WO2016086355A1

WO2016086355A1 - Authentication method within wireless communication network, related apparatus and system

Info

Publication number: WO2016086355A1
Application number: PCT/CN2014/092787
Authority: WO
Inventors: 崇卫微; 吴晓波; 吕阳明; 陈璟; 席国宝
Original assignee: 华为技术有限公司
Priority date: 2014-12-02
Filing date: 2014-12-02
Publication date: 2016-06-09
Also published as: CN107005842A; CN107005842B

Abstract

Provided are an authentication method within a wireless communication network, a related apparatus and a system. A core network device saving an unused authentication vector for a user equipment may send a first authentication data request message to an authentication device, the first authentication data request message being used for requesting the authentication device to generate an authentication vector for the user equipment, a first authentication data response message of the authentication device is received, the first authentication data response message carrying a first authentication vector generated by the authentication device for the user equipment, and the first authentication vector is used to initiate an authentication process for the user equipment. The present invention ensures that each time CS domain / PS domain authentication is performed, a sequence included in the authentication vector is newly generated by the authentication device. Successful synchronisation is ensured even if PS domain authentication is inserted before CS domain authentication or CS domain authentication is inserted before PS domain authentication, solving the problem in the prior art of authentication failure caused by synchronisation failure.

Description

Authentication method, related device and system in wireless communication network

Technical field

The present invention relates to the field of communications technologies, and in particular, to an authentication method, related device, and system in a wireless communication network.

Background technique

Authentication is part of mobile network security management to achieve the confidentiality and data integrity of mobile networks. In the current mobile communication network, only a valid user equipment (User Equipment, UE) is entitled to receive the service, and verifying whether the UE is valid needs to be completed through an authentication process. The UE triggers the authentication process by initiating a registration request, a service request, or a handover request to the network. In the second generation (Second Generation, 2G) network system, authentication is a one-way process, and the network needs to verify the legitimacy of the UE; in the third generation (Third Generation, 3G) network or Long Term Evolution (Long Term Evolution, In the LTE network, in addition to verifying the legitimacy of the UE, the UE also needs to verify the validity of the network, that is, perform network authentication.

It should be noted that the authentication process is performed in a domain-by-domain manner, that is, a packet switching (PS) domain and a circuit switching (CS) domain respectively perform an authentication process, and a PS domain authentication is performed by a mobility management entity ( The Mobility Management Entity (MME) or the General Packet Radio Service (GPRS) Service Support Node (SGSN) is initiated. The CS domain authentication is initiated by the Mobile Switching Center (MSC). The UE needs to Network authentication is performed on the PS domain and the CS domain, respectively. Taking the 3G authentication process as an example, after obtaining the authentication vector from the home location register (HLR) or the authentication center (AUC), the MSC/SGSN sends an authentication request carrying the authentication vector to the UE. Message. The UE first determines the validity of the network according to the authentication request message. If the network is legal, it verifies whether the network is synchronized with the network. If the synchronization is successful, the UE successfully authenticates the network, and the UE returns a response message to the network, and the MSC/SGSN according to the UE. The response message sent by the UE verifies the validity of the UE. If the synchronization fails, the UE will reply to the MSC/SGSN with an authentication failure message carrying the cause value, and the MSC/SGSN will send an authentication request message to the UE again.

In the prior art, when the MSC/SGSN/MME obtains an authentication vector from the HLR/AUC, Multiple authentication vectors are requested to save network expenses and reduce the burden on HLR/AUC. Moreover, since the Universal Mobile Telecommunications System Subscriber Identity Module (USIM) of most UEs does not support the domain synchronization detection, the UE does not completely separate the synchronization detection of the PS domain and the CS domain network. Once the PS domain authentication is inserted before the CS domain authentication, and the unused authentication vector is stored in the MSC that initiates the CS domain authentication process, the UE may fail to perform network authentication on the CS domain; or The CS domain authentication is inserted before the PS domain authentication, and the MME/SGSN that initiates the PS domain authentication process saves the unused authentication vector, which may cause the UE to fail the network authentication for the CS domain.

In addition, if the MSC/SGSN/MME receives the authentication failure message sent by the UE twice, the authentication process is terminated, and an authentication rejection message is sent to the UE. Once the UE receives the authentication rejection message, it will not be able to initiate the service normally until it restarts, which has a serious impact on the user.

Summary of the invention

For the above problems in the prior art, the embodiments of the present invention provide an authentication method, a related device, and a system in a wireless communication network, which can solve the problem of authentication failure in the prior art.

In a first aspect, an embodiment of the present invention provides an authentication method in a wireless communication network, where the method includes:

The core network device that stores the unused authentication vector for the user equipment sends a first authentication data request message to the authentication device, where the first authentication data request message is used to request the authentication device to be the user equipment. Generating an authentication vector;

Receiving, by the core network device, the first authentication data response message returned by the authentication device according to the first authentication data request message, where the first authentication data response message carries a first authentication vector;

The core network device sends a first authentication request message to the user equipment, where the first authentication request message includes a random number and an authentication token in the first authentication vector, where the user equipment saves An unused authentication vector indicates that the unused authentication vector is associated with the user equipment or the unused authentication vector is generated for the user equipment.

With reference to the first aspect, in a first possible implementation, before the core network device that saves an unused authentication vector by the user equipment sends the first authentication data request message to the authentication device, The method further includes: after the user equipment accesses the first network where the core network device is located, the core network device determines that the user equipment is a user equipment that is accessed from the second network to the first network; The network standard of the first network is different from the network standard of the second network.

With reference to the first possible implementation manner of the first aspect, in a second possible implementation manner, the first network is a 3G network, and the second network is an LTE network, a 2G network, a 5G network, or a 4.5G network. Or the first network is an LTE network, and the second network is a 5G network or a 4.5G network.

With reference to the first aspect, or the first or second possible implementation manner of the first aspect, in a third possible implementation manner, the core network device that saves an unused authentication vector for the user equipment Before the authentication device sends the first authentication data request message, the method further includes:

The core network device sends a second authentication data request message to the authentication device, where the second authentication data request message is used to request the authentication device to generate an authentication vector for the user equipment; Receiving, by the network device, the second authentication data response message returned by the authentication device according to the second authentication data request message, where the second authentication data response message carries the second authentication vector and the unused authentication a weight vector; the core network device sends a second authentication request message to the user equipment, where the second authentication request message includes a random number and an authentication token in the second authentication vector.

In a second aspect, an embodiment of the present invention provides an authentication method in a wireless communication network, where the method includes:

Receiving, by the authentication device, a first authentication data request message sent by the core network device that is saved by the user equipment with an unused authentication vector, where the first authentication data request message is used to request the authentication device to be the user The device generates an authentication vector, and the authentication device generates a first authentication data response message according to the first authentication data request message, where the first authentication data response message includes the authentication device as the user a first authentication vector generated by the device; the authentication device returns the first authentication data response message to the core network device.

With reference to the second aspect, in a first possible implementation, before the authenticating device receives the first authentication data request message sent by the core network device that the user device stores the unused authentication vector, The method also includes:

Receiving, by the authentication device, a second authentication data request message sent by the core network device, where the second authentication data request message is used to request the authentication device to generate an authentication vector for the user equipment; The authentication device generates a second authentication data response message according to the second authentication data request message, where The authentication data response message includes a second authentication vector generated by the authentication device for the user equipment and the unused authentication vector; the authentication device returns the second to the core network device Authentication data response message.

In a third aspect, an embodiment of the present invention provides a core network device, where the core network device includes:

a storage unit, configured to save an unused authentication vector for the user equipment;

An acquiring unit, configured to send, by the storage unit, the first authentication data request message to the authentication device, where the storage unit saves the unused authentication vector, the first authentication The data request message is used to request the authentication device to generate an authentication vector for the user equipment, and receive a first authentication data response message returned by the authentication device according to the authentication data request message, the first The weight data response message includes a first authentication vector;

And a sending unit, configured to send a first authentication request message to the user equipment, where the first authentication request message includes a random number and an authentication token in the first authentication vector.

With reference to the third aspect, in a first possible implementation manner, the core network device further includes:

a determining unit, configured to determine, after the user equipment accesses the first network where the core network device is located, the user equipment is a user equipment that is accessed from the second network to the first network; The network system of the first network is different from the network system of the second network. The acquiring unit is specifically configured to determine, in the determining unit, that the user equipment is accessed from the second network to the first network. After the user equipment, the first authentication data request message is sent to the authentication device.

With reference to the third aspect and the first possible implementation manner of the third aspect, in a second possible implementation, the first network is a 3G network, and the second network is an LTE network, a 2G network, or a 5G network. Or a 4.5G network; or the first network is an LTE network, and the second network is a 5G network or a 4.5G network.

With reference to the third aspect and the first or second possible implementation manner of the third aspect, in a third possible implementation, the acquiring unit is further configured to send the first authentication data request to the authentication device Before the message, the second authentication data request message is sent to the authentication device, where the second authentication data request message is used to request the authentication device to generate an authentication vector for the user equipment, and receive the authentication. And the second authentication data response message returned by the device according to the second authentication data request message, where the second authentication data response message carries the second authentication vector and the unused authentication vector; Also used to send the first authentication data request message to the authentication device before the obtaining unit sends the first authentication data request message to the user The device sends a second authentication request message, where the second authentication request message includes a random number and an authentication token in the second authentication vector.

In a fourth aspect, the embodiment of the present invention further provides an authentication device, where the authentication device includes a receiving unit, configured to receive first authentication data sent by a core network device that stores an unused authentication vector for the user equipment. a request message, the first authentication data request message is used to request the authentication device to generate an authentication vector for the user equipment, and the processing unit is configured to generate a first template according to the first authentication data request message And a first data authentication message, the first authentication data response message includes a first authentication vector generated for the user equipment, and a sending unit, configured to return the first authentication data response message to the core network device.

With reference to the fourth aspect, in a first possible implementation, the receiving unit is further configured to: before receiving the first authentication data request message, receive a second authentication data request message sent by the core network device. The processing unit is further configured to: according to the second authentication data request message, the second authentication data request message is used to request the authentication device to generate an authentication vector for the user equipment, to generate a second a weight data response message, the authentication data response message includes a second authentication vector generated for the user equipment and the unused authentication vector; the sending unit is further configured to return to the core network device The second authentication data response message is described.

In a fifth aspect, the embodiment of the present invention further provides an authentication system, including the core network device and any of the fourth aspect or the fourth aspect, which may be implemented in any one of the third aspect or the third aspect. The implementation of the authentication network device described.

In a sixth aspect, the embodiment of the present invention further provides an authentication method in a wireless communication network, where the method includes: after the user equipment accesses from the 3G network to the long term evolution LTE network, the mobility management entity MME of the LTE network Obtaining an unused authentication vector saved by the general packet radio system GPRS service supporting node SGSN of the 3G network for the user equipment;

The MME deletes or discards the unused authentication vector, so that after the user equipment re-accesses from the LTE network to the 3G network, the MME cannot send the unused authentication vector Give the SGSN.

With reference to the sixth aspect, in a first possible implementation, the mobility management entity MME of the LTE network acquires an unused packet saved by the GPRS service support node SGSN of the 3G network for the user equipment The weight vector includes:

Receiving, by the mobility management entity MME of the LTE network, a context request message sent by the SGSN of the 3G network, and receiving a first context response message returned by the SGSN, where the first context response message includes the unused authentication vector ;or,

The first SGSN of the LTE network receives the first forward relocation request message, and the first forward relocation request message includes the unused authentication vector.

With reference to the sixth aspect, or the first possible implementation manner of the sixth aspect, in a second possible implementation manner, after the MME deletes or discards the unused authentication vector, the method further includes :

After the user equipment re-accesses the LTE network to the 3G network, the MME receives the SGSN to send a second context request message, and returns a second context response message to the SGSN, where the second The context response message does not include the unused authentication vector;

Or after the user equipment re-accesses the LTE network to the 3G network, the MME sends a second forward relocation request message to the SGSN, where the second forward relocation request message is not The unused authentication vector is included.

In a seventh aspect, an embodiment of the present invention provides a mobility management entity MME, including:

And an acquiring unit, configured to acquire, after the UE accesses the LTE network from the 3G network, an unused authentication vector saved by the SGSN of the 3G network for the UE. Specifically, the acquiring unit may receive, by using a context request message sent by the SGSN of the 3G network, a first context response message returned by the SGSN, where the first context response message includes the unused authentication vector; Alternatively, the acquiring unit may receive, by the first SGSN of the 3G network, a first forward relocation request message, where the first forward relocation request message includes the unused authentication vector;

a processing unit, configured to delete or discard the unused authentication vector, so that the MME cannot use the unused authentication vector after the UE re-accesses from the LTE network to the 3G network Sent to the SGSN.

With reference to the seventh aspect, in a first possible implementation, the acquiring unit is further configured to: after the user equipment re-accesses the LTE network to the 3G network, receive the SGSN to send a second context. Requesting a message and returning a second context response message to the SGSN, the second context response message not including the unused authentication vector; or, at the user equipment from the LTE After the network re-accesses to the 3G network, a second forward relocation request message is sent to the SGSN, where the second forward relocation request message does not include the unused authentication vector.

In an eighth aspect, an embodiment of the present invention provides a core network device, including a processor, a memory, a bus, and a communication interface.

The memory is configured to store a computer to execute an instruction, the processor is connected to the memory through the bus, and when the core network device is in operation, the processor executes the computer-executed instruction stored in the memory to The core network device is configured to perform an authentication method in the wireless communication network according to the first aspect or any one of the possible implementation manners of the first aspect.

According to a ninth aspect, an embodiment of the present invention provides an authentication device, where the processor includes a processor, a memory, a bus, and a communication interface.

The memory is configured to store a computer to execute an instruction, the processor is connected to the memory through the bus, and when the authentication device is in operation, the processor executes the computer-executed instruction stored in the memory to The authentication device is configured to perform an authentication method in a wireless communication network according to any of the possible implementations of the second aspect or the second aspect.

An embodiment of the present invention provides an authentication method in a wireless communication network. Before the core network device sends an authentication request message to the UE, even if the core network device saves an unused authentication vector for the UE, And acquiring, by the authentication device, a first authentication vector, and sending, by using the random number and the authentication token in the first authentication vector, an authentication request message to the UE, to start the UE and the core network. Network authentication process between devices. The above method ensures that each time the CS domain/PS domain network authentication is performed, the authentication device obtains the first authentication vector for authentication, instead of using the unused authentication vector saved by the core network device. Authentication, even if the PS domain network authentication is inserted before the CS domain network authentication or the CS domain network authentication is inserted before the PS domain network authentication, the synchronization verification can be ensured successfully, and the cause of the prior art is solved. The problem of authentication failure caused by synchronization failure.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention. Other drawings can also be obtained from those skilled in the art based on these drawings without paying any creative effort.

FIG. 1 is an authentication method in a wireless communication network according to an embodiment of the present invention;

2 is another authentication method in a wireless communication network according to an embodiment of the present invention;

3 is another authentication method in a wireless communication network according to an embodiment of the present invention;

4 is another authentication method in a wireless communication network according to an embodiment of the present invention;

FIG. 5 is another authentication method in a wireless communication network according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of a core network device according to an embodiment of the present disclosure;

FIG. 7 is a schematic diagram of an authentication device according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of an authentication system according to an embodiment of the present invention; FIG.

FIG. 9 is a schematic structural diagram of an authentication device in a wireless communication network according to an embodiment of the present invention.

detailed description

The embodiments of the present invention provide a method, a related device, and a system for authenticating in a wireless communication network, which can solve the problem of authentication failure caused by synchronization failure in the prior art.

In order to more clearly describe the embodiments of the present invention, the knowledge related to the embodiments of the present invention is first introduced.

Generally, in the network authentication process, the UE needs to verify whether it is synchronized with the network. If it is not synchronized, the authentication process fails. To detect whether the network is synchronized with the network, the UE needs to obtain a sequence number (SQN) from the authentication vector sent by the core network device (MME/MSC/SGSN), and detect whether the sequence number satisfies a series of detection conditions, where Including whether the sequence (SEQ) included in the verification sequence number satisfies SEQ _{MS -} SEQ < L, where L is usually set by the operator, L may be 32, and SEQ _MS is a sequence of the maximum sequence number currently stored by the UE itself. . If the SQN satisfy all test conditions, the synchronization verification is successful, and when SEQ> SEQ _MS UE stored SEQ _MS will be updated as SEQ. The above-mentioned SQN obtained from the authentication vector is actually generated by the authentication device (HLR/AUC) and included in the authentication vector.

The SQN generated by the authentication device is usually expressed in binary, consisting of two parts, SEQ and IND. In the mechanism for generating an SQN based on time, the authentication device stores a difference (DIF) value for each user equipment in its own database, and the DIF value of each user equipment is different, and the DIF value of the user equipment is represented. The SEQ value generated for the user equipment and the global counter (Golbal Counter) GLC The difference in value, thus the SEQ generated for the same UE, is only related to the value of the global counter GLC. In general, after the authentication device receives the authentication data request message, if the authentication data request message does not carry the synchronization failure indication, it will query the DIF value of the UE from its own database and obtain the value of the current global counter GLC. Then, SEQ can be generated. At this time, SEQ=GLC+DIF, that is, the difference between the two SEQs generated by the authentication device for the same UE is only related to the value of the global counter GLC, and the value of the global counter GLC is usually taken from the time point. (Timestamp), for example, the value of the global counter GLC may be incremented by one every 0.1 seconds, and the SEQ difference generated for the same UE within 5 seconds is 1*(5s/0.1s)=50.

The inventor has found that in the prior art, since the UE does not completely separate the synchronization detection of the PS domain and the CS domain, once the PS domain authentication is inserted before the CS domain authentication, and the CS domain authentication process is initiated, the MSC is in the MSC. If the unused authentication vector is saved, the UE may fail to perform network authentication on the CS domain; or the CS domain authentication is inserted before the PS domain authentication, and the MME/SGSN that initiates the PS domain authentication process is initiated. The unused authentication vector is saved, which may cause the UE to perform network authentication failure on the PS domain. For example, in the scenario where the UE performs a PS domain network authentication between the two CS domain network authentications, the MSC may obtain multiple authentications from the authentication device before the core network device initiates the first CS domain authentication. The authentication vectors AV _C11 and AV _C12 , after performing the first CS domain authentication, the unused authentication vector AV _C12 is still stored in the MSC; and then, due to the change of the radio access type of the UE, etc., it may be required The PS domain authentication and the second CS domain authentication are initiated for the UE, and the PS domain authentication may be before the second CS domain authentication. If the PS domain authentication succeeds, the sequence SEQ of the largest sequence number stored in the UE is _{The MS} may be updated to SEQ _P obtained from the PS domain authentication authentication vector AV _P ; when performing the second CS domain authentication, the MSC will initiate the authentication process using its saved unused authentication vector AV _C12 in this case the UE acquires equal SEQ obtained from AV _{_C12} SEQ _C12, the _{_{_{SEQ MS -SEQ = SEQ P -SEQ C12}}} , i.e. the value of the SEQ _MS -SEQ generates AV _{_P} (SEQ _P) and AV _{_C12} (SEQ _C12) The time difference is related. However, since the core network device utilizes the unused authentication vector AV _C12 acquired during the first CS domain network authentication saved by itself during the second CS domain authentication, if the authentication device generates AV _P and AV The time of _C12 is very different, so that SEQ _{MS -} SEQ is not less than L, and the detection condition cannot be satisfied, resulting in synchronization failure, thereby causing authentication failure.

In addition, in the prior art, when the authentication fails due to the synchronization failure, the core network device usually receives an authentication failure message carrying the cause value sent by the UE, and the reason value is that the synchronization fails, and the core network device passes the The data authentication request message of the synchronization failure indication is sent to the authentication device to trigger the resynchronization process, wherein the data authentication request message carrying the synchronization failure indication further includes the information of the sequence SEQ _MS1 of the largest sequence number stored in the UE when the synchronization fails. . Different from the data authentication request message that does not carry the synchronization failure indication message, the authentication device generates a sequence SEQ according to the DIF value of the UE acquired by the identity identifier of the UE. In the resynchronization process, the authentication device first needs to obtain the SEQ _MS1. Resetting the UE's DIF value to SEQ _MS1 -GLC1, and then generating a resynchronization sequence SEQ _sy according to the reset DIF value and the current global counter GLC value, then the resynchronization sequence SEQ _sy = SEQ _MS1 -GLC1 + GLC2 Where GLC1 is the time to receive SEQ _MS1 , and GLC2 is the time to generate the resynchronization sequence; then the information of the resynchronization sequence SEQ _sy is included in the authentication vector according to a preset algorithm and sent to the core network device for re-authentication. However, since GLC1 and GLC2 usually differ greatly, the resynchronization sequence SEQ _{sy is} almost equal to SEQ _MS1 . At this time, if the PS domain authentication is inserted before the core network device initiates the CS domain authentication again by using the authentication vector including the resynchronization sequence SEQ _sy , the UE performs network authentication again on the CS domain, in the UE. stored largest sequence number SEQ _MS2 synchronization parameter may have been updated as SEQ _P2 obtained from the authentication vector AV _P2 PS domain authentication, the weight at a time equal to the synchronization sequence SEQ SEQ _SY, the SEQ _MS2 -SEQ = SEQ _{_P2} -SEQ _sy _{≈SEQ P2} -SEQ _MS1, and often SEQ _P2 and SEQ _MS1 may vary greatly, and SEQ _P2 is greater than SEQ _MS1, so that the SEQ _MS2 -SEQ _sy <L can not be established, again leading to failure of the authentication. Similarly, if the CS domain authentication is inserted before the core network device initiates the PS domain authentication again by using the authentication vector including the resynchronization sequence, according to the prior art method, the authentication failure may be caused again. The suspension of the rights process causes the UE to fail to initiate a service normally until it is restarted.

In order to solve the above problem, an embodiment of the present invention provides an authentication method in a wireless communication network, which enables a core network device (MSC/SGSN/MME) to acquire a new one from an authentication device before initiating an authentication request to the UE. The authorization vector (AV), even if the core network device saves the unused authentication vector, uses the acquired new authentication vector for authentication, ensuring that each time the CS domain/PS domain network authentication is performed The SEQ included in the authentication vector is newly generated by the authentication device, and even if the PS domain network authentication is inserted before the CS domain network authentication or the CS domain network authentication is inserted before the PS domain network authentication, The synchronization success is ensured, and the problem of authentication failure caused by the synchronization failure in the prior art is solved, and the UE disconnection may be avoided due to the authentication failure.

The embodiment of the present invention further provides an authentication method in a wireless communication network, which enables the authentication device to use the sequence SEQ _MS of the largest sequence number stored in the UE when the core network device triggers the resynchronization process due to synchronization failure. The resynchronization sequence SEQ _{sy is} generated, and the DIF value of the UE is directly obtained according to the identity identifier of the UE, just according to the authentication data request message that does not carry the synchronization failure indication, according to the DIF value of the UE and the value of the current global counter GLC ( That is, the time at which the resynchronization SEQ is generated) to generate the resynchronization sequence SEQ _sy such that the resynchronization sequence SEQ _sy is not equal to (or approximately equal to) SEQ _MS1 , ensuring that the core network device is utilizing the authentication vector containing the resynchronization sequence SEQ _sy The authentication succeeds when the authentication is performed, so as to avoid the problem that the UE cannot initiate the service normally until restarting after the failure of the authentication again.

The technical solutions in the embodiments of the present invention will be clearly and completely described in the following with reference to the accompanying drawings. It should be noted that, in various embodiments of the present invention, the core network device may be an MSC, an SGSN, or an MME, and the authentication device may be an HLR, a Home Subscriber Server (HSS), an AUC, or a Home Environment (HE). ).

As shown in FIG. 1 , an embodiment of the present invention provides an authentication method in a wireless communication network, where the method includes:

S101: The core network device that saves the unused authentication vector for the UE sends a first authentication data request message (authentication data request), where the first authentication data request message is used to request the authentication. The device generates an authentication vector for the UE.

When the radio access type (RAT) of the UE changes, the core network device of the target network initiates an authentication process for the UE from one network to another. The authentication process may be PS. The network authentication process of the domain may also be the network authentication process of the CS domain. For example, when a UE in an LTE network switches to a 2G or 3G network due to Circuit Switched Fallback (CSFB) or network reselection, the core network device of the 2G or 3G network may send an authentication to the UE. Request a message to initiate a network authentication process for the CS domain or the PS domain.

Before initiating the network authentication process of the CS domain or the PS domain, the core network device may send a first authentication data request message to the authentication device to request to obtain an authentication vector. In the embodiment of the present invention, before sending the first authentication request message to the UE, the core network device may request the authentication device to generate an authentication for the UE, whether or not the UE maintains an unused authentication vector for the UE. Vector, and using the generated authentication vector to initiate network authentication of the CS domain or the PS domain, to avoid synchronization failure that may occur when the core network device in the prior art initiates network authentication by using an unused authentication vector saved by itself. The problem of authentication failure has ensured the success of network authentication as much as possible.

Correspondingly, the authentication device may receive a location in which the UE stores an unused authentication vector. The first authentication data request message sent by the core network device, according to the first authentication data request message, generating a first authentication data response message, where the first authentication data response message includes the authentication device The first authentication vector generated by the UE returns the first authentication data response message to the core network device.

It should be noted that, in various embodiments of the present invention, an unused authentication vector is saved for the UE, that is, the unused authentication vector is generated for the UE, or the unused authentication vector and The UE is related. S102: The core network device receives a first authentication data response message (authentication data response) returned by the authentication device according to the first authentication data request message, where the first authentication data response message carries the first Authentication vector.

S103: The core network device sends a first authentication request message (authentication request) to the UE, where the first authentication request message includes a random number and an authentication token in the first authentication vector.

The first authentication vector may include a random number (RAND), an authentication token (AUTN), an expected response (XRES), an integrity key (IK), and an encryption. Key (cipher key, CK). After obtaining the first authentication vector, the core network device may send a first authentication request message by using a random number and an authentication token in the first authentication vector, to start the UE and the The authentication process between the core network devices. The UE may determine an SQN according to the random number and the authentication token, that is, determine SEQ (including SEQ in SQN), so that synchronization detection between the UE and the network may be completed by using SQN (SEQ) or other The authentication process.

In addition, the first authentication vector obtained by the core network device to the authentication device may be one or more. When the first authentication vector is multiple, the multiple first authentication vectors constitute a reference. And an authorization vector, the first authentication request message may include an authentication token and a random number in one of the plurality of first authentication vectors.

Optionally, the core network device may impose a large burden on the authentication device if the authentication device obtains the authentication vector before the authentication process is initiated. In practical applications, the authentication failure problem caused by the synchronization failure basically occurs in the authentication process after the UE switches from the LTE network to the 3G network, or occurs after the UE switches from the 2G network to the 3G network. In the process of the authentication process, the method of the present invention can be used only for the above scenario, and the step 101 can be specifically: After the UE accesses the 3G network, the core network device of the 3G network sends a first authentication data request message to the authentication device. At this time, the core network device stores an unused authentication vector for the UE. . Correspondingly, the core network devices in steps 102 and 103 refer to the core network devices of the 3G network.

Optionally, the method may also be performed only for the scenario that the UE performs the network authentication after the UE is switched from the second network to the first network. Before the step S101, the method may further include the step S100:

S100: After the UE accesses the first network where the core network device is located, the core network device determines that the UE is a UE that accesses the first network from the second network.

Correspondingly, the core network devices in steps S101 to S103 all refer to the core network devices located in the first network. In the embodiment of the present invention, the network standard of the first network is different from the network standard of the second network, where the first network may be a 3G network, and the second network may be an LTE network or a 2G network; or The first network may be an LTE network, and the second network may be a 5G/4.5G network.

For example, when the first network is a 3G network and the second network is an LTE network, S100 is: after the UE accesses the 3G network, the core network device of the 3G network determines that the UE is connected from the LTE network. The UE entering the 3G network determines that the UE is a UE from an LTE network. The method ensures that the core network device obtains the first authentication to the authentication device even if the core network device stores an unused authentication vector when the UE is accessed from the LTE network to the 3G network. The vector uses the first authentication vector to initiate the network authentication process.

The core network device may also have multiple modes when determining that the UE is a UE accessing the LTE network to the 3G network. The core network device may determine, according to the CS domain Non-Access Stratum (CS domain NAS) message sent by the UE or the paging response message of the UE in the called scenario, whether the UE is For the CSFB user, if it is determined that it is a CSFB user, that is, the UE is determined to be a UE accessing the LTE network to the 3G network, the CS domain NAS message may be a connection management service request message or a location update request message, etc. The core network device may be an MSC; or,

The core network device may determine, according to the PS domain Non-Access Stratum (PS domain NAS) message sent by the UE, whether the UE is a UE that accesses the LTE network to the 3G network. For example, the routing area update (RAU) request message may be used to determine that the UE is a UE that is accessed from the LTE network to the 3G network, where the core is The network device can be an SGSN; or,

The function of the base station may be enhanced, so that the base station can determine whether the UE is a CSFB user by analyzing whether the UE includes the CSFB indication information in the Radio Resource Control (RRC) connection request message sent by the UE. When the UE is a CSFB user, the UE sends a notification message to the core network device, and the core network device may determine, according to the notification message, that the UE is a UE that accesses the LTE network to the 3G network. The core network device may be an MSC or an SGSN; or

For a certain UE, the core network device may determine whether the UE is connected to the UE of the 3G network from the LTE network by determining whether the SGS interface is associated with the MME, and if the SGS interface is associated, determining The UE is a UE that accesses the LTE network to the 3G network, and the core network device may be an MSC.

In the foregoing embodiment, the unused authentication vector saved in the core network device may be acquired before the core network device initiates the last authentication process, as shown in FIG. 2, before step S101. The method may further include:

S201: The core network device sends a second authentication data request message to the authentication device, where the second authentication data request message is used to request the authentication device to generate an authentication vector for the UE.

Correspondingly, the authentication device may receive a second authentication data request message sent by the core network device, and generate a second authentication data response message according to the second authentication data request message, where the authentication data is generated. The response message includes a second authentication vector and the unused authentication vector, and returns the second authentication data response message to the core network device.

S202: The core network device receives a second authentication data response message that is returned by the authentication device according to the second authentication data request message, where the second authentication data response message includes the authentication device The second authentication vector generated by the UE and the unused authentication vector.

S203: The core network device sends a second authentication request message to the UE, where the second authentication request message includes a random number and an authentication token in the second authentication vector.

In the embodiment of the present invention, before the core network device sends the second authentication request message, the second authentication vector generated for the UE and the unused authentication vector are obtained from the authentication device. When the UE sends the second authentication request message, the second authentication vector is used, and the unused authentication vector is also saved in the core network device. The subsequent core network device needs to send the first authentication. When the message is requested, instead of using the unused authentication vector, the first authentication vector generated for the UE is obtained by using the re-authentication device to avoid the unused use of the core network device saved in the prior art. When the authentication vector initiates network authentication, the authentication failure may be caused by the synchronization failure, and the success of the network authentication is guaranteed as much as possible.

As shown in FIG. 3, the embodiment of the present invention provides a network authentication method, which can be applied to a scenario in which PS domain authentication is inserted between two CS domain authentications. Specifically, the scenario may be that the UE located in the LTE network initiates a joint attach procedure, and is registered on the MME of the LTE network and the MSC of the 3G network. During/after the joint registration process, the MSC initiates an authentication process for the UE, that is, initiates a first CS domain authentication process. After completing the joint attach procedure, the UE resides on the LTE network. If the UE may access the 3G network from the LTE network due to reasons such as CSFB, and may provide CS domain services by the originally registered MSC, the SGSN and the MSC in the 3G network may respectively The UE initiates the PS domain authentication process and the second CS domain authentication process, and the method can ensure that the authentication is successful in the foregoing authentication process. The method may include:

S301: The UE located in the LTE network initiates a joint attach procedure, and is registered on the MME of the LTE network and the MSC of the 3G network.

In the above attach procedure, an SGs interface association is established between the MME and the MSC corresponding to the UE. Specifically, the UE sends an attach request message to the MME, where the attach request message includes an attach type cell, where the attach type cell is used to notify the MME that the UE requests a joint evolved packet system (evolved packet) System, EPS) Attachment or International Mobile Subscriber Identity (IMSI) attachment. After receiving the attach request message, the MME performs an EPS attach procedure, and then the MME selects an MSC according to the configuration information and/or the budget algorithm, and sends a location update request message to the MSC to enable the UE to register. On the MSC. After the UE is attached to the IMSI of the MSC, the SGs interface between the MME and the MSC enters an association state, that is, an SGs interface association corresponding to the UE is established between the two.

S302: In the joint attach process, the MSC sends a second authentication data request message to the authentication device, where the second authentication data request message includes an identity of the UE, and the second authentication data request message is used. The authentication device is requested to generate an authentication vector for the UE.

During the joint attach process, the MSC or MME may be triggered to initiate an authentication process. The MSC may obtain an authentication vector by using a second authentication data request message before initiating the authentication process.

The identity of the UE may be an IMSI. Generally, when an authentication data request message is sent to the authentication device, the number of authentication vectors requested to be acquired may be specified. In order to save network resource expenditure, multiple authentication vectors may be acquired each time, that is, an authentication vector required for subsequent authentication is reserved. For example, the second authentication data request message may include indication information, where the indication information is used to indicate that the number of authentication vectors requested to be acquired is 3.

S303: The authentication device returns a second authentication data response message to the MSC, where the second authentication data response message includes an authentication vector AV21, AV22, and AV23 generated for the UE.

Each of the authentication vectors returned by the authentication device may include a random number RAND, an authentication token AUTN, a desired response XRES, an integrity key IK, and an encryption key CK. When generating the authentication vector, the authentication device may include the SQN and an anonymous key (AK) obtained by using the random number RAND in the authentication token AUTN, where the SQN may include the SEQ and the IND. (eg SQN=SEQ||IND). For example, the SEQs contained in the SQN contained in the authentication vectors AV21, AV22, and AV23 may be: SEQ21=756EA3, SEQ22=756EA4, and SEQ23=756EA5, respectively.

If the subsequent UE needs to obtain the SQN from the authentication token AUTN, the anonymous key AK may be first obtained from the random number RAND, and the SQN is obtained from the authentication token AUTN for synchronization detection by using the anonymous key AK and the correlation algorithm. That is to verify whether the SQN is in the correct range.

S304: The MSC sends a second authentication request message to the UE, where the second authentication request message includes RAND21 and AUTN21 in the authentication vector AV21.

S305: The UE performs CS domain authentication on the 3G network according to the second authentication request message, and after the authentication succeeds, returns a second authentication response message (authentication response) to the MSC.

The UE may first verify the validity of the network by using RAND21 and AUTN21. If the network is legal, the synchronization sequence number SQN21 is obtained from the AUTN 21 by using the AK21 and related algorithm obtained from the RAND21, wherein the SQN21 includes the parameter SEQ21. The UE may compare the synchronization parameter SEQ _{MS of} SEQ21 with the maximum sequence number stored by itself, if SEQ _{MS -} SEQ21 < L (L = 32) is satisfied, and other detection conditions are met (eg, SEQ21-SEQ _MS ≤ Δ and SEQ 21 > SEQ _MS ( i), where △ can be set to a large number such as 2 ²⁸ , i is the same as the IND value), then the UE determines that the SQN is in the correct range, and the synchronization verification is successful this time.

After the UE successfully authenticates the network and the synchronization is successful, that is, after the authentication succeeds, the UE returns a second authentication response message to the MSC, and if SEQ21>SEQ _MS , the UE will itself The stored SEQ _{MS was} updated to SEQ 21, SEQ _MS = 756 EA3.

S306: The UE accesses the 3G network from the LTE network.

For some reason, the UE may access the 3G network from the LTE network and may provide CS domain services for it by the originally registered MSC. For example, the LTE network may not support the voice service, and when the UE needs to make a voice call, the CSFB is dropped back to the 3G network to initiate the CS voice service; for example, the UE may be abnormal due to the LTE network. The 3G network is accessed by means of handover or network reselection.

S307: The UE sends an RAU request message to the SGSN of the 3G network.

Because the radio access type RAT is changed, the UE may send a RAU request message to the SGSN of the 3G network for requesting registration to the PS domain of the 3G network, so as to be able to perform PS domain service.

S308: The SGSN sends a third authentication data request message to the authentication device, where the third authentication data request message includes an identity identifier of the UE, and the third authentication data request message is used to request the location The authentication device generates an authentication vector for the UE.

After receiving the RAU request message sent by the UE, the SGSN may need to initiate an authentication process, that is, PS domain authentication, and thus, before the authentication, the authentication vector may be obtained through the third authentication data request message.

S309: The authentication device returns a third authentication data response message to the SGSN, where the third authentication data response message includes an authentication vector AV31, AV32, and AV33 generated for the UE.

For example, assuming that the third authentication data request message is sent after the second authentication data request message is transmitted for 5 s, the authentication device generates a time difference between the AV31/AV32/AV33 and the generated AV21/AV22/AV23. For 5 s, the SEQs contained in the SQN contained in the authentication vectors AV31, AV32, and AV33 may be SEQ31=756ED5, SEQ32=756ED6, and SEQ33=756ED7, respectively.

S310: The SGSN sends a third authentication request message to the UE, where the third authentication request message includes RAND31 and AUTN32 in the authentication vector AV31.

S311: The UE performs PS domain authentication on the 3G network according to the third authentication request message. After the authentication succeeds, a third authentication response message is returned to the SGSN.

After successfully verifying the validity of the network, the UE may acquire SQN31 (including SEQ31=756ED4) by using RAND31 and AUTN31, and then perform synchronous verification by using SQN31, that is, whether the SQN31 is in the correct range. Assuming that the UE's validity and synchronization verification for the network is successful, that is, the authentication is successful, the UE updates its own stored SEQ _MS from SEQ21 to SEQ31, ie, SEQ _MS = 756 ED5.

Optionally, in the step S306-S311, the process that the SGSN obtains the authentication vector and initiates the authentication process for the PS domain may also be performed by the MME. In this case, the UE is still located in the LTE network. The MME obtains an authentication vector and initiates an authentication process for the PS domain. After the authentication process ends, the UE may switch from the LTE network to the 3G network, and the MSC of the 3G network performs the acquisition of the authentication vector and the following steps. CS domain authentication process.

S312: The UE sends an access request message or a service request message to the MSC to obtain a CS domain service of the 3G network.

After the UE migrates from the LTE network to the 3G network, the UE may send an access request message or a service request message, such as a location update request message and a connection management service request message, to obtain the CS domain service of the 3G network. .

S313: The MSC determines, according to the access request message or the service request message, whether the UE is a UE that accesses the LTE network to the 3G network.

S314: After determining that the UE is a UE that accesses the LTE network to the 3G network, the MSC sends a first authentication data request message to the authentication device, where the first authentication data request message includes the UE. An identifier, the first authentication data request message is used to request the authentication device to generate an authentication vector for the UE.

In the present invention, although the unused authentication vectors AV22 and AV23 are stored in the MSC, the MSC still goes to the authentication device to acquire the newly generated authentication vector AV11 to ensure successful authentication. Otherwise, according to the current technical procedure, the MSC will use AV22/AV23 to send an authentication request message, if the UE uses AV22/AV23 for authentication, since the SEQ _MS = 756 ED5 stored in the UE is SEQ 22 = 756 EA 4 / SEQ 23 = If 756EA5 is large and larger than 32, it does not satisfy SEQ _MS -SEQ<L in the detection rule, which will cause the synchronization detection to fail and the authentication fails.

S315: The authentication device returns a first authentication data response message to the MSC, where the first The authentication data response message contains an authentication vector AV11 generated for the UE.

Assuming that the first authentication data request message is sent after the third authentication data request message is sent for 0.5s, the time difference between the authentication device generating the AV31/AV32/AV33 and generating the AV11 is about 0.5s. Then, the information of the SEQ included in the authentication vector AV11 may be: SEQ31=756 EDA.

Optionally, the MSC may also obtain multiple authentication vectors from the authentication device, and the first authentication data response message may also include multiple authentication vectors.

S316: The MSC sends a first authentication request message to the UE, where the first authentication request message includes RAND11 and AUTN11 in the authentication vector AV11.

S317: The UE performs CS domain authentication on the 3G network according to the first authentication request message, and after the authentication succeeds, returns a first authentication response message to the MSC.

The UE performs validity verification on the network by using RAND11 and AUTN11 in the AV11, and performs synchronization detection using the SQN11 acquired from the AUTN. Since SEQ _MS = 756 ED5 stored in the UE is smaller than SEQ 31 = 756 EDA in SQN 31, SEQ _{MS -} SEQ < 0 < L is satisfied, so that the synchronization detection is successful, and the problem of authentication failure caused by the prior art for authentication is avoided. , to avoid the UE off the network.

Since in the prior art, after the UE accesses the LTE network from the 3G network, the SGSN of the 3G network may transmit an authentication vector to the MME of the LTE network, when the UE is again from the LTE network. After re-accessing to the 3G network, the MME may send an authentication vector to the SGSN of the 3G network, so that the SGSN may use the authentication vector to send an authentication during the authentication process. The request message is not obtained by acquiring the newly generated authentication vector of the authentication device, resulting in failure of authentication.

In view of this, the embodiment of the present invention provides an authentication method in a wireless communication network. After the UE accesses the LTE network from the 3G network, the first SGSN of the 3G network does not save the UE as the UE. An unused authentication vector is sent to the MME of the LTE network, so that after the UE re-accesses the 3G network from the LTE network, the MME cannot send the saved authentication vector to The second SGSN of the 3G network, the first SGSN may be the same or different, and the method provided by the embodiment of the present invention may be used to prevent an unused authentication vector from being saved in the SGSN, thereby ensuring that the SGSN initiates the authentication each time. Before the rights flow, the authentication device obtains the authentication vector, which solves the problem of the prior art. Specifically, as shown in FIG. 4, the method may include:

S400: After the UE accesses the LTE network from the 3G network, the first SGSN of the 3G network receives a context request message sent by the MME of the LTE network.

The context request message is used to request to acquire information of the UE.

S401: The first SGSN that saves an unused authentication vector sends a first context response message to the MME, where the first context response message does not include the unused authentication vector.

The unused authentication vector may be a 3G authentication vector (3G AV).

Different from the prior art, in the present invention, even if an unused authentication vector is stored in the first SGSN, the unused authentication vector is not sent to the MME, so that when the UE is subsequently After re-accessing the LTE network to the 3G network, the MME is also unable to send the unused authentication vector to the SGSN in the 3G network, thereby avoiding saving the unused authentication vector in the SGSN, thereby ensuring The SGSN obtains a new authentication vector before each initiation of the authentication process, which solves the problem of authentication failure in the prior art.

Optionally, if the UE accesses the LTE network from the 3G network due to performing PS domain handover, the steps S400-S401 may be replaced by:

S401': after the UE accesses the LTE network from the 3G network, the first SGSN of the 3G network sends a first forward relocation request message to the MME of the LTE network; wherein the first When the SGSN sends the first pre-relocation request message, the UE saves an unused authentication vector, and the first forward relocation request message does not include the unused authentication vector.

The first forward relocation request message is used to notify the MME of information about the UE, such as an identity and a context of the UE. The forward relocation request message does not include the unused 3G authentication vector.

Optionally, the method may further include:

S402: After the UE re-accesses the 3G network from the LTE network, the second SGSN of the 3G network sends a second context request message to the MME.

The first SGSN may be the same as or different from the second SGSN. The unused authentication vector is not included in the MME by step S400-S401 or step S401'.

S403: The second SGSN receives a second context response message returned by the MME, where the The second context response message does not contain the unused authentication vector.

If the UE is re-accessing the 3G network from the LTE network by performing PS domain handover, steps S402-S403 may be replaced by:

S403 ′: after the UE re-accesses the LTE network to the 3G network, the second SGSN of the 3G network receives a second forward relocation request message sent by the MME, where the second front The relocation request message does not contain the unused authentication vector.

The second forward relocation request message is used to notify the second SGSN of the information of the UE, such as the identity and context of the UE.

S404: The second SGSN sends an authentication data request message to the authentication device.

After the UE re-accesses from the LTE network to the 3G network, the second SGSN may initiate an authentication process, and the authentication is initiated because the unused authentication vector is not saved in the second SGSN. Before the process, the second SGSN will request the authentication device to obtain an authentication vector.

S405: The second SGSN receives an authentication data response message returned by the authentication device, where the authentication data response message includes an authentication vector.

The authentication vector contains a random number and an authentication token, or may also include a desired response, an integrity key, and an encryption key.

S406: The second SGSN sends an authentication request message to the UE, where the authentication request message includes a random number and an authentication token in the authentication vector included in the authentication data response message.

In the embodiment of the present invention, after the UE accesses the LTE network from the 3G network, the first SGSN of the 3G network does not send the unused authentication vector saved by itself to the MME of the LTE network, so that the After the UE re-accesses from the LTE network to the 3G network, the MME is also unable to send the unused authentication vector to the second SGSN in the 3G network, to avoid saving the unused in the second SGSN. The authentication vector, so that the second SGSN needs to obtain the newly generated authentication vector from the authentication device before sending the authentication request message to the UE, which solves the problem of authentication failure in the prior art.

An embodiment of the present invention provides an authentication method in a wireless communication network. After the UE accesses the LTE network from the 3G network, the MME of the LTE network acquires the SGSN of the 3G network and saves the SGSN of the 3G network. Unused authentication vector, the MME deletes or discards the unused An authentication vector, such that after the UE re-accesses the 3G network from the LTE network, the MME cannot send the unused authentication vector to the SGSN. The method provided by the embodiment of the present invention can prevent the unused authentication vector from being saved in the SGSN, thereby ensuring that the SGSN obtains a new authentication vector before each initiation of the authentication process, thereby solving the problem of the prior art. Specifically, as described in FIG. 5, the method may include:

S500: A context request message sent by the MME of the LTE network to the first SGSN of the 3G network after the UE accesses the LTE network from the 3G network.

S501: The MME receives a first context response message returned by the first SGSN, where the first context response message includes an unused authentication vector saved by the first SGSN for the UE.

The unused authentication vector may be a 3G authentication vector.

Optionally, if the UE accesses the LTE network from the 3G network due to performing the PS domain handover, the steps S500-S501 may be replaced by:

S501 ′: after the UE accesses the LTE network from the 3G network, the MME of the LTE network receives a first forward relocation request message sent by the first SGSN of the 3G network, where the first When the SGSN sends the pre-relocation request message, the UE stores an unused authentication vector, and the first forward relocation request message includes an unused authentication vector saved by the first SGSN. For a specific implementation of step S501', reference may be made to step S401'.

S502: After the UE re-accesses the 3G network from the LTE network, the MME receives a second context request message sent by the second SGSN.

S503: The second context response message returned by the MME to the second SGSN, where the second context response message does not include the unused authentication vector.

Because the step S500-S501 is configured to save the unused authentication vector in the MME, different from the prior art, the second context response message sent by the MME that stores the unused authentication vector does not The unused authentication vector is included.

Different from the prior art, in the present invention, after the UE re-accesses from the LTE network to the 3G network, even if an unused authentication vector is stored in the MME, the unused one is not used. Sending an authentication vector to the second SGSN of the 3G network, avoiding saving the unused authentication vector in the second SGSN, so as to ensure that the second SGSN is inspected before each initiation of the authentication process. The right device obtains the authentication vector and solves the problem of authentication failure in the prior art.

If the UE is re-accessing the 3G network from the LTE network by performing PS domain handover, steps S502-S503 may be replaced by:

S503 ′: After the UE re-accesses the LTE network to the 3G network, the MME sends a second forward relocation request message to the second SGSN of the 3G network, where the second forwarding The relocation request message does not contain the unused authentication vector.

Because the step S501 ′ is configured to save the unused authentication vector in the MME, different from the prior art, the second forward relocation request message sent by the MME that saves the unused authentication vector is used. Does not contain the unused authentication vector.

It is to be noted that, after receiving the unused authentication vector sent by the first SGSN, the MME may delete or discard the unused authentication vector, so as to be sent to the second SGSN. The unused forwarding vector is not included in the sent second forward relocation request message or the second context response message. Alternatively, the MME may not delete the unused authentication vector, but only send the unused authentication vector to the second SGSN.

Optionally, the method may further include:

S504: The second SGSN sends an authentication data request message to the authentication device.

After the UE re-accesses from the LTE network to the 3G network, the second SGSN may initiate an authentication process, and if the second SGSN does not store an unused authentication vector, the authentication is initiated. Before the rights flow, the second SGSN may request the authentication device to acquire a newly generated authentication vector.

S505: The second SGSN receives an authentication data response message returned by the authentication device, where the authentication data response message includes an authentication vector.

S506: The second SGSN sends an authentication request message to the UE, where the authentication request message includes a random number and an authentication token in the authentication vector included in the authentication data response message.

In the embodiment of the present invention, after the UE re-accesses from the LTE network to the 3G network, the unused metric is not used even if an unused authentication vector is stored in the MME of the LTE network. Transmitting a weight vector to the second SGSN of the 3G network, avoiding saving the unused authentication vector in the second SGSN, so that the second SGSN needs to send an authentication request message to the UE The newly generated authentication vector is obtained from the authentication device, which solves the problem of authentication failure in the prior art.

Corresponding to the foregoing method embodiment, the embodiment of the present invention provides a core network device 60. As shown in FIG. 6, the core network device may be a mobile switching center MSC or a core network device of a SGSN or a 5G network, where the core The network device may include a storage unit 601, an obtaining unit 602, and a sending unit 603;

The storage unit 601 is configured to save an unused authentication vector for the UE.

The obtaining unit 602 is configured to send a first authentication data request message to the authentication device, where the first authentication data request message is used to request the authentication device to generate an authentication vector for the UE. Receiving, by the authentication device, a first authentication data response message returned according to the authentication data request message, where the first authentication data response message includes a first authentication vector generated by the authentication device for the UE . For example, the obtaining unit 602 may send, before the sending unit 603 sends a first authentication request message to the UE, the storage unit 601, if the UE saves the unused authentication vector, The authentication device sends the first authentication data request message, where the first authentication data request message may further include an identifier of the UE, so that the core network device is configured according to the identity of the UE. The UE generates a first authentication vector.

The sending unit 603 is configured to send a first authentication request message to the UE UE, where the first authentication request message includes a random number and an authentication token in the first authentication vector.

The core network device may impose a large burden on the authentication device if the authentication device obtains the authentication vector before the authentication process is initiated. In practical applications, certain scenes can be protected by pointers. The core network device may further include:

a determining unit 604, configured to determine, after the UE accesses the first network where the core network device is located, that the UE is a UE that is accessed from the second network to the first network; 602 may send the first authentication data request message to the authentication device after the determining unit 604 determines that the UE is accessing the UE of the first network from the second network.

For example, the first network may be a 3G network, and the second network may be a long term evolution LTE network, and the determining unit 604 is specifically configured to determine that the UE is a UE that accesses the LTE network to the 3G network. The method ensures that the core network device obtains the first authentication to the authentication device even if the core network device stores an unused authentication vector when the UE is accessed from the LTE network to the 3G network. The vector uses the first authentication vector to initiate the network authentication process.

Specifically, the determining unit 604 determines that the UE is accessing from the LTE network to the 3G network. There are also many ways to use the UE. The determining unit 604 may determine, according to the CS domain NAS message sent by the UE or the paging response message of the UE in the called scenario, whether the UE is a CSFB user, and if it is determined to be a CSFB user, determine the UE. For the UE that accesses the LTE network to the 3G network, the CS domain NAS message may be a connection management service request message or a location update request message, etc., where the core network device may be an MSC; or, the determining The unit 604 may determine, according to the PS domain NAS message sent by the UE, whether the UE is a UE that accesses the LTE network to the 3G network, for example, may determine, according to the RAU request message, that the UE is accessed from an LTE network. To the UE of the 3G network, the core network device may be an SGSN, or the determining unit 604 may determine, according to the notification message sent by the base station, that the UE is a UE that accesses the LTE network to the 3G network. The notification message is a message sent by the base station to the core network device after determining that the UE is a circuit switched fallback CSFB user, and the core network device may be an MSC or an SGSN; or, The determining unit 604 may determine, by determining whether the SGS interface is associated between the core network device and the MME, that the UE is an UE that is accessed from the LTE network to the 3G network, and if there is an SGS interface association, And determining that the UE is a UE that accesses the LTE network to the 3G network, where the core network device may be an MSC.

Optionally, the unused authentication vector saved in the storage unit 601 may be acquired before the core network device initiates the last authentication process, and the acquiring unit 602 is further configured to And before the sending, by the right device, the first authentication data request message, sending a second authentication data request message to the authentication device, where the second authentication data request message is used to request the authentication device to generate a template for the UE a weight vector, the second authentication data response message returned by the authentication device according to the second authentication data request message, where the second authentication data response message carries the authentication device generated by the authentication device for the UE a second authentication vector and the unused authentication vector; the sending unit 603 is further configured to send the second to the UE before the acquiring unit 602 sends the first authentication data request message to the authentication device An authentication request message, the second authentication request message includes a random number and an authentication token in the second authentication vector.

In the embodiment of the present invention, the acquiring unit 602 may send the first authentication data request message to the authentication device if the storage unit 601 saves an unused authentication vector for the UE. Receiving, by the authentication device, the first authentication data response message returned by the authentication data request message, where the first authentication data response message includes the first authentication generated by the authentication device for the UE a vector, the sending unit 603 may send a first authentication request message to the UE, where the first authentication request message includes a random number and an authentication token in the first authentication vector, so that the core network device Even if an unused authentication vector is saved, the first authentication vector is used for authentication, which avoids synchronization that may occur when the core network device in the prior art initiates network authentication by using an unused authentication vector saved by itself. The failure of authentication caused by failure has ensured the success of network authentication as much as possible.

Corresponding to the foregoing method embodiment, the embodiment of the present invention further provides an authentication device. As shown in FIG. 7, the authentication device may be a home environment HE, a home location register HLR, a home subscriber server HSS, or an authentication center. AUC, the authentication device includes a receiving unit 701, a processing unit 702, and a sending unit 703;

The receiving unit 701 is configured to receive a first authentication data request message sent by a core network device that stores an unused authentication vector, where the first authentication data request message is used to request the authentication device to be Said UE generates an authentication vector;

The processing unit 702 is configured to generate a first authentication data response message according to the first authentication data request message, where the first authentication data response message includes a first authentication vector generated for the UE;

The sending unit 703 is configured to return the first authentication data response message to the core network device.

Optionally, the receiving unit 701 is further configured to: before receiving the first authentication data request message, receive a second authentication data request message sent by the core network device, where the second authentication data request message is And the processing unit 702 is further configured to generate a second authentication data response message according to the second authentication data request message, where the second authentication is generated. The weight data response message includes a second authentication vector generated for the UE and the unused authentication vector; the sending unit 703 is further configured to return the second authentication data response message to the core network device. .

In the embodiment of the present invention, the authentication device may receive the first authentication data request message sent by the core network device that the UE saves the unused authentication vector, and is the core that holds the unused authentication vector. The network device returns a first authentication data response message, where the first authentication data response message includes a first authentication vector generated for the UE, so that the core network device uses the unused authentication vector even if it is saved. The first authentication vector is used for authentication, so that the core network device in the prior art is saved by itself. When the unused authentication vector initiates network authentication, the authentication failure caused by the synchronization failure may be caused, and the success of the network authentication is guaranteed as much as possible.

As shown in FIG. 8, an embodiment of the present invention further provides an authentication system 80, including a core network device 60 and an authentication device 70. For the actions performed by the core network device 60 and the authentication device 70 and the interaction between them, refer to the description of the method embodiment corresponding to FIG. 1 to FIG. 3, and also the description of the device embodiment corresponding to FIG. 6 and FIG. , will not repeat them here.

Optionally, the authentication system may further include a user equipment 801;

For example, the core network device may be configured to send a first authentication data request message to the authentication device, where the user equipment saves an unused authentication vector, the first authentication data request message And configured to request the authentication device to generate an authentication vector for the user equipment;

The authentication device may be configured to receive the first authentication data request message, and generate a first authentication data response message according to the first authentication data request message, where the first authentication data response message includes Determining, by the authentication device, a first authentication vector generated by the user equipment, and returning the first authentication data response message to the core network device.

The core network device may be further configured to receive the first authentication data response message, and send a first authentication request message to the user equipment, where the first authentication request message includes random in the first authentication vector Number and authentication token;

The user equipment may receive the first authentication request message, and perform authentication by using a random number and an authentication token in the first authentication vector included in the first authentication request message.

As shown in FIG. 9, an embodiment of the present invention further provides an authentication device in a wireless communication system, where the authentication device may include:

The processor 901, the memory 902, the bus 904, and the communication interface 905. The processor 901, the memory 902, and the communication interface 905 are connected by a bus 904 and complete communication with each other.

Processor 901 may be a single core or multi-core central processing unit, or a particular integrated circuit, or one or more integrated circuits configured to implement embodiments of the present invention.

The memory 902 may be a high speed RAM memory or a non-volatile memory such as at least one disk memory.

Memory 902 is used by computer to execute instructions 903. Specifically, the computer execution instructions 903 may include program code.

When the authentication device is running, the processor 901 runs the computer execution instruction 903, and may perform the method flow of the authentication method in the wireless communication system according to the method embodiment corresponding to any one of FIG. 1 to FIG. 3 or FIG. The method flow of the authentication method in the wireless communication system described in the method embodiment corresponding to any one of FIG. The authentication device may be a core network device or an authentication device.

The embodiment of the present invention further provides a computer readable medium, including a computer executing instruction, when the processor of the computer executes the computer execution instruction, the computer performs the method embodiment corresponding to any one of FIG. 1 to FIG. The method flow of the authentication method in the wireless communication system or the method flow of the authentication method in the wireless communication system described in the method embodiment corresponding to any one of FIG. 4 to FIG.

The LTE network mentioned in the present invention includes an LTE A network, and may subsequently have an LTE version. The first, second, third, fourth, fifth, etc. in the embodiments of the present invention are only used to distinguish different indication information, messages, or other objects, and do not represent sequential relationships.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both, for clarity of hardware and software. Interchangeability, the composition and steps of the various examples have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

A person skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division, and the actual implementation may have another The manner of division, such as multiple units or components, may be combined or integrated into another system, or some features may be omitted or not performed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, or an electrical, mechanical or other form of connection.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the embodiments of the present invention.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention contributes in essence or to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any equivalent person can be easily conceived within the technical scope of the present invention by any person skilled in the art. Modifications or substitutions are intended to be included within the scope of the invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

An authentication method in a wireless communication network, the method comprising:

The core network device that stores the unused authentication vector for the user equipment sends a first authentication data request message to the authentication device, where the first authentication data request message is used to request the authentication device to be the user equipment. Generating an authentication vector;

Receiving, by the core network device, the first authentication data response message returned by the authentication device according to the first authentication data request message, where the first authentication data response message carries a first authentication vector;

The core network device sends a first authentication request message to the user equipment, where the first authentication request message includes a random number and an authentication token in the first authentication vector.
The method according to claim 1, wherein the method further comprises: before the core network device that stores the unused authentication vector for the user equipment sends the first authentication data request message to the authentication device, the method further includes:

After the user equipment accesses the first network where the core network device is located, the core network device determines that the user equipment is a user equipment that is accessed from the second network to the first network; The network format of the first network is different from the network format of the second network.
The method according to claim 2, wherein the first network is a 3G network, and the second network is a long term evolution LTE network;

And determining, by the core network device, that the user equipment is a user equipment that is accessed from the second network to the first network, where the core network device determines that the user equipment is a user that accesses the LTE network to the 3G network. device.
The method according to claim 3, wherein the determining, by the core network device of the 3G network, that the user equipment is a user equipment that is accessed from an LTE network to a 3G network, includes:

Determining, by the core network device, that the user equipment is a user equipment that accesses the LTE network to the 3G network according to the packet switched domain non-access stratum message sent by the user equipment; or

Determining, by the core network device, that the user equipment is a user equipment that is accessed from the LTE network to the 3G network according to the paging response message sent by the user equipment or the circuit switched domain non-access stratum message; or

The core network device determines that the user equipment is associated with the SG S interface of the user equipment, and determines that the user equipment is a user equipment that is accessed from the LTE network to the 3G network; or

The core network device determines, according to the notification message sent by the base station, that the user equipment is a user equipment that is accessed from the LTE network to the 3G network, and the notification message is that the base station determines that the user equipment is a circuit switched fallback CSFB user. The message is then sent to the core network device.
The method according to any one of claims 1-4, wherein the core network device storing the unused authentication vector for the user equipment sends the first authentication data request message to the authentication device before the The method also includes:

The core network device sends a second authentication data request message to the authentication device, where the second authentication data request message is used to request the authentication device to generate an authentication vector for the user equipment;

Receiving, by the core network device, the second authentication data response message returned by the authentication device according to the second authentication data request message, where the second authentication data response message carries the second authentication vector and the The authentication vector used;

The core network device sends a second authentication request message to the user equipment, where the second authentication request message includes a random number and an authentication token in the second authentication vector.
The method according to any of claims 1-5, wherein the core network device is a mobile switching center MSC or a general packet radio system GPRS service support node SGSN.
An authentication method in a wireless communication network, the method comprising:

Receiving, by the authentication device, a first authentication data request message sent by the core network device that is saved by the user equipment with an unused authentication vector, where the first authentication data request message is used to request the authentication device to be the user The device generates an authentication vector;

The authentication device generates a first authentication data response message according to the first authentication data request message, where the first authentication data response message includes the first authentication generated by the authentication device for the user equipment Weight vector

The authentication device returns the first authentication data response message to the core network device.
The method according to claim 6, wherein the method further comprises before the authentication device receives a first authentication data request message sent by a core network device that the user equipment holds an unused authentication vector include:

Receiving, by the authentication device, a second authentication data request message sent by the core network device, where the second authentication data request message is used to request the authentication device to generate an authentication vector for the user equipment;

The authentication device generates a second authentication data response message according to the second authentication data request message, where the authentication data response message includes a second authentication vector generated by the authentication device for the user equipment And the unused authentication vector;

The authentication device returns the second authentication data response message to the core network device.
The method according to claim 7 or 8, wherein the authentication device is a home environment HE, a home location register HLR, a home subscriber server HSS or an authentication center AUC.
A core network device, comprising:

a storage unit, configured to save an unused authentication vector for the user equipment;

An acquiring unit, configured to send, by the storage unit, the first authentication data request message to the authentication device, where the storage unit saves the unused authentication vector, the first authentication The data request message is used to request the authentication device to generate an authentication vector for the user equipment, and receive a first authentication data response message returned by the authentication device according to the authentication data request message, the first The weight data response message includes a first authentication vector;

And a sending unit, configured to send a first authentication request message to the user equipment, where the first authentication request message includes a random number and an authentication token in the first authentication vector.
The core network device according to claim 10, wherein the core network device further comprises:

a determining unit, configured to determine, after the user equipment accesses the first network where the core network device is located, the user equipment is a user equipment that is accessed from the second network to the first network; The network standard of the first network is different from the network format of the second network;

The obtaining unit is specifically configured to: after the determining unit determines that the user equipment is accessed from the second network to the user equipment of the first network, send the first authentication data to the authentication device. Request message.
The core network device according to claim 11, wherein the first network is a 3G network, and the second network is a long term evolution LTE network;

The determining unit is specifically configured to determine that the user equipment is a user equipment that is accessed from an LTE network to a 3G network.
The core network device according to claim 12, wherein the determining unit is configured to determine, according to the packet switched domain non-access stratum message sent by the user equipment, that the user equipment is User equipment accessing from the LTE network to the 3G network; or

Determining, according to the paging response message sent by the user equipment or the circuit switching domain non-access stratum message, that the user equipment is a user equipment that is accessed from the LTE network to the 3G network; or

Determining that the user equipment is a user equipment that is connected to the 3G network from the LTE network by determining that the user equipment and the mobility management entity MME are associated with the SG S interface; or

Determining, according to the notification message sent by the base station, that the user equipment is a user equipment that is accessed from the LTE network to the 3G network, and the notification message is that the base station sends the CSFB user to the core after determining that the user equipment is a circuit switched fallback CSFB user. The message sent by the network device.
The core network device according to any one of claims 10 to 13, wherein the obtaining unit is further configured to send the first authentication data request message to the authentication device before sending the first authentication data request message to the authentication device. a second authentication data request message, the second authentication data request message is used to request the authentication device to generate an authentication vector for the user equipment, and the receiving the authentication device according to the second authentication data request message Returning a second authentication data response message, the second authentication data response message carrying a second authentication vector and the unused authentication vector;

The sending unit is further configured to: before the sending unit sends the first authentication data request message to the authentication device, send a second authentication request message to the user equipment, where the second authentication request message includes the A random number and an authentication token in the second authentication vector.
The core network device according to any one of claims 10-14, wherein the core network device is a mobile switching center MSC or a general packet radio system GPRS service support node SGSN.
An authentication device, comprising:

a receiving unit, configured to receive a first authentication data request message sent by a core network device that saves an unused authentication vector, where the first authentication data request message is used to request the authentication device to be The user equipment generates an authentication vector;

a processing unit, configured to generate a first authentication data response message according to the first authentication data request message, where the first authentication data response message includes a first authentication vector generated for the user equipment;

And a sending unit, configured to return the first authentication data response message to the core network device.
The authentication device according to claim 16, wherein the receiving unit is further configured to receive the second authentication sent by the core network device before receiving the first authentication data request message. Data request message

The processing unit is further configured to: according to the second authentication data request message, the second authentication data request message is used to request the authentication device to generate an authentication vector for the user equipment, and generate a second authentication. a data response message, the authentication data response message including a second authentication vector generated for the user equipment and the unused authentication vector;

The sending unit is further configured to return the second authentication data response message to the core network device.
The method according to claim 16 or 17, wherein the authentication device is a home environment HE, a home location register HLR, a home subscriber server HSS or an authentication center AUC.
An authentication system, comprising the core network device according to any one of claims 10-15 and the authentication device according to any one of claims 16-18.
The system of claim 19, further comprising a user equipment;

The user equipment is configured to receive a first authentication request message sent by the core network device, and perform authentication by using a random number and an authentication token in the first authentication vector included in the first authentication request message.
An authentication method in a wireless communication network, characterized in that the method comprises

After the user equipment accesses from the 3G network to the long-term evolution LTE network, the mobility management entity MME of the LTE network acquires an unused packet saved by the GPRS service support node SGSN of the 3G network for the user equipment. Weight vector

The MME deletes or discards the unused authentication vector, so that after the user equipment re-accesses from the LTE network to the 3G network, the MME cannot send the unused authentication vector Give the SGSN.
The method according to claim 21, wherein the mobility management entity MME of the LTE network acquires an unused authentication vector saved by the general packet radio system GPRS service support node SGSN of the 3G network for the user equipment include:

Receiving, by the mobility management entity MME of the LTE network, a context request message sent by the SGSN of the 3G network, and receiving a first context response message returned by the SGSN, where the first context response message includes the unused authentication vector ;or,

The first SGSN of the LTE network receives the first forward relocation request message, and the first forward relocation request message includes the unused authentication vector.
The method according to claim 21 or 22, wherein after the MME deletes or discards the unused authentication vector, the method further includes:

After the user equipment re-accesses the LTE network to the 3G network, the MME receives the SGSN to send a second context request message, and returns a second context response message to the SGSN, where the second The context response message does not include the unused authentication vector;

Or after the user equipment re-accesses the LTE network to the 3G network, the MME sends a second forward relocation request message to the SGSN, where the second forward relocation request message is not The unused authentication vector is included.
A core network device, comprising: a processor, a memory, a bus, and a communication interface;

The memory is configured to store a computer to execute an instruction, the processor is connected to the memory through the bus, and when the core network device is in operation, the processor executes the computer-executed instruction stored in the memory to The core network device is caused to perform an authentication method in the wireless communication network according to any one of claims 1-6.
An authentication device, characterized in that the processor comprises a processor, a memory, a bus and a communication interface;

The memory is configured to store a computer to execute an instruction, the processor is connected to the memory through the bus, and when the authentication device is in operation, the processor executes the computer-executed instruction stored in the memory to The authentication device is caused to perform an authentication method in the wireless communication network according to any one of claims 7-9.
A computer readable medium, comprising: a computer executing instructions for execution by a processor of a computer, the computer executing the wireless communication network of any of claims 1-6 The authentication method in the middle.
A computer readable medium, comprising: a computer executing instructions for execution by a processor of a computer to execute a wireless communication network according to any one of claims 7-9 The authentication method in the middle.