not limited to the scope of the embodiments of the present invention. For details, refer to the description of the PNE identifier, which is not described here.

 In step 210, after receiving the registration request from the WLAN device sent by the NAF, the PNM AS determines whether to allow access according to the WLAN device identification code. For example, the PNM AS determines whether the WLAN device allows access according to the information saved by the PNM AS. It can be a user blacklist, or a device blacklist.

 Assign a PNE identifier to the WLAN device that is allowed to access, save the correspondence, and send the PNE identifier to the NAF;

 In this step, the PNM AS may also determine, according to some other user information (such as a public identity), whether the user has the right to register the device;

 At the same time, the PNM AS can also save the device number or public user identity available to the WLAN device locally. The identity is carried in the GBA User Security Settings ("GBSS") and sent to the NAF. The NAF is sent to the PNM AS.

 In step 211, the NAF sends a registration response to the WLAN device through the secure channel, where the registration response can carry the PNE identifier assigned to the WLAN device;

 It should be noted that, in this embodiment, after the PNM AS allocates the PNE identifier to the WLAN device, the NAF sends the PNE identifier to the WLAN device through the secure channel, where the PNE identifier may be transmitted by using an existing message, or Define a new message to transmit the PNE identifier

 In step 212, the WLAN device sends a response that has been successfully registered to the UE through the local interface, and notifies the UE that it has registered to the personal network.

In this embodiment, when the PNM AS and the NAF function are separated, two functional entities, the PNM AS and the NAF, exist in the network, and the WLAN device authenticates the registration message through the GBA mode, and passes the secure channel. It protects the delivery of PNE identifiers, prevents PNs from being maliciously infringed, and improves security. The present invention provides an application scenario of the second embodiment, which is different from the first embodiment in that: when only the PNM AS exists in the network, the PNM AS not only has the authentication function and the PN management function, but also has the function of the NAF to participate in the GBA. process. The WLAN device is self-registered, and the network side uses the GBA authentication registration request message. Specifically shown in Figure 3.

 In step 301, the UE, the BSF, and the HSS perform a GBA process, and the UE and the BSF generate a shared key Ks. The GBA technology can implement the function of checking and verifying the identity of the user of the application service, and providing a key for the user to access the application service. Since the GBA technology belongs to the standardized technology in the field of communication security technology, it is no longer in this embodiment. Describe the details of GBA technology;

 In step 302, based on the shared key Ks in step 301, the BSF derives the key Ks_NAF, and the derived key may also be the case of GBA U Ks_int-NAF, or may be the case of GBA-ME Ks_ext_NAF, or Is the other ^" raw key;

 In step 303, the BSF sends the derived key Ks_NAF to the PNMAS;

 In step 304, the PNM AS receives the "green key Ks_NAF" sent by the BSF, and saves the "generated key Ks-NAF;

 In step 305, the UE derives the key Ks_NAF based on the shared key Ks in step 301; in step 306, the UE sends the dirty key Ks_NAF to the WLAN device in the PAN through the local interface. Through this step, the NAF and the WLAN device have the shared key Ks-NAF; in particular, the shared key used to establish the secure channel here may be Ks-NAF or may be derived based on Ks-NAF. Keys; it should be noted that the local interface has been defined by related specifications, and is a technology known in the art, and will not be described here;

 In this step, the UE sends the smear key Ks-NAF to the WLAN device in the PAN through the local interface, and optionally sends related parameters, which can establish related parameters of the security channel, or are related to specific service applications. Related parameters, or other related parameters.

In step 307, the PNM AS and the WLAN device establish a secure channel based on the shared key Ks-NAF, and the secure channel may be a pre-shared key transport layer security ("PSK TLS"). Or IP security channel (IP security, referred to as "Ipsec"), or other types of security channels; in particular, the technology for establishing a secure channel belongs to the well-known technology in the industry, so the details of the secure channel technology are not described here; 307 operation, PNM Communication between the AS and the WLAN device can be performed through this secure channel;

 In step 308, the WLAN device sends a registration request to the PNM AS, where the registration request may include, but is not limited to, a device identification code of the WLAN device. The PNE identifier (PNE identifier) is corresponding to the PNM storage management. Therefore, the WLAN device identification code is not limited to this, as long as the identifier of the cardless device can be uniquely distinguished in a PN.

 In step 309, after receiving the registration request from the WLAN device sent by the NAF, the PNMAS determines whether to allow access according to the WLAN device identification code. For example, the PNM AS determines whether the WLAN device allows access according to the information saved by itself, and the information may be It is a user blacklist, or a device blacklist.

 Assign a PNE identifier to the WLAN device that is allowed to access, save the correspondence, and send the PNE identifier to the NAF;

 It should be noted that the PNE identifier in the embodiment of the present invention is merely a name adopted for convenience of description. This name does not limit the scope of application of the embodiments of the present invention, that is, there may be no name of the PNE identifier in some systems, but it cannot be considered that the technical solutions in the embodiments of the present invention are not applicable to these systems. Alternatively, the PNE identifier may be a unique number in the entire PN. In another case, in order to save the cell space, the PNE identifier is the same number in different PANs, but after adding different PAN identifiers, it becomes the entire PN. The unique identification number.

 The PNE identifier is unique in the PN, and the identity and location of the PNE in the PN are determined. It is to be noted that the PNE identifier in the embodiment of the present invention is merely a name used for convenience of description. This name does not limit the scope of application of the embodiments of the present invention, that is, there may be no name of the PNE identifier in some systems, but it cannot be considered that the technical solutions in the embodiments of the present invention are not applicable to these systems. Alternatively, the PNE identifier may be a unique number in the entire PN, or in order to save the cell space, the PNE identifier is the same number in different PANs, but after adding different PAN identifiers, it becomes the unique identification number in the entire PN. .

 In this step, the PNM AS may also determine, according to some other user information (such as a public identity), whether the user has the right to register the device;

In this step, the PNM AS can also save the device number or public available for the WLAN device locally. Total user identity. The identity is carried in the GBA User Security Settings (GBS) and sent to the NAF. The NAF is sent to the PNMAS.

 In step 310, the WLAN device sends a response that has been successfully registered to the UE through the local interface, and notifies the UE that it has registered to the personal network.

 In this embodiment, when the PNM AS and the NAF function are combined, the WLAN device authenticates the registration message through the GBA mode, protects the PNE identifier from being sent through the secure channel, prevents the PN from being maliciously invaded, and improves the security.

 The application scenario of the third embodiment of the present invention is basically similar to that of the first embodiment. The PNM AS and the NAF function are separated, and two functional entities, PNMAS and NAF, exist in the network, and the network side uses the Generic Bootstrapping Architecture (abbreviation). "GBA") authentication registration request message. The difference is that the UE is registered instead of the WLAN device, as shown in FIG. 4 .

 Steps 401 to 406 are the same as steps 201 to 206 in the first embodiment, and are not described herein again.

 In step 407, the UE sends a WLAN device registration request and a WLAN device identification code to the NAF through the Ua port or the other network side interface, and the message is encrypted and protected by the GBA derivative key Ks-NAF;

 The registration request may include, but is not limited to, a device identification code of the WLAN device. The WLAN device identification code is used to correspond to the PNE identifier (PNE identifier) issued by the PNM AS in the future. It is convenient for the PNM to save management. Therefore, the WLAN device identification code is not limited herein, as long as the identifier of the cardless device can be uniquely distinguished in one PN;

In step 408, the NAF and the WLAN device establish a secure channel based on the shared key Ks-NAF, which may be a pre-shared key transport layer security ("PSK TLS"), or IP security channel (IP security, referred to as "Ipsec"), or other types of security channels; it is particularly important to note that the techniques for establishing a secure channel are well known in the art, so the details of the secure channel technology are not described herein; Operation, communication between the NAF and the WLAN device can be performed through this secure channel; Steps 409 to 412 are the same as steps 209 to 212 in the first embodiment, and are not described herein again.

 In this embodiment, the PNE identifier is transmitted through the secure channel to prevent the PN from being maliciously infringed, and the security is improved. At the same time, the registration mode of the UE instead of the WLAN device registration is provided, and the user can select the registration mode according to the preference.

 The application scenario of the fourth embodiment of the present invention is basically similar to that of the second embodiment, and the difference is that the UE is registered instead of the WLAN device, as shown in FIG. 5 .

 The steps 501 to 506 are the same as the steps 301 to 306 in the second embodiment, and are not described herein again.

 In step 507, the UE sends a WLAN device registration request and a WLAN device identification code to the PNM AS through the Ut port or the other network side interface, and the message uses the GBA derived key.

Ks—NAF encryption protection;

 The registration request may include, but is not limited to, a device identification code of the WLAN device. The WLAN device identification code is used to correspond to the PNE identifier (PNE identifier) issued by the PNM AS in the future. It is convenient for the PNM to save management. Therefore, the WLAN device identification code is not limited herein, as long as the identifier of the cardless device can be uniquely distinguished in one PN;

 In step 508, the PNM AS and the WLAN device establish a secure channel based on the shared key Ks-NAF, and the secure channel may be a pre-shared key transport layer security ("PSK TLS"). Or IP security channel (IP security, referred to as "Ipsec"), or other types of secure channels; it is important to point out that the technology for establishing a secure channel is a well-known technology in the industry, so the details of the secure channel technology are not mentioned here; In operation of step 508, communication between the NAF and the WLAN device can be performed through the secure channel;

 Steps 509 to 510 are the same as steps 309 to 310 in the second embodiment, and are not described herein again.

In this embodiment, the PNE identifier is sent through the secure channel to prevent the PN from being maliciously infringed, and the security is improved. The registration mode of the UE instead of the WLAN device registration is provided, and the user can use the local policy or the network side policy. Or choose a registration method in advance by the network side to negotiate with the user. The application scenario of the fifth embodiment of the present invention is basically similar to that of the third embodiment. The difference is that the UE registers multiple WLAN devices at a time. In this embodiment, two WLAN devices are taken as an example, as shown in FIG. 6 .

 The steps 601 to 605 are the same as the steps 401 to 405 in the third embodiment, and are not described herein again.

 In step 606, the UE sends the derived key Ks_NAF to the WLAN1 device in the PAN through the local interface. Through this step, the NAF and WLAN1 devices have the shared key Ks-NAF; in particular, the shared key used to establish the secure channel here may be Ks-NAF or may be derived based on Ks-NAF. Keys; it should be noted that the local interface has been defined by related specifications, and is a technology known in the art, and will not be described here;

 In this step, the UE sends the smear key Ks-NAF to the WLAN device in the PAN through the local interface, and optionally sends related parameters, which may establish related parameters of the security channel, or are related to specific service applications. Parameters, or other related parameters.

 In step 607, the UE sends the derived key Ks_NAF to the WLAN2 device in the PAN through the local interface. Through this step, the NAF and WLAN2 devices have the shared key Ks-NAF; it is particularly pointed out that here The shared key used to establish a secure channel may be Ks-NAF or a key based on Ks-NAF redistribution; in particular, the local interface has been defined by relevant specifications and belongs to the known technology in the industry. I will not repeat them here;

 In this step, the UE sends the smear key Ks-NAF to the WLAN 2 device in the PAN through the local interface, and optionally sends related parameters, which can establish related parameters of the security channel, or are related to specific service applications. Related parameters, or other related parameters.

 In step 608, the UE sends the WLAN device registration request and the identification codes of the WLAN devices 1 and 2 to the NAF through the Ua port or other network-side interfaces. The message is encrypted with the GBA derived key Ks-NAF.

The registration request may include, but is not limited to, a device identification code of the WLAN device. The WLAN device identification code is used to correspond to the PNE identifier (PNE identifier) issued by the PNM AS in the future. It is convenient for the PNM to save management. Therefore, the WLAN device identification code is not limited herein, as long as the identifier of the cardless device can be uniquely distinguished in one PN; Step 609 to step 613, and step 614 to step 618, respectively, the registration process of the WLAN1 device and the WLAN2 device are respectively the same as the steps 408 to 412 in the third embodiment, and details are not described herein again. For the implementation of the steps 609 to 613 and the steps 614 to 618, there is no order in time, and the method may be performed at the same time. This embodiment does not limit this.

 In this embodiment, multiple WLAN devices can be simultaneously registered to the PNM at the same time, which improves the registration efficiency. At the same time, the PNE identifier is protected by the secure channel to prevent the PN from being maliciously invaded and the security is improved.

 The application scenario of the sixth embodiment of the present invention is basically similar to that of the fourth embodiment. The difference is that the UE registers multiple WLAN devices at a time. In this embodiment, two WLAN devices are taken as an example, and the PNM AS is separately sent to each WLAN device. The PNE identifier is shown in Figure 7.

 Steps 701 to 705 are the same as steps 501 to 505 in the fourth embodiment, and are not described herein again.

 The steps 706 to 707 are the same as the steps 606 to 607 in the fifth embodiment, and are not described herein again.

 In step 708, the UE sends a WLAN device registration request and an identification code of the WLAN devices 1 and 2 to the PNM AS through the Ut port or the other network side interface. The message is GBA.

^Stained key Ks—NAF encryption protection.

 The registration request may include, but is not limited to, a device identification code of the WLAN device. The WLAN device identification code is used to correspond to the PNE identifier (PNE identifier) issued by the PNM AS in the future. It is convenient for the PNM to save management. Therefore, the WLAN device identification code is not limited herein, as long as the identifier of the cardless device can be uniquely distinguished in one PN;

 Step 709 to step 711 and step 712 to step 714 are the same as step 508 to step 510 in the fourth embodiment, respectively, and are not further described herein. For the implementation of the steps 709 to 713 and the steps 614 to 618, there is no order in time, and the method may be performed at the same time. This embodiment does not limit this.

In this embodiment, multiple WLAN devices can be simultaneously registered to the PNM at the same time, which improves registration efficiency. At the same time, the PNE identifier is protected by the secure channel to prevent the PN from being maliciously infringed and the security is improved. The application scenario of the seventh embodiment of the present invention is basically similar to that of the sixth embodiment. The difference is that all the PNE identifiers are sent to the UE by the PNM AS, and are sent by the UE to the WLAN devices. Specifically, as shown in Figure 8.

 Steps 801 to 805 are the same as steps 701 to 705 in the sixth embodiment, and are not described herein again.

 In step 806, the UE sends a WLAN device registration request and an identification code of the WLAN devices 1 and 2 to the PNM AS through the Ut interface, and the message is protected by GBA^"home key Ks-NAF encryption.

 The registration request may include, but is not limited to, a device identification code of the WLAN device. The WLAN device identification code is used to correspond to the PNE identifier (PNE identifier) issued by the PNM AS in the future. It is convenient for the PNM to save management. Therefore, the WLAN device identification code is not limited herein, as long as the identifier of the cardless device can be uniquely distinguished in one PN;

 In step 807, if the PNM AS considers that the registration is successful (the PNM AS may also need to judge whether the user has the right to register the device according to some user information), assign a PNE identifier to all the WLAN devices according to the WLAN device identification code, and save the corresponding Relationship

 It is worth noting that the PNM AS may locally store the device number or public user identity available to the user.

 In step 808, the PNMAS sends the allocated PNE identifier encrypted with Ks-NAF and the corresponding relationship with the WLAN device identification code to the UE.

 In step 809 and step 810, the UE sends the PNE identifier to the WLAN device through the local interface according to the correspondence between the PNE identifier sent by the PNM AS and the WLAN device identification code.

 In this embodiment, multiple WLAN devices can be simultaneously registered to the PNM at the same time, which improves the registration efficiency. At the same time, the PNE identifier is protected by the secure channel to prevent the PN from being maliciously invaded and the security is improved.

The application scenario of the eighth embodiment of the present invention is basically similar to that of the seventh embodiment. The difference is that the PNMAS and the NAF function are separated. The PNM AS and the NAF function entities exist in the network, and the PNM AS performs the authentication function. Features. The UE sends a registration request for multiple WLAN devices and all the identifiers of the WLAN devices that need to be registered. In this embodiment, two WLAN devices are used. For example, all the PNE identifiers are sent to the UE by the NAF, and the WLAN devices are notified by the UE. Specifically, as shown in Figure 9.

 Steps 901 to 905 are the same as steps 601 to 605 in the fifth embodiment, and are not described herein again.

 In step 906, the UE sends the WLAN device registration request and the identification codes of the WLAN devices 1 and 2 to the NAF through the Ut interface, and the message is encrypted and protected by the GBA^"green key Ks-NAF. The registration request and the seventh embodiment The registration request in step 806 is the same, as described in detail above, and details are not described herein again;

 The key is that, in step 907, after receiving the registration request, the NAF sends an indication to the PNMAS, instructing the PNM AS to assign PNE identifiers to the WLAN devices 1 and 2, and transmitting the identification codes of the WLAN devices 1 and 2.

 In step 908, if the PNM AS considers that the registration is successful (the PNM AS may also need to judge whether the user has the right to register the device according to some user information), assign the PNE identifier to all the WLAN devices according to the WLAN device identification code, and save the corresponding Relationship

 It is worth noting that the PNMAS may locally store the device number or public user identity available to the user. Identity. The information is sent to the GUS and sent to the NAF, and the NAF is sent to the PNMAS.

 In step 909, the PNM AS sends the assigned PNE identifier to the NAF and the correspondence with all WLAN device identification codes.

 In step 910, after receiving the message of the PNM AS, the NAF encrypts the PNE identifiers with the Ks-NAF and the corresponding relationship with all the WLAN device identification codes, and sends the information to the UE through the Ua interface.

 In step 911 and step 912, the UE sends a PNE identifier to all WLAN devices through the local interface according to the correspondence between the PNE identifier sent by the PNM AS and all the WLAN device identification codes, indicating that the registration is successful.

 In the above embodiments, the network side uses the GBA mode to authenticate the user's registration message. When receiving the cardless device registration message sent by the user side, the key authentication message further derived by using the GBA related key or the GBA related key is legal. Sex.

In the ninth embodiment of the present invention, the network side may also adopt an authentication and key negotiation manner. (Authentication and key agreement, referred to as "AKA mode") is registered. At this time, the user directly obtains the authentication parameter quintuple from the HSS, and uses AKA to generate a shared key, thereby authenticating the validity of the registration message. Specifically, as shown in Figure 10.

 In step 1001, the UE sends a request for generating a shared key to the PNMAS;

 In step 1002, the PNM AS takes a set of authentication parameter quintuals to the HSS;

 In step 1003, the UE performs an AKA process with the PNMAS, and performs mutual authentication to generate a shared key K. The AKA algorithm can perform checking and verifying the identity of the user of the application service, and provides a key for secure communication for the user to access the application service; AKA belongs to the standardized technology in the field of communication security technology. Therefore, the details of AKA are no longer praised in this embodiment;

 In step 1004, the UE sends the shared key K to the WLAN device, and establishes a security channel related parameter, so that the PNMAS and the WLAN device have a shared key;

 The shared key used to establish a secure channel here may be K or a key based on K re-derived;

 In step 1005, the PNMAS and the WLAN device establish a secure channel based on the shared key K, such as PSK TLS, or IPsec, etc.; in step 1005, communication between the PNM AS and the WLAN device is performed through the secure channel.

 In step 1006, the WLAN device sends a registration request to the PNMAS, where the registration request may include, but is not limited to, a device identification code of the WLAN device. The WLAN device identification code is used for the PNE delivered by the PNM AS in the future. The identifier (PNE identifier, referred to as "PNE identifier") corresponds to the PNM storage management. Therefore, the WLAN device identification code is not limited to this, as long as the identifier of the cardless device can be uniquely distinguished in one PN;

 In step 1007, after receiving the registration request from the WLAN device sent by the NAF, the PNM AS determines that the registration is successful, assigns a PNE identifier to the WLAN device according to the WLAN device identification code, and saves the correspondence, and sends the PNE identifier to the NAF;

 In this step, the PNMAS can also determine whether the user has the right to register the device according to other user information (such as a public identity);

At the same time, in this step, the PNM AS can also save the device number or public user identity that is available to the WLAN device locally. Identity. The information is sent to the GUS and sent to the NAF, and the NAF is sent to the PNMAS.

 In step 1008, the WLAN device sends a successful registration response to the UE through the local interface, notifying the UE that it has registered to the personal network.

 It should be noted that, when the AKA authentication registration message is adopted, the embodiment of the present invention is applicable not only to the case where the cardless device is self-registered, but also to the case where the UE replaces the cardless device registration; not only for the single cardless device registration. The case can also be applied to the case of multiple cardless device registrations; the basic principle thereof has been explained in the foregoing embodiments, and those skilled in the art can associate with the AKA solution according to the GBA technical revelation, or based on other The solution to the authentication algorithm. No longer here - list these technical solutions.

 In the tenth embodiment of the present invention, the network side may also use the GBA mode to authenticate the registration information, when

The PNM AS has the NAF function. The WLAN device is self-registered and can directly share the key with the BSF for the GBA process. Specifically as shown in Figure 11.

 In step 1101, the WLAN device, the BSF and the HSS perform a GBA process, and the WLAN device and the BSF generate a shared key Ks.

 In step 1102, the BSF derives the key Ks-NAF.

 In step 1103 and step 1104, the BSF sends the "Generation Key Ks-NAF" and the established security channel related parameters to the PNM AS, and the PNM AS saves the derived key.

 In step 1105, the WLAN device generates a "home key Ks-NAF" such that the PNM AS and the WLAN device have a shared key.

 In step 1106, the PNM AS and the WLAN device establish a secure channel based on the shared key, which may be PSK TLS, or IPsec. Thereafter, communication between the PNM AS and the WLAN device takes place via this secure channel.

 In step 1107, the WLAN device sends a registration request to the PNM AS, including the device identification code of the WLAN device.

 In step 1108 and in step 1109, if the PNM AS considers that the registration is successful (the PNM AS may also need to determine whether the user has the right to register the device or the public identity according to some user information), the WLAN device identification code is assigned to the WLAN device. PNE identifier, and save this correspondence, send PNE identifie to the WLAN device

It is worth pointing out that PNMAS may locally store the device number or public user available to the user. Identity. Identity. The information is sent to the GUS and sent to the NAF, and the NAF is sent to the PNMAS.

 In step 1110, the WLAN device sends a response to the UE that has successfully registered, informing the UE that it has registered to the personal network.

 This embodiment solves the problem that a cardless device is registered to a personal network, and provides a method of secure registration so that the user's personal network is not invaded by a malicious terminal.

 In the eleventh embodiment of the present invention, the network side may also use the public key certificate to authenticate the registration information, thereby authenticating the validity of the registration message. Specifically, as shown in Figure 12.

 In step 1201, the WLAN device performs an authentication process with the PNMAS through a public key certificate (or a shared key, that is, a key shared by the WLAN device and the network in advance). After the PNMAS verifies the identity of the WLAN device, it determines whether to allow it to join the P-awake according to the user subscription information or the locally stored correspondence between the user and the device.

 The manner in which the PNM AS determines whether to allow the device to join may also be that the PNM notifies the UE of a device registration, and after the UE approves, it is allowed to join.

 In step 1202, the WLAN device sends the public key certificate (or the shared key, that is, the key shared by the WLAN device and the network in advance) to the UE through the local interface, and the UE and the PNM AS authenticate each other based on the public key certificate (or share). The key, the key shared by the WLAN device and the network in advance, establishes a secure channel.

 In step 1203, the UE sends a registration request to the PNMAS, including the identification code of the WLAN device.

 In step 1204, the PNM AS assigns a PNE identifier to the WLAN device according to the identification code of the WLAN device, and saves the correspondence.

 In step 1205, the PNM AS sends a registration response to the UE, including the PNE identifier assigned to the WLAN device.

 In step 1206, the UE sends a PNE identifie to the WLAN device.

 This embodiment solves the problem that a cardless device is registered to a personal network, and provides a method of secure registration so that the user's personal network is not invaded by a malicious terminal.

In the twelfth embodiment of the present invention, the difference from the above embodiment is that: different UEs are used for multiple The WLAN device registers, and multiple WLAN devices do not belong to the same PAN. In this embodiment, two WLAN devices are taken as an example (WLAN1, WLAN2), which belong to different PANs, and corresponding to different UEs (such as UE1, UE2), BSF (BSF1, BSF2), and HSS (HSS1, HSS2). There is only a PNM AS in the network. In addition to the PN management function, the PNM AS also has the function of NAF to participate in the GBA process. The UE registers on behalf of the WLAN device, and the network side uses the GBA authentication registration request message. Specifically, as shown in FIG.

 Steps 1301 to 1305 and steps 1306 to 1310 are respectively processes for generating a shared key. The foregoing embodiment has described the flow in detail, and details are not described herein again; and steps 1301 to 1305 and steps 1306 to 1310 are in time. No backward order;

 In step 1311 and step 1312, the UE sends the derived key Ks-NAF to the WLAN device through the local interface and establishes a security channel related parameter. Through these two steps, the PNMAS and the WLAN device have a shared key Ks-NAF; It is pointed out that the shared key used to establish a secure channel may be Ks-NAF or a key derived based on Ks-NAF. In particular, the local interface has been defined by relevant specifications. Techniques known in the art will not be described here;

 These two steps do not have strict timing constraints. Of course, the UE can only send the shared key to the WLAN device after generating the shared key.

 Steps 1313 to 1316 and steps 1317 to 1320 are respectively processes for registering the WLAN device to the PNM AS. The foregoing embodiment has described the flow in detail, and is not mentioned here; and steps 1313 to 1316 and steps 1317 to 1320 are There is no backward order in time, and it can be done at the same time.

 The embodiment of the present invention does not limit whether the PNM AS and the NAF are merged and separated. In the above embodiment, the PNM AS and the NAF are combined as an embodiment, but the flow between the PNM AS and the NAF is not affected. Under separation, there will be signaling between these entities in addition to the flow of the invention between the PNM AS and the NAF.

It should be noted that, when there is no card device registration, and when multiple cardless devices do not belong to the same PAN, the embodiment of the present invention is applicable not only to the case where the cardless device is self-registered, but also to the UE instead of the Card device registration; not only applies to the case where the PNM AS is separated from the NAF, but also applies to the case where the PNM AS is integrated with the NAF; not only applies to the GBA algorithm authentication process, It can also be applied to the solution based on other authentication algorithms in the prior art; the basic principle thereof has been explained in the foregoing embodiments, and those skilled in the art should understand that it can be made in form and detail. Various changes may be made without departing from the spirit and scope of the invention. No longer here - list these technical solutions.

 In the embodiment of the present invention, the WLAN device is selected as the cardless device, but the embodiment of the present invention is not applicable to the WLAN device, and the method for the other cardless device to access the personal network may be deduced by the foregoing embodiments of the present invention. Out, but the difference is that some simple substitutions may be made in some concepts. For example, in the above embodiments, the identity identifier of the WLAN device is a WLAN device identification code. If it is another cardless device, it may not be the device identification code, so as long as it can uniquely distinguish this in a PN. The identity of the card device can be used as an identification identifier.

 The following describes the embodiment of the personal network management entity (PNMAS) in the embodiment of the present invention. Referring to FIG. 14, the personal network management entity 1400 in the embodiment of the present invention includes:

 The determining unit 1410: configured to determine whether the cardless device is allowed to access the personal network;

 The allocating unit 1420: configured to determine, by the determining unit 1410, the cardless device that is allowed to access to allocate the personal network element identifier;

 The sending unit 1430: is configured to send the personal network element identifier allocated by the allocating unit to the cardless device that allows access.

 The determining unit 1410 includes:

 Acquisition unit: an identification identifier for acquiring a cardless device;

 a determining unit: configured to determine, according to the identity identification identifier acquired by the acquiring unit, whether the cardless device is allowed to access the personal network.

 The obtaining unit includes:

 Secure channel establishment unit: used to establish a secure channel;

 The information acquiring unit is configured to obtain the identity identification of the cardless device by using the secure channel established by the secure channel establishing unit.

 The determining unit 1410 may also include:

 Authentication unit: used to authenticate cardless devices;

 Determining unit: used to identify according to the above

Access to the personal network. In a preferred embodiment, in the foregoing embodiment, the acquiring unit in the personal network management entity may include: a shared key generating unit, a secure channel establishing unit, and an information acquiring unit. The shared key generating unit is configured to: determine a shared key between the user equipment and the personal network management entity; the secure channel establishing unit is configured to establish a secure channel by using the shared key; And obtaining, by the secure channel established by the secure channel establishing unit, an identity identifier of the cardless device.

 Preferably, the obtaining unit may include: a shared key generating unit and an information acquiring unit, where the shared key generating unit is configured to: determine a shared key between the user equipment and the personal network management entity; And the acquiring, by the user equipment, the registration request based on the shared key encryption, where the registration request carries the identity identification identifier of the cardless device.

 The shared key generating unit includes: an authentication key negotiating unit: configured to obtain a shared key between the user equipment and the personal network management entity by using an authentication and key negotiation technology.

 In a preferred embodiment, in the foregoing embodiment, the authentication unit in the personal network management entity may include: a public key certificate unit and a shared key unit, where the public key certificate unit is used to pass the public key certificate. The cardless device is authenticated; the shared key unit is used to generate a shared key to authenticate the cardless device.

 The allocating unit in the personal network management entity may include: an acquiring unit and an identifier of the cardless device that is allowed to access when the identifier of the network element is identified; the identifier assigning unit, configured to be used according to the acquiring unit The acquired identification identifier assigns a personal network element identifier to the cardless device that is allowed to access.

 It will be understood by those skilled in the art that all or part of the steps of implementing the foregoing embodiments may be performed by a program to instruct related hardware, and the program may be stored in a computer readable storage medium. The method includes the following steps: obtaining an identity identifier of the cardless device in the personal network, determining, according to the acquired identity identifier, whether the cardless device is allowed to access the personal network, and performing the cardless device that is allowed to access The corresponding access operation. The access operation includes: assigning a corresponding personal network element identifier to the cardless device that is allowed to access, and sending the personal network element identifier to the user side.

The above-mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like. The following describes an embodiment of the access system in the embodiment of the present invention. Referring to FIG. 15, the access system in the embodiment of the present invention includes:

 The network entity 1502: configured to connect the cardless device 1501 and the personal network management entity 1503; the cardless device 1501: configured to send an identity identification identifier to the personal network management entity 1503 by using the network entity;

 The personal network management entity 1503 is configured to determine whether the cardless device is allowed to access the personal network, and perform a corresponding access operation on the cardless device that is allowed to access.

 The personal network management entity 1503 includes:

 The determining unit 1510: configured to determine whether the cardless device is allowed to access the personal network;

 The allocating unit 1520 is configured to allocate a personal network element identifier to the cardless device that allows access; the sending unit 1530: is configured to send the personal network element identifier allocated by the allocating unit to the cardless device that allows access.

 The embodiment of the present invention determines whether the cardless device allows access to the personal network according to the identity identification identifier, or determines whether the cardless device allows access to the individual by using the authentication process of the cardless device. Network; assign a personal network element identifier to the cardless device that is allowed to access, and send the personal network element identifier to the cardless device that is allowed to access. It solves the problem of registering a cardless device to a personal network and provides a secure registration method that allows users to securely access the personal network.

 Although the invention has been illustrated and described with reference to the preferred embodiments of the present invention, it will be understood The spirit and scope of the invention.

Claims

Rights request  A method for a cardless device to access a personal network, characterized in that  Determine whether cardless devices are allowed to access the personal network;  A cardless device that allows access is assigned a personal network element identity, and the personal network element identity is sent to the cardless device that is allowed to access.  The method for accessing a personal network by a cardless device according to claim 1, wherein the process of determining whether to allow a cardless device to access a personal network includes:  The network side obtains the identity identifier of the cardless device, and determines, according to the identity identification identifier, whether the cardless device is allowed to access the personal network.  The method for accessing a personal network of a cardless device according to claim 2, further comprising:  The user equipment and the network side obtain a shared key, and the user equipment sends the shared key to the cardless device, and the cardless device and the network side establish a secure channel based on the shared key;  The identifier of the card-free device acquired by the network side includes:  The network side obtains the registration request sent by the cardless device by using the secure channel, and the registration request carries the identity identifier of the cardless device.  The method for accessing a personal network by a cardless device according to claim 3, wherein the cardless device and a personal network management entity on the network side establish a secure channel based on the shared key, the personal network The management entity obtains the registration request sent by the cardless device by using the secure channel, where the registration request carries the identity identification identifier of the cardless device;  Or,  The cardless device and the network application function entity on the network side establish a secure channel based on the shared key, and the network application function entity receives the registration request sent by the cardless device through the secure channel, where the registration request is Carrying the identity identification identifier of the cardless device, the network application function entity sends the identity identification identifier of the cardless device to the personal network management entity on the network side, and the personal network management entity acquires the identity of the cardless device Identify the logo.  The method for accessing a personal network of a cardless device according to claim 2, further comprising: The user equipment and the network side obtain a shared key; The identifier of the card-free device acquired by the network side includes:  The network side acquires a registration request based on the shared key encryption sent by the user equipment, where the registration request carries an identity identification identifier of the cardless device.  The method for accessing a personal network by a cardless device according to claim 5, wherein the personal network management entity on the network side acquires a registration request sent by the user equipment based on the shared key encryption, The registration request carries the identification identifier of the cardless device;  Or,  The network application function entity of the network side receives the registration request based on the shared key encryption sent by the user equipment, where the registration request carries the identity identification identifier of the cardless device, and the network application function entity is to the network side. The personal network management entity sends the identity identification identifier of the cardless device, and the personal network management entity acquires the identity identification identifier of the cardless device.  The method of accessing a personal network by a cardless device according to any one of claims 3 to 6, wherein the user equipment and the network side obtain a shared key by using one of the following methods, wherein:  The user equipment obtains a shared key by performing a general bootstrap architecture technical process with the network side; the user equipment obtains a shared key by performing an authentication and key agreement technology process with the network side. The method for accessing a personal network by a cardless device according to any one of claims 3 to 6, wherein the personal network element identifier is sent to the cardless device by one of the following methods:  The personal network management entity directly sends the personal network element identifier to the cardless device that is allowed to access;  The personal network management entity notifies the personal network element identifier to the network application function entity, and the network application function entity sends the personal network element identifier to the cardless device that is allowed to access;  Sending, by the personal network management entity, the personal network element identifier to the user equipment, where the user equipment sends the personal network element identifier to the cardless device that is allowed to access;  Transmitting, by the personal network management entity, the personal network element identifier to a network application function entity, where the network application function entity sends the personal network element identifier to a user equipment, where the user equipment sends the personal network element identifier Give the cardless device that is allowed to access. 9. The method of claim 1, wherein the cardless device accesses a personal network, wherein: The process of determining whether to allow a cardless device to access a personal network includes:  The network side determines whether the cardless device is allowed to access the personal network by authenticating the cardless device.  The method for accessing a personal network by a cardless device according to claim 9, wherein the network side authenticates the cardless device by using a public key certificate or a shared key.  The method for accessing a personal network by a cardless device according to claim 9, wherein the assigning a personal network element identifier to the cardless device that allows access includes:  Obtaining an identification identifier of the cardless device that is allowed to access, and assigning a personal network element identifier to the cardless device that is allowed to access according to the identity identification identifier.  The method for accessing a personal network of a cardless device according to claim 11, further comprising:  The cardless device that is allowed to access sends a public key certificate or a shared key to the user equipment, and the user equipment and the personal network management entity on the network side establish a security channel based on the public key certificate or the shared key;  The acquiring the identity identifier of the cardless device includes:  And the personal network management entity obtains the registration request sent by the user equipment by using the secure channel, where the registration request carries the identity identification identifier of the cardless device.  The method of claim 1, wherein the process of determining whether to allow a cardless device to access a personal network comprises:  If the cardless device does not belong to the user blacklist, allowing the cardless device to access the personal network; and/or,  If the cardless device does not belong to the device blacklist, the cardless device is allowed to access the personal network.  14. A personal network management entity, comprising:  Judging unit: used to determine whether to allow cardless devices to access the personal network; The sending unit is configured to send the personal network element identifier allocated by the allocating unit to the cardless device that allows access. The personal network management entity according to claim 14, wherein the determining unit comprises:  Acquisition unit: an identification identifier for acquiring a cardless device;  a determining unit: configured to determine, according to the identity identification identifier acquired by the acquiring unit, whether the cardless device is allowed to access the personal network.  The personal network management entity according to claim 15, wherein the obtaining unit comprises:  a shared key generation unit: configured to determine a shared key between the user equipment and the personal network management entity;  a secure channel establishing unit: configured to establish a secure channel by using the shared key;  The information acquiring unit is configured to obtain the identity identification of the cardless device by using the secure channel established by the secure channel establishing unit.  The personal network management entity according to claim 15, wherein the obtaining unit comprises:  a shared key generation unit: configured to generate a shared key between the user equipment and the personal network management entity;  The information obtaining unit is configured to obtain a registration request that is sent by the user equipment and is encrypted according to the shared key, where the registration request carries an identity identification identifier of the cardless device.  The personal network management entity according to claim 16 or 17, wherein the shared key generation unit comprises:  The authentication key negotiation unit is configured to obtain a shared key between the user equipment and the personal network management entity by using an authentication and key agreement technology.  The personal network management entity according to claim 14, wherein the determining unit comprises:  Authentication unit: Used to authenticate cardless devices; access to personal networks. The personal network management entity according to claim 19, wherein the authentication unit comprises: a public key certificate unit, configured to authenticate a cardless device by using a public key certificate;  The shared key unit, which is used to generate a shared key to authenticate the cardless device.  The personal network management entity according to claim 14, wherein the allocating unit comprises: when identifying, obtaining an identity identification identifier of the cardless device that is allowed to access;  And an identifier allocation unit, configured to allocate a personal network element identifier to the cardless device that is allowed to access according to the identity identification identifier acquired by the obtaining unit.  22. An access system, comprising: a cardless device, a network entity, and a personal network management entity:  The network entity: configured to connect a cardless device and a personal network management entity;  The cardless device is configured to send an identity identifier to the personal network management entity by using the network entity;  The personal network management entity is configured to determine whether the cardless device is allowed to access the personal network, and perform a corresponding access operation on the cardless device that is allowed to access.  The access system according to claim 22, wherein the personal network management entity comprises:  The determining unit is configured to determine whether the cardless device is allowed to access the personal network;  The allocating unit is configured to allocate a personal network element identifier to the cardless device that allows access; the sending unit is configured to send the personal network element identifier allocated by the allocating unit to the cardless device that is allowed to access.