WO2016086356A1

WO2016086356A1 - Authentication method within wireless communication network, related apparatus and system

Info

Publication number: WO2016086356A1
Application number: PCT/CN2014/092793
Authority: WO
Inventors: 崇卫微; 吴晓波; 吕阳明; 陈璟
Original assignee: 华为技术有限公司
Priority date: 2014-12-02
Filing date: 2014-12-02
Publication date: 2016-06-09
Also published as: CN107113610A

Abstract

Provided are an authentication method within a wireless communication network, a related apparatus and a system. After receiving an authentication data request message sent by a core network device, even if the authentication data request message carries a synchronisation failure indication, an authentication device queries and obtains a DIF value of a UE according to an identifier of the UE in order to generate a resynchronisation sequence, so that the resynchronisation sequence is not equal to (or approximately equal to) a self-stored maximum sequence number sequence reported by the UE, preventing repeated authentication failure in the prior art caused by the resynchronisation sequence being equal to (or approximately equal to) the maximum sequence number sequence stored by the UE, and ensuring successful authentication for the core network device when an authentication vector including the resynchronisation sequence is used to perform authentication, thereby solving the problem in the prior art caused after repeated authentication failure that the UE is not able to initiate a service in a normal manner until restarted.

Description

Authentication method, related device and system in wireless communication network

Technical field

The present invention relates to the field of communications technologies, and in particular, to an authentication method, related device, and system in a wireless communication network.

Background technique

Authentication is part of mobile network security management to achieve the confidentiality and data integrity of mobile networks. In the current mobile communication network, only a valid user equipment (User Equipment, UE) is entitled to receive the service, and verifying whether the UE is valid needs to be completed through an authentication process. The UE triggers the authentication process by initiating a registration request, a service request, or a handover request to the network. In the second generation (Second Generation, 2G) network system, authentication is a one-way process, and the network needs to verify the legitimacy of the UE; in the third generation (Third Generation, 3G) network or Long Term Evolution (Long Term Evolution, In the LTE network, in addition to verifying the legitimacy of the UE, the UE also needs to verify the validity of the network, that is, perform network authentication.

It should be noted that the authentication process is performed in a domain-by-domain manner, that is, a packet switching (PS) domain and a circuit switching (CS) domain respectively perform an authentication process, and a PS domain authentication is performed by a mobility management entity ( The Mobility Management Entity (MME) or the General Packet Radio Service (GPRS) Service Support Node (SGSN) is initiated. The CS domain authentication is initiated by the Mobile Switching Center (MSC). The UE needs to Network authentication is performed on the PS domain and the CS domain, respectively. Taking the 3G authentication process as an example, after obtaining the authentication vector from the home location register (HLR) or the authentication center (AUC), the MSC/SGSN sends an authentication request carrying the authentication vector to the UE. Message. The UE first determines the validity of the network according to the authentication request message. If the network is legal, it verifies whether the network is synchronized with the network. If the synchronization is successful, the UE successfully authenticates the network, and the UE returns a response message to the network, and the MSC/SGSN according to the UE. The response message sent by the UE verifies the validity of the UE. If the synchronization fails, the UE will reply the MSC/SGSN with an authentication failure message carrying the cause value, and the MSC/SGSN will send an authentication request message to the UE again.

In the prior art, when the MSC/SGSN/MME obtains an authentication vector from the HLR/AUC, Multiple authentication vectors are requested to save network expenses and reduce the burden on HLR/AUC. Moreover, since the Universal Mobile Telecommunications System Subscriber Identity Module (USIM) of most UEs does not support the domain synchronization detection, the UE does not completely separate the synchronization detection of the PS domain and the CS domain network. Once the PS domain authentication is inserted before the CS domain authentication, and the unused authentication vector is stored in the MSC that initiates the CS domain authentication process, the UE may fail to perform network authentication on the CS domain; or The CS domain authentication is inserted before the PS domain authentication, and the MME/SGSN that initiates the PS domain authentication process saves the unused authentication vector, which may cause the UE to fail the network authentication for the CS domain.

In addition, if the MSC/SGSN/MME receives the authentication failure message sent by the UE twice, the authentication process is terminated, and an authentication rejection message is sent to the UE. Once the UE receives the authentication rejection message, it will not be able to initiate the service normally until it restarts, which has a serious impact on the user.

Summary of the invention

For the above problems in the prior art, the embodiments of the present invention provide an authentication method, a related device, and a system in a wireless communication network, which can solve the problem that the user equipment cannot initiate the service normally caused by two consecutive authentication failures in the prior art. Until the issue of rebooting.

In a first aspect, an embodiment of the present invention provides an authentication method in a wireless communication network, where the authentication device includes: an authentication data request message sent by a core network device, where the authentication data request message includes a user equipment. Identity and synchronization failure indications;

The authentication device acquires a difference DIF value of the user equipment according to the identity identifier of the user equipment, and generates a resynchronization sequence according to the DIF value of the user equipment;

The authentication device generates an authentication vector according to the resynchronization sequence;

The authentication device sends the authentication vector to the core network device.

With reference to the first aspect, in a first possible implementation, the authentication device acquires a difference of the user equipment according to the identity identifier of the user equipment, and generates a resynchronization according to the difference of the user equipment. The sequence includes:

The authentication device queries the database according to the identity identifier of the user equipment, and obtains a DIF value of the user equipment; the authentication device is configured according to a DIF value of the user equipment and a value of a current global counter. The resynchronization sequence is generated.

With reference to the first aspect, or the first possible implementation manner of the first aspect, in a second possible implementation manner, the authentication data request message further includes information about a sequence of a maximum sequence number stored by the user equipment. .

With reference to the first aspect, or the first or second possible implementation manner of the first aspect, in a third possible implementation manner, the identity of the user equipment is an international mobile subscriber identity of the user equipment IMSI.

With reference to the second aspect, an embodiment of the present invention provides an authentication device, where the core network device sends an authentication data request message to an authentication device, where the authentication data request message includes an identity identifier of the user equipment and a synchronization failure indication.

The core network device receives the authentication vector returned by the authentication device, where the authentication vector is generated by the authentication device according to the resynchronization sequence, and the resynchronization sequence is the authentication device according to the authentication device. The identity of the user equipment is generated by the DIF value of the user equipment acquired;

The core network sends an authentication request message to the user equipment, where the authentication request message includes a random number and an authentication token in the authentication vector.

With reference to the second aspect, in a first possible implementation, before the sending, by the core network device, the authentication data request message to the authentication device, the method further includes:

The core network device receives an authentication failure message sent by the user equipment, where the authentication failure message includes a cause value, and the cause value is a synchronization failure.

In a third aspect, an embodiment of the present invention provides an authentication device, including:

a receiving unit, configured to receive an authentication data request message sent by the core network device, where the authentication data request message includes an identity identifier of the user equipment and a synchronization failure indication;

a processing unit, configured to determine a DIF value of the user equipment according to the identity identifier of the user equipment, determine a resynchronization sequence according to the difference DIF value of the user equipment, and generate an authentication vector according to the resynchronization sequence;

And a sending unit, configured to send the authentication vector to the core network device.

With reference to the third aspect, in a first possible implementation, the processing unit is specifically configured to query a database according to an identity identifier of the user equipment, to obtain a DIF value of the user equipment, and according to a DIF value of the user equipment. The value of the current global counter is generated to generate the resynchronization sequence.

With reference to the third aspect, or the first possible implementation manner of the third aspect, in a second possible implementation manner, the authentication data request message further includes information about a sequence of a maximum sequence number stored by the user equipment.

In a fourth aspect, an embodiment of the present invention provides a core network device, including:

a sending unit, configured to send an authentication data request message to the authentication device, where the authentication data request message includes an identity identifier of the user equipment and a synchronization failure indication;

An obtaining unit, configured to receive an authentication vector returned by the authentication device, where the authentication vector is generated by the authentication device according to a resynchronization sequence, where the resynchronization sequence is The identity of the user equipment is generated by the DIF value of the user equipment acquired;

The sending unit is further configured to send an authentication request message to the user equipment, where the authentication request message includes a random number and an authentication token in the authentication vector.

With reference to the fourth aspect, in a first possible implementation, the core network device further includes:

a receiving unit, configured to receive an authentication failure message sent by the user equipment, where the sending failure unit sends a verification data request message, where the authentication failure message includes a cause value, the cause value Failed for synchronization.

According to a fifth aspect, an embodiment of the present invention provides an authentication system, including the authentication device according to any one of the third aspect or the third aspect, and any of the fourth or fourth aspects. The core network device described in the implementation manner.

With reference to the fifth aspect, in a first possible implementation, the system further includes a user equipment;

The user equipment is configured to receive an authentication request message sent by the core network device, and perform authentication by using a random number and an authentication token in the authentication vector included in the authentication request message.

In a sixth aspect, an embodiment of the present invention provides an authentication device, including a processor, a memory, a bus, and a communication interface.

The memory is configured to store a computer to execute an instruction, the processor is connected to the memory through the bus, and when the authentication device is in operation, the processor executes the computer-executed instruction stored in the memory to The authentication device is configured to perform an authentication method in the wireless communication network of the first aspect or any of the possible implementations of the first aspect.

In a seventh aspect, an embodiment of the present invention provides a core network device, where the processor includes a processor, a memory, a bus, and a communication interface.

The memory is configured to store a computer to execute an instruction, the processor is connected to the memory through the bus, and when the core network device is in operation, the processor executes the computer-executed instruction stored in the memory to The core network device is configured to perform an authentication method in the wireless communication network described in the second aspect or the first possible implementation manner of the second aspect.

According to an eighth aspect, an embodiment of the present invention provides a computer readable medium, comprising: executing, by a computer, an instruction to execute, by a processor of a computer, the first aspect or the first An authentication method in a wireless communication network as described in any of the possible implementations.

According to a ninth aspect, an embodiment of the present invention provides a computer readable medium, comprising: a computer executing an instruction, when the processor of the computer executes the computer to execute an instruction, the computer performs the second aspect or the second An authentication method in a wireless communication network as described in the first possible implementation of the aspect.

In the present invention, the DIF value of the user equipment represents a difference between a value of a sequence generated by the user equipment and a value of a global counter. The embodiment of the present invention provides an authentication method in a wireless communication network, after the authentication device receives the authentication data request message sent by the core network device, even if the authentication data request message carries a synchronization failure indication, The ID of the UE obtains the DIF value of the UE to generate a resynchronization sequence, so that the resynchronization sequence is not equal to (or approximately equal to) the sequence of the maximum sequence number stored by the UE, which avoids resynchronization in the prior art. The re-authentication failure caused by the sequence equal to (or approximately equal to) the sequence of the largest sequence number stored by the UE ensures that the authentication of the core network device by using the authentication vector including the resynchronization sequence is successful, thereby solving the present problem. In the technology, the UE fails to initiate the service normally until the restart is caused after the failure of the authentication again.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention. Other drawings can also be obtained from those skilled in the art based on these drawings without paying any creative effort.

FIG. 1 is an authentication method in a wireless communication network according to an embodiment of the present invention;

2 is another authentication method in a wireless communication network according to an embodiment of the present invention;

3 is another authentication method in a wireless communication network according to an embodiment of the present invention;

4 is a schematic diagram of an authentication device according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of a core network device according to an embodiment of the present disclosure;

FIG. 6 is a schematic diagram of an authentication system according to an embodiment of the present invention; FIG.

FIG. 7 is a schematic structural diagram of an authentication device in a wireless communication network according to an embodiment of the present invention.

detailed description

The embodiment of the invention provides a method, a related device and a system for authenticating in a wireless communication network, which can solve the problem that the user equipment cannot initiate a service normally until restarting due to two consecutive authentication failures in the prior art.

In order to more clearly describe the embodiments of the present invention, the knowledge related to the embodiments of the present invention is first introduced.

Generally, in the network authentication process, the UE needs to verify whether it is synchronized with the network. If it is not synchronized, the authentication process fails. To detect whether the network is synchronized with the network, the UE needs to obtain a sequence number (SQN) from the authentication vector sent by the core network device (MME/MSC/SGSN), and detect whether the sequence number satisfies a series of detection conditions, where Including whether the sequence (SEQ) included in the verification sequence number satisfies SEQ _{MS -} SEQ < L, where L is usually set by the operator, L may be 32, and SEQ _MS is a sequence of the maximum sequence number currently stored by the UE itself. . If the SQN satisfy all test conditions, the synchronization verification is successful, and when SEQ> SEQ _MS UE stored SEQ _MS will be updated as SEQ. The above-mentioned SQN obtained from the authentication vector is actually generated by the authentication device (HLR/AUC) and included in the authentication vector.

The SQN generated by the authentication device is usually expressed in binary, consisting of two parts, SEQ and IND. In the mechanism for generating an SQN based on time, the authentication device stores a difference (DIF) value for each user equipment in its own database, and the DIF value of each user equipment is different, and the DIF value of the user equipment is represented. The difference between the SEQ value generated for the user equipment and the value of the global counter (Golbal Counter) GLC, thus the SEQ generated for the same UE is only related to the value of the global counter GLC. In general, after the authentication device receives the authentication data request message, if the authentication data request message does not carry the synchronization failure indication, it will query the DIF value of the UE from its own database and obtain the value of the current global counter GLC. Then, SEQ can be generated, and SEQ=GLC+DIF, that is, the authentication device is the same UE. The difference between the two generated SEQs is only related to the value of the global counter GLC, and the value of the global counter GLC is usually taken from the time point (time stamp). For example, the value of the global counter GLC can be increased by 1 every 0.1 seconds, then 5 seconds. The SEQ difference generated for the same UE is 1*(5s/0.1s)=50.

The inventor has found that in the prior art, since the UE does not completely separate the synchronization detection of the PS domain and the CS domain, once the PS domain authentication is inserted before the CS domain authentication, and the CS domain authentication process is initiated, the MSC is in the MSC. If the unused authentication vector is saved, the UE may fail to perform network authentication on the CS domain; or the CS domain authentication is inserted before the PS domain authentication, and the MME/SGSN that initiates the PS domain authentication process is initiated. The unused authentication vector is saved, which may cause the UE to perform network authentication failure on the PS domain. For example, in the scenario where the UE performs a PS domain network authentication between the two CS domain network authentications, the MSC may obtain multiple authentications from the authentication device before the core network device initiates the first CS domain authentication. The authentication vectors AV _C11 and AV _C12 , after performing the first CS domain authentication, the unused authentication vector AV _C12 is still stored in the MSC; and then, due to the change of the radio access type of the UE, etc., it may be required The PS domain authentication and the second CS domain authentication are initiated for the UE, and the PS domain authentication may be before the second CS domain authentication. If the PS domain authentication succeeds, the sequence SEQ of the largest sequence number stored in the UE is _{The MS} may be updated to SEQ _P obtained from the PS domain authentication authentication vector AV _P ; when performing the second CS domain authentication, the MSC will initiate the authentication process using its saved unused authentication vector AV _C12 in this case the UE acquires equal SEQ obtained from AV _{_C12} SEQ _C12, the _{_{_{SEQ MS -SEQ = SEQ P -SEQ C12}}} , i.e. the value of the SEQ _MS -SEQ generates AV _{_P} (SEQ _P) and AV _{_C12} (SEQ _C12) The time difference is related. However, since the core network device utilizes the unused authentication vector AV _C12 acquired during the first CS domain network authentication saved by itself during the second CS domain authentication, if the authentication device generates AV _P and AV The time of _C12 is very different, so that SEQ _{MS -} SEQ is not less than L, and the detection condition cannot be satisfied, resulting in synchronization failure, thereby causing authentication failure.

In addition, in the prior art, when the authentication fails due to the synchronization failure, the core network device usually receives an authentication failure message carrying the cause value sent by the UE, and the reason value is that the synchronization fails, and the core network device passes the The data authentication request message of the synchronization failure indication is sent to the authentication device to trigger the resynchronization process, wherein the data authentication request message carrying the synchronization failure indication further includes the information of the sequence SEQ _MS1 of the largest sequence number stored in the UE when the synchronization fails. . Different from the data authentication request message that does not carry the synchronization failure indication message, the authentication device generates a sequence SEQ according to the DIF value of the UE acquired by the identity identifier of the UE. In the resynchronization process, the authentication device first needs to obtain the SEQ _MS1. , reset the UE's DIF value to SEQ _MS1 -GLC1, and then generate a resynchronization sequence SEQ _sy according to the reset DIF value and the current global counter GLC value, then the resynchronization sequence SEQ _sy = SEQ _MS1 -GLC1 + GLC2 Where GLC1 is the time to receive SEQ _MS1 , and GLC2 is the time to generate the resynchronization sequence; then the information of the resynchronization sequence SEQ _sy is included in the authentication vector according to a preset algorithm and sent to the core network device for re-authentication. However, since GLC1 and GLC2 usually differ greatly, the resynchronization sequence SEQ _{sy is} almost equal to SEQ _MS1 . At this time, if the PS domain authentication is inserted before the core network device initiates the CS domain authentication again by using the authentication vector including the resynchronization sequence SEQ _sy , the UE performs network authentication again on the CS domain, in the UE. stored largest sequence number SEQ _MS2 synchronization parameter may have been updated as SEQ _P2 obtained from the authentication vector AV _P2 PS domain authentication, the weight at a time equal to the synchronization sequence SEQ SEQ _SY, the SEQ _MS2 -SEQ = SEQ _{_P2} -SEQ _sy _{≈SEQ P2} -SEQ _MS1, and often SEQ _P2 and SEQ _MS1 may vary greatly, and SEQ _P2 is greater than SEQ _MS1, so that the SEQ _MS2 -SEQ _sy <L can not be established, again leading to failure of the authentication. Similarly, if the CS domain authentication is inserted before the core network device initiates the PS domain authentication again by using the authentication vector including the resynchronization sequence, according to the prior art method, the authentication failure may be caused again. The suspension of the rights process causes the UE to fail to initiate a service normally until it is restarted.

In order to solve the above problem, an embodiment of the present invention provides an authentication method in a wireless communication network, which enables a core network device (MSC/SGSN/MME) to acquire a new one from an authentication device before initiating an authentication request to the UE. The authorization vector (AV), even if the core network device saves the unused authentication vector, uses the acquired new authentication vector for authentication, ensuring that each time the CS domain/PS domain network authentication is performed The SEQ included in the authentication vector is newly generated by the authentication device, and even if the PS domain network authentication is inserted before the CS domain network authentication or the CS domain network authentication is inserted before the PS domain network authentication, The synchronization success is ensured, and the problem of authentication failure caused by the synchronization failure in the prior art is solved, and the UE disconnection may be avoided due to the authentication failure.

The embodiment of the present invention further provides an authentication method in a wireless communication network, which enables the authentication device to use the sequence SEQ _MS of the largest sequence number stored in the UE when the core network device triggers the resynchronization process due to synchronization failure. The resynchronization sequence SEQ _{sy is} generated, and the DIF value of the UE is directly obtained according to the identity identifier of the UE, just according to the authentication data request message that does not carry the synchronization failure indication, according to the DIF value of the UE and the value of the current global counter GLC ( That is, the time at which the resynchronization SEQ is generated) to generate the resynchronization sequence SEQ _sy such that the resynchronization sequence SEQ _sy is not equal to (or approximately equal to) SEQ _MS1 , ensuring that the core network device is utilizing the authentication vector containing the resynchronization sequence SEQ _sy The authentication succeeds when the authentication is performed, so as to avoid the problem that the UE cannot initiate the service normally until restarting after the failure of the authentication again.

The technical solutions in the embodiments of the present invention will be clearly and completely described in the following with reference to the accompanying drawings. It should be noted that, in various embodiments of the present invention, the core network device may be an MSC, an SGSN, or an MME, and the authentication device may be an authentication device, which may be an HLR, a Home Subscriber Server (HSS), an AUC, or a home environment. (Home Environment, HE).

An embodiment of the present invention provides an authentication method in a wireless communication network. As shown in FIG. 1, the method may include:

S101: The authentication device receives an authentication data request sent by the core network device, where the authentication data request message includes an identity identifier of the UE and a synchronization failure indication.

The identity of the UE may be an International Mobile Subscriber Identity (IMSI) of the UE, the synchronization failure indication is used to indicate that the synchronization fails, and the authentication data request message including the synchronization failure indication is usually The resynchronization process is triggered.

Furthermore, the authentication data request may also contain information of the sequence SEQ _MS1 of the largest sequence number stored by the user equipment, from which the SEQ _MS1 may be determined. Since the sequence of the maximum sequence number stored by the user equipment can be updated after the authentication succeeds, the information of the SEQ _MS1 included in the authentication data request is stored by the UE after the last successful authentication. The sequence of the largest sequence number of the SEQ _MS1 , that is, the information of the sequence of the largest sequence number stored in the UE when the authentication fails.

S102: The authentication device acquires a DIF value of the UE according to the identity identifier of the UE, and determines a resynchronization sequence SEQ _sy according to the DIF value of the UE.

In the database of the authentication device, a corresponding DIF value is saved for each user equipment, and the DIF value of the user equipment is represented as the difference between the SEQ value generated by the user equipment and the value of the global counter (Golbal Counter) GLC. Therefore, the authentication device may query the database according to the identity identifier of the UE, and obtain a DIF value of the UE stored in the database, according to the DIF value of the UE and the value of the current global counter GLC (ie, generate resynchronization At the time of the sequence SEQ _sy , a resynchronization sequence SEQ _{sy is} generated. The database is typically configured in the authentication device.

Different from the prior art, when receiving the data authentication request message carrying the synchronization failure indication, resetting the DIF value of the UE to SEQ _MS1 -GLC1 (the value of the global counter GLC when GLC1 is connected to SEQ _MS1 ) results in a resynchronization sequence. SEQ _{sy is} almost equal to SEQ _MS1 , and instead of receiving the authentication data request message that does not carry the synchronization failure indication, the DIF value of the UE is directly obtained according to the identity of the UE, according to the DIF value of the UE and the value of the current global counter GLC. The resynchronization sequence SEQ _{sy is} generated, which avoids the re-authentication failure caused by the resynchronization sequence SEQ _sy equal to (or approximately equal to) SEQ _MS1 in the prior art, and solves the problem that the UE cannot initiate the service normally until restarting due to the re-authentication failure. The problem is to avoid impact on the UE's business.

S103: The authentication device generates an authentication vector according to the resynchronization sequence SEQ _sy .

The authentication device may first include the resynchronization sequence SEQ _sy in the sequence number SQN by using a preset algorithm; and then use the SQN and obtain an anonymous key (anonymity key according to a random number (RAND). AK), generating an authentication token (AUTN), the authentication vector including the authentication token and the random number.

Specifically, the authentication device may obtain an anonymous key AK by using a random number, and include the SQN, the anonymous key AK, and other necessary parameters in the authentication token, where the finally generated authentication vector includes The authentication token and the random number. Subsequently, the UE and the like may obtain the anonymous key AK by using the random number included in the authentication vector, and obtain, by using the anonymous key AK, the re-synchronization sequence from the authentication token. The sequence number, ie the authentication token and the random number, may be used to determine an SQN comprising the resynchronization sequence SEQ _sy .

In addition, the authentication vector may further include an expected response (XRES), an integrity key (IK), and a cipher key (CK).

S104: The authentication device sends the authentication vector to the core network device, so that the core network device initiates an authentication process by using the authentication vector.

The authentication device may send the authentication vector to the core network device by using an authentication data response message. In this case, the authentication data response message includes the authentication vector.

An embodiment of the present invention further provides an authentication method in a wireless communication network. As shown in FIG. 2, the method includes:

S201: The core network device sends an authentication data request message to the authentication device, where the authentication data is requested. The request message includes the identity of the UE and a synchronization failure indication.

The authentication failure message may further include information of a sequence SEQ _MS1 of the maximum sequence number stored by the user equipment, and according to the information, the SEQ _MS1 may be determined. Since the sequence of the maximum sequence number stored by the user equipment can be updated after the authentication succeeds, the information of the SEQ _MS1 included in the authentication data request is the last successful authentication of the UE. The sequence of the maximum sequence number stored after SEQ _MS1 , that is, the information of the sequence of the largest sequence number stored in the UE when the authentication fails. Correspondingly, the authentication data request message may further comprise information of the SEQ _MS1 .

S202: The core network device receives an authentication vector returned by the authentication device, where the authentication vector is generated by the authentication device according to the resynchronization sequence SEQ _sy , and the resynchronization sequence SEQ _sy is The authentication device is generated according to the DIF value of the user equipment acquired by the identity of the user equipment.

S203: The core network device sends an authentication request message to the UE, where the authentication request message includes a random number and an authentication token in the authentication vector.

The core network device may initiate an authentication process by using a random number and an authentication token in the authentication vector, and the UE may use the random number to obtain an anonymous key AK, and use the anonymous key AK. acquiring from the authentication token comprises a sequence number SQN resynchronization SEQ _sy and acquires the resynchronization sequence SEQ _sy synchronize sequence number SQN from the authentication in.

Since the resynchronization sequence SEQ _sy is determined by the authentication device according to the DIF value of the UE obtained according to the identity of the UE, regardless of SEQ _MS1 , the prior art due to the resynchronization sequence SEQ _{sy is} avoided. It is equal to (or approximately equal to) the re-authentication failure caused by the SEQ _MS1 , which solves the problem that the UE cannot initiate the service normally until restarting due to the failure of the authentication again, and avoids the impact on the service of the UE.

Optionally, step S200 may be further included before S201:

S200: The core network device receives an authentication failure message sent by the UE, where the authentication failure message includes a cause value, and the cause value is a synchronisation failure. The core network device may send an authentication data request message to the authentication device according to the authentication failure message, where the authentication data request message includes an identity identifier of the UE and a synchronization failure indication.

An embodiment of the present invention provides an authentication method in a wireless network communication network. As shown in FIG. 3, the method includes:

S301: The UE returns an authentication failure message to the MSC, where the authentication failure message carries the cause value and the information of the sequence SEQ _MS1 of the maximum sequence number stored by the UE after the last successful authentication, where the cause value is a synchronization failure. .

Before the MSC initiates the resynchronization procedure according to the authentication failure message, the SGSN of the 3G network may need to obtain an authentication vector from the HLR/HE/AUC to initiate PS domain authentication, and thus step S302 may be performed.

S302: The SGSN sends a first authentication data request message to the HLR/HE/AUC, where the first authentication data request message carries an IMSI of the UE.

The first authentication data request message is also a PS authentication data request message.

S303: The HLR/HE/AUC returns a first authentication data response message to the SGSN, where the first authentication data response message includes an authentication vector AV _ps .

The HLR/HE/AUC may first obtain the DIF value DIF of the UE according to the IMSI of the UE, and generate a sequence SEQ _ps , where SEQ _ps = DIF + GLC _T1 , and GLC _T1 is a global counter GLC when generating SEQ _ps value, then the number contained in the sequence SEQ _ps SQN _ps, and the SQN _ps and the anonymity key AK _ps using the random number RAND _ps contained in the obtained authentication token AUTN _ps, and finally generated authentication vector AV _ps, The AV _ps includes the RAND _ps and the AUTN _ps .

Specifically, assuming SEQ _MS1 = 5, the value of the global counter GLC may be incremented by one every 0.1 seconds, and after the SEQ _{MS1 is} generated 4.5 seconds, the HLR/HE/AUC receives the first authentication data request message from the SGSN, then The generated SEQ _ps = 50.

S304: The MSC sends a second authentication data request message to the HLR/HE/AUC, where the second authentication data request message includes an IMSI of the UE, a synchronization failure indication, and information of the SEQ _MS1 .

S305: The HLR/HE/AUC obtains a DIF value DIF of the UE according to the IMSI of the UE, and determines a resynchronization sequence SEQ _sy according to the DIF value of the UE, and generates according to the resynchronization sequence SEQ _sy The authentication vector AV _sy , the AV _sy contains a random number RAND _sy and an authentication token AUTN _sy .

Specifically, the resynchronization sequence SEQ _sy may be SEQ _sy = DIF + GLC _T2 , and GLC _T2 is a value of the global counter GLC when SEQ _sy is generated. For example, assume that after 2 seconds of generating SEQ _ps , the HLR/HE/AUC receives the second authentication data request message from the MSC, the generated SEQ _sy = 70.

S306: The HLR/HE/AUC returns a second authentication data response message to the MSC, where the second authentication data response message includes the AV _sy .

S307: The SGSN sends a first authentication request message to the UE, where the first authentication request message includes RAND _ps and AUTN _ps (SEQ _ps ) in the AV _ps .

S308: If the authentication succeeds and SEQ _{ps is} greater than SEQ _MS1 , the UE updates the sequence of the largest sequence number stored by itself to SEQ _ps .

If the authentication is successful and SEQ _{ps is} greater than SEQ _MS1 , the UE updates the sequence of the largest sequence number stored by itself to SEQ _ps .

The steps S307-S308 may also be used in the embodiment of the present invention before the step S304.

S309: The UE returns a first authentication response message to the SGSN.

S310: The MSC sends a second authentication request message to the UE, where the second authentication request message includes RAND _sy and AUTN _sy (SEQ _sy ) in AV _sy .

S311: If the authentication succeeds and SEQ _{sy is} greater than SEQ _ps , the UE updates the sequence of the largest sequence number stored by itself to SEQ _sy .

After receiving the second authentication request message, the UE obtains AK _sy according to RAND _sy , obtains SQN _sy including SEQ _sy from AUTN _sy according to the AK _sy and related algorithm, and obtains SEQ _sy And compare SEQ _sy with the sequence of the largest sequence number stored by itself.

Since the sequence of the largest sequence number stored by the UE has been updated to SEQ _ps at this time, it is known that SEQ _MS - SEQ = SEQ _{ps -} SEQ _sy = GLC _{T1 -} GLC _T2 , and the value of the global counter GLC when generating SEQ _sy is definitely later than GLC _T2 Generating the value GLC _{T1 of the} global counter GLC when SEQ _MS2 is generated, then SEQ _MS - SEQ = SEQ _{ps -} SEQ _sy GLC _{T1 -} GLC _T2 < 0 < L ensures that the UE is successfully synchronized with the network, thereby ensuring successful authentication, thereby avoiding again After the authentication fails, the UE cannot initiate the service normally until it restarts.

If the process according to the prior art, the resulting SEQ _SY is equal to or approximately equal SEQ _MSl, since larger than SEQ _SY SEQ _MSl, resulting in _{_{_{SEQ MS -SEQ = SEQ ps -SEQ sy}}} ≈SEQ ps -SEQ MS1, if generated in SEQ After 4.5 seconds of _MS1 , the HLR/HE/AUC receives the first authentication data request message from the SGSN, then =50-5>L (L=32), causing the resynchronization verification to fail, so that the UE cannot initiate the service normally until the start up.

S312: The UE returns a second authentication response message to the MSC.

In the embodiment of the present invention, after receiving the authentication data request message carrying the synchronization failure indication, the authentication device may directly obtain the re-synchronization sequence SEQ _sy according to the _{IMIF of} the UE to obtain the re-synchronization sequence SEQ _sy according to the IMSI of the UE. The resynchronization sequence SEQ _sy generates an authentication vector and sends the authentication vector to the core network device, even if the subsequent core network device performs CS domain (or PS domain) authentication by using the resynchronization sequence SEQ _sy The previous PS domain (or CS domain) authentication is inserted, which also ensures the authentication success, avoiding the use of the prior art process so that the generated resynchronization sequence SEQ _{sy is} almost equal to (or approximately equal to) SEQ _MS1 . The problem of authentication failure.

Corresponding to the above method embodiment, the embodiment of the present invention provides an authentication device 40. As shown in FIG. 4, the authentication device 40 may be an HLR or an AUC or an HE. The authentication device 40 includes a receiving unit 401. , processing unit 402 and transmitting unit 403;

The receiving unit 401 is configured to receive an authentication data request message sent by the core network device, where the authentication data request message includes an identity identifier of the UE and a synchronization failure indication, where the identity of the UE may be the UE IMSI;

The processing unit 402 is configured to determine a DIF value of the UE according to the identity identifier of the UE, determine a resynchronization sequence SEQ _sy according to the DIF value of the UE, and generate an authentication according to the resynchronization sequence SEQ _sy Specifically, the processing unit 402 may query the database according to the identity of the UE, obtain a DIF value of the UE, and generate the resynchronization sequence according to the DIF value of the UE and the value of the current global counter GLC. SEQ _sy ; The processing unit 402 may further include the resynchronization sequence SEQ _sy in the sequence number by using a preset algorithm, and generate an authentication token by using the sequence number and the anonymous key AK obtained according to the random number. The authentication vector includes the authentication token and the random number.

The sending unit 403 is configured to send the authentication vector to the core network device.

Optionally, the authentication data request may further include information of a sequence SEQ _MS1 of a maximum sequence number stored by the user equipment, and according to the information, the SEQ _MS1 may be determined. Since the sequence of the maximum sequence number stored by the user equipment can be updated after the authentication succeeds, the information of the SEQ _MS1 included in the authentication data request is the last successful authentication of the UE. The sequence of the maximum sequence number stored after SEQ _MS1 , that is, the information of the sequence of the largest sequence number stored in the UE when the authentication fails.

Different from the prior art, when receiving the data authentication request message carrying the synchronization failure indication, resetting the DIF value of the UE to SEQ _MS1 -GLC1 (the value of the global counter GLC when GLC1 is connected to SEQ _MS1 ) results in a resynchronization sequence. SEQ _sy almost equal SEQ _MS1, embodiments of the present invention, the receiving unit 401 receives the sync failure indication is carried in the authentication data request message, the processing unit 402 acquires a UE identity UE according DIF values, according to the The DIF value of the UE and the value of the current global counter GLC are used to generate the resynchronization sequence SEQ _sy , which avoids the re-authentication failure caused by the resynchronization sequence SEQ _sy equal to (or approximately equal to) the SEQ _MS1 in the prior art. The problem that the UE fails to initiate the service and restarts due to the failure of the right does not affect the service of the UE.

Corresponding to the foregoing method embodiment, the embodiment of the present invention provides a core network device 50. As shown in FIG. 5, the core network device 50 may be an MME or an MSC or an SGSN, and the core network device 50 includes a sending unit. 501 and acquisition unit 502;

The sending unit 501 is configured to send an authentication data request message to the authentication device, where the authentication data request message includes an identity identifier of the UE and a synchronization failure indication; the identity identifier of the UE may be an IMSI of the UE; The authentication failure message may further include information of the sequence SEQ _MS1 of the largest sequence number stored by the user equipment, according to which the SEQ _MS1 may be determined. Since the sequence of the maximum sequence number stored by the user equipment can be updated after the authentication succeeds, the information of the SEQ _MS1 included in the authentication data request is the last successful authentication of the UE. The sequence of the maximum sequence number stored after SEQ _MS1 , that is, the information of the sequence of the largest sequence number stored in the UE when the authentication fails. Correspondingly, the authentication data request message may further comprise information of the SEQ _MS1 .

The obtaining unit 502 is configured to receive an authentication vector returned by the authentication device, where the authentication vector is generated by the authentication device according to the resynchronization sequence SEQ _sy , and the resynchronization sequence SEQ _sy is The authentication device is generated according to the DIF value of the user equipment acquired by the identity identifier of the user equipment;

The sending unit 501 is further configured to send an authentication request message to the UE, where the authentication request message includes a random number and an authentication token in the authentication vector. Therefore, the UE may obtain the anonymous key AK by using the random number, and obtain the sequence number SQN including the resynchronization sequence SEQ _sy from the authentication token by using the anonymous key AK, and The resynchronization sequence SEQ _sy is obtained in the serial number SQN for synchronization verification. Since the resynchronization sequence SEQ _sy is determined by the authentication device according to the DIF value of the UE obtained according to the identity of the UE, regardless of SEQ _MS1 , the prior art due to the resynchronization sequence SEQ _{sy is} avoided. It is equal to (or approximately equal to) the re-authentication failure caused by the SEQ _MS1 , which solves the problem that the UE cannot initiate the service normally until restarting due to the failure of the authentication again, and avoids the impact on the service of the UE.

Optionally, the core network device further includes: a receiving unit 503, configured to receive an authentication failure message sent by the UE, where the authentication failure message includes a cause value, and the cause value is a synchronization failure; Specifically, the method is used to send an authentication data request message to the authentication device according to the authentication failure message, where the authentication data request message includes an identity identifier of the UE and a synchronization failure indication.

As shown in FIG. 6, an embodiment of the present invention further provides an authentication system 60, as shown in FIG. 6, including an authentication device 40 and a core network device 50. For the actions performed by the authentication device 40 and the core network device 50 and the interaction between them, refer to the description of the method embodiment corresponding to FIG. 1 to FIG. 3, and also the description of the device embodiment corresponding to FIG. 4 and FIG. , will not repeat them here.

Optionally, the authentication system may further include a user equipment 601;

The user equipment 601 may be configured to receive an authentication request message sent by the core network device 50, and perform authentication by using a random number and an authentication token in the authentication vector included in the authentication request message.

Optionally, the user equipment 601 is further configured to send an authentication failure message to the core network device 50, where the authentication failure message includes a cause value, and the cause value is a synchronization failure.

As shown in FIG. 7, an embodiment of the present invention further provides an authentication device in a wireless communication system, where the authentication device 700 can include:

Processor 701, memory 702, bus 704, and communication interface 705. The processor 701, the memory 702, and the communication interface 705 are connected by a bus 704 and complete communication with each other.

Processor 701 may be a single core or multi-core central processing unit, or a particular integrated circuit, or one or more integrated circuits configured to implement embodiments of the present invention.

The memory 702 may be a high speed RAM memory or a non-volatile memory such as at least one disk memory.

Memory 702 is used by computer to execute instructions 703. Specifically, the computer execution instructions 703 may include program code.

When the authentication device is running, the processor 701 runs the computer execution instruction 703, and may execute the method flow of the authentication method in the wireless communication system according to the method embodiment corresponding to any one of FIG. 1 to FIG. In the method flow of the authentication method in the wireless communication system described in the method embodiment corresponding to FIG. 1 or FIG. 3, the authentication device may be an authentication device, and the method corresponding to FIG. 2 or FIG. 3 is implemented. In the method flow of the authentication method in the wireless communication system, the authentication device may be a core network device.

The embodiment of the present invention further provides a computer readable medium, comprising: a computer executing instructions for a processor of a computer to execute the computer to execute an instruction, the computer performing the wireless operation of FIG. 1 or FIG. Method flow of an authentication method in a communication network.

The embodiment of the present invention further provides a computer readable medium, comprising: a computer executing instructions for a processor of a computer to execute the computer execution instructions, wherein the computer performs the wireless operation of FIG. 2 or FIG. Method flow of an authentication method in a communication network.

The LTE network mentioned in the present invention includes an LTE A network, and may subsequently have an LTE version. The first, second, third, fourth, fifth, etc. in the embodiments of the present invention are only used to distinguish different indication information, messages, or other objects, and do not represent sequential relationships.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both, for clarity of hardware and software. Interchangeability, the composition and steps of the various examples have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

A person skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, or an electrical, mechanical or other form of connection.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the embodiments of the present invention.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention contributes in essence or to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any equivalent person can be easily conceived within the technical scope of the present invention by any person skilled in the art. Modifications or substitutions are intended to be included within the scope of the invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

An authentication method in a wireless communication network, the method comprising:

The authentication device receives an authentication data request message sent by the core network device, where the authentication data request message includes an identity identifier of the user equipment and a synchronization failure indication.

The authentication device acquires a difference DIF value of the user equipment according to the identity identifier of the user equipment, and generates a resynchronization sequence according to the DIF value of the user equipment;

The authentication device generates an authentication vector according to the resynchronization sequence;

The authentication device sends the authentication vector to the core network device.
The method according to claim 1, wherein the authentication device acquires a difference value of the user equipment according to the identity identifier of the user equipment, and generates a resynchronization sequence according to the difference of the user equipment, including :

The authentication device queries the database according to the identity identifier of the user equipment, and obtains a DIF value of the user equipment;

The authentication device generates the resynchronization sequence according to a DIF value of the user equipment and a value of a current global counter.
The method according to claim 1 or 2, wherein the authenticating device generates an authentication vector according to the resynchronization sequence, including:

The authentication device uses the preset algorithm to include the resynchronization sequence in the sequence number;

The authentication device generates an authentication token by using the sequence number and an anonymous key AK obtained according to a random number, the authentication vector including the authentication token and the random number.
The method according to any one of claims 1 to 3, wherein the authentication data request message further comprises information of a sequence of a maximum sequence number stored by the user equipment.
The method according to any one of claims 1-4, wherein the identity of the user equipment is an International Mobile Subscriber Identity (IMSI) of the user equipment.
An authentication method in a wireless communication network, the method comprising:

The core network device sends an authentication data request message to the authentication device, where the authentication data request message includes an identity identifier of the user equipment and a synchronization failure indication.

Receiving, by the core network device, an authentication vector returned by the authentication device, where the authentication vector is generated by the authentication device according to a resynchronization sequence, where the resynchronization sequence is the root of the authentication device Generating according to the DIF value of the user equipment acquired by the identity of the user equipment;

The core network device sends an authentication request message to the user equipment, where the authentication request message includes a random number and an authentication token in the authentication vector.
An authentication device, comprising:

a receiving unit, configured to receive an authentication data request message sent by the core network device, where the authentication data request message includes an identity identifier of the user equipment and a synchronization failure indication;

a processing unit, configured to determine a DIF value of the user equipment according to the identity identifier of the user equipment, determine a resynchronization sequence according to the difference DIF value of the user equipment, and generate an authentication vector according to the resynchronization sequence;

And a sending unit, configured to send the authentication vector to the core network device.
The authentication device according to claim 7, wherein the processing unit is configured to obtain a DIF value of the user equipment according to an identity identifier of the user equipment, and obtain a DIF value according to the user equipment. And the value of the current global counter, the resynchronization sequence is generated.
The authentication device according to claim 7 or 8, wherein the processing unit is specifically configured to include the resynchronization sequence in a sequence number by using a preset algorithm; using the sequence number and according to the random number The obtained anonymous key AK generates an authentication token, and the authentication vector includes the authentication token and the random number.
The authentication device according to any one of claims 7-9, wherein the authentication data request message further includes information of a sequence of a maximum sequence number stored by the user equipment.
A core network device, comprising:

a sending unit, configured to send an authentication data request message to the authentication device, where the authentication data request message includes an identity identifier of the user equipment and a synchronization failure indication;

An obtaining unit, configured to receive an authentication vector returned by the authentication device, where the authentication vector is generated by the authentication device according to a resynchronization sequence, where the resynchronization sequence is The identity of the user equipment is generated by the DIF value of the user equipment acquired;

The sending unit is further configured to send an authentication request message to the user equipment, where the authentication request message includes a random number and an authentication token in the authentication vector.
An authentication system, comprising the authentication device according to any one of claims 7 to 10 and the core network device according to claim 11.
The system of claim 12, further comprising a user equipment;

The user equipment is configured to send an authentication failure message to the core network device, where the authentication failure message includes a cause value, the cause value is a synchronization failure, and an authentication request message sent by the core network device is received. The authentication is performed by using the random number and the authentication token in the authentication vector included in the authentication request message.
An authentication device, comprising: a processor, a memory, a bus, and a communication interface;

The memory is configured to store a computer to execute an instruction, the processor is connected to the memory through the bus, and when the authentication device is in operation, the processor executes the computer-executed instruction stored in the memory to The authentication device is caused to perform an authentication method in the wireless communication network according to any one of claims 1-5.
A core network device, characterized in that the processor comprises a processor, a memory, a bus and a communication interface;

The memory is configured to store a computer to execute an instruction, the processor is connected to the memory through the bus, and when the core network device is in operation, the processor executes the computer-executed instruction stored in the memory to The core network device is caused to perform the authentication method in the wireless communication network according to claim 6.
A computer readable medium, comprising: a computer executing instructions for execution by a processor of a computer to execute a wireless communication network according to any one of claims 1-5 The authentication method in the middle.
A computer readable medium, comprising: computer executable instructions for executing, by a processor of a computer, the method of authenticating in a wireless communication network of claim 6.