CN101355763B

CN101355763B - Terminal authentification system, terminal authentification method

Info

Publication number: CN101355763B
Application number: CN2008101443143A
Authority: CN
Inventors: 大谷太郎
Original assignee: Kyocera Corp
Current assignee: Kyocera Corp
Priority date: 2007-07-25
Filing date: 2008-07-25
Publication date: 2012-03-07
Anticipated expiration: 2028-07-25
Also published as: CN101355763A; JP2009033320A

Abstract

The invention provides an authentication method, an authentication system, a terminal and a server used therein. This authentication system is an authentication system for a terminal used in a wireless communication system that accesses a server from a terminal via a base station, and the terminal includes: a first encryption unit that encrypts part of data transmitted from the terminal with a common key Encryption to generate first encrypted data; a second encryption unit to change the code sequence order of the first encrypted data to generate second encrypted data; and a transmission data generation unit to add the first encrypted data to the data Two encrypted data to generate sent data, the server includes: a decryption unit, which restores the code sequence of the second encrypted data sent from the terminal and attached to the sent data to the original state, and uses the general a key to perform decryption; and a data discarding unit that discards data received from the terminal if the decrypted data is inappropriate.

Description

The Verification System at terminal and the authentication method at terminal

Technical field

The illegal use that the present invention relates to the terminal prevents method, especially only allows to send data to the terminal that allows from the wireless communication system that the terminal conducts interviews to server via the base station to use.

Background technology

As this technology; Give two kinds of ID numberings that are called as MIN (Mobile Identification Number) and ESN (Electronic SerialNumber) to the mobile telephone terminal (portable telephone terminal, automobile telephone terminal) of AMPS (the Advanced MobilePhone System) mode of uses such as North America or Australia, and the ID numbering is stored in the built-in EEPROM nonvolatile memories such as (ElectricErasable Programmable Read Only Memory).

MIN is equivalent to telephone number, and ESN is equivalent to make numbering.Under situation about calling; Send these two ID codes by mobile telephone terminal to network; Whether register the group of these two ID codes in the network terminal inspection; Only have and establish the talk path of dialling between hitter and the those who answer under the situation of these two codes, become according to air time, speech range to dialling the structure that the hitter collects the charges in registration.

But, also have following situation: illegally obtain the MIN and the ESN of in esse validated user, these MIN and ESN are write the EEPROM of other mobile telephone terminals and illegally communicate.In the communication process of the illegal use of this mobile telephone terminal, almost can't handle at the switch end, produce the problem of original user being collected the circuit usage charges.

Solution countermeasure as the problems referred to above; Known: the illegal use of the mobile telephone terminal in a kind of GSM prevents method; The 2nd ID codes such as an ID code that installs identification usefulness and telephone number are stored in the nonvolatile memory of mobile telephone terminal in advance; During communication these ID codes are sent to network, judge whether to register the group of first, second code, have in registration under the situation of these code-group to allow communication in network terminal; It is characterized in that; When first code is write the nonvolatile memory of mobile telephone terminal, in the writing station side mobile telephone terminal is encrypted and be input to first code, the nonvolatile memory that writes direct of first code after mobile telephone terminal will be encrypted; During communication first code after this encryption is deciphered, first code that obtains is sent to network (with reference to patent documentation 1) with second code.

No. 2902249 specification of [patent documentation 1] Japan Patent

The illegal use at prior mobile phone terminal prevents method, owing to be to prevent the illegal mode of using through specific cipher mode, so can be general in the wireless communication system that adopts the cipher mode identical with the cipher mode of this mobile telephone terminal.

Therefore; In a state (or region); Will with the same wireless communication system of the wireless communication system that has adopted (first wireless communication system) under the situation that other countries (or region) expand; Terminal as in second wireless communication system of new expansion, allowing to use can't be limited in the use at used terminal in first wireless communication system.

Summary of the invention

Problem of the present invention (purpose) is; A kind of authentication method, Verification System are provided, are used for wherein terminal and server; Promptly as the terminal that can use in second wireless communication system of first wireless communication system that has adopted the particular encryption mode in order to prevent illegal use (not permitting the use at terminal) and the identical cipher mode of employing, can limit the use at the terminal that only allows in above-mentioned first wireless communication system, to use.

In order to solve above-mentioned problem, Verification System of the present invention is the Verification System at the terminal of from the wireless communication system that the terminal conducts interviews to server, using via the base station, it is characterized in that,

Said terminal comprises:

First ciphering unit, it is encrypted the part of the data of sending from this terminal with universal key, generates first enciphered data;

Second ciphering unit, its code column to said first enciphered data changes in proper order, to generate second enciphered data; With

Send data generating unit, they are additional said second enciphered data on said data, sends data to generate,

Said server comprises:

Decryption unit, the code column order recovery original state that is attached to said second enciphered data on the said transmission data that it will send from said terminal is carried out deciphering with said universal key; With

Data are discarded the unit, and it discards the data that receive from the terminal under the unsuitable situation of the data after the said deciphering.(technical scheme 1)

Have, be characterised in that, said wireless communication system refusal is from the visit that only possesses with the terminal of general first ciphering unit of existing wireless communication system.(technical scheme 2)

And then, be characterised in that said second ciphering unit begins to be attached on the said data according to first enciphered data of opposite order after with said encryption from last bit.(technical scheme 3)

Also have, authentication method of the present invention is the authentication method at the terminal of from the wireless communication system that the terminal conducts interviews to server, using via the base station, it is characterized in that this authentication method comprises:

In said terminal, with universal key the part of the data of sending from this terminal is encrypted, generate the step of first enciphered data;

Code column to said first enciphered data changes in proper order, to generate the generation step of second enciphered data;

Additional said second enciphered data on said data, with the step of generation transmission data,

In said server, the code column order recovery original state that is attached to said second enciphered data on the said transmission data that will receive from said terminal is carried out the step of deciphering with said universal key; With

Under the unsuitable situation of the data after the said deciphering, the step of the discarded data that receive from the terminal.(technical scheme 4)

Have, terminal of the present invention is the terminal of from the wireless communication system that the terminal conducts interviews to server, using via the base station, it is characterized in that, comprising again:

Send data generating unit, they are additional said second enciphered data that has been changed said code column order on said data.(technical scheme 5)

Also have, server of the present invention is the server that from the wireless communication system that the terminal conducts interviews to server, uses via the base station, it is characterized in that this server comprises:

Decryption unit, the code column order recovery original state that is attached to the enciphered data on the transmission data that it will send from said terminal is carried out deciphering with universal key; With

Data are discarded the unit, and it discards the data that receive from the terminal under the unsuitable situation of the data after the said deciphering.

According to authentication method of the present invention, Verification System, be used for wherein terminal and server; As the terminal that in first wireless communication system that has adopted the particular encryption mode in order to prevent illegal use (not permitting the use at terminal) and second wireless communication system that adopts identical cipher mode, can use, can limit the use at the terminal that only allows in above-mentioned first wireless communication system, to use.

Description of drawings

Fig. 1 is used to explain the function constitution map that has adopted the wireless communication system of new particular encryption mode for the illegal use (not permitting the use at terminal) that prevents terminal of the present invention.

Fig. 2 is the sequence chart that the handling process between terminal, base station and the server in the wireless communication system of Verification System (authentication method) at terminal of the present invention has been used in expression.

Among the figure: 1-universal key, 2-data (send data, receive data), 3-ciphering unit (encrypt, decipher), 4-code column order conversion (listed sequence change, listed sequence restore), 5-encrypting messages.

Embodiment

Before the Verification System (authentication method) to terminal of the present invention describes, the existing wireless communication system that has adopted the particular encryption mode for the illegal use (not permitting the use at terminal) that prevents the terminal is divided into end side handles that processing describes with server side.

At first,, utilize the known ciphering unit of a part (for example 16 bytes) of sending data being encrypted with one's own universal key to generate encrypting messages, and send to server after this encrypting messages being attached to the end of above-mentioned transmission data in end side.

At server side; With one's own universal key the additional encrypting messages in reception data end that receives from the terminal is deciphered; Whether judgement comes the data of self terminal correct; At (terminal be regular and the situation at the terminal that is allowed under) under the situation correct, allow later data communication from terminal data.

Have again, in (terminal be not regular and the situation at the terminal that is allowed under) under the incorrect situation of data, discarded received data.

Then, utilize Fig. 1 that the Verification System (authentication method) at terminal of the present invention is described.

Fig. 1 is used to explain the function constitution map that has adopted the wireless communication system of new particular encryption mode for the illegal use (not permitting the terminal to use) that prevents the terminal of the present invention.

In Fig. 1, be divided into and constitute that the terminal of wireless communication system side is handled and server side is handled and put down in writing.

At first; In end side; 1 pair of part (for example 16 bytes) of sending data 2 of universal key so that known ciphering unit 3-1 is had is encrypted; Generate encrypting messages (first enciphered data) 5, the code column of this encrypting messages is attached to the end of data in proper order after changing and sends to server with listed sequence change unit 4-1.

At server side; After the code column that will be added from the data end that the terminal receives with listed sequence restoration unit 4-2 changes the code column order recovery original state of data 5 in proper order; Universal key 1 with decryption unit 3-2 is had is deciphered; Whether judgement is correct from terminal data, at (terminal be regular and the situation at the terminal that is allowed under) under the correct situation of the data of coming self terminal, allows later data communication.

In the present invention; As stated; Through carrying out as the known encryption method of first encryption and as the change of the code column order of second encryption; Thereby, can limit the use at the terminal that only allows in above-mentioned first wireless communication system, to use as the terminal that in first wireless communication system that has adopted the particular encryption mode in order to prevent illegal use (not permitting the use at terminal) and second wireless communication system that adopts identical cipher mode, can use.

In addition, second encryption is because only change the code column order of the encrypting messages that first encryption obtains, so can realize with simple structure.

Have, the change of the code column order of encrypting messages is not just upset for example again, can carry out the various changes that begin from the code column assigned position in proper order of encrypting messages.

Then, the sequence chart of utilizing Fig. 2 describes the handling process between terminal, base station and server in the wireless communication system of the Verification System (authentication method) of having used terminal of the present invention.

Between terminal and base station, carry out the link connecting moves.(step S1)

If link is connected, then send connection to the base station and begin request (BIND) from the terminal.(step S2)

In the base station, begin request (BIND), link connecting moves between base station and server according to connection.(step S3)

If link is connected, then send connection to server and begin request (BIND) from the base station.(step S4)

Begin request (BIND) according to connection from the base station, via the base station from server to the terminal send to connect begin to confirm (" success ") (+RSP).(step S5, S6)

Then, as shown in Figure 1, send the data at the place, end that changes encrypting messages code column order and be attached to data to server via the base station.(step S7)

In server, the code column that is additional to the data end is changed in proper order the code column order recovery original state of data after, decipher with one's own universal key, judge the data of self terminal whether correct.(step S8)

In (terminal be not regular and the situation at the terminal that is allowed under) under the situation that is judged as ERROR of step S8, the discarded data that receive.(step S9)

At (terminal be regular and the situation at the terminal that is allowed under) under the situation that is judged as OK of step S8, allow later data communication.(step S10)

In above-mentioned explanation; Explained: the Verification System at terminal of the present invention (authentication method) is in a state (or region); Will with the same wireless communication system of the wireless communication system that has adopted (first wireless communication system) under the situation that other countries (or region) expand; As the terminal that in second wireless communication system of new expansion, allows to use; Be limited in the use at used terminal in first wireless communication system, but first wireless communication system and second wireless communication system also can be the systems that is applicable to same region, also can be made as the wireless communication system and the hard-core wireless communication system that on the function at terminal, limit.

Have again; As the terminal of in wireless communication system of the present invention, using; Also can manufacture the terminal that possesses first ciphering unit and the second ciphering unit both sides function; First ciphering unit wherein, it is encrypted the part of the data of sending from this terminal with universal key, to generate encrypting messages; Second ciphering unit, the code column of its message after to said encryption changes in proper order, stops the second ciphering unit function when dispatching from the factory etc. and only possesses first ciphering unit.

Claims

1. An authentication system for a terminal, which is an authentication system for a terminal used in a wireless communication system in which a terminal accesses a server via a base station,

The terminals include:

a first encryption unit that encrypts a part of the data sent from the terminal with a common key to generate first encrypted data;

a second encryption unit that changes the sequence of code columns of the first encrypted data to generate second encrypted data; and

a sending data generating unit that adds the second encrypted data to the data to generate sending data,

The servers include:

a decryption unit that restores the code sequence of the second encrypted data appended to the transmission data sent from the terminal, and performs decryption using the common key; and

A data discarding unit discards the data received from the terminal when the decrypted data is inappropriate.

2. The terminal authentication system according to claim 1, characterized in that,

The wireless communication system denies access from a terminal provided only with a first encryption unit common to existing wireless communication systems.

3. The terminal authentication system according to claim 1 or 2, characterized in that,

The second encryption unit appends the encrypted first encrypted data to the data in reverse order starting from the last bit.

4. An authentication method for a terminal, which is an authentication method for a terminal used in a wireless communication system in which a terminal accesses a server via a base station, the authentication method comprising:

In the terminal, encrypting a part of the data sent from the terminal with a common key to generate first encrypted data;

The step of changing the sequence of code columns of the first encrypted data to generate the second encrypted data;

adding the second encrypted data to the data to generate the sending data,

In the server, restoring the sequence of the code sequence of the second encrypted data attached to the transmission data received from the terminal to the original state, and performing a decryption step using the common key; and

The step of discarding the data received from the terminal when the decrypted data is inappropriate.