WO2013007139A1

WO2013007139A1 - Authentication method and home location register

Info

Publication number: WO2013007139A1
Application number: PCT/CN2012/076466
Authority: WO
Inventors: 张志华; 王振; 曹小飞; 张强
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-07-13
Filing date: 2012-06-05
Publication date: 2013-01-17
Also published as: CN102238546A

Abstract

An authentication method, including: when receiving an authentication request carrying a call history count (COUNT) value and if the number of calls indicated by the COUNT value in the authentication request is one more call than the number of calls indicated by the COUNT value in a home location register, the home location register judging that the COUNT authentication is passed.Also provided is a home location register.The problem that, when the MSC/VLR has failed, the terminal cannot gain access due to the inconsistency of the COUNT values of the network side and the terminal side can be solved.

Description

An authentication method and home location register

Technical field

The present invention relates to mobile communications, and more particularly to an authentication method and a home location register.

Background technique

In order to detect and prevent all kinds of illegal use of mobile communication resources and services such as theft and theft in mobile communication, to ensure network security and protect the legitimate rights and interests of telecom operators and users, mobile user authentication is effective. The method, its introduction and use is an important aspect of digital mobile communication superior to analog mobile communication.

At present, the CDMA2000 system also has the ability to authenticate users. In the network, three checksums need to be performed: one is the Authentication Confirmation Parameter (RANDC), and the other is the authentication response parameter ( The Authentication Response Parameter (AUTHR for short), and the third is the Call History Count (COUNT). Only when all three checks pass, the mobile station is allowed to access. RANDC's test In order to verify whether the random number used by the mobile station authentication is generated by the switch (that is, the system that the mobile station is ready to access), the AUTHR check is based on the shared secret data (SSD) of the network side. The result calculated by the CAVE algorithm with the Authentication Challenge Parameter (RANDU) is consistent with that reported by the mobile station. Here we must introduce the COUNT check, which is an effective means of identifying whether there is a copy or fake mobile station in the network (that is, a "clone" mobile station made by illegal means), so the COUNT check is also called "clone". Detection. If a mobile phone is "cloned, then, as long as the real mobile phone and the "clone" machine are used online, the COUNT value provided by the two machines (COUNT is a 0-63 number, the complete clone terminal is no different) Differently, the legal terminal has the correct COUNT value and is accumulating with each call service, so that when the COUNT of the terminal is found to be inconsistent with the system, it can be judged as an illegal terminal and rejected, preventing the "clone" machine from accessing the network. Calling the service to achieve the effect of identifying legitimate users.

In the CDMA2000 system, the COUNT authentication process is performed when the PAL authentication is successful when the mobile station initiates the call access, and the network side triggers the COUNT update to achieve the effect of adding the COUNT value saved by the mobile station and the HLR device, so that it is "clone". Machine user, COUNT authentication at this time Failure will not trigger a COUNT update.

Figure 1 depicts the COUNT authentication and COUNT update process, including:

101: The mobile station initiates a call, and the BSC sends a call request message to the MSC/VLR, where the message carries RANDC, AUTHR and COU T for authentication.

102: The MSC/VLR sends an authentication request message to the HLR, requesting the HLR to perform authentication processing, where the message carries RAND, AUTHR, and COU T for authentication.

103: After receiving the authentication request message, the HLR performs an authentication process, including COUNT authentication and triggers a COUNT update.

104: The HLR returns an authentication response message to the MSC/VLR, carrying a flag requiring a COUNT update.

105: The MSC/VLR saves the flag that needs to perform the COUNT update, and first sends the assignment request message to the BSC, instructing the BSC to establish a traffic channel.

106: The BSC completes establishing a traffic channel, and returns an assignment completion message to the MSC/VLR.

107: The MSC/VLR determines that the service channel is established, and performs a COUNT update flag according to the previously saved needs, and sends a COUNT parameter update request message to the BSC.

108: The BSC informs the mobile station to perform COUNT update, and the mobile station COUNT value is heavy. After 1 returns the response to the BSC.

109: The BSC receives the response from the mobile station and sends a parameter update confirmation message to the MSC/VLR.

110: The MSC/VLR sends an authentication status report request message to the HLR, carrying the COUNT update result.

111: After receiving the authentication status report request message, the HLR saves the COUNT value of the HLR in the HLR according to the COUNT update result carried in the HLR.

112: After the HLR completes the COUNT value accumulation, it returns an authentication status report response message to the MSC/VLR.

In the process of performing COUNT update, if there is a MSC/VLR downtime, a link interruption with the HLR, etc., the COUNT value in the terminal has been accumulated and the user COUNT saved in the HLR device is not accumulated, and the two are inconsistent. These terminals will always be after MSC/VLR recovery Call service cannot be performed because COUNT authentication failed. Since the terminal performs COUNT update every time the call service is performed, the terminal that cannot be used due to the above problem will be a large number, so this problem must be solved in order to truly use COUNT to identify a legitimate or cloned user.

Figure 2 depicts the flow chart of the MSC/VLR downtime in the COUNT update process, including:

201: The mobile station initiates a call, and the BSC sends a call request message to the MSC/VLR, where the message carries RANDC, AUTHR and COU T for authentication.

202: The MSC/VLR sends an authentication request to the HLR, requesting the HLR to perform an authentication process, where the message carries RAND, AUTHR, and COU T for authentication.

203: After receiving the authentication request message, the HLR performs an authentication process, including COUNT authentication and triggering a COUNT update.

204: The HLR returns an authentication response message to the MSC/VLR, carrying a flag that needs to perform a COUNT update.

205: The MSC/VLR saves the flag that needs to perform COUNT update, and first sends an assignment request message to the BSC, instructing the BSC to establish a traffic channel.

206: The BSC completes establishing a traffic channel, and returns an assignment completion message to the MSC/VLR.

207: The MSC/VLR determines that the service channel is established, and performs a COUNT update flag according to the previously saved needs, and sends a COUNT parameter update request message to the BSC.

208: The BSC notifies the mobile station to perform COUNT update, and the mobile station COUNT value is heavy. After 1 returns the response to the BSC.

209: The BSC receives the response from the mobile station and sends a parameter update confirmation message to the MSC/VLR.

210: The parameter update confirmation message cannot be passed to the HLR due to a MSC/VLR downtime or a broken link with the HLR.

211: The MSC/VLR recovers, but at this time, the COUNT saved by the terminal is inconsistent with the record in the HLR, and the terminal will not be able to perform call service because the COUNT authentication fails. Summary of the invention The technical problem to be solved by the present invention is to provide an authentication method and a home location register, which solves the problem that the existing MSC/VLR is down, and the COUNT value of the network side and the terminal side are inconsistent, resulting in the terminal being unable to access.

In order to solve the above problems, the present invention provides an authentication method, including:

When the home location register receives the authentication request carrying the historical call count (COUNT) value, when the number of calls indicated by the COUNT value in the authentication request is more than the number of calls indicated by the COUNT value in the home location register , judge COUNT authentication passed.

Preferably, the above method may further have the following feature: determining, according to the following formula, whether the number of calls indicated by the COUNT value in the authentication request is greater than the number of calls indicated by the COUNT value in the home location register:

The COUNT value in the authentication request = (COUNT value + X in the home location register) mod ( N+1 ); wherein, X is an accumulated value of the call history call count every time a call occurs, the N is The maximum value of the call history counter.

Preferably, the above method may also have the following characteristics, wherein X=l.

Preferably, the above method may further have the following features, the method further comprising: when the COUNT value in the authentication request indicates that the number of calls is more than the number of calls indicated by the COUNT value in the home location register, The home location register also updates the local COUNT value to the COUNT value in the authentication request.

Preferably, the above method may further have the following feature, the method further comprising: when the COUNT value in the authentication request is equal to the COUNT value in the home location register, determining that the COUNT authentication passes.

The invention also provides a home location register, comprising an authentication unit, wherein:

The authentication unit is configured to: when receiving an authentication request carrying a historical call count (COUNT) value, when the number of calls indicated by the COUNT value in the authentication request is greater than the COUNT value in the home location register When the number of calls is more than one, the COUNT authentication is judged to pass.

Preferably, the home location register may further have the following feature, the authentication unit is configured to: determine, according to the following formula, whether the number of calls indicated by the COUNT value in the authentication request is greater than a COUNT value in the home location register More calls per call: The COUNT value in the authentication request = (COUNT value + X in the home location register) mod ( N+1 ); wherein X is the accumulated value of the call history count for each call history, and the N is the call history. The maximum value of the counter.

Preferably, the home location register may further have the following characteristics, where X=l.

Preferably, the home location register may further have the following feature, the home location register further includes an updating unit, configured to: when the COUNT value in the authentication request indicates the number of calls is greater than the COUNT value in the home location register When the number of indicated calls is more than one, the local COUNT value is updated to the COUNT value in the authentication request.

Preferably, the home location register may further have the following feature, the authentication unit is further configured to: when the COUNT value in the authentication request is equal to the COUNT value in the home location register, determine that the COUNT authentication is passed .

In the method provided by the embodiment of the present invention, when the number of calls indicated by the COUNT value in the authentication request is more than the number of calls indicated by the COUNT value in the HLR, the COUNT authentication is passed, thereby solving the COUNT inconsistency in the case of the MSC/VLR downtime. The problem that legitimate users cannot make call services. BRIEF abstract

Figure 1 is a flow chart of COUNT authentication and COUNT update;

Figure 2 is a flow chart of the MSC/VLR downtime in the COUNT update process;

Figure 3 is an improved COUNT authentication flow chart;

Figure 4 is a simplified COUNT authentication flow chart after MSC/VLR downtime recovery;

Figure 5 is a block diagram of a home location register in accordance with an embodiment of the present invention. Preferred embodiment of the invention

In order to make the objects, the technical solutions and the advantages of the present invention more clearly, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other. When the terminal performs the call service, the link between the MSC/VLR downtime or the HLR occurs during the COUNT update process. At this time, the COUNT of the terminal has been updated and accumulated, and the COUNT that has not been saved by the HLR has not changed. At this time, all legitimate users under the MSC/VLR have two cases regarding the COUNT value:

COUNT value of the terminal = COUNT value in HLR

The COUNT value of the terminal = ( COUNT value + X in HLR) mod (N+1)

Where X is the accumulated value of the call history call count every time a call occurs, and N is the maximum value of the call history counter, for example, X=l, N=63, and other values may be taken as needed.

In the embodiment of the present invention, when the COUNT authentication is performed, when the COUNT value of the terminal = (the COUNT value in the HLR + 1) mod 64 is determined, the COUNT authentication is also considered to be successful, and the COUNT value saved by the HLR is modified to be the COUNT value reported by the terminal. Solve the problem that the COUNT is inconsistent in the case of the MSC/VLR downtime and the legitimate user cannot make the call service.

An embodiment of the present invention provides an authentication method, including:

When the home location register receives the authentication request carrying the historical call count (COUNT) value, when the number of calls indicated by the COUNT value in the authentication request is more than the number of calls indicated by the COUNT value in the home location register , judge COUNT authentication passed;

Wherein, when the COUNT value in the authentication request is equal to the COUNT value in the home location register, it is determined that the COUNT authentication is passed.

Wherein, it is determined according to the following formula whether the number of calls indicated by the COUNT value in the authentication request is greater than the number of calls indicated by the COUNT value in the home location register:

The COUNT value in the authentication request = ( COUNT value + X in the home location register) mod ( N+1 ) ;

Wherein, the X is an accumulated value of a call history call count every time a call occurs, and the N is a maximum value of a call history counter.

The method further includes: when the number of calls indicated by the COUNT value in the authentication request is greater than the number of calls indicated by the COUNT value in the home location register, the home location register further updates the local COUNT The value is the COUNT value in the authentication request.

The present invention will be described below with X = l and N = 63, and other values are similar. Figure 3 is a flow chart of an improved COUNT authentication proposed by the present invention.

301: The mobile station initiates a call, and the BSC sends a call request message to the MSC/VLR, where the message carries RANDC, AUTHR and COU T for authentication.

302: The MSC/VLR sends an authentication request message to the HLR, requesting the HLR to perform authentication processing, where the message carries RAND, AUTHR, and COU T for authentication.

303: After receiving the authentication request message, the HLR performs an authentication process, including COUNT authentication and triggers a COUNT update. If the terminal COUNT value = COUNT value in the HLR, or the terminal COUNT value = (the COUNT value in the HLR + l) mod 64 considers that the COUNT authentication is successful, and at the same time, the COUNT value saved by the HLR is modified to the COUNT value on the terminal, the terminal COUNT The value is the COUNT value carried in the authentication request.

304: The HLR returns an authentication response message to the MSC/VLR, carrying a flag requiring a COUNT update.

305: The MSC/VLR saves the flag that needs to perform the COUNT update, and first sends the assignment request message to the BSC, instructing the BSC to establish a traffic channel.

306: The BSC completes establishing a traffic channel, and returns an assignment completion message to the MSC/VLR.

FIG. 4 is a flow chart of the authentication of the improved COUNT authentication proposed by the present invention after the MSC/VLR is recovered.

401: The mobile station initiates a call, and the BSC sends a call request message to the MSC/VLR, where the message carries RANDC, AUTHR and COU T for authentication.

402: The MSC/VLR sends an authentication request message to the HLR, requesting the HLR to perform authentication processing, where the message carries RAND, AUTHR, and COU T for authentication.

403: After receiving the authentication request message, the HLR performs an authentication process, including COUNT authentication and triggers a COUNT update. If the terminal COUNT value = COUNT value in the HLR, or the terminal COUNT value = (the COUNT value + l in the HLR) mod 64 considers that the COUNT authentication is successful, and the COUNT value saved by the HLR is modified to the terminal reporting the COUNT value.

404: The HLR returns an authentication response message to the MSC/VLR, carrying a flag that needs to perform a COUNT update.

405: The MSC/VLR saves the flag that needs to perform the COUNT update, and first sends the assignment request to cancel. The information is given to the BSC, instructing the BSC to establish a traffic channel.

406: The BSC completes establishing a traffic channel, and returns an assignment completion message to the MSC/VLR.

407: The MSC/VLR determines that the service channel is established, and performs a COUNT update flag according to the previously saved needs, and sends a COUNT update parameter update request message to the BSC.

408: The BSC informs the mobile station to perform COUNT update, and the mobile station COUNT value is heavy. After 1 returns the response to the BSC.

409: The BSC receives the response from the mobile station and sends a parameter update confirmation message to the MSC/VLR.

410: The parameter update confirmation message cannot be forwarded to the HLR due to a link between the MSC/VLR and the link between the HLR and the HLR.

411: The MSC/VLR is restored, but the COUNT and the HLR stored in the terminal are not consistent.

412: The mobile station initiates the call again, and the BSC sends a call request message to the MSC/VLR, where the message carries RANDC, AUTHR and COU T for authentication.

413: The MSC/VLR sends an authentication request message to the HLR, requesting the HLR to perform authentication processing, where the message carries RAND, AUTHR, and COU T for authentication.

414: After receiving the authentication request message, the HLR performs authentication processing. Because the MSC/VLR is down, the terminal COUNT value = (COUNT value + 1 in HLR) mod 64, and the COUNT authentication is successful, and the HLR is saved. The COUNT value is modified to the COUNT value reported by the terminal.

415: The HLR returns an authentication response message to the MSC/VLR, carrying a flag that needs to perform a COUNT update.

416: The MSC/VLR saves the flag that needs to perform the COUNT update, and first sends the assignment request message to the BSC, instructing the BSC to establish a traffic channel.

417: The BSC completes establishing the traffic channel and returns an assignment completion message to the MSC/VLR.

The present invention further provides a home location register, as shown in FIG. 5, including an authentication unit, where: the authentication unit is configured to: when receiving an authentication request carrying a historical call count (COUNT) value, when When the number of calls indicated by the COUNT value in the authentication request is more than the number of calls indicated by the COUNT value in the home location register, the COUNT authentication is judged to pass. The home location register may further include an updating unit, configured to update the local time when the number of calls indicated by the COUNT value in the authentication request is greater than the number of calls indicated by the COUNT value in the home location register The COUNT value is the COUNT value in the authentication request.

The authentication unit is configured to determine, according to the following formula, whether the number of calls indicated by the COUNT value in the authentication request is greater than the number of calls indicated by the COUNT value in the home location register: the authentication request COUNT value = (COUNT value + X in the home location register) mod ( N+1 );

Wherein, the X is an accumulated value of a call history count every time a call is generated, and the N is a maximum value of a call history counter.

The authentication unit is further configured to: when the COUNT value in the authentication request is equal to the COUNT value in the home location register, determine that the COUNT authentication passes.

The embodiment of the present invention introduces a method for solving the COUNT inconsistency between the terminal and the HLR in the CDMA2000 system, and is also applicable to systems such as WCDMA and TD-SCDMA.

By using the method proposed by the invention, the improvement of the COUNT authentication method solves the problem that a large number of legitimate terminals cannot perform call service after the MSC/VLR is recovered.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be accomplished by a program instructing the associated hardware, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware or in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

Industrial applicability

In the above method, when the number of calls indicated by the COUNT value in the authentication request is more than the number of calls indicated by the COUNT value in the HLR, the COUNT authentication is passed, thereby solving the problem that the COUNT is inconsistent in the case of the MSC/VLR downtime, and the legitimate user cannot The problem of making a call service.

Claims

1. An authentication method, including:

2. The method according to claim 1, wherein the number of calls indicated by the COUNT value in the authentication request is determined to be one more than the number of calls indicated by the COUNT value in the home location register according to the following formula:

3. The method of claim 2, wherein said X = 1.

The method according to any one of claims 1 to 3, wherein the method further comprises: when the COUNT value in the authentication request indicates the number of calls is greater than the number indicated by the COUNT value in the home location register When the number is more than one, the home location register also updates the local COUNT value to the COUNT value in the authentication request.

The method according to any one of claims 1 to 3, wherein the method further comprises: determining COUNT authentication when a COUNT value in the authentication request is equal to a COUNT value in the home location register by.

6. A home location register, comprising an authentication unit, wherein:

7. The home location register according to claim 6, wherein the authentication unit is configured to: determine, according to the following formula, whether the number of calls indicated by the COUNT value in the authentication request is greater than COUNT in the home location register The number of calls indicated by the value is one more time: The COUNT value in the authentication request = (COUNT value + X in the home location register) mod ( N+1 );

8. The home location register of claim 7, wherein said X = 1.

The home location register according to any one of claims 6 to 8, wherein the home location register further comprises an updating unit, configured to: when the number of calls indicated by the COUNT value in the authentication request is greater than the attribution When the number of calls indicated by the COUNT value in the location register is more than one, the local COUNT value is updated to the COUNT value in the authentication request.

The home location register according to any one of claims 6 to 8, wherein the authentication unit is further configured to: when a COUNT value in the authentication request is equal to a COUNT value in the home location register , judge COUNT authentication passed.