Access rejection methods, apparatuses, and storage medium

CROSS-REFERENCE TO RELATED APPLICATIONS

0001This application claims priority to a <patcit id="pcit0001" dnum="CN201711144738"><text>Chinese patent application No. 201711144738.5 filed on November 17, 2017</text></patcit>, application of which is incorporated herein by reference in its entirety.

TECHNICAL FIELD

0002The present application relates to the field of communications and, in particular, to an access rejection method, apparatus and system, a computer storage medium and a processor.

BACKGROUND

0003The 3rd Generation Partnership Project (3GPP) proposes a solution of rejecting an access of an inactive terminal. As shown in <figref idref="f0001">FIG. 1, FIG. 1</figref> is a schematic diagram of a process of an access rejection in the related art of the present disclosure, where a base station system is used to establish a wireless connection with a terminal so that the terminal may access to a mobile network. The process of this solution includes steps described as follows. <ul id="ul0001" list-style="none"><li>Step 101: a terminal (a user equipment (UE)) used to access to a wireless mobile network through a base station system A (such as a gNB, or an eNB1), which retains UE-related security information, including a key, then the UE enters an inactive state, in which the UE and the base station system A will still retain information for communication, including security information, but both will release wireless connection resources;</li><li>step 102: the terminal hopes to regain an access to a mobile network at a certain time, but the UE may move to a coverage of a base station system B, and the UE sends an access resume request to the base station system B, such as sending a radio resource control (RRC) resume request message; and</li><li>step 103: the base station system B receives the access resume request, and hopes that the terminal will try to restore the access after waiting for a period of time, then the base station system B sends an access rejection message, such as a reject message, to the UE.</li></ul>

0004In the related art, if the reject message does not have any security protection, an illegal base station may also send the access rejection message to the terminal, thereby making the terminal cannot access to the network all the time, and the illegal base station even sends short waiting try time information, so that the terminal frequently sends an access resume request and is rejected, resulting in terminal power exhaustion.

0005In view of the above problem in the related art, no effective solution has yet been proposed.

SUMMARY

0006Embodiments of the present disclosure provide an access rejection method, apparatus and system, a computer storage medium and a processor, so as to at least solve a technical problem that a terminal cannot verify validity of an access rejection message in the related art.

0007An access rejection method is provided according to an embodiment of the present disclosure, and the method includes steps described below. A first base station receives an access request from a terminal; and the first base station sends an access rejection message to the terminal; where the access rejection message carries at least a check value generated based on a key of the terminal and at least part of contents of the access rejection message.

0008Another access rejection method is provided according to an embodiment of the present disclosure, and the method includes steps described below. A terminal sends an access request to a first base station; and the terminal receives an access rejection message fed back by the first base station; where the access rejection message carries at least a check value generated based on the key of the terminal and at least part of contents of the access rejection message.

0009Still another access rejection method is provided according to an embodiment of the present disclosure, and the method includes steps described below. A second base station receives a request message aimed for a terminal from a first base station; and the second base station sends a response message to the first base station; where the request message carries part or all of contents of an access rejection message aimed for the terminal, and the response message carries a check value generated based on a key and part or all of the contents of the access rejection message.

0010An access rejection apparatus applied to a first base station is provided according to another embodiment of the present disclosure, and the apparatus includes a first receiving module and a first sending module. The first receiving module is configured to receive an access request of a terminal; and the first sending module is configured to send an access rejection message to the terminal; where the access rejection message carries at least a check value generated based on a key of the terminal and at least part of contents of the access rejection message.

0011An access rejection apparatus applied to a terminal is provided according to another embodiment of the present disclosure, and the apparatus includes a sending module and a receiving module. The sending module is configured to send an access request to a first base station; and the receiving module is configured to receive an access rejection message fed back by the first base station; where the access rejection message carries at least a check value generated based on a key of the terminal and at least part of contents of the access rejection message.

0012An access rejection apparatus applied to a second base station is provided according to another embodiment of the present disclosure, and the apparatus includes a receiving module and a sending module. The receiving module is configured to receive a request message aimed for a terminal from a first base station; and the sending module is configured to send a response message to the first base station; where the request message carries part or all of contents of the access rejection message aimed for the terminal, and the response message carries a check value generated based on a key and at least part of the contents of the access rejection message.

0013An access rejection system is provided according to another embodiment of the present disclosure, and the system includes a first base station and a terminal; where <ul id="ul0002" list-style="none"><li>the terminal is configured to send an access request;</li><li>the first base station is configured to receive the access request and send an access rejection message based on the access request; and</li><li>the terminal is configured to receive the access rejection message;</li></ul> where the access rejection message carries at least a check value generated based on a key of the terminal and at least part of contents of the access rejection message.

0014A first storage medium is further provided according to another embodiment of the present disclosure, the storage medium includes stored programs, which, when executed, perform the aforementioned access rejection method applied to the first base station.

0015A second storage medium is further provided according to another embodiment of the present disclosure, this storage medium includes stored programs, which, when executed, perform the aforementioned access rejection method applied to the terminal.

0016A third storage medium is further provided according to another embodiment of the present disclosure, this storage medium stored programs, which, when executed, perform the aforementioned access rejection method applied to the second base station.

0017A first processer is further provided according to another embodiment of the present disclosure, and the processor is used to run a program, when the program is executed, performs the aforementioned access rejection method applied to the first base station.

0018A second processer is further provided according to another embodiment of the present disclosure, and the processor is used to run a program, when the program is executed, performs the aforementioned access rejection method applied to the terminal.

0019A third processer is further provided according to another embodiment of the present disclosure, and the processor is used to run a program, when the program is executed, performs the aforementioned access rejection method applied to the second base station.

0020According to the embodiments of the present disclosure, the check value generated based on the key of the terminal and part or all of the contents of the access rejection message is carried in the access rejection message, after receiving the access rejection message, the terminal may use the check value to perform a legality verification to determine legality of the sending base station, solving the technical problem in the related art that the terminal cannot verify the legality of the access rejection message, thus improving the security of interactions between a base station and a terminal.

BRIEF DESCRIPTION OF DRAWINGS

0021The drawings described herein are used to provide a further understanding of the present disclosure, and form a part of the present application. The exemplary embodiments and descriptions thereof in the present disclosure are used to explain the present disclosure, and do not form improper limits to the present disclosure. In the drawings: <ul id="ul0003" list-style="none"><li><figref idref="f0001">FIG. 1</figref> is a schematic flowchart of an access rejection in the related art of the present disclosure;</li><li><figref idref="f0001">FIG. 2</figref> is a flowchart of an access rejection method according to an embodiment of the present disclosure;</li><li><figref idref="f0002">FIG. 3</figref> is a flowchart of another access rejection method according to an embodiment of the present disclosure;</li><li><figref idref="f0002">FIG. 4</figref> is a structural block diagram of an access rejection apparatus according to an embodiment of the present disclosure;</li><li><figref idref="f0002">FIG. 5</figref> is a structural block diagram of another access rejection apparatus according to an embodiment of the present disclosure;</li><li><figref idref="f0003">FIG. 6</figref> is a structural block diagram of an access rejection system according to an embodiment of the present disclosure;</li><li><figref idref="f0003">FIG. 7</figref> is schematic flowchart one of an access rejection method according to an embodiment of the present disclosure;</li><li><figref idref="f0004">FIG. 8</figref> is schematic flowchart two of an access rejection method according to an embodiment of the present disclosure;</li><li><figref idref="f0004">FIG. 9</figref> is schematic flowchart three of an access rejection method according to an embodiment of the present disclosure.</li></ul>

DETAILED DESCRIPTION

0022Hereinafter the present disclosure will be described in detail with reference to the drawings in conjunction with the embodiments. It is to be noted that if not in collision, the embodiments and features therein in the present application may be combined with each other.

0023It is to be noted that the terms of "first", "second" and the like in the description, claims and drawings of the present disclosure are used to distinguish between similar objects and are not necessarily used to describe a particular order or sequence.

Embodiment one

0024Network architecture of the embodiments of the present application includes at least one base station and a terminal, where interaction is performed between the base station and the terminal.

0025An access rejection method executed on the above network architecture is provided in the present embodiment. <figref idref="f0001">FIG. 2</figref> is a flowchart of an access rejection method according to an embodiment of the present disclosure. As shown in <figref idref="f0001">FIG. 2</figref>, the process of the method includes steps described below.

0026Step S202, a first base station receives an access request of a terminal.

0027Step S204, the first base station sends an access rejection message to the terminal; where the access rejection message carries at least a check value generated based on a key of the terminal and at least part of contents of the access rejection message.

0028Those skilled in the art should understand that the at least part of the contents of the access rejection message may be part or all of the contents of the access rejection message.

0029Through the above steps, the check value is carried in the access rejection message, after receiving the access rejection message, the terminal may use the check value to perform a legality verification to determine the legality of the sending base station, so that the technical problem in the related art that the terminal cannot verify legality of the access rejection message is solved, thereby improving the security of interactions between the base station and the terminal.

0030Optionally, the above steps may be executed by the base station, such as a gNB, an eNB, and an NB, but may not be limited thereof.

0031Optionally, an access rejection request may also carry a waiting time for indicating the terminal to try next time.

0032Optionally, the method of the present embodiment further includes obtaining the check value, which may be obtained and gained in a following manner.

0033Before the first base station sends the access rejection message to the terminal, the method further includes steps described below.

0034S11, the first base station sends a request message to a second base station, where the request message carries part or all of the contents of the access rejection message.

0035S12, the first base station receives a response message aimed for the request message fed back by the second base station, where the response message carries the check value generated based on the key and at least part of the contents of the access rejection message. There are many ways to generate the check value, such as a function value of a Hash-based Message Authentication Code-Secure Hash Algorithm-256 (HMAC-SHA-256) is calculated using the key and waiting time as parameters, or the key and the waiting time are concatenated into a string to calculate the function value of secure Hash function (SHA-256) thereof.

0036As another manner, before the first base station sends the access rejection message to the terminal, the method further includes steps described below.

0037S21, the first base station sends a security information request to the second base station.

0038S22, the first base station receives a security information response fed back by the second base station, where the security information response carries the key.

0039S23, the first base station generates the check value according to the key and at least part of the contents of the access rejection message. There are many ways to generate the check value (also called a token), such as calculating the function value of the HMAC-SHA-256 with the key and the waiting time as parameters, or concatenating the key and the waiting time into a string to calculate the function value of SHA-256 thereof. This type of Hash algorithm may map an input value into a fixed-length value, and a collision probability is very low, that is, a probability of obtaining a same output value from different input values is very low, so that it may be determined whether input values are the same by comparing output values.

0040Optionally, when a current congestion coefficient is greater than a first threshold value, and/or a number of currently accessed terminals is greater than a second threshold value, the first base station sends the access rejection message is to the terminal.

0041In the present embodiment, the second base station releases a connection with the terminal before the terminal sends the access request to the first base station. When the terminal accesses to the second base station, the second base station saves relevant information of the terminal, such as the key and etc..

0042Another access rejection method executing on the network architecture is provided in the present embodiment. <figref idref="f0002">FIG. 3</figref> is a flowchart of another access rejection method according to an embodiment of the present disclosure. As shown in <figref idref="f0002">FIG. 3</figref>, the process of the method includes steps described below.

0043Step S302, the terminal sends the access request to the first base station.

0044Step S304, the terminal receives the access rejection message fed back by the first base station; where the access rejection message carries at least the check value generated based on the key of the terminal and at least part of the contents of the access rejection message.

0045Optionally, after the terminal receives the access rejection message fed back by the first base station, the method further includes steps described below.

0046S31, the terminal calculates a check value based the key and at least part of the contents of the access rejection message.

0047S32, when the calculated check value is same as the received check value, the access rejection message is accepted, and when the calculated check value is different from the received check value, the access rejection message is discarded. The key may be preset in the terminal in advance.

0048An access rejection method is further provided according to the present embodiment, and the method includes steps described below. The second base station receives the request message aimed for the terminal from the first base station; and the second base station sends the response message to the first base station; where the request message carries part or all of the contents of the access rejection message aimed for the terminal, and the response message carries the check value generated based on the key and at least part of the content of the access rejection message.

0049Optionally, before receiving the request message from the first base station, the second base station releases the connection with the terminal.

0050From the description of the above-mentioned embodiments, it will be apparent to those skilled in the art that the methods in the embodiments described above may be implemented by software plus a necessary general-purpose hardware platform, or may of course be implemented by hardware. However, in many cases, the former is a preferred implementation manner. Based on this understanding, the technical solutions provided by the present disclosure substantially, or the part contributing to the existing art, may be embodied in the form of a software product. The computer software product is stored in a storage medium (such as a read-only memory (ROM)/random access memory (RAM), a magnetic disk or an optical disk) and includes several instructions for enabling a terminal apparatus (which may be a mobile phone, a computer, a server, a network apparatus or the like) to execute the methods according to each embodiment of the present disclosure.

Embodiment two

0051The present embodiment further provides an access rejection apparatus and system for implementing the embodiments and preferred embodiments described above. What has been described will not be repeated here. As used below, the term of "module" may be software, hardware or a combination thereof, which is capable of implementing predetermined functions. The apparatuses in the embodiment described below are preferably implemented by software, but implementation by hardware or by a combination of software and hardware is also possible and conceivable.

0052<figref idref="f0002">FIG. 4</figref> is a structural block diagram of an access rejection apparatus according to an embodiment of the present disclosure, the apparatus is applied to a first base station. As shown in <figref idref="f0002">FIG. 4</figref>, the apparatus includes a first receiving module 40 and a first sending module 42.

0053The first receiving module 40 is configured to receive an access request of a terminal; and <ul id="ul0004" list-style="none"><li>the first sending module 42 is configured to send an access rejection message to the terminal;</li><li>where the access rejection message carries a check value generated based on a key of the terminal and at least part of contents of the access rejection message.</li></ul>

0054Optionally, the apparatus further includes a second sending module and a second receiving module. The second sending module is configured to send a request message to a second base station before the first sending module 42 sends the access rejection message to the terminal, where the request message carries part or all of the contents the access rejection message; and correspondingly, the second receiving module is configured to receive a response message fed back by the second base station, where the response message carries the check value generated based on the key and part or all of the contents of the access rejection message.

0055Optionally, the apparatus further includes a third sending module, a third receiving module and a generation module, the third sending module is configured to send a security information request to the second base station before the first sending module 42 sends the access rejection message to the terminal; <ul id="ul0005" list-style="none"><li>correspondingly, the third receiving module is configured to receive a security information response fed back by the second base station, where the security information response carries the key; and</li><li>the generation module is configured to generate the check value according the key and part or all of the contents of the access rejection message.</li></ul>

0056Optionally, the first sending module is further configured to send the access rejection message to the terminal when the first base station satisfies at least one of following conditions: a current congestion coefficient is greater than a first threshold value, or a number of currently accessed terminals is greater than a second threshold value.

0057<figref idref="f0002">FIG. 5</figref> is a structural block diagram of another access rejection apparatus according to an embodiment of the present disclosure, the apparatus is applied to a terminal and includes a sending module 50 and a receiving module 52.

0058The sending module 50 is configured to send the access request to the first base station; and <ul id="ul0006" list-style="none"><li>the receiving module 52 is configured to receive the access rejection message fed back by the first base station;</li><li>where the access rejection message carries the check value generated based on the key of the terminal and at least part of the contents (part or all of the contents) of the access rejection message.</li></ul>

0059The apparatus further includes a calculation module and a processing module. The calculation module is configured to calculate a check value according to the key and part or all of the contents of the access rejection message after the receiving module 52 receives the access rejection message fed back by the first base station; and the processing module is configured to: accept the access rejection message when the calculated check value is the same as the received check value, and discard the access rejection message when the calculated check value is different from the received check value.

0060An access rejection apparatus applied to a second base station is further provided by the present embodiment, and the apparatus includes a receiving module and a sending module.

0061The receiving module is configured to receive the request message aimed for the terminal from the first base station, where the request message carries part or all of the contents of the access rejection message aimed for the terminal; the sending module is configured to send the response message to the first base station; where he response message carries the check value generated based on the key and at least part of the contents (part or all of the contents) of the access rejection message.

0062<figref idref="f0003">FIG. 6</figref> is a structural block diagram of an access rejection system according to an embodiment of the present disclosure, the system includes a first base station 60 and a terminal 62.

0063The terminal 62 is configured to send an access request; <ul id="ul0007" list-style="none"><li>the first base station 60 is configured to receive the access request and send an access rejection message; and</li><li>the terminal 62 is configured to receive the access rejection message fed back by the first base station 60; where the access rejection message carries at least a check value generated based on a key of the terminal and at least part of contents of the access rejection message.</li></ul>

0064In an optional embodiment, the first base station 60 includes a first receiving module 600 and a first sending module 602.

0065The first receiving module 600 is configured to receive the access request sent by the terminal, specifically a second sending module 620; and the first sending module 602 is configured to send the access rejection message to the terminal, specifically a second receiving module 622.

0066The terminal 62 includes the second sending module 620 and the second receiving module 622.

0067The second sending module 620 is configured to send the access request to the first base station 60, specifically the first receiving module 600; and <ul id="ul0008" list-style="none"><li>the second receiving module 622 is configured to receive the access rejection message fed back by the first base station, specifically the first sending module 602;</li><li>where the access rejection message carries the check value generated based on the key of the terminal and at least part of the contents (part or all of the contents) of the access rejection message.</li></ul>

0068Optionally, the system further includes a second base station, where the second base station includes a third receiving module and a third sending module, the third receiving module is configured to receive a request message aimed for the terminal from the first base station; and the third sending module is configured to send a response message to the first base station; where the request message carries part or all of the contents of the access rejection message aimed for the terminal, and the response message carries the check value generated based on the key and part or all of the contents of the access rejection message.

0069The first base station 60 and the terminal 62 may also include one or more apparatuses included in the above contents.

0070It should be noted that each of the modules described above may be implemented by software or hardware. Implementations by hardware may, but may not necessarily, be performed in a following manner: the various modules described above are all located in a same processor, or the various modules described above are located in their respective processors in any combination form.

Embodiment three

0071This embodiment is an optional embodiment of the present application and used for describing in detail in conjunction with specific implementation modes.

0072It may be understood that the present embodiment provides a related method for rejecting an access of a terminal in an inactive state.

0073<figref idref="f0003">FIG. 7</figref> is schematic flowchart one of an access rejection method according to an embodiment of the present disclosure. As shown in <figref idref="f0003">FIG. 7</figref>, the process includes steps described below.

0074Steps 201 and 202: same as Steps 101 and 102 of <figref idref="f0001">FIG. 1</figref> Step 203: a base station system B receives an access resume request, due to the congestion and other reasons thereof, it is hoped that the terminal will wait for a period of time before attempting to regain an access, therefore, the base station system B sends an unserviceable request, such as a service deny request message, to a base station system A while carries information of the waiting time, such as a wait timer.

0075Step 204: the base station system A calculates a token based on the key and the waiting time which are related to the UE, for example, the function value of the HMAC-SHA-256 is calculated using the key and the waiting time as parameters, or the key and the waiting time are concatenated into a string to calculate the function value of the SHA-256 thereof.

0076Step 205, the base station system A sends an unserviceable response, such as a service deny response message, to the base station system B while carries the information of the waiting time and the calculated token.

0077Step 206: the base station system B sends the access rejection message, such as a reject message, to the UE while carries the received the information of the waiting time and the received token, the terminal uses the same calculation method to calculate a token, and compares whether the calculated token and the received token are the same, if the calculated token and the received token are the same, the access rejection message is accepted, and if the calculated token and the received token are different, the access rejection message is not accepted, for example, the message is discarded.

0078<figref idref="f0004">FIG. 8</figref> is schematic flowchart two of an access rejection method according to an embodiment of the present disclosure. As shown in <figref idref="f0004">FIG. 8</figref>, the process includes steps described below.

0079Steps 301 and 302: same as Steps 101 and 102 of <figref idref="f0001">FIG. 1</figref> Step 303: the base station system B receives an access resume request, due to the congestion and other reasons thereof, it is hoped that the terminal will wait for a period of time before attempting to regain the access, therefore, the base station system B sends a security information request, such as a security info request message, to the base station system A.

0080Step 304, the base station system A sends a security information response, such as a security info response message, to the base station system B while carries the UE-related security information, including the key.

0081Step 305: the base station system B calculates a token based on the key and the waiting time which are related to the UE, for example, the function value of the HMAC-SHA-256 is calculated using the key and the waiting time as parameters, or the key and the waiting time are concatenated into a string to calculate the function value of the SHA-256 thereof.

0082Step 306: the base station system B sends the access rejection message, such as the reject message, to the UE while carries the information of the waiting time and the token, the terminal uses the same calculation method to calculate a token, and compares whether the calculated token and the received token are the same, if the calculated token and the received token are the same, the access rejection message is accepted, and if the calculated token and the received token are different, the access rejection message is not accepted, for example, the message is discarded.

0083<figref idref="f0004">FIG. 9</figref> is schematic flowchart three of an access rejection method according to an embodiment of the present disclosure. As shown in <figref idref="f0004">FIG. 9</figref>, the process includes steps described below.

0084Steps 401 and 402: same as Steps 101 and 102 of <figref idref="f0001">FIG. 1</figref> Step 403: the base station system B receives the access resume request, due to the congestion and other reasons thereof, it is hoped that the terminal will wait for a period of time before attempting to regain the access, therefore, the base station system B sends a forward request, such as a forward request message, to the base station system A while carries the access rejection message sent by the base station B to the UE, for example, the reject message, and the access rejection message carries the information of the waiting time, such as a wait timer.

0085Step 404: the base station system A calculates a message check code based on the key and the access rejection message which are related to the UE, for example, the function value of the HMAC-SHA-256 is calculated using the key and the contents of the access rejection message as parameters.

0086Step 405, the base station system A sends a forward response, such as a forward response message, to the base station system B while carries a processed access rejection message, that is, the access rejection message carries a message check code.

0087Step 406: the base station system B sends the access rejection message to the UE, the terminal uses the same calculation method as the base station A to calculate a message check code, and compares whether the calculated message check code and the received message check code are the same, if the calculated message check code and the received message check code are the same, the access rejection message is accepted, and if the calculated message check code and the received message check code are different, the access rejection message is not accepted, for example, the message is discarded.

Embodiment four

0088An embodiment of the present disclosure also provides three types of computer storage media, which include respective stored programs. Where, a program stored in a first computer storage medium performs the aforementioned access rejection method applied to the first base station when executed; a program stored in a second computer storage medium performs the aforementioned access rejection method applied to the terminal when executed; and a program stored in a third computer storage medium performs the aforementioned access rejection method applied to the second base station when executed.

0089In the present embodiment, the above storage media may include, but are not limited to, a USB flash disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, an optical disk or another medium capable of storing program codes.

0090An embodiment of the present disclosure also provides three types of processors, each type of which is used to execute respective programs. Where a first type of the processor executes the aforementioned access rejection method applied to the first base station when executes the program stored in the first type of the storage medium. A second type of the processor executes the aforementioned access rejection method applied to the terminal when executes the program stored in the second type of the storage medium. And a third type of the processor executes the aforementioned access rejection method applied to the second base station when executes the program stored in the third type of the storage medium.

0091Optionally, for specific examples in the present embodiment, reference may be made to the examples described in the above embodiments and optional implementations, and a repetition is not made in the present embodiment.

0092Apparently, it should be understood by those skilled in the art that each of the above-mentioned modules or steps of the present disclosure may be implemented by a general-purpose computing apparatus, the modules or steps may be concentrated on a single computing apparatus or distributed on a network composed of multiple computing apparatuses, and optionally, the modules or steps may be implemented by program codes executable by the computing apparatus, so that the modules or steps may be stored in a storage apparatus and executed by the computing apparatus. In some circumstances, the illustrated or described steps may be executed in sequences different from those described herein, or the modules or steps may be made into various integrated circuit modules separately, or multiple modules or steps therein may be made into a single integrated circuit module for implementation. In this way, the present disclosure is not limited to any specific combination of hardware and software.

0093The above are merely preferred embodiments of the present disclosure and are not intended to limit the present disclosure. Those skilled in the art can make various modifications and changes. Any modifications, equivalent substitutions, improvements and the like made within the principle of the present disclosure should fall within the scope of the present disclosure.

0094It should be understood by those skilled in the art that the embodiments of the present disclosure may be provided as methods, systems or computer program products. Therefore, the present disclosure may be embodied in the form of a hardware embodiment, a software embodiment, or a combination of hardware and software embodiments. In addition, the present disclosure may be embodied in the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, a disk memory, an optical memory and the like) which include computer-usable program codes.

0095The present disclosure is described with reference to flowcharts and/or block diagrams of the methods, apparatuses (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that computer program instructions may implement each flow and/or block in the flowcharts and/or the block diagrams and a combination of flows and/or blocks in the flowcharts and/or the block diagrams. These computer program instructions may be provided for a general-purpose computer, a special-purpose computer, an embedded processor or a processor of another programmable data processing apparatus to produce a machine so that instructions executed by the computer or the processor of another programmable data processing apparatus produce an apparatus for implementing functions designated in one or more flows in the flowcharts and/or one or more blocks in the block diagrams.

0096These computer program instructions may be stored in a computer-readable memory that can cause the computer or another programmable data processing apparatus to operate in a particular manner so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction apparatus. The instruction apparatus implements the functions designated in the one or more flows in the flowcharts and/or the one or more blocks in the block diagrams.

0097These computer program instructions may be loaded into the computer or another programmable data processing apparatus so that a series of operation steps are performed on the computer or another programmable apparatus to produce processing implemented by the computer. Therefore, instructions executed on the computer or another programmable apparatus provide steps for implementing the functions designated in the one or more flows in the flowcharts and/or the one or more blocks in the block diagrams.

0098The above are only preferred embodiments of the present disclosure and are not intended to limit the scope of the present disclosure.

INDUSTRIAL APPLICABILITY

0099In the embodiment of the present disclosure, by carrying the check value generated based on the key of the terminal and part or all of the content of the access rejection message in the access rejection message, after receiving the access rejection message, the terminal may use the check value to perform legality verification to determine the legality of the sending base station, solving the technical problem that the terminal in the related art cannot verify the legality of the access rejection message and improving the security of the interaction between the base station and the terminal. The following items refer to preferred embodiments: <ol id="ol0001"><li>1. An access rejection method, comprising: <ul id="ul0009" list-style="none"><li>receiving, by a first base station, an access request of a terminal; and</li><li>sending, by the first base station, an access rejection message to the terminal;</li></ul> wherein the access rejection message carries at least a check value generated based on a key of the terminal and at least part of contents of the access rejection message.</li><li>2. The method according to item 1, wherein before sending, by the first base station, the access rejection message to the terminal, the method further comprises: <ul id="ul0010" list-style="none"><li>sending, by the first base station, a request message to a second base station, wherein the request message carries part or all of the contents of the access rejection message; and</li><li>receiving, by the first base station, a response message fed back by the second base station, wherein the response message carries the check value generated based on the key and at least part of the contents of the access rejection message.</li></ul></li><li>3. The method according to item 1, wherein before sending, by the first base station, the access rejection message to the terminal, the method further comprises: <ul id="ul0011" list-style="none"><li>sending, by the first base station, a security information request to a second base station;</li><li>receiving, by the first base station, a security information response fed back by the second base station, wherein the security information response carries the key; and</li><li>generating, by the first base station, the check value based on the key and at least part of the contents of the access rejection message,</li></ul></li><li>4. The method according to item 1, wherein sending, by the first base station, the access rejection message to the terminal comprises: in case where the first station satisfies at least one of following conditions, sending, by the first base station, the access rejection message to the terminal: a current congestion coefficient is greater than a first threshold value, or a number of currently accessed terminals is greater than a second threshold value.</li><li>5. The method according to item 1, wherein the part of the contents of the access rejection message contains a waiting time for indicating the terminal to try to access next time.</li><li>6. The method according to item 2 or 3, wherein before the terminal sends the access request to the first base station, the method comprises: releasing, by the second base station, a connection with the terminal.</li><li>7. An access rejection method, comprising: <ul id="ul0012" list-style="none"><li>sending, by a terminal, an access request to a first base station; and</li><li>receiving, by the terminal, an access rejection message aimed for the access request fed back by the first base station;</li></ul> wherein the access rejection message carries at least a check value generated based on a key of the terminal and at least part of contents of the access rejection message.</li><li>8. The method according to item 7, wherein after receiving, by the terminal, the access rejection message fed back by the first base station, the method further comprises: <ul id="ul0013" list-style="none"><li>calculating, by the terminal, a check value according to the key and at least part of the contents of the access message rejection; and</li><li>in case where the calculated check value is the same as the received check value, accepting the access rejection message, or</li><li>in case where the calculated check value is different from the received check value, discarding the access rejection message.</li></ul></li><li>9. The method according to item 7, wherein the part of the contents of the access rejection message contains a waiting time for indicating the terminal to try to access next time.</li><li>10. An access rejection method, comprising: <ul id="ul0014" list-style="none"><li>receiving, by a second base station, a request message aimed for a terminal from a first base station; and</li><li>sending, by the second base station, a response message to the first base station;</li></ul> wherein the request message carries part or all of contents of an access rejection message aimed for the terminal, and the response message carries a check value generated based on a key and at least part of the contents of the access rejection message.</li><li>11. The method according to item 10, wherein the part of the contents of the access rejection message contains a waiting time for indicating the terminal to try to access next time.</li><li>12. The method according to item 10, wherein before receiving, by the second base station, the request message from the first base station, the method comprises: releasing, by the second base station, a connection with the terminal.</li><li>13. An access rejection apparatus, applied to a first base station, comprising: <ul id="ul0015" list-style="none"><li>a first receiving module, which is configured to receive an access request of a terminal; and</li><li>a first sending module, which is configured to send an access rejection message to the terminal;</li></ul> wherein the access rejection message carries at least a check value generated based on a key of the terminal and at least part of contents of the access rejection message.</li><li>14. The apparatus according to item 13, further comprising: <ul id="ul0016" list-style="none"><li>a second sending module, which is configured to send a request message to a second base station before the first sending module sends the access rejection message to the terminal, wherein the request message carries part or all of the contents of the access rejection message; and</li><li>a second receiving module, which is configured to receive a response message fed back by the second base station, wherein the response message carries the check value generated based on the key and part or all of the contents of the access rejection message.</li></ul></li><li>15. The apparatus according to item 13, further comprising: <ul id="ul0017" list-style="none"><li>a third sending module, which is configured to send a security information request to the second base station before the first sending module sends the access rejection message to the terminal;</li><li>a third receiving module, which is configured to receive a security information response fed back by the second base station, wherein the security information response carries the key; and</li><li>a generation module, which is configured to generate the check value according to the key and the part or all of the contents of the access rejection message.</li></ul></li><li>16. The apparatus according to item 13, wherein the first sending module is further configured to send the access rejection message to the terminal, in case where the first base station satisfies at least one of following conditions: a current congestion coefficient is greater than a first threshold value, or a number of currently accessed terminals is greater than a second threshold value.</li><li>17. An access rejection apparatus, applied to a terminal, comprising: <ul id="ul0018" list-style="none"><li>a sending module, which is configured to send an access request to a first base station; and</li><li>a receiving module, which is configured to receive an access rejection message fed back by the first base station;</li></ul> wherein the access rejection message carries at least a check value generated based on a key of the terminal and at least part of contents of the access rejection message.</li><li>18. The apparatus according to item 17, further comprising: <ul id="ul0019" list-style="none"><li>a calculation module, which is configured to, after the receiving module receives the access rejection message fed back by the first base station, calculate a check value according to the key and part or all of the contents of the access rejection message; and</li><li>a processing module, which is configured to: accept the access rejection message in case where the calculated check value is the same as the received check value, and discard the access rejection message in case where the calculated check value is different from the received check value.</li></ul></li><li>19. An access rejection apparatus, applied to a second base station, comprising: <ul id="ul0020" list-style="none"><li>a receiving module, which is configured to receive a request message aimed for a terminal from a first base station; and</li><li>a sending module, which is configured to send a response message to the first base station;</li></ul> wherein the request message carries part or all of contents of an access rejection message aimed for the terminal, and the response message carries a check value generated based on a key and at least part of the contents of the access rejection message.</li><li>20. An access rejection system, comprising a first base station and a terminal, wherein <ul id="ul0021" list-style="none"><li>the terminal is configured to send an access request;</li><li>the first base station is configured to receive the access request and send an access rejection message based on the access request; and</li><li>the terminal is configured to receive the access rejection message;</li></ul> wherein the access rejection message carries at least a check value generated based on a key of the terminal and at least part of contents of the access rejection message.</li><li>21. The system according to item 20, further comprising a second base station, wherein the second base station is configured to: <ul id="ul0022" list-style="none"><li>receive a request message aimed for the terminal from the first base station; and</li><li>send a response message aimed for the request message to the first base station;</li></ul> wherein the request message carries part or all of the contents of the access rejection message aimed for the terminal, and the response message carries the check value generated based on the key and at least part of the contents of the access rejection message.</li><li>22. A storage medium, comprising stored programs, wherein the programs, when executed, perform the method according to any one of items 1 to 6.</li><li>23. A storage medium, comprising stored programs, wherein the programs, when executed, perform the method according to any one of items 7 to 9.</li><li>24. A storage medium, comprising stored programs, wherein the programs, when executed, perform the method according to any one of items 10 to 12.</li><li>25. A processor, configured to execute programs, wherein the programs, when executed, perform the method according to any one of items 1 to 6.</li><li>26. A processor, configured to execute programs, wherein the programs, when executed, perform the method according to any one of items 7 to 9.</li><li>27. A processor, configured to execute programs, wherein the programs, when executed, perform the method according to any one of items 10 to 12.</li></ol>