Patent Description:
In communication systems, before a terminal device accesses to a network, there is usually an authentication process between the terminal device and entities in the network. For example, in the third generation wireless communication (<NUM>) system or Long Term Evolved (LTE) communication system, the authentication mechanism employs message authentication codes to verify the terminal device and the entities. While in the fifth generation wireless communication system (<NUM>), such traditional authentication mechanism may have some problems due to an increasing number of terminal devices. For example, in Internet of Things (IoT), there are a large number of terminal devices. It may consume a lot of calculation resources for the network to perform the authentication for all of the terminal devices.

<CIT> discloses an access control method, apparatus and system, which can control the access of an illegal UE to a network. In order to solve the above technical problems, the method embodiments for access control can be implemented through the following technical solutions: receive an access request; obtain the access right information of the user equipment of the access request, the group to which the user equipment belongs, or the name of the access point; If the access right information meets the conditions for allowing access, perform an access operation; If the access right information does not meet the conditions for allowing access, refuse to perform the access operation, and determine that the user equipment or the group to which the user equipment belongs, or the name of an access point is illegal; The information that the user equipment is in the group or the name of an access point is illegal is sent to the server.

<CIT> discloses a method for allocating a plurality of subscriptions to wireless services in a network among a plurality of wireless devices in the network comprises creating a group including a plurality of wireless devices, making an initial allocation of the subscriptions to the group, the initial allocation including allocating one subscription to each of some of the plurality of wireless devices, modifying the allocation of the subscriptions to the group, including at least one of deallocating a subscription from one of the plurality of wireless devices and allocating a subscription to one of the plurality of wireless devices.

<CIT> discloses a method performed under control of an end device, wherein the method may include transmitting a probe request frame including a fake device identifier for the end device to an access point, receiving a probe response frame including information regarding the access point from the access point, determining whether the access point is an authenticated access point based at least in part on the information regarding the access point, and transmitting a connection request including an authentic device identifier for the end device to the access point.

In general, embodiments of the present disclosure relate to a method for authenticating terminal devices and the corresponding network device and terminal device. The scope of protection sought for various example embodiments is set out by the independent claims. Some example embodiments are defined in the dependent claims.

Some example embodiments will now be described with reference to the accompanying drawings, where.

Throughout the figures, same or similar reference numbers indicate same or similar elements.

The subject matter described herein will now be discussed with reference to several example embodiments. It should be understood these embodiments are discussed only for the purpose of enabling those skilled persons in the art to better understand and thus implement the subject matter described herein, rather than suggesting any limitations on the scope of the subject matter.

It will be further understood that the terms "comprises," "comprising," "includes" and/or "including," when used herein, specify the presence of stated features, integers, steps, operations, elements and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and/or groups thereof.

For example, two functions or acts shown in succession may in fact be executed concurrently or may sometimes be executed in the reverse order, depending upon the functionality/acts involved.

As used herein, the term "communication network" refers to a network following any suitable communication standards, such as Long Term Evolution (LTE), LTE-Advanced (LTE-A), Wideband Code Division Multiple Access (WCDMA), High-Speed Packet Access (HSPA), and so on. Furthermore, the communications between a terminal device and a network device in the communication network may be performed according to any suitable generation communication protocols, including, but not limited to, the first generation (<NUM>), the second generation (<NUM>), <NUM>, <NUM>, the third generation (<NUM>), the fourth generation (<NUM>), <NUM>, the future fifth generation (<NUM>) communication protocols, and/or any other protocols either currently known or to be developed in the future.

Embodiments of the present disclosure may be applied in various communication systems. Given the rapid development in communications, there will of course also be future type communication technologies and systems with which the present disclosure may be embodied. It should not be seen as limiting the scope of the present disclosure to only the aforementioned system.

The term "network device" includes, but not limited to, a base station (BS), a gateway, a management entity, and other suitable device in a communication system. The term "base station" or "BS" represents a node B (NodeB or NB), an evolved NodeB (eNodeB or eNB), a Remote Radio Unit (RRU), a radio header (RH), a remote radio head (RRH), a relay, a low power node such as a femto, a pico, and so forth.

The term "terminal device" includes, but not limited to, "user equipment (UE)" and other suitable end device capable of communicating with the network device. By way of example, the "terminal device" may refer to a terminal, a Mobile Terminal (MT), a Subscriber Station (SS), a Portable Subscriber Station, a Mobile Station (MS), or an Access Terminal (AT).

The term "circuitry" used herein may refer to one or more or all of the following:.

As described above, in communication systems, there is often an authentication process between the terminal devices and the entities in the network. Communication systems, such as <NUM> systems or <NUM> systems, usually use message authentication codes. It often takes some time to finish the authentication process. There are also some signaling transmitted among the terminal device and the entities during the authentication.

However, in the <NUM> system, especially in the scenario of Internet of Things (IoT), since the terminal devices are everywhere, there are a huge number of connections between the terminal devices and the network. The conventional authentication mechanism may take very long time to authenticate the terminal devices in the IoT and bring signaling storm.

In order to at least in part solve above and other potential problems, Embodiments of the present disclosure provide a salutation for authenticating terminal devices. Generally speaking, according to embodiments of the present disclosure, for a group of terminal device, only the first terminal device accessing to a network need to complete a whole authentication process. The remaining terminal devices in the same group may ignore the authentication process if they request to access to the network.

Now some example embodiments of the present disclosure are described below with reference to the figures. Those skilled in the art would readily appreciate that the detailed description given herein with respect to these figures is for explanatory purpose as the present disclosure extends beyond theses limited embodiments.

<FIG> illustrates a schematic diagram of a communication system in which embodiments of the present disclosure can be implemented. The communication system <NUM>, which is a part of a communication network, comprises a network device <NUM> and terminal devices <NUM>-<NUM>, <NUM>-<NUM>,. , and <NUM>-N, which can be collectively referred to as "terminal device(s)" <NUM>. It is to be understood that the number of network devices and terminal devices shown in <FIG> is given for the purpose of illustration without suggesting any limitations. The communication system <NUM> may comprise any suitable number of network devices and terminal devices. It should be noted that the communication system <NUM> may also comprise other elements which are omitted for the purpose of clarity. The network device <NUM> may communicate with the terminal devices <NUM>.

The terminal devices <NUM>-<NUM>, <NUM>-<NUM>,. , <NUM>-N belong to the same group of terminal devices <NUM>. Only by way of example, in the scenario of IoT, the terminal devices which have a similar application may be categorized into a same group. For example, the shared bicycles or vehicles may be classified into the same group of terminal devices. Alternatively, or in addition, in some embodiments, the terminal devices may also be categorized based on locations. For example, the terminal devices in a same industry product line may be categorized into the same group. Alternatively or in addition, in some embodiments, the terminal devices which require the same quality of service (QoS) may be classified into the same group. It is to be understood that the terminal devices may be categorized into groups based on any suitable conditions with any suitable methods. The present disclosure is not limited in this aspect.

The network device <NUM> may be an entity in a network <NUM>. For example, the network device <NUM> may be a mobility management entity (MME). The network device <NUM> may also be an entity with an access and mobility management function (AMF). Alternatively, or in addition, in some embodiments, the network device <NUM> may be an entity with an authentication server function (AUSF). In some embodiments, the network <NUM> may also comprise other network device (not shown). For example, the network <NUM> may comprise a home subscriber server (HSS). In yet another embodiment, the network <NUM> may comprise a home gateway or an entity in a home environment (HE).

Communications in the communication system <NUM> may be implemented according to any proper communication protocol(s), comprising, but not limited to, cellular communication protocols of the first generation (<NUM>), the second generation (<NUM>), the third generation (<NUM>), the fourth generation (<NUM>) and the fifth generation (<NUM>) and on the like, wireless local network communication protocols such as Institute for Electrical and Electronics Engineers (IEEE) <NUM> and the like, and/or any other protocols currently known or to be developed in the future. Moreover, the communication may utilize any proper wireless communication technology, comprising but not limited to: Code Divided Multiple Address (CDMA), Frequency Divided Multiple Address (FDMA), Time Divided Multiple Address (TDMA), Frequency Divided Duplexer (FDD), Time Divided Duplexer (TDD), Multiple-Input Multiple-Output (MIMO), Orthogonal Frequency Divided Multiple Access (OFDMA) and/or any other technologies currently known or to be developed in the future.

<FIG> is a schematic diagram <NUM> illustrating interactions among terminal devices and network devices according to conventional technologies. As described above, the conventional authentication mechanisms use message authentication codes for authenticating terminal devices, where a root key is shared between a terminal device and a network device. <FIG> shows an example authentication process among a terminal device <NUM>, a network device <NUM> and a further network device <NUM>.

The terminal device <NUM> may transmit <NUM> an attach request to the network device <NUM>. Upon receiving the attach request, the network device <NUM>.

Upon receiving the authentication data request, the further network device <NUM> may generate a cipher key (CK) and integrity key (IF) based on the shared root key. The further network device <NUM> may generate <NUM> authentication vectors. The further network device <NUM> may transmit <NUM> an authentication data response to the network device <NUM>. The authentication data response may comprise the generated authentication vector. The authentication data response may comprise other information generated by the further network device <NUM>. For example, the authentication data response may also comprise a random number (RAND). Additionally, the authentication data response may comprise an authentication token (AUTN). The authentication data response may comprise an expected response (XRES) as well. The network device <NUM> may save <NUM> the vectors.

The network device <NUM> may transmit <NUM> a user authentication request to the terminal device <NUM>. The user authentication request may contain related parameters which the message authentication code value. The related parameters may comprise the RAND and/or the AUTH. The terminal device <NUM> may calculate an expected authentication message code and XRES to authenticate <NUM> the network. The terminal device <NUM> may generate <NUM> RES and transmit <NUM> a user authentication response to the network device <NUM>. The user authentication response may comprise the generated RES. The network device <NUM> may check <NUM> if the RES equals to the XRES. The network device <NUM> may transmit <NUM> a response to the attach request based on the checking results. For example, if the RES equals to the XRES, the network device <NUM> may successfully authenticate the terminal device <NUM> and transmit the response to indicate that the attach request is accepted.

It will be appreciated that the interactions according to the traditional authentication, as shown in <FIG>, usually take a relatively long period of time to complete the authentication. Since every terminal device needs to complete the whole authentication as long as accessing to the network, the authentication may take very long time if there are many terminal devices. Besides, there may be a huge number of signaling due to the number of the terminal devices. Thus, a new authentication solution is needed.

Different from the above authentication procedure, the present disclosure provides an IBC-based method for authenticating terminal devices. Identity-based cryptography (IBC) is a public-key cryptography that adopts the bilinear mapping technique, which does not require rules to pre-compute key pairs or obtain certificates for their public keys. Instead, the public keys can be any identifiers such as email addresses, while private keys are derived at any time by a trusted private key generator upon request by the designated principals.

<FIG> is a schematic diagram <NUM> illustrating interactions among the terminal device and the network devices. As shown in <FIG> and <FIG>, the terminal device <NUM>-<NUM> belongs to the group of terminal devices <NUM>. The group identity of each group is shared between the respective group and the network <NUM>.

The terminal device <NUM>-<NUM> transmits <NUM> a connection request to the network device <NUM> in the network <NUM>. The connection request comprises the identity of the terminal device <NUM>-<NUM>. For example, the identity of the terminal device <NUM>-<NUM> may comprise, but not limit to, an international mobile subscriber identity (IMSI) of the terminal device <NUM>-<NUM>, a packet-temporary mobile subscriber identity (P-TMSI) of the terminal device <NUM>-<NUM> a globally unique temporary UE identity ( GUTI) of the terminal device <NUM>-<NUM>. It is to be understood that the connection request may comprise any one or any combination of the aforementioned identities. Alternatively, or in addition, the connection request may comprise a signature of the terminal device <NUM>-<NUM> (referred to as "first signature" hereinafter). In some embodiments, as will be described below, the first signature may be verified by the network device <NUM> during authentication. In some embodiments, the connection request may be an accessing request to the network <NUM>. In other embodiments, the connection request may be a service request. It is to be understood that the connection request may any kinds of suitable requests.

Upon receiving the connection request, the network device <NUM> obtains <NUM> the group identity of the group of terminal devices based on the identity of the terminal device. In some embodiments, the network device <NUM> may map the identity of the terminal device <NUM>-<NUM> to the group identity based on a pre-defined mapping. As described above, the group identity of each group is shared between the respective group and the network <NUM>. In some embodiments, if a terminal device enters the group <NUM>, the identity of the terminal device is stored associated with the group identity and such information is updated to the network <NUM>.

In some embodiments, he pre-defined mapping may be generated upon the terminal devices are categorized into the group. The pre-defined mapping may be stored in the network. Each group of terminal devices has a respective pre-defined mapping. For example, all of the pre-defined mapping of each group may be stored in a further communication device <NUM> with a large amount of storing space and/or in a remote storage device which can be accessed by the further communication device <NUM>. In an example embodiment, the pre-defined mappings of some groups may also be stored in the network device <NUM>.

In an example embodiment, the pre-defined mapping may be stored in the form of table. Alternatively, the pre-defined mapping may be stored in the form of tree. It is to be understood the pre-defined mapping may be stored in any suitable manners.

If the group identity is not pre-stored in the network device <NUM>, the network device <NUM> may not find the group identity corresponding to the identity of the terminal device <NUM>-<NUM> In such situation, the network device <NUM> may transmit <NUM> an authentication request to the further network device <NUM> in the network <NUM>, in order to obtain the group identity and a group status of the group. The authentication request may comprise the identity of the terminal device <NUM>. For example, the authentication request may comprise the IMSI of the terminal device <NUM>-<NUM>. Alternatively, or in addition, the authentication request may comprise a serving network (SN) identity. In other embodiments, the authentication request may comprise a network type. It is to be understood that the present disclosure is not limited in the aspect.

In an example embodiment, the further network device <NUM> may be a HSS. Alternatively, or in addition, the further network device <NUM> may be a home gateway or an entity in a home environment (HE). As described above, the further network device <NUM> may store the mapping between identities of terminal devices and identities of groups. For example, the further network <NUM> may store the mapping relationship between the identities of the terminal devices <NUM>-<NUM>, <NUM>-<NUM>,. , <NUM>-N and the group identity of the group <NUM>. In other embodiment, the further network device <NUM> may be able to access to a remote storage which stores the mapping relationship.

In some embodiments, upon receiving the authentication request from the network device <NUM>, the further network device <NUM> may find <NUM> the group identity based on the identity of the terminal device <NUM>-<NUM>. As described above, the further network device <NUM> stores all the mapping between identities of terminal devices and identities of groups locally or remotely. The further network device <NUM> may look up the group identity of the group <NUM> corresponding to the identity of the terminal device <NUM>-<NUM> in the mapping relationship. The group identity of the group <NUM> may be represented as "Vtl_Grp_ID.

The further network device <NUM> may also store group status of each group. The group status relates to historical access of the group of terminal devices to the network <NUM>. The group identity has one or more attribute to indicate the group status. For example, the group status may be a Boolean value. In other embodiments, the group status may be a bit in the group identity. For example, if the group status is "<NUM>" (false), it means that there is no terminal device in the group accessing to the network previously. If the group status is "<NUM>" (true), it means that there is at least one terminal device in the group accessing to the network previously.

The further network device <NUM> may transmit <NUM> the group identity and the group status to the network device <NUM>. The network device <NUM> may store the group identity and the group status from the further network device <NUM>. In this way, the further network device <NUM> does not need to generate authentication vectors and the space for storing the authentication vectors at the network device <NUM> is saved.

In some embodiments, the network device <NUM> may obtain <NUM> the first signature from the received connection request, and then verify <NUM> the first signature based on a public key derived from the group identity. In an example embodiment, since IBC is a public-key cryptography, the first signature may be decrypted using the public key obtained from the group identity (i.e., the public key). If the network device <NUM> fails to verify the first signature, the network device <NUM> may deny the connection request.

The network device <NUM> determines <NUM> the group status of the group <NUM>. If the group identity is in the network device <NUM>, the network device <NUM> determines <NUM> the group status of the group <NUM> based on the group identity. As described above, the group status relates to historical access of the group of terminal devices to the network <NUM>.

If the group status indicates that there is at least one terminal device in the group <NUM> accessing to the network <NUM> previously, it means that the terminal device <NUM>-<NUM> is not the first terminal device in the group <NUM> requesting to access to the network <NUM>. In this situation, the network device <NUM> transmits <NUM> a response to the connection request. The response may indicate that the connection request is approved and the terminal device <NUM>-<NUM> may ignore the following authentication and connect to the network directly. In this way, both the network device <NUM> and the terminal device <NUM>-<NUM> can reduce time for authentication, thereby improving the efficiency of authentication.

In some embodiments, the response may comprise an auth_pass_ind indicator. In this way, if the network device <NUM> pre-stores the group identity, the network device does not need to communicate with the further network device <NUM> for authentication, which reduces the number of signaling and saves time compared with the conventional technologies. Further, the terminal device <NUM>-<NUM> does not need to authenticate the network <NUM>, which reduces the calculation burden on the terminal device <NUM>-<NUM>.

In some embodiments, if the group status indicates that there is none of the terminal devices in the group <NUM> has ever accessed to the network <NUM> previously, it can be determined that the connection request is associated with an initial access of the group <NUM> to the network <NUM> and the terminal device <NUM>-<NUM> is the first terminal device in the group <NUM> requesting to access to the network <NUM>. In some embodiments, upon verifying <NUM> the first signature, the network device <NUM> may generate <NUM> its signature (referred to as "second signature" hereinafter) to be verified by the terminal device <NUM>-<NUM>. The network device <NUM> transmits <NUM> a response to the connection request comprising the second signature and the verifying result of the first signature.

In some embodiments, upon receiving the response to the connection request comprising the second signature, the terminal device <NUM>-<NUM> may verify <NUM> the second signature to authenticate the network <NUM> based on a public identity of the network device <NUM>. If the terminal device <NUM>-<NUM> verifies the second signature successfully and authenticates the network, the terminal device <NUM>-<NUM> may transmit <NUM> the authentication information to the network device <NUM>. Upon receiving the authentication, the network device <NUM> may set the group status of the group <NUM> to indicate that at least one of the terminal devices in the group <NUM> has accessed to the network <NUM>.

In this way, for a group of terminal devices, only the first terminal device accessing to the network needs to complete the whole authentication process and the remaining terminal devices in the same group can ignore the authentication, thereby saving a lot of calculating efforts and authenticating time. Further, there is no dedicated authentication message between the terminal device and the network device.

<FIG> illustrates a flowchart of method <NUM> in accordance with an example of the present disclosure. The method <NUM> may be implemented at the network device <NUM>.

At block <NUM>, the network device <NUM> receives a connection request from the terminal device <NUM>-<NUM> in the group of terminal device <NUM>. The connection request comprises an identity of the terminal device <NUM>-<NUM>. In some embodiments, the network device <NUM> may obtain the first signature in the connection request. The first signature may be verified by the network device <NUM> based on the public key derived from the group identity.

At block <NUM>, the network device <NUM> obtains the group identity based on the identity of the terminal device <NUM>-<NUM>. In some embodiments, the network device <NUM> may determine whether the group identity is stored in the network device <NUM> or not. In an example embodiment, if the network device <NUM> determines that the group identity is not in the network device <NUM>, the network device <NUM> may transmit an authentication request to obtain the group identity to the further communication device <NUM>.

In some embodiments, the further network device <NUM> stores all the mapping between identities of terminal devices and identities of groups locally or remotely. The further network device <NUM> may look up the group identity of the group <NUM> corresponding to the identity of the terminal device <NUM>-<NUM> based on the mapping. The further network device <NUM> may transmit the group identity to the network device <NUM>.

At block <NUM>, the network device <NUM> determines the group status of the group <NUM> based on the group identity. The group status relates to historical access of the group of terminal devices to the network <NUM>. In an example embodiment, the group status indicates whether there is at least one terminal device in the group <NUM> accessing to the network <NUM> previously.

At block <NUM>, the network device <NUM> transmits a response to the connection request at least in part based on the group status of the group to the terminal device <NUM>-<NUM>. <FIG> illustrates a flowchart of method <NUM> that can be implemented at block <NUM>. An example embodiment of the present disclosure is described below with the reference to <FIG>.

At block <NUM>, the network device <NUM> may determine whether the group status indicates that the connection request is associated with an initial access of the group of terminal devices <NUM>.

If the group status indicates that there is no terminal device in the group <NUM> having accessed to the network <NUM> previously, and the network device <NUM>, at block <NUM>, verifies the first signature successfully, the network device <NUM> may transmit a second signature to be verified by the terminal device <NUM>-<NUM>. If the network device <NUM> fails to verify the first signature, the network device <NUM> may deny the connection request.

At block <NUM>, the network device <NUM> may receive authentication information from the terminal device. The authentication information is based on the verifying result of the second signature. If the authentication information indicates the second signature is verified successfully, at block <NUM>, the network device <NUM> may set the group status to indicate that at least one terminal device in the group <NUM> has accessed to the network <NUM>.

In some embodiments, if the group status indicates that there is one or more terminal devices in the group <NUM> has accessed to the network <NUM> before, at block <NUM>, the network device <NUM> may transmit an approval of the connection request to the terminal device <NUM>-<NUM>.

In some embodiments, an apparatus for performing the method <NUM> (for example, the terminal device <NUM>-<NUM>) may comprise respective means for performing the corresponding steps in the method <NUM>. These means may be implemented in any suitable manners. For example, it can be implemented by circuitry or software modules.

In some embodiments, the apparatus comprises: means for receiving, from a terminal device in a group of terminal devices, a connection request comprising an identity of the terminal device; means for obtaining a group identity of the group of terminal devices based on the identity of the terminal device; means for determining a group status of the group based on the group identity, the group status related to historical access of the group of terminal devices to the network; and means for transmitting, to the terminal device, a response to the connection request at least in part based on the group status of the group.

In some embodiments, the means for obtaining a group identity of the group and a group status of the group comprises: means for, in response to determining that the group identity is absent in the network device, transmitting, to a further network device in the network, a further request to obtain the group identity; and means for receiving, from the further network device, the group identity and the group status.

In some embodiments, the means for transmitting a response to the connection request comprises: means for obtaining a first signature of the terminal device from the connection request; means for verifying the first signature; and means for in response to the first signature being successfully verified and the group status indicating that the connection request is associated with an initial access of the group of terminal devices to the network, transmitting, to the terminal device, the response comprising a second signature of the network device to be verified by the terminal device.

In some embodiments, the apparatus further comprises: means for receiving, from the terminal device, authentication information provided based on a verifying result of the second signature; and means for in response to determining from the authentication information that the second signature is successfully verified, setting the group status to indicate that at least one terminal device in the group has accessed to the network.

In some embodiments, the means for transmitting a response to the connection request comprises: means for obtaining a first signature of the terminal device from the connection request; means for verifying the first signature; and means for in response to the first signature being successfully verified and the group status indicating that at least one terminal device in the group of terminal devices has previously successfully accessed to the network,, transmitting, to the terminal device, an approval of the connection request.

<FIG> illustrates a flowchart of method <NUM> in accordance with an example of the present disclosure. The method <NUM> may be implemented at the terminal device <NUM>-<NUM>.

At block <NUM>, the terminal device <NUM>-<NUM> transmits the connection request to the network device <NUM> in the network <NUM>. The connecting device comprises the identity of the terminal device <NUM>-<NUM>. The identity of the terminal device <NUM>-<NUM> is used by the network device <NUM> to obtain the group identity of the group <NUM>. In some embodiments, the terminal device <NUM>-<NUM> may transmit the first signature comprised in the connection request. The first signature may be verified by the network device <NUM>.

At block <NUM>, the terminal device <NUM>-<NUM> receives the response to the connection request from the network device <NUM>. The response is based on the group status of the group which relates to historical access of the group of terminal devices to the network <NUM>. The group status is determined based on the group identity.

In some embodiment, if the terminal device <NUM>-<NUM> is the first terminal device in the group accessing to the network <NUM>, which means that the group status indicates the connection request is associated with initial access to the network <NUM> and the first signature is successfully verified, the terminal device <NUM>-<NUM> may receive the response comprising the second signature to be verified. The terminal device <NUM>-<NUM> may verify the second signature and transmit authentication information based on the verifying result to the network device <NUM>.

In some embodiments, the terminal device <NUM>-<NUM> is not the first terminal device in the group accessing to the network <NUM>, which means that the group status indicates that one or more terminal devices in the group <NUM> have accessed to the network <NUM> before, the terminal device <NUM>-<NUM> may receive an approval of the connection request from the network device <NUM>.

In some embodiments, an apparatus for performing the method <NUM> (for example, the network device <NUM>) may comprise respective means for performing the corresponding steps in the method <NUM>. These means may be implemented in any suitable manners. For example, it can be implemented by circuitry or software modules.

In some embodiments, the apparatus comprises: means for transmitting, to a network device in a network, a connection request comprising an identity of the terminal device which is used for obtaining a group identity of the group of terminal devices; and means for receiving, from the network device, a response to the connection request at least in part based on a group status of the group, the group status being determined based on the group identity and related to historical access of the group of terminal devices to the network.

In some embodiments, the means for receiving a response to the connection request comprises: means for transmitting, to the network device in the network, a first signature of the terminal device to be verified by the terminal device; and means for in response to the first signature being successfully verified and the group status indicating that the connection request is associated with an initial access of the group of terminal devices to the network, receiving, from the network device, the response comprising a second signature of the network device.

In some embodiments, the apparatus further comprises: means for verifying the second signature; and means for transmitting, to the network device, authentication information being based on a verifying result of the second signature.

In some embodiments, the means for receiving a response to the connection request comprises: means for transmitting, to the network device in the network, a first signature of the terminal device to be verified by the network device; and means for in response to the first signature being successfully verified and group status indicating that at least one terminal device in the group of terminal devices has previously accessed to the network, receiving, from the network device, an approval of the connection request.

<FIG> is a simplified block diagram of a device <NUM> that is suitable for implementing embodiments of the present disclosure. The device <NUM> may be implemented at the network device <NUM>. The device <NUM> may also be implemented at the terminal devices <NUM>. As shown, the device <NUM> comprises one or more processors <NUM>, one or more memories <NUM> coupled to the processor(s) <NUM>, one or more transmitters and/or receivers (TX/RX) <NUM> coupled to the processor <NUM>.

The processor <NUM> may be of any type suitable to the local technical network, and may comprise one or more of general purpose computers, special purpose computers, microprocessors, digital signal processors (DSPs) and processors based on multicore processor architecture, as non-limiting examples.

The memory <NUM> may be of any type suitable to the local technical network and may be implemented using any suitable data storage technology, such as a non-transitory computer readable storage medium, semiconductor based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory and removable memory, as non-limiting examples.

The memory <NUM> stores at least a part of a program <NUM>. The TX/RX <NUM> is for bidirectional communications. The TX/RX <NUM> has at least one antenna to facilitate communication, though in practice an Access Node mentioned in this application may have several ones.

The program <NUM> is assumed to comprise program instructions that, when executed by the associated processor <NUM>, enable the device <NUM> to operate in accordance with the embodiments of the present disclosure, as discussed herein with reference to <FIG>. That is, embodiments of the present disclosure can be implemented by computer software executable by the processor <NUM> of the device <NUM>, or by hardware, or by a combination of software and hardware.

In the context of the present disclosure, the computer program code or related data may be carried by any suitable carrier to enable the device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer readable media and the like.

While this specification contains many specific implementation details, these should not be construed as limitations on the scope of any disclosure or of what may be claimed, but rather as descriptions of features that may be specific to particular embodiments of particular disclosures. Moreover, although features may be described above as acting in certain combinations and even initially claimed as such, one or more features from a claimed combination can in some cases be excised from the combination, and the claimed combination may be directed to a sub-combination or variation of a sub-combination.

Various modifications, adaptations to the foregoing exemplary embodiments of this disclosure may become apparent to those skilled in the relevant arts in view of the foregoing description, when read in conjunction with the accompanying drawings. Any and all modifications will still fall within the scope of the non-limiting and exemplary embodiments of this disclosure. Furthermore, other embodiments of the disclosures set forth herein will come to mind to one skilled in the art to which these embodiments of the disclosure pertain having the benefit of the teachings presented in the foregoing descriptions and the associated drawings.

Therefore, it is to be understood that the embodiments of the disclosure are not to be limited to the specific embodiments disclosed and that modifications and other embodiments are intended to be comprised within the scope of the appended claims. Although specific terms are used herein, they are used in a generic and descriptive sense only and not for purpose of limitation.

Claim 1:
A network device (<NUM>), comprising:
at least one processor; and
at least one memory including computer program codes;
the at least one memory and the computer program codes configured to, with the at least one processor, cause the network device (<NUM>) to:
receive, from a terminal device (<NUM>-<NUM>) in a group of terminal devices, a connection request comprising an identity of the terminal device (<NUM>-<NUM>) and a first signature of the terminal device (<NUM>-<NUM>);
obtain (<NUM>) a group identity of the group of terminal devices based on the identity of the terminal device (<NUM>-<NUM>);
determine a group status of the group based on the group identity, the group status relating to historical access of the group of terminal devices to a network; and
transmit (<NUM>), to the terminal device (<NUM>-<NUM>), a response to the connection request at least in part based on the group status of the group, wherein the transmitting (<NUM>) of the response to the connection request comprises:
- obtain (<NUM>) the first signature of the terminal device (<NUM>-<NUM>) from the connection request;
- verify (<NUM>) the first signature;
- in response to the first signature being successfully verified and the group status indicating that at least one terminal device in the group of terminal devices has successfully accessed to the network previously, transmit, to the terminal device (<NUM>-<NUM>), the response comprising an approval of the connection request; and
- in response to the first signature being successfully verified and the group status indicating that the connection request is associated with an initial access of the group of terminal devices to the network, transmit, to the terminal device (<NUM>-<NUM>), the response comprising a second signature of the network device (<NUM>) to be verified by the terminal device (<NUM>-<NUM>).