WO2017193889A1

WO2017193889A1 - Terminal access method and device

Info

Publication number: WO2017193889A1
Application number: PCT/CN2017/083470
Authority: WO
Inventors: 余万涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-05-10
Filing date: 2017-05-08
Publication date: 2017-11-16
Also published as: CN107360573A; CN107360573B

Abstract

A terminal access method and device. The method comprises: a terminal sends subscriber identity information to a base station; the terminal receives authentication challenge information and base station response information sent by the base station; the terminal detects the base station response information, and if the detection is passed, the terminal accesses the base station according to the authentication challenge information. By means of the solution, in the terminal access process, a base station to which a terminal is attached is authenticated by an authentication center. The authentication center can determine whether to terminate the access process according to an authentication result of the base station, and send the authentication result of the base station to the terminal. Then the terminal determines whether to connect to the base station. By means of the procedure, a malicious base station cannot cheat a terminal to transfer from a legal base station to the malicious base station, and the security when a terminal accesses a base station is increased.

Description

Terminal access method and device

Technical field

This document relates to the field of terminal access technologies, and in particular, to a terminal access method and apparatus.

Background technique

Currently, the EGPRS security architecture adopts a one-way authentication mode. The authentication and key negotiation process needs to forward authentication information through the base station. In the EGPRS-based cellular Internet of Things, the Cellular Internet of Things (CIoT) terminal device first transmits the user identity information of the terminal device to the base station when attaching to the network, and then receives the authentication information and the key forwarded by the base station. Negotiate challenge information. The CIoT terminal device generates a session key and authentication response information according to the authentication information, and transmits the authentication response information to the base station. In this process, the CIoT device does not need to determine whether the base station is a legitimate base station or a malicious base station.

In the CeoT (Cellular IoT) system based on EGPRS, for the Cellular Internet of Things (CIoT) terminal device, when the EGPRS security architecture adopts the one-way authentication mode, the CIoT terminal device cannot recognize the received one. Whether the authentication and key agreement information comes from a legitimate base station. It is possible for a malicious base station to cause a CIoT terminal device to be transferred from a legitimate base station to the malicious base station by means of spoofing. This will result in the disclosure of information about the CIoT terminal device.

Summary of the invention

The present invention will provide a terminal access method and apparatus to improve the security of terminal access.

In order to achieve the above objectives, the following technical solutions are adopted:

A terminal access method, the method includes: the terminal transmitting the user identity information to the base station; the terminal receiving the authentication challenge information and the base station response information sent by the base station; the terminal detecting the base station response information, detecting In the case of passing, the terminal accesses the base station according to the authentication challenge information.

In an embodiment, the step of detecting, by the terminal, the base station response information includes the following manner In any one of the following manners, in the case that the base station response information carries the identity information of the base station, the terminal acquires the identity information of the base station corresponding to the response information of the base station; and the terminal determines the response of the base station Whether the identity information of the base station corresponding to the information is consistent with the identity information of the base station detected by the terminal; if not, the detection fails; if yes, the detection passes; and the mode 1-2, the base station response information carries the base station authentication. In the case of the result, the terminal acquires the base station authentication result corresponding to the base station response information, and if the base station authentication result indicates that the base station is an illegal base station, the detection fails; if the base station authentication result indicates the The base station is a legal base station, and the detection passes; wherein the terminal acquires session key information through the authentication challenge information, and obtains the base station response information by using the session key information.

In an embodiment, the step of obtaining the base station response information by using the session key information comprises: when the session key information includes an encryption key Ck, the terminal passes the session key The encryption key Ck in the information performs a third processing on the base station response information to obtain the carried content of the base station response information corresponding to the base station response information; the session key information includes the encryption key Ck and the integrity protection key Ik In the case that the terminal performs the fourth processing on the base station response information by using the integrity protection key Ik in the session key information, and uses the encryption key Ck in the session key information to perform the fourth The result of the processing is performed by the third processing to obtain the content of the base station response information. The first processing refers to the processing performed by the authentication center to obtain the base station response information and the carrying content of the base station response information by using the encryption key Ck; The second processing refers to processing of the result of the first processing by the authentication center through the integrity protection key Ik for acquiring the base station response information, and the third processing is The first process corresponds to an inverse process, and the fourth process is an inverse process corresponding to the second process.

A terminal access method, the method includes: an authentication center receives base station identity information and user identity information sent by a base station; the authentication center performs authentication on the base station according to the identity information of the base station, and the The terminal performs authentication; when the authentication of the terminal passes, generates corresponding authentication information, and sends the authentication information to the base station.

In an embodiment, after the step of authenticating the base station according to the base station identity information by the authentication center, the method further includes: performing the generating corresponding to the case that the authentication of the base station is passed The step of authenticating the information; in the case where the authentication of the base station is not passed, the termination is terminated. The access process of the terminal.

In an embodiment, after the authentication center authenticates the base station according to the base station identity information, the method further includes: mode 2-1: performing the generation corresponding to the case that the authentication of the base station is passed Step of authenticating information; generating base station response information, and transmitting the base station response information to the base station; if the authentication of the base station fails, terminating the access process of the terminal; or, mode 2-2: generating a base station response And transmitting the base station response information to the base station; wherein the corresponding base station response information is set according to the authentication result of the base station.

In an embodiment, the authentication information includes authentication challenge information, session key information, and authentication response information; in the case of mode 2-1, the carrying content of the base station response information includes base station identity information; In the case of -2, the carrying content of the base station response information includes base station identity information and base station authentication result, where the base station authentication result includes identifier information indicating that the base station is illegal or legal; and the generating base station response information includes: The session key information processes the carried content of the base station response information to obtain corresponding base station response information.

In an embodiment, processing the carried content of the base station response information by using the session key information includes: when the session key information generated by the authentication center includes the encryption key Ck, the authentication center passes the encryption key Ck The base station responds to the carried content of the information to perform the first processing to obtain the corresponding base station response information; or, in the case that the session key information generated by the authentication center includes the encryption key Ck and the integrity protection key Ik, the authentication center first The first processing is performed on the carrying content of the base station response information by using the encryption key Ck, and the second processing is performed on the result of the first processing by using the integrity protection key Ik, thereby obtaining base station response information corresponding to the carried content of the base station response information.

A terminal access method, the method includes: the base station receives the user identity information sent by the terminal; the base station sends the base station identity information and the user identity information to the authentication center base station to receive the authentication information sent by the authentication center; the base station authenticates The authentication challenge information in the information is sent to the terminal.

In an embodiment, after the sending the base station identity information and the user identity information to the authentication center, the method further includes: the base station receiving the authentication center to send the base station response information; and the base station sending the base station response information Give the terminal.

A terminal access device is disposed on a terminal, where the device includes: a first sending unit, a first receiving unit, a detecting unit, and an access unit, where the first sending unit is configured to: send user identity information The first receiving unit is configured to: receive the authentication challenge information and the base station response information sent by the base station; the detecting unit is configured to: detect the base station response information; and the access unit is configured to: detect In the case of passing, access to the base station is performed according to the authentication challenge information.

In an embodiment, the detecting unit comprises at least one of a first detecting module and a second detecting module, wherein the first detecting module is configured to: in case the carrying content of the base station response information includes base station identity information The terminal acquires the identity information of the base station corresponding to the response information of the base station; determines whether the identity information of the base station corresponding to the response information of the base station is consistent with the identity information of the base station detected by the terminal; if not, the detection fails; if yes, the detection passes; The second detection module is configured to: when the carrying content of the base station response information includes the base station authentication result, obtain the base station authentication result corresponding to the base station response information, and if the base station authentication result is an illegal base station, the detection fails; if the base station authentication result is legal And detecting, by the base station, the first detecting module and/or the second detecting module acquiring the session key information by using the authentication challenge information, and obtaining the carrying content of the base station response information by using the session key information.

In an embodiment, the first detecting module and/or the second detecting module are configured to obtain the carrying content of the base station response information by using the session key information as follows: the session key information includes the encryption key Ck In the case where the base station response information is subjected to the third processing by the encryption key Ck in the session key information, the carried content of the base station response information is obtained; in the case where the key information includes the encryption key Ck and the integrity protection key Ik And performing fourth processing on the base station response information by using the integrity protection key Ik in the session key information, and performing third processing on the result of the fourth processing by using the encryption key Ck in the session key information to obtain the base station response information. The first processing means that the authentication center processes the base station identity information or the base station authentication result by using the encryption key Ck for acquiring the base station response information; the second processing means that the authentication center is acquiring the base station response information. And processing the result of the first process by the integrity protection key Ik, wherein the third process is a inverse corresponding to the first process Processing procedure, the fourth process is a second process corresponding to an inverse process.

A terminal access device is disposed at an authentication center, where the device includes a second receiving unit, an authentication unit, and a processing unit, where the second receiving unit is configured to: receive base station identity information and user identity information sent by the base station The authentication unit is configured to: authenticate the base station according to the identity information of the base station, and authenticate the terminal according to the user identity information; the processing unit is configured to: generate corresponding authentication information when the authentication of the terminal is passed And transmitting the authentication information to the base station.

In an embodiment, the processing unit includes a first processing module, configured to: perform the process of generating corresponding authentication information when the authentication of the base station passes; and if the authentication of the base station fails End the access process of the terminal.

In one embodiment, the processing unit includes any one of a second processing module and a third processing module, wherein the second processing module is configured to perform the generation corresponding to the authentication of the base station The process of authenticating information; and generating base station response information, and transmitting the base station response information to the base station; if the authentication of the base station fails, terminating the access process of the terminal; the third processing module is configured to: Generating base station response information, and transmitting the base station response information to the base station; wherein the corresponding base station response information is set according to the authentication result of the base station.

In one embodiment, the authentication information includes authentication challenge information, session key information, and authentication response information; the carrying content of the base station response information generated by the second processing module includes base station identity information; The carrying content of the base station response information generated by the processing module includes the base station identity information and the base station authentication result, where the base station authentication result includes identifier information indicating that the base station is illegal or legal; the second processing module and/or the third processing module are configured. The base station response information is generated in the following manner: the carried content of the base station response information is processed by the session key information to obtain corresponding base station response information.

In an embodiment, the second processing module and/or the third processing module are configured to process the carried content of the base station response information by the session key information as follows: the session key information generated at the authentication center includes In the case of the encryption key Ck, the authentication center performs the first processing on the carried content of the base station response information by using the encryption key Ck to obtain the corresponding base station response information; or the session key information generated in the authentication center includes the encryption key. In the case of the key Ck and the integrity protection key Ik, the authentication center first performs the first processing on the carried content of the base station response information by using the encryption key Ck, and then performs the first processing result by the integrity protection key Ik. Second processing, thereby obtaining a basis The base station response information corresponding to the carried content of the station response information.

A terminal access device is disposed at a base station, where the device includes: a third receiving unit and a third sending unit, where the third receiving unit is configured to: receive user identity information sent by the terminal; The unit is configured to: send the base station identity information and the user identity information to the authentication center; the third receiving unit is further configured to: receive the authentication information sent by the authentication center; the third sending unit is further configured to: The authentication challenge information in the authentication information is sent to the terminal.

In an embodiment, the third receiving unit is further configured to: receive base station response information sent by the authentication center; the third sending unit is further configured to: send the base station response information to the terminal.

Compared with the related art, the technical solution provided by the present invention includes: the terminal sends the user identity information to the base station; the terminal receives the authentication challenge information and the base station response information sent by the base station; and the terminal detects the response information of the base station, and the detected In the case, the terminal accesses the base station according to the authentication challenge information. With the solution of the present invention, in the terminal access process, the authentication center authenticates the base station to which the terminal is attached, and the authentication center may decide whether to terminate the access process according to the authentication result of the base station, or may be determined by the authentication center. The authentication result of the base station is sent to the terminal, and the terminal determines whether it is connected to the base station. Through the process, the malicious base station improves the terminal connection from the legal base station to the malicious base station by means of spoofing, thereby improving the terminal connection. Security when entering the base station.

BRIEF abstract

The drawings in the following description of the embodiments of the present invention are intended to illustrate the invention, and are not intended to limit the scope of the invention.

1A and FIG. 1B are flowcharts of a method for accessing a terminal according to an embodiment of the present invention;

2 is a flowchart of another terminal access method according to an embodiment of the present invention;

FIG. 3 is a flowchart of still another terminal access method according to an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a terminal access device according to an embodiment of the present disclosure;

FIG. 5 is a schematic structural diagram of another terminal access device according to an embodiment of the present disclosure;

FIG. 6 is a schematic structural diagram of still another terminal access device according to an embodiment of the present invention.

Detailed

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

In order to facilitate the understanding of those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings, and is not intended to limit the scope of the present invention. It should be noted that the embodiments in the present application and the various manners in the embodiments may be combined with each other without conflict.

Referring to FIG. 1A, an embodiment of the present invention provides a terminal access method, where the method includes:

Step 110: The terminal sends the user identity information IMSI to the base station.

Step 120: The base station sends the base station identity information and the user identity information IMSI to the authentication center.

Step 130: The authentication center authenticates the base station.

Step 140: If the authentication of the base station fails, the access procedure is terminated.

In addition, the authentication center also authenticates the terminal; if the authentication of the terminal fails, the access process, that is, the attach process, is also terminated.

On the basis of the terminal access method shown in FIG. 1A, as shown in FIG. 1B, after step 130, the method further includes:

Step 150: In the case that the authentication of the base station and the terminal is passed by the authentication center, the authentication center generates the authentication information corresponding to the terminal;

In the embodiment of the present invention, the authentication information includes authentication challenge information, session key information, and authentication response information. The session key information includes an encryption key Ck, or the session key information includes an encryption key Ck and an integrity protection key Ik.

Step 160: The authentication center sends the authentication information to the base station.

Step 170: The base station sends the authentication challenge information in the authentication information to the terminal.

The base station obtains the session key information and the authentication response information in the authentication information, and the base station compares the obtained authentication response information with the authentication response information sent by the terminal to complete the authentication of the terminal. In After the terminal successfully accesses, the base station performs secure communication with the terminal according to the session key information acquired in the authentication information.

Step 180: The terminal receives the authentication challenge information sent by the base station, and generates session key information and authentication response information according to the authentication challenge information.

Step 190: The terminal accesses the base station according to the authentication response information.

The terminal sends the generated authentication response information to the base station, and the base station compares the authentication response information obtained from the authentication information with the authentication response information sent by the terminal, and allows the terminal to access the base station if the comparison is consistent. After the terminal successfully accesses, the terminal performs secure communication with the base station through the session key information generated according to the authentication challenge information.

In the method for authenticating a base station by the terminal shown in FIGS. 1A and 1B, when the terminal attempts to attach to the pseudo base station, the attachment is directly terminated by the network.

Referring to FIG. 2, an embodiment of the present invention further provides another terminal access method, where the method includes:

Step 210: The terminal sends the user identity information IMSI to the base station.

Step 220: The base station sends the base station identity information and the user identity information IMSI to the authentication center.

The step 220 may include: the base station transmitting the base station identity information and the user identity information IMSI to the SGSN; the SGSN forwarding the received base station identity information and the user identity information IMSI to the authentication center;

Step 230: The authentication center authenticates the base station and the terminal; in the case that the authentication passes, the authentication center generates the base station response information and the authentication information; if the authentication fails, the attachment process is terminated.

The authentication center authenticates the base station and the terminal; when the authentication is passed, the authentication center generates the base station response information and the authentication information: the authentication center authenticates the base station; and when the authentication passes, the authentication center generates the base station response. The authentication center authenticates the terminal; when the authentication is passed, the authentication center generates authentication information corresponding to the terminal. The authentication of the base station and the authentication of the terminal can be performed separately.

The step 230 specifically includes:

Step 231: The authentication center verifies the identity information of the base station, and if the verification passes, step 232 is performed; otherwise, the attach process is terminated.

Step 232: In the case that both the base station and the terminal are authenticated, the authentication center generates the authentication information and the base station response information.

The authentication center generates authentication information according to the user identity information;

The generated authentication information includes: authentication challenge information, session key information, and authentication response information;

Wherein, in the case where the session key information includes the encryption key Ck,

The generating, by the authentication center, the base station response information includes: the authentication center performing the first processing on the base station identity information by using the encryption key Ck to obtain the corresponding base station response information; in one or more embodiments, the first processing refers to the encryption process.

or,

In the case where the session key information includes the encryption key Ck and the integrity protection key Ik,

The generating center base station response information includes: the authentication center first performs the first processing on the base station identity information by using the encryption key Ck, and then uses the integrity protection key Ik to perform the first processing result, that is, the ciphertext of the base station identity information. Performing a second process, thereby obtaining base station response information corresponding to the base station identity information. In one or more embodiments, the second process refers to processing the message with an integrity key to calculate integrity information of the message.

Step 240: The authentication center sends the authentication information and the base station response information to the base station.

Step 240 may include: the authentication center sends the authentication information and the base station response information to the SGSN; the SGSN forwards the received authentication information and the base station response information to the base station.

Step 250: The base station sends the received base station response information and the authentication challenge information in the authentication information to the terminal.

Step 260: The terminal acquires, according to the received authentication challenge information and the base station response information, the base station identity information corresponding to the base station response information.

In one or more embodiments, the terminal acquires session key information by using authentication challenge information, the session key information includes an encryption key Ck, and the terminal performs base station response information by using the encryption key Ck. The third process is performed to obtain base station identity information corresponding to the base station response information; wherein the third process is an inverse process corresponding to the first process, that is, a decryption process.

In one or more embodiments, the terminal acquires session key information by using authentication challenge information, the session key information includes an encryption key Ck and an integrity protection key Ik, and the terminal performs base station response information through the integrity protection key Ik. a fourth process, and performing a third process on the result of the fourth process by using the encryption key Ck to obtain base station identity information corresponding to the base station response information; wherein the third process is an inverse process corresponding to the first process, The fourth process is an inverse process corresponding to the second process.

Step 270: The terminal determines whether the identity information of the base station corresponding to the base station response information is consistent with the identity information of the base station detected by the terminal; if not, the terminal terminates the attach process; if yes, step 280 is performed.

Step 280: If the judgment result is consistent, the terminal accesses the base station.

The terminal generates the authentication response information according to the authentication challenge, and sends the generated authentication response information to the base station, and the base station compares the authentication response information obtained from the authentication information with the authentication response information sent by the terminal, and the comparison is performed. Next, the terminal is allowed to access to the base station. After the terminal successfully accesses, the terminal performs secure communication with the terminal through the session key information generated according to the authentication challenge information.

In the method for terminal-to-base station authentication shown in FIG. 2, when the terminal attempts to attach to the pseudo base station, the terminal determines whether to terminate the attachment according to the received base station response information.

In the embodiment of the present invention, the terminal is a CIoT terminal device.

The following describes a specific application scenario. There are a legal base station A1 and an illegal base station X1 in the vicinity of the terminal. The two base stations are in close proximity. After the terminal device accesses the A1, the legal base station acquires the authentication information and the base station response information corresponding to the terminal from the authentication center, and the illegal base station X1 intercepts. The authentication information acquired by the legal base station A1 and the base station response information are sent to the terminal, and after receiving the authentication information and the base station response information sent by the illegal base station X1, the terminal performs access to the illegal base station X1. According to the terminal access method of the embodiment of the present invention, after receiving the authentication information and the base station response information sent by the illegal base station X1, the terminal determines whether the base station identity information corresponding to the base station response information is consistent with the base station identity information detected by the terminal. The base station identity information corresponding to the base station response information is not the identity information of the base station A1. The base station identity information detected by the terminal is an illegal base station X1, which is inconsistent. Therefore, the terminal will terminate the attachment process to the illegal base station X1.

Referring to FIG. 3, an embodiment of the present invention further provides another terminal access method, where the method includes:

Step 310: The terminal sends the user identity information IMSI to the base station.

Step 320: The base station sends the base station identity information and the user identity information IMSI to the authentication center.

The step 320 may include: the base station transmitting the base station identity information and the user identity information IMSI to the SGSN; the SGSN forwarding the received base station identity information and the user identity information IMSI to the authentication center;

Step 330: The authentication center authenticates the base station and the terminal. When the authentication of the terminal passes, the authentication center generates the base station response information and the authentication information, and sets the base station response information according to the authentication result of the base station; In the case of the termination process.

The authentication center authenticates the base station and the terminal; in the case that the terminal authentication passes, the authentication center generates the base station response information and the authentication information, including: the authentication center authenticates the terminal; and when the authentication of the terminal passes, The authentication center generates the authentication information corresponding to the terminal, and the authentication center authenticates the base station; and according to the base station authentication result, sets the corresponding base station response information. The authentication of the base station and the authentication of the terminal can be performed separately.

Wherein, step 330 specifically includes:

Step 331: The authentication center authenticates the terminal.

Step 332: In the case that the authentication of the terminal is passed, the authentication center generates the authentication information corresponding to the terminal, and generates corresponding base station response information according to the authentication result of the identity information of the base station.

The base station response information includes base station identity information and base station authentication result;

The base station authentication result may be identifier information used to indicate that the base station is illegal or legal;

And generating the corresponding base station response information according to the authentication result of the base station identity information, where: when the authentication of the base station is passed, the base station authentication result carries the identifier information indicating that the base station is legal; if the authentication of the base station fails, The base station authentication result carries identification information indicating that the base station is illegal.

Wherein, in the case that the session key information includes the encryption key Ck, the authentication center performs the first processing on the base station identity information and the base station authentication result by using the encryption key Ck to obtain corresponding base station response information;

or,

In the case that the session key information includes the encryption key Ck and the integrity protection key Ik, the authentication center first performs the first processing on the base station identity information and the base station authentication result by using the encryption key Ck, and then passes the integrity protection key. Ik performs a second process on the result of the first process, thereby obtaining corresponding base station response information.

Step 340: The authentication center sends the authentication information and the base station response information to the base station.

The step 340 may specifically include: the authentication center sends the authentication information and the base station response information to the SGSN; and the SGSN receives the authentication information and the base station response information to the base station.

Step 350: The base station sends the received base station response information and the authentication challenge information in the authentication information to the terminal.

Step 360: The terminal acquires the base station authentication result carried in the authentication information according to the received authentication challenge information and the base station response information.

In one or more embodiments, the terminal acquires session key information by using the authentication challenge information. In the case that the session key information includes the encryption key Ck, the terminal performs third processing on the base station response information by using the encryption key Ck. The base station response information corresponds to the base station identity information and the base station authentication result; wherein the third process is an inverse process corresponding to the first process.

In one or more embodiments, the terminal acquires session key information by using authentication challenge information. In case the session key information includes the encryption key Ck and the integrity protection key Ik, the terminal passes the integrity protection key Ik. Performing a fourth process on the base station response information, and performing a third process on the result of the fourth process by using the encryption key Ck, to obtain the base station identity information and the base station authentication result corresponding to the base station response information; wherein the third process is the first process Processing the corresponding inverse processing, the fourth processing is An inverse process corresponding to the second process.

Step 370: The terminal detects the base station authentication result. If the base station authentication result is an illegal base station, the terminal terminates the attach process. If the base station authentication result is a legal base station, step 380 is performed.

Step 380: When the base station authentication result is a legal base station, the terminal accesses the base station.

In the method for terminal-to-base station authentication shown in FIG. 3, when the terminal attempts to attach the pseudo base station, the terminal determines whether to terminate the attachment according to the received base station authentication result information.

The processing of the authentication center in each of the above embodiments will be described below by means of a table 1. The authentication result is 1 to indicate that the authentication is passed, and 0 is the authentication failure. The process that does not pass the terminal and the base station authentication is the termination access process, which is not shown in Table 1.

Table 1 Schematic diagram of the authentication center performing different processing procedures based on the authentication result

Based on the same or similar concepts as the foregoing embodiments, the embodiment of the present invention further provides a terminal access device, which is disposed on a terminal. Referring to FIG. 4, a terminal access device according to an embodiment of the present invention includes:

The first sending unit 10 is configured to: send user identity information to the base station;

The first receiving unit 20 is configured to: receive the authentication challenge information and the base station response information that are sent by the base station;

The detecting unit 30 is configured to: detect the base station response information;

The access unit 40 is configured to: when the detection passes, access to the base station according to the authentication challenge information.

In the embodiment of the present invention, the detecting unit 30 includes at least one of the following modules:

The first detecting module is configured to: when the carrying content of the base station response information includes the identity information of the base station, the terminal acquires the identity information of the base station corresponding to the base station response information;

Determining whether the base station identity information corresponding to the base station response information is consistent with the base station identity information detected by the terminal; if not, the detection result of the base station response information is not passed; if they are consistent, the detection result of the base station response information is passed;

The second detecting module is configured to: when the carrying content of the base station response information includes the base station authentication result, obtain the base station authentication result corresponding to the base station response information, and if the base station authentication result is an illegal base station, the detection result of the base station response information is If the base station authentication result is a legal base station, the detection result of the base station response information is passed.

The first detecting module and/or the second detecting module acquires session key information by using the authentication challenge information, and obtains the carrying content of the base station response information by using the session key information.

In the embodiment of the present invention, the content of the base station response information is obtained by using the session key information. include:

In the case that the session key information includes the encryption key Ck, the base station response information is subjected to the third processing by the encryption key Ck in the session key information, and the carried content of the base station response information is obtained; wherein the third processing is Describe the inverse processing corresponding to the first processing;

In the case where the key information includes the encryption key Ck and the integrity protection key Ik, the base station response information is subjected to the fourth processing by the integrity protection key Ik in the session key information, and is passed through the session key information. The encryption key Ck performs a third process on the result of the fourth process to obtain the carried content of the base station response information; wherein the third process is an inverse process corresponding to the first process, and the fourth process is the second process Processing the corresponding inverse processing;

The first processing refers to the processing of the base station identity information or the base station authentication result by the authentication center for acquiring the base station response information by using the encryption key Ck; the second processing refers to the integrity of the authentication center for obtaining the base station response information. The protection key Ik processes the result of the first process.

Based on the same or similar concepts as the foregoing embodiments, the embodiment of the present invention further provides a terminal access device, which is disposed on an authentication center. Referring to FIG. 5, a terminal access device according to an embodiment of the present invention includes:

The second receiving unit 50 is configured to: receive base station identity information and user identity information sent by the base station;

The authentication unit 60 is configured to: perform authentication on the base station according to the identity information of the base station, and authenticate the terminal according to the identity information of the user;

The processing unit 70 is configured to generate corresponding authentication information when the authentication of the terminal passes, and send the authentication information to the base station.

In the embodiment of the present invention, the processing unit 70 includes a first processing module, configured to: perform the process of generating corresponding authentication information when the authentication of the base station passes, and fail to pass the authentication of the base station Next, terminate the access process of the terminal.

In an embodiment of the present invention, in another example, the processing unit includes any one of the following modules:

a second processing module, configured to: perform the process of generating corresponding authentication information when the authentication of the base station passes; generate base station response information, and send the base station response information To the base station; in the case that the authentication of the base station fails, the access procedure of the terminal is terminated;

The third processing module is configured to: generate base station response information, and send the base station response information to the base station; where, the corresponding base station response information is set according to the authentication result of the base station.

In the embodiment of the present invention, the authentication information includes authentication challenge information, session key information, and authentication response information;

The carried content of the base station response information generated by the second processing module includes base station identity information;

The carrying content of the base station response information generated by the third processing module includes base station identity information and a base station authentication result, where the base station authentication result includes identifier information indicating that the base station is illegal or legal;

The generating, by the second processing module and/or the third processing module, the base station response information includes:

And processing the carried content of the base station response information by using the session key information to obtain corresponding base station response information.

In the embodiment of the present invention, processing the carried content of the base station response information by using the session key information includes:

In the case that the session key information generated by the authentication center includes the encryption key Ck, the authentication center performs the first processing on the carried content of the base station response information by using the encryption key Ck to obtain the corresponding base station response information;

or,

In the case that the session key information generated by the authentication center includes the encryption key Ck and the integrity protection key Ik, the authentication center first performs the first processing on the carried content of the base station response information through the encryption key Ck, and then completes the complete processing. The sex protection key Ik performs a second process on the result of the first process, thereby obtaining base station response information corresponding to the carried content of the base station response information.

Based on the same or similar concepts as the foregoing embodiments, the embodiment of the present invention further provides a terminal access device, which is disposed on a base station. Referring to FIG. 6, a terminal access device according to an embodiment of the present invention includes:

The third receiving unit 80 is configured to: receive user identity information sent by the terminal;

The third sending unit 90 is configured to: send the base station identity information and the user identity information To the authentication center;

The third receiving unit 80 is further configured to: receive the authentication information sent by the authentication center;

The third sending unit 90 is further configured to: send the authentication challenge information in the authentication information to the terminal.

In the embodiment of the present invention,

The third receiving unit 80 is further configured to: receive an authentication center to send base station response information;

The third sending unit 90 is further configured to: send the base station response information to the terminal.

Based on the same or similar concepts as the foregoing embodiments, the embodiment of the present invention further provides a terminal, where the terminal includes any terminal access device provided on the terminal provided by the embodiment of the present invention.

Based on the same or similar concepts as the foregoing embodiments, the embodiment of the present invention further provides a base station, where the base station includes any terminal access device disposed on a base station according to an embodiment of the present invention.

Based on the same or similar concepts as the above embodiments, the embodiment of the present invention further provides an authentication center, where the authentication center includes any terminal access device provided in the authentication center provided by the embodiment of the present invention.

It should be noted that the above-mentioned embodiments are only for the purpose of facilitating the understanding of those skilled in the art, and are not intended to limit the scope of the present invention, and those skilled in the art will Any obvious substitutions and improvements made by the invention are within the scope of the invention.

The embodiment of the invention further discloses a computer program, comprising program instructions, when the program instruction is executed by the terminal, so that the terminal can perform any of the above methods for detecting wireless network access security.

The embodiment of the invention also discloses a carrier carrying the computer program.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

One of ordinary skill in the art will appreciate that all or a portion of the steps of the above-described embodiments can be implemented using a computer program flow, which can be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, System, device, device, device, etc.) In execution, one or a combination of the steps of the method embodiments is included.

In one or more embodiments, all or part of the steps of the above embodiments may also be implemented using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be made into A single integrated circuit module is implemented. Thus, the invention is not limited to any specific combination of hardware and software.

The devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Variations or substitutions are readily conceivable within the scope of the present invention by those skilled in the art and are within the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Industrial applicability

The technical solution provided by the present invention includes: the terminal sends the user identity information to the base station; the terminal receives the authentication challenge information and the base station response information sent by the base station; the terminal detects the response information of the base station, and if the detection passes, the terminal according to the authentication The challenge information is accessed into the base station. With the solution of the present invention, in the terminal access process, the authentication center authenticates the base station to which the terminal is attached, and the authentication center may decide whether to terminate the access process according to the authentication result of the base station, or may be determined by the authentication center. The authentication result of the base station is sent to the terminal, and the terminal determines whether it is connected to the base station. Through the process, the malicious base station improves the terminal connection from the legal base station to the malicious base station by means of spoofing, thereby improving the terminal connection. Security when entering the base station. Therefore, the present invention has strong industrial applicability.

Claims

A terminal access method, the method comprising:

The terminal sends the user identity information to the base station;

Receiving, by the terminal, authentication challenge information and base station response information sent by the base station;

The terminal detects the response information of the base station, and if the detection passes, the terminal accesses the base station according to the authentication challenge information.
The terminal access method according to claim 1, wherein the step of detecting, by the terminal, the base station response information comprises any one of the following:

1-1, in a case that the base station response information carries the identity information of the base station, the terminal acquires the identity information of the base station corresponding to the response information of the base station;

Determining, by the terminal, whether the identity information of the base station corresponding to the base station response information is consistent with the identity information of the base station detected by the terminal; if not, the detection fails; if yes, the detection is passed;

1-2, in a case that the base station response information carries a base station authentication result, the terminal acquires the base station authentication result corresponding to the base station response information, and if the base station authentication result indicates that the base station is an illegal base station, The detection fails; if the base station authentication result indicates that the base station is a legal base station, the detection passes;

The terminal acquires session key information by using the authentication challenge information, and obtains the base station response information by using the session key information.
The terminal access method according to claim 2, wherein the step of obtaining the base station response information by using the session key information comprises:

In the case that the session key information includes the encryption key Ck, the terminal performs a third process on the base station response information by using the encryption key Ck in the session key information to obtain a base station corresponding to the base station response information. The content of the response information;

In a case where the session key information includes an encryption key Ck and an integrity protection key Ik, the terminal performs fourth response to the base station response information by using an integrity protection key Ik in the session key information. Processing and passing the encryption key Ck in the session key information to the fourth processing As a result, the third processing is performed to obtain the carried content of the base station response information;

The first processing refers to the processing of the carrying content of the base station response information by the authentication center for acquiring the base station response information by using the encryption key Ck; the second processing means that the authentication center passes the integrity protection for acquiring the base station response information. The key Ik processes the result of the first process, the third process is an inverse process corresponding to the first process, and the fourth process is an inverse process corresponding to the second process.
A terminal access method, the method comprising:

The authentication center receives the base station identity information and the user identity information sent by the base station;

The authentication center authenticates the base station according to the identity information of the base station, and authenticates the terminal according to the user identity information;

When the authentication of the terminal passes, corresponding authentication information is generated, and the authentication information is transmitted to the base station.
The terminal access method according to claim 4, wherein after the step of authenticating the base station according to the base station identity information, the method further includes:

And performing the step of generating the corresponding authentication information when the authentication of the base station is passed;

In the case that the authentication of the base station fails, the access procedure of the terminal is terminated.
The terminal access method according to claim 4, wherein after the authentication center authenticates the base station according to the base station identity information, the method further includes:

Mode 2-1: performing the step of generating corresponding authentication information when the authentication of the base station passes, generating base station response information, and transmitting the base station response information to the base station; failing to pass the authentication of the base station In case, the access process of the terminal is terminated; or,

Mode 2-2: Generate base station response information, and send the base station response information to the base station; where, corresponding base station response information is set according to the authentication result of the base station.
The terminal access method according to claim 6, wherein the authentication information includes authentication challenge information, session key information, and authentication response information;

In the case of the mode 2-1, the carrying content of the base station response information includes base station identity information;

In the case of mode 2-2, the carrying content of the base station response information includes base station identity information. And the base station authentication result, where the base station authentication result includes identifier information indicating that the base station is illegal or legal;

The generating base station response information includes:

And processing the carried content of the base station response information by using the session key information to obtain corresponding base station response information.
The terminal access method according to claim 7, wherein processing the carried content of the base station response information by using the session key information comprises:

In the case that the session key information generated by the authentication center includes the encryption key Ck, the authentication center performs the first processing on the carried content of the base station response information by using the encryption key Ck to obtain the corresponding base station response information; or

In the case that the session key information generated by the authentication center includes the encryption key Ck and the integrity protection key Ik, the authentication center first performs the first processing on the carried content of the base station response information through the encryption key Ck, and then completes the complete processing. The sex protection key Ik performs a second process on the result of the first process, thereby obtaining base station response information corresponding to the carried content of the base station response information.
A terminal access method, the method comprising:

The base station receives user identity information sent by the terminal;

The base station sends the base station identity information and the user identity information to the authentication center.

The base station receives the authentication information sent by the authentication center;

The base station transmits the authentication challenge information in the authentication information to the terminal.
The terminal access method according to claim 9, wherein after the sending the base station identity information and the user identity information to the authentication center, the method further includes:

The base station receives the authentication center to send the base station response information;

The base station sends the base station response information to the terminal.
A terminal access device is disposed on a terminal, where the device includes: a first sending unit, a first receiving unit, a detecting unit, and an access unit, where

The first sending unit is configured to: send user identity information to a base station;

The first receiving unit is configured to: receive the authentication challenge information sent by the base station, and the base station ringing Information

The detecting unit is configured to: detect the base station response information;

The access unit is configured to: access to the base station according to the authentication challenge information if the detection passes.
The terminal access device according to claim 11, wherein the detecting unit comprises at least one of a first detecting module and a second detecting module, wherein

The first detecting module is configured to: when the carrying content of the base station response information includes the identity information of the base station, the terminal acquires the identity information of the base station corresponding to the base station response information;

Determining whether the identity information of the base station corresponding to the response information of the base station is consistent with the identity information of the base station detected by the terminal; if not, the detection fails; if they are consistent, the detection is passed;

The second detecting module is configured to: when the carrying content of the base station response information includes the base station authentication result, obtain the base station authentication result corresponding to the base station response information, and if the base station authentication result is an illegal base station, the detection fails; if the base station authenticates The result is a legal base station, and the test passes;

The first detecting module and/or the second detecting module acquires session key information by using the authentication challenge information, and obtains the carrying content of the base station response information by using the session key information.
The terminal access device according to claim 12, wherein the first detecting module and/or the second detecting module are configured to obtain the carried content of the base station response information by using the session key information as follows:

In the case that the session key information includes the encryption key Ck, the base station response information is subjected to a third process by using the encryption key Ck in the session key information to obtain the carried content of the base station response information;

In the case where the key information includes the encryption key Ck and the integrity protection key Ik, the base station response information is subjected to the fourth processing by the integrity protection key Ik in the session key information, and is passed through the session key information. The encryption key Ck performs a third processing on the result of the fourth processing to obtain the carried content of the base station response information;

The first processing refers to the processing of the base station identity information or the base station authentication result by the authentication center for acquiring the base station response information by using the encryption key Ck; the second processing refers to the integrity of the authentication center for obtaining the base station response information. The protection key Ik processes the result of the first process, wherein the third process is an inverse process corresponding to the first process, and the fourth process is the second process Process the corresponding inverse process.
A terminal access device is disposed at an authentication center, where the device includes a second receiving unit, an authentication unit, and a processing unit, where

The second receiving unit is configured to: receive base station identity information and user identity information sent by the base station;

The authentication unit is configured to: perform authentication on the base station according to the identity information of the base station, and perform authentication on the terminal according to the identity information of the user;

The processing unit is configured to: when the authentication of the terminal passes, generate corresponding authentication information, and send the authentication information to the base station.
The terminal access device according to claim 14, wherein the processing unit comprises a first processing module, configured to: execute the process of generating corresponding authentication information in the case that the authentication of the base station is passed; If the authentication of the base station fails, the access procedure of the terminal is terminated.
The terminal access device according to claim 14, wherein the processing unit comprises any one of a second processing module and a third processing module, wherein

The second processing module is configured to: perform the process of generating corresponding authentication information when the authentication of the base station passes; generate base station response information, and send the base station response information to the base station; If the authentication fails, the terminal access process is terminated;

The third processing module is configured to: generate base station response information, and send the base station response information to the base station; wherein, the corresponding base station response information is set according to the authentication result of the base station.
The terminal access device according to claim 16, wherein the authentication information includes authentication challenge information, session key information, and authentication response information;

The carried content of the base station response information generated by the second processing module includes base station identity information;

The content of the base station response information generated by the third processing module includes the base station identity information and the base station authentication result, where the base station authentication result includes identifier information indicating that the base station is illegal or legal;

The second processing module and/or the third processing module are configured to generate base station response information as follows:

And processing the carried content of the base station response information by using the session key information to obtain corresponding base station response information.
The terminal access device according to claim 17, wherein the second processing module and/or the third processing module are configured to process the carried content of the base station response information by the session key information as follows:

In the case that the session key information generated by the authentication center includes the encryption key Ck, the authentication center performs the first processing on the carried content of the base station response information by using the encryption key Ck to obtain the corresponding base station response information; or

In the case that the session key information generated by the authentication center includes the encryption key Ck and the integrity protection key Ik, the authentication center first performs the first processing on the carried content of the base station response information through the encryption key Ck, and then completes the complete processing. The sex protection key Ik performs a second process on the result of the first process, thereby obtaining base station response information corresponding to the carried content of the base station response information.
A terminal access device is disposed at a base station, where the device includes: a third receiving unit and a third sending unit, where

The third receiving unit is configured to: receive user identity information sent by the terminal;

The third sending unit is configured to: send the base station identity information and the user identity information to the authentication center;

The third receiving unit is further configured to: receive authentication information sent by the authentication center;

The third sending unit is further configured to: send the authentication challenge information in the authentication information to the terminal.
The terminal access device according to claim 19, wherein

The third receiving unit is further configured to: receive base station response information sent by the authentication center;

The third sending unit is further configured to: send the base station response information to the terminal.