CN101466096A - Method and system for triggering synchronous failure of authentication process - Google Patents

Abstract

The invention discloses a synchronous failed method of triggering authentication process, which comprises: an indexed (IND) value to be sent down is calculated according to serial number (SQN) obtained by twice triggering authentication flow; the serial-number SEQ value corresponding to the IND in a universal subscriber identification module (USIM) file in a mobile station can be modified according to the calculated IND value; and the authentication flow synchronous failure can be obtained in the third triggering authentication flow. The invention also discloses a synchronous failed system of triggering authentication process. Adopting the method and the system can realize a test that the triggering authentication flow is failed due to synchronous failure.

Description

A kind of method and system that trigger synchronous failure of authentication process

Technical field

The present invention relates to the authentication measuring technology in the mobile communication system, be meant a kind of especially triggering the method and system that synchronous failure of authentication process is tested.

Background technology

In mobile communication system, no matter be the second generation (2G) or the third generation (3G) system, when travelling carriage (MS) is done the position renewal or is made a call in start, all need to carry out earlier authentication, after authentication, system thinks that validated user just provides service, provides service to illegal custom system refusal.In the 2G system, mainly be that network carries out authentication to the user; And in the 3G system, not only comprise the authentication of network to the user, also comprise the authentication of user simultaneously to network.

In the prior art, the basic authorizing procedure of 2G and 3G system mainly comprises four processes as shown in Figure 1, with user start in the 3G system and successfully carry out IMSI International Mobile Subscriber Identity to adhere to the position updating process of (IMSIATTACH) be example, concrete authentication process process comprises:

Step 101: mobile switching centre's (service universal grouping wireless business supporting node)/VLR Visitor Location Register is (after MSC (SGSN)/VLR) receives the message of mobile platform started by the IU mouth, judge according to IMSI number whether this user is new user, if new user, then initiate to get authentication collection request message Authentication Data Request, carry IMSI number of user in this request message to attaching position register/AUC (HLR/AUC).

After step 102:HLR/AUC receives Authentication Data Request message, can return to MSC (SGSN) and get authentication collection response message Authentication Data Response, carry the good a series of authentication parameter groups of ordering in this response message.

Here, if the 2G system, each authentication parameter group is a tlv triple, comprises random number (RAND), symbol response (SRES), key (KC); If the 3G system, each authentication parameter group is a five-tuple, comprises network challenge nonce (RAND), user answer desired value (XRES), encryption key (CK), Integrity Key (IK), network identity affirmation mark (AUTN).

After step 103:MSC (SGSN) receives response message, therefrom take out and come top one group of authentication parameter, wherein RAND and AUTN be carried among the subscription authentication request message User AuthenticationRequest send to MS, the key identification code (KSI) that is used for identifying CK and IK in this authentication group of simultaneously, carrying in User Authentication Request message also that MSC (SGSN) produces.

After step 104:MS receives User Authentication Request message, carry out the checking of AUTN earlier, in fact this is the authentication process of MS to service network, if be proved to be successful, MS can carry out the calculating of RES, CK, IK, CK wherein and IK and the KSI that receives store together, and form a safe context; Afterwards, MS can be carried at RES among the subscription authentication response message User Authentication Response and return MSC (SGSN).If MS fails to network authentication, then can send subscription authentication refuse information User Authentication Reject to MSC (SGSN).

From above-mentioned flow process as can be seen, the authentication ciphering and the 2G of 3G subscription are similar, and the authentication collection of different is 2G is a tlv triple, and the authentication collection of 3G is a five-tuple, 3G authentication and 2G maximum be not both an AUTN value many, AUTN is used for travelling carriage network is carried out authentication.In the 3GPP agreement, AUTN is defined as:

$\mathrm{AUTN}=\mathrm{SQN}\⊕\mathrm{AK}\left|\right|\mathrm{AMF}\left|\right|\mathrm{MAC}$

Wherein, SQN is a sequence number, is made of SQN=SEQ ‖ IND serial number class value (SEQ) and call number (IND); AK is Anonymity Key (Anonymity Key); AMF is authentication management field (AuthenticationManagement Field); MAC is message authentication code (Message Authentication Code).

Reaching by SQN synchronously of MS and network, in the 3GPP agreement, provided the generation principle of SEQ, IND, SQN respectively, each core net producer specifically how to realize determining by each producer oneself synchronously, so the realization mechanism of each producer also is not quite similar as long as under the principle of regulation.

In the prior art, test for authentication process, though in rower, test item is had clearly regulation, fail as authentication process, failure cause is a synchronization failure (SYNCH Failure) etc., still, specifically how to carry out the test of authentication process failure, how realizing triggering authentication process failure and failure cause is the test of synchronization failure, still unexposed at present corresponding test method.

Summary of the invention

In view of this, main purpose of the present invention is to provide a kind of method and system that trigger synchronous failure of authentication process, and can realize triggering authentication process failure and failure cause is the test of synchronization failure.

For achieving the above object, technical scheme of the present invention is achieved in that

The invention provides a kind of method that triggers synchronous failure of authentication process, comprising:

Trigger the sequence number SQN that authorizing procedure obtains according to twice, calculate the call number IND value that core net will issue, and according to the sequence number SEQ value of IND correspondence described in the IND value modification travelling carriage USIM USIM file that calculates; Trigger authorizing procedure for the third time, obtain the authorizing procedure synchronization failure.

Wherein, described triggering authorizing procedure is by starting travelling carriage and trigger or by initiating that circuit domain or packet switch domain service trigger or by carrying out the triggering of adhering to of GPRS.

In the such scheme, the described SQN of obtaining is for to obtain from the USIM file of travelling carriage self.The IND value that described calculating will issue is specially: calculate the added value of IND value earlier according to the SQN of twice acquisition, calculate previous IND value again and add the above added value sum, with described and mould 32, obtain the IND value that core net will issue afterwards.Wherein, described modification SEQ value is specially: the value that the corresponding SEQ value of IND value that will issue in the travelling carriage USIM file is revised as the SEQ value that will issue greater than core net; Perhaps, be revised as the value of 28 powers of the SEQ value little 2 that will issue next time than core net.

The described authorizing procedure synchronization failure that obtains is specially: travelling carriage compares SQN and the amended SEQ value that core net issues for the third time, if the SQN that core net issues for the third time is less than amended SEQ value or than 28 powers of amended SEQ value big 2, then travelling carriage returns failed authentication to core net, and failure cause is a synchronization failure.

In the such scheme, behind the failed authentication, this method further comprises: travelling carriage reports the authentication synchronization failure to core net, wherein carries the SQN of current mobile station side, core net is calculated new SQN according to the SQN that reports in the travelling carriage synchronization failure and is issued, and triggers the secondary authentication process.

The present invention also provides a kind of system that triggers synchronous failure of authentication process, comprises travelling carriage and core net, comprises authentication process trigger module, parameter acquisition module, parameter calculating module, parameter modification module, parameter comparison module in the travelling carriage; Wherein,

The authentication process trigger module is used to trigger authorizing procedure;

Parameter acquisition module is used to obtain that core net issues comprises SQN in interior parameter;

Parameter calculating module is calculated the protocol parameter that uses in the core net authentication arithmetic according to the SQN that obtains, and calculates the IND value that core net will issue;

The parameter modification module is revised its corresponding SEQ value according to the IND value that parameter calculating module calculates;

The parameter comparison module is used for the SEQ value that current SQN that issues of comparison core net and parameter modification module are revised, and confirms whether authentication process fails.

Described core net further comprises secondary authentication trigger module, calculates new SQN according to the SQN that reports in the travelling carriage synchronization failure and issues, and triggers the secondary authentication process.

The method and system of triggering synchronous failure of authentication process provided by the present invention, by revising the authentication parameter in travelling carriage USIM (USIM) file, the authentication parameter value that makes travelling carriage and network side is not within the framework of the agreement, realization is to the triggering of synchronization failure authorizing procedure, the method need not to revise the authentication arithmetic of mobile phone or core net, in the Web-compatible property testing, do not need to make the test item that special beta version supported to trigger the authentication process failure originally, realize simple, convenient, flexible.In addition, can also in the interoperability test (IOT, Inter-Operability Test) of wireless access system and core net, be used for further verifying whether core net supports the secondary authentication.

Description of drawings

Fig. 1 is the realization flow schematic diagram of authentication in the prior art;

Fig. 2 is the realization flow schematic diagram of the inventive method one embodiment.

Embodiment

Because travelling carriage and network realizes by SQN synchronously at present, based on this, basic thought of the present invention is: trigger the SQN that authorizing procedure obtains core net by twice, revise authentication parameter in the travelling carriage USIM file according to the SQN that obtains again, realize the triggering to the synchronization failure authorizing procedure.Concrete, revise authentication parameter for revising the SEQ value of SQN.

Here, described triggering authorizing procedure can be by starting that travelling carriage triggers or by initiating that circuit domain or packet switch domain service trigger or by carrying out the triggering of adhering to of GPRS.

Fig. 2 triggers the authorizing procedure failure for one embodiment of the invention and failure cause is the process of synchronization failure, in the present embodiment, triggers authorizing procedure and triggers by starting travelling carriage, and as shown in Figure 2, the concrete processing procedure of present embodiment may further comprise the steps:

Step 201: the startup travelling carriage carries out IMSI and adheres to, and triggers authentication process.

Here, when described travelling carriage is mobile phone, starts travelling carriage and start shooting exactly.Be that mobile phone is an example hereinafter with travelling carriage.

Step 202: check SQN array in the mobile phone USIM file, obtain the up-to-date SQN that core net is handed down to mobile phone.

Each mobile phone all includes the USIM file at self, stores security-related information in the USIM file, as IMSI information, SQN information, keyword (key) information, operation (op) information etc.; Also store the information relevant, as Temporary Mobile (TMSI) information, packet domain Temporary Mobile (PTMSI) information, Location Area Identification (LAI) number etc. with mobile management; Also has wireless network parameter information, as frequency and code word etc.; And other information.Among the present invention, relate generally to SQN information, SQN information generally is that core net calculates by a series of complicated algorithms, and by authentication request message the SQN that calculates directly is handed down to mobile phone when mobile phone power-on is registered or adhered to.

Step 203: after the shutdown again start carry out IMSI and adhere to, trigger authentication process once more, obtain the SQN that core net is handed down to mobile phone once more.

Step 204: mobile phone calculates the protocol parameter that uses in the core net authentication arithmetic according to the SQN that core net issues for twice.

In this step, described calculate protocol parameter be exactly obtain the SEQ value of current SQN and next time core net issue the added value of IND value on previous IND value basis that SEQ will use.

Because SQN is actual is the array of one 32 dimension, by SEQ[0], SEQ[1] ... SEQ[31] form, and according to the agreement regulation, the SEQ value that core net issues increases progressively.Therefore, the process of specifically calculating the IND added value is like this:

After start triggers authentication process for the first time, find the maximum of current SEQ in the mobile phone USIM file earlier, suppose it is SEQ[3], its value is 100; After shutdown was started shooting and triggered authentication process, core net issued new SEQ value, in like manner finds the maximum of SEQ in the mobile phone USIM file, supposes it is SEQ[8], its value is 101, the added value of IND value is 5 so, subtracts subscript 3 by subscript 8 and obtains.Like this, can know that the IND value among the SQN that core net issues next time will be 13, based on this, revise the SQN in the mobile phone USIM file, promptly revise SEQ[13], suppose that original value is 80, can change 1000 into, be generally to guarantee to trigger big a lot of value can be set, when core net issues SQN next time, because SEQ[13 wherein] value be far smaller than 1000, mobile phone will report failed authentication to core net.

Step 205: the call number IND that calculates the SQN that core net will issue next time;

In this step, definition according to the 3GPP agreement, next IND value is that previous IND value adds one less than 32 value, obtain behind the mould 32 then, wherein, the value less than 32 that increases on previous IND basis is exactly the value of calculating in the step 204, can obtain the value of the next IND that core net will issue based on this.

Step 206: the IND value that the core net that mobile phone calculates according to step 205 will issue next time, revise the SEQ value that is designated as the IND value that core net will issue in self USIM file SQN array down, and the assurance analog value SEQ value that will issue next time greater than core net; Perhaps, 28 powers of the analog value SEQ value little 2 that will issue next time than core net.

Here, the actual value that will descend the less important SEQ value that issues to be revised as the criterion of regulation in the discontented football association view exactly, thus authentication process is failed and failure cause is a synchronization failure when making the next time start.Specifically, according to the agreement regulation, if less than, need little a lot, agreement regulation be little 2 28 powers, and the SEQ value can not be negative, so, unless the SEQ value that issues surpass 2 28 powers just can be revised as less than, as long as generally be revised as, how much do not require greatly greater than just passable.And, because modification is the SEQ value, directly have influence on SQN, make mobile phone and network because SQN is inconsistent and asynchronous.

Step 207: start is for the third time carried out IMSI and is adhered to after the shutdown, trigger authentication process for the third time, at this moment, because when new SQN that core net is issued for the third time and the amended SEQ value of step 206 compare, therefore the new SQN that core net issues for the third time, confirms to trigger the authentication synchronization failure according to the regulation of agreement just in time less than amended SEQ value in the step 206, that is to say that authentication process failure and failure cause are synchronization failure.

Further, after step 207, mobile phone can report the authentication synchronization failure to core net, wherein carry the SQN of current phone side, if core net is supported the secondary authentication, core net will generate new SQN in AUC according to the SQN that reports in the mobile phone synchronization failure and issue, and then realize the secondary authentication.Therefore, utilize this flow process further the test core net whether support the secondary authentication.Here, specifically how generating new SQN belongs to prior art, does not repeat them here.

For realizing said method, the present invention provides a kind of system that triggers synchronous failure of authentication process simultaneously, comprise travelling carriage and core net, comprise authentication process trigger module, parameter acquisition module, parameter calculating module, parameter modification module, parameter comparison module in the travelling carriage, wherein, the authentication process trigger module is used to trigger authorizing procedure; Parameter acquisition module is used to obtain the parameters such as SQN that core net issues; Parameter calculating module is calculated the protocol parameter that uses in the core net authentication arithmetic according to the SQN that obtains for twice, calculates the IND value that core net will issue; The parameter modification module is revised its corresponding SEQ value according to the IND value that parameter calculating module calculates; The parameter comparison module is used for the SEQ value of current SQN that issues of comparison core net and the modification of parameter modification module, confirms whether authentication process fails.

Further, core net can also comprise secondary authentication trigger module, calculates new SQN according to the SQN that reports in the travelling carriage synchronization failure and issues, and triggers the secondary authentication process.

The above is preferred embodiment of the present invention only, is not to be used to limit protection scope of the present invention.

Claims (9)

1, a kind of method that triggers synchronous failure of authentication process is characterized in that, this method comprises:

Trigger the sequence number SQN that authorizing procedure obtains according to twice, calculate the call number IND value that core net will issue, and according to the sequence number SEQ value of IND correspondence described in the IND value modification travelling carriage USIM USIM file that calculates; Trigger authorizing procedure for the third time, obtain the authorizing procedure synchronization failure.

2, method according to claim 1 is characterized in that, described triggering authorizing procedure is by starting travelling carriage and trigger or by initiating that circuit domain or packet switch domain service trigger or by carrying out the triggering of adhering to of GPRS.

3, method according to claim 1 and 2 is characterized in that, the described SQN of obtaining is for to obtain from the USIM file of travelling carriage self.

4, method according to claim 1 and 2, it is characterized in that, the IND value that described calculating will issue is specially: the added value of calculating the IND value earlier according to the SQN of twice acquisition, calculate previous IND value again and add the above added value sum, with described and mould 32, obtain the IND value that core net will issue afterwards.

5, method according to claim 4 is characterized in that, described modification SEQ value is specially: the value that the corresponding SEQ value of IND value that will issue in the travelling carriage USIM file is revised as the SEQ value that will issue greater than core net; Perhaps, be revised as the value of 28 powers of the SEQ value little 2 that will issue next time than core net.

6, method according to claim 5, it is characterized in that, the described authorizing procedure synchronization failure that obtains is specially: travelling carriage compares SQN and the amended SEQ value that core net issues for the third time, if the SQN that core net issues for the third time is less than amended SEQ value or than 28 powers of amended SEQ value big 2, then travelling carriage returns failed authentication to core net, and failure cause is a synchronization failure.

7, method according to claim 1 and 2, it is characterized in that, behind the failed authentication, this method further comprises: travelling carriage reports the authentication synchronization failure to core net, wherein carry the SQN of current mobile station side, core net is calculated new SQN according to the SQN that reports in the travelling carriage synchronization failure and is issued, and triggers the secondary authentication process.

8, a kind of system that triggers synchronous failure of authentication process comprises travelling carriage and core net, it is characterized in that, comprises authentication process trigger module, parameter acquisition module, parameter calculating module, parameter modification module, parameter comparison module in the travelling carriage; Wherein,

The authentication process trigger module is used to trigger authorizing procedure;

Parameter acquisition module is used to obtain that core net issues comprises SQN in interior parameter;

Parameter calculating module is calculated the protocol parameter that uses in the core net authentication arithmetic according to the SQN that obtains, and calculates the IND value that core net will issue;

The parameter modification module is revised its corresponding SEQ value according to the IND value that parameter calculating module calculates;

The parameter comparison module is used for the SEQ value that current SQN that issues of comparison core net and parameter modification module are revised, and confirms whether authentication process fails.

9, system according to claim 8 is characterized in that, described core net further comprises secondary authentication trigger module, calculates new SQN according to the SQN that reports in the travelling carriage synchronization failure and issues, and triggers the secondary authentication process.

Images