CN118200912A - Authentication method, authentication device, authentication equipment and readable storage medium - Google Patents

Abstract

The application discloses an authentication method, an authentication device, authentication equipment and a readable storage medium, and relates to the technical field of communication so as to reduce data processing time delay. The method comprises the following steps: generating an authentication vector which is obtained by calculation by using the symmetric key EK generated in the registration stage; and sending the authentication vector to the terminal. The embodiment of the application can reduce the data processing time delay.

Description

Authentication method, device, equipment and readable storage medium

Technical Field

The present application relates to the field of communication technology, and in particular to an authentication method, apparatus, device and readable storage medium.

Background technique

In the authentication system of mobile communication systems, the 5G-AKA (Authentication and Key Agreement) authentication used in the 5G system increases the control of the home network over authentication. In a 5G-AKA link attack, the attacker uses the authentication vector to launch a link attack on all UEs (User Equipment) in the attack area. The target UE will be identified by the attacker due to its unique response, which will have an adverse impact on the security of the target UE.

In response to the above-mentioned 5G-AKA link attack, in the prior art solution, the UE (User Equip) side and the HN (Home network) side added the steps of encrypting and decrypting the authentication vector to ensure the security of the UE. However, this method also increases the delay of data processing.

Summary of the invention

Embodiments of the present application provide an authentication method, apparatus, device, and readable storage medium to reduce data processing delay.

In a first aspect, an embodiment of the present application provides an authentication method, which is applied to an HN, including:

Generate an authentication vector, where the authentication vector is calculated using the symmetric key EK generated during the registration phase;

The authentication vector is sent to the terminal.

Optionally, the authentication vector includes: a four-tuple formed by RAND (random number), AUTN (Authentication Token), HXRES (Hash eXpected RESponse), and Kseaf (anchor key); wherein,

AUTN includes parameters CONC and MAC (Message Authentication Code) value; the CONC is calculated based on AK (Anonymity Key) and the sequence number SQN _HN of HN, and the AK is calculated using the symmetric key EK and the RAND;

HXRES is a hash value of RAND and XRES (Expected Response), where XRES is calculated based on RAND and a shared key k.

Optionally, the symmetric key EK is generated in the following manner:

Obtaining a public key of the terminal;

A key data string K is generated according to the public key of the terminal and the private key of the HN, wherein the bytes starting from the leftmost side of the key data string K and having a key length enckeylen as the length are the symmetric key EK.

Optionally, the method further includes:

Instruction information from the terminal is received, where the instruction information is used to instruct the HN to obtain the authentication vector using the symmetric key EK.

In a second aspect, an embodiment of the present application provides an authentication method, which is applied to a terminal, including:

Obtaining an authentication vector of the HN, where the authentication vector is calculated by the HN using the symmetric key EK generated during the registration phase;

Authentication is performed according to the authentication vector and the symmetric key EK.

Optionally, the authentication vector includes: a four-tuple formed by RAND, AUTN, HXRES, and Kseaf; wherein,

AUTN includes CONC and MAC values; the CONC is calculated based on the sequence number SQN _HN of AK and HN, and the AK is calculated using the symmetric key EK and the RAND;

HXRES is a hash value of RAND and XRES, where XRES is calculated based on RAND and a shared key k.

Optionally, the performing authentication according to the authentication vector and the symmetric key EK includes:

Splitting the AUTN into CONC and MAC values;

Calculate AK based on the RAND and the symmetric key EK;

Calculate SQN _HN according to the AK and the CONC;

The xMAC value is calculated based on the shared key k, SQN _HN and RAND;

Authentication is performed based on the xMAC value and the MAC value.

Optionally, the symmetric key EK is generated in the following manner:

Generate a public-private key pair;

A key data string K is generated according to the private key of the terminal and the public key of the HN, wherein the bytes starting from the leftmost side of the key data string K and having a key length enckeylen as the length are the symmetric key EK.

Optionally, the method further includes:

Sending instruction information to the HN, where the instruction information is used to instruct the HN to obtain the authentication vector by using the symmetric key EK.

Optionally, the method further includes:

The public key of the terminal is sent to the HN.

In a third aspect, an embodiment of the present application provides an authentication device, applied to HN, including:

A first generating module, used to generate an authentication vector, wherein the authentication vector is obtained by calculating using the symmetric key EK generated in the registration phase;

The first sending module is configured to send the authentication vector to a terminal.

Optionally, the authentication vector includes: a quaternary group formed by RAND, AUTN, HXRES, and Kseaf; wherein,

AUTN includes CONC and MAC values; the CONC is calculated based on the sequence number SQN _HN of AK and HN, and the AK is calculated using the symmetric key EK and the RAND;

HXRES is a hash value of RAND and XRES, where XRES is calculated based on RAND and a shared key k.

Optionally, the symmetric key EK is generated in the following manner:

Obtaining a public key of the terminal;

A key data string K is generated according to the public key of the terminal and the private key of the HN, wherein the bytes starting from the leftmost side of the key data string K and having a key length enckeylen as the length are the symmetric key EK.

Optionally, the device further comprises:

The first receiving module is configured to receive instruction information from the terminal, where the instruction information is used to instruct the HN to obtain the authentication vector using the symmetric key EK.

In a fourth aspect, an embodiment of the present application provides an authentication device, applied to a terminal, including:

A first acquisition module is used to acquire an authentication vector of the HN, where the authentication vector is calculated by the HN using the symmetric key EK generated in the registration phase;

The first authentication module is used to perform authentication according to the authentication vector and the symmetric key EK.

Optionally, the authentication vector includes: a four-tuple formed by RAND, AUTN, HXRES, and Kseaf; wherein,

AUTN includes CONC and MAC values; the CONC is calculated based on the sequence number SQN _HN of AK and HN, and the AK is calculated using the symmetric key EK and the RAND;

HXRES is a hash value of RAND and XRES, where XRES is calculated based on RAND and a shared key k.

Optionally, the first authentication module includes:

A first processing submodule, configured to split the AUTN into CONC and MAC values;

A first calculation submodule, configured to calculate AK according to the RAND and the symmetric key EK;

A second calculation submodule, configured to calculate and obtain SQN _HN according to the AK and the CONC;

The third calculation submodule is used to calculate the xMAC value according to the shared key k, SQN _HN and RAND;

The first authentication submodule is used to perform authentication according to the xMAC value and the MAC value.

Optionally, the symmetric key EK is generated in the following manner:

Generate a public-private key pair;

A key data string K is generated according to the private key of the terminal and the public key of the HN, wherein the bytes starting from the leftmost side of the key data string K and having a key length enckeylen as the length are the symmetric key EK.

Optionally, the device may further include:

The first sending module is configured to send instruction information to the HN, where the instruction information is used to instruct the HN to obtain the authentication vector using the symmetric key EK.

Optionally, the device may further include:

The second sending module is used to send the public key of the terminal to the HN.

In a fifth aspect, an embodiment of the present application provides an authentication device, applied to an HN, comprising: a processor and a transceiver;

The processor is used to generate an authentication vector, where the authentication vector is calculated using the symmetric key EK generated during the registration phase;

The transceiver is used to send the authentication vector to the terminal.

Optionally, the authentication vector includes: a four-tuple formed by RAND, AUTN, HXRES, and Kseaf; wherein,

AUTN includes CONC and MAC values; the CONC is calculated based on the sequence number SQN _HN of AK and HN, and the AK is calculated using the symmetric key EK and the RAND;

HXRES is a hash value of RAND and XRES, where XRES is calculated based on RAND and a shared key k.

Optionally, the symmetric key EK is generated in the following manner:

Obtaining a public key of the terminal;

A key data string K is generated according to the public key of the terminal and the private key of the HN, wherein the bytes starting from the leftmost side of the key data string K and having a key length enckeylen as the length are the symmetric key EK.

Optionally, the transceiver is further used to receive indication information from the terminal, where the indication information is used to instruct the HN to obtain the authentication vector using the symmetric key EK.

In a sixth aspect, an embodiment of the present application provides an authentication device, applied to a terminal, comprising: a processor and a transceiver;

The processor is used to obtain an authentication vector of the HN, where the authentication vector is calculated by the HN using the symmetric key EK generated in the registration phase; and perform authentication according to the authentication vector and the symmetric key EK.

Optionally, the authentication vector includes: a four-tuple formed by RAND, AUTN, HXRES, and Kseaf; wherein,

AUTN includes CONC and MAC values; the CONC is calculated based on the sequence number SQN _HN of AK and HN, and the AK is calculated using the symmetric key EK and the RAND;

HXRES is a hash value of RAND and XRES, where XRES is calculated based on RAND and a shared key k.

Optionally, the processor is used to:

Splitting the AUTN into CONC and MAC values;

Calculate AK based on the RAND and the symmetric key EK;

Calculate SQN _HN according to the AK and the CONC;

The xMAC value is calculated based on the shared key k, SQN _HN and RAND;

Authentication is performed based on the xMAC value and the MAC value.

Optionally, the symmetric key EK is generated in the following manner:

Generate a public-private key pair;

A key data string K is generated according to the private key of the terminal and the public key of the HN, wherein the bytes starting from the leftmost side of the key data string K and having a key length enckeylen as the length are the symmetric key EK.

Optionally, the transceiver is further used to send indication information to the HN, where the indication information is used to instruct the HN to obtain the authentication vector using the symmetric key EK.

Optionally, the transceiver is further configured to send a public key of the terminal to the HN.

In a seventh aspect, an embodiment of the present application further provides a communication device, comprising: a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor implements the steps in the authentication method as described above when executing the program.

In an eighth aspect, an embodiment of the present application further provides a readable storage medium, on which a program is stored, and when the program is executed by a processor, the steps in the authentication method as described above are implemented.

In the embodiment of the present application, the HN side uses the symmetric key EK generated in the registration phase to calculate and generate the authentication vector, and the terminal side uses the symmetric key EK generated in the registration phase and the authentication vector for authentication. Since both the HN side and the terminal side have the symmetric key EK generated in the registration phase and can perform corresponding processing, the solution of the embodiment of the present application does not need to add encryption and decryption operations on the authentication vector on the HN side and the terminal side, which can reduce data processing delay.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flowchart of an authentication method provided in an embodiment of the present application;

FIG2 is a second flowchart of the authentication method provided in an embodiment of the present application;

FIG3 is a flow chart of generating a symmetric key EK on the terminal side in an embodiment of the present application;

FIG4 is a flow chart of generating a symmetric key EK on the HN side in an embodiment of the present application;

FIG5 is a third flowchart of the authentication method provided in an embodiment of the present application;

FIG6 is a structural diagram of an authentication device provided in an embodiment of the present application;

FIG7 is a second structural diagram of the authentication device provided in an embodiment of the present application;

FIG8 is a third structural diagram of the authentication device provided in an embodiment of the present application;

FIG. 9 is a fourth structural diagram of the authentication device provided in an embodiment of the present application.

Detailed ways

In the embodiments of the present application, the term "and/or" describes the association relationship of the associated objects, indicating that there may be three relationships. For example, A and/or B may represent: A exists alone, A and B exist at the same time, and B exists alone. The character "/" generally indicates that the associated objects before and after are in an "or" relationship.

In the embodiments of the present application, the term "plurality" refers to two or more than two, and other quantifiers are similar.

The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

Referring to FIG. 1 , FIG. 1 is a flow chart of an authentication method provided in an embodiment of the present application, which is applied to HN, and includes the following steps as shown in FIG. 1 :

Step 101: Generate an authentication vector, where the authentication vector is calculated using the symmetric key EK generated during the registration phase.

In the embodiment of the present application, the authentication vector includes: a four-tuple formed by RAND, AUTN, HXRES, and Kseaf; wherein:

RAND is a random number;

AUTN is an authentication token, including CONC and MAC values; the CONC is calculated based on AK and SQN _HN , the AK is calculated using the symmetric key EK and the RAND, and SQN _HN is the sequence number of HN;

HXRES is the hash value of RAND and XRES, where XRES is calculated based on RAND and the shared key k;

Kseaf is the anchor key.

Specifically, AK is calculated by f5(EK, RAND); MAC value is calculated by f1(k, SQN _HN , RAND); CONC is calculated by (AK⊕SQN _HN ); XRES is calculated by f2(k, RAND); where f1(x), f2(x), and f5(x) represent encryption functions. Kseaf is obtained based on the shared key k, RAND, IDSN, and SQN _HN .

For the HN side, during the registration phase, the symmetric key KN is generated as follows:

Obtaining a public key of the terminal;

A key data string K is generated according to the public key of the terminal and the private key of the HN.

The length of the key data string is enckeylen+icblen+mackeylen. The bytes starting from the leftmost of the key data string K and with a length of enckeylen are the symmetric key EK, and enckeylen represents the key length. In addition, icblen represents the database length, and mackeylen represents the verification key length. The bytes in the middle of K with a length of icblen are parsed as ICB, and the rightmost bytes of K with a length of mackeylen are used as the MAC key MK.

Optionally, in the embodiment of the present application, the HN may also receive indication information from the terminal, the indication information being used to instruct the HN to obtain the authentication vector using the symmetric key EK. If the indication information is received, the HN uses the symmetric key EK generated during the registration phase to calculate and obtain the authentication vector; otherwise, the authentication vector may be obtained in the manner of the prior art.

Step 102: Send the authentication vector to the terminal.

The HN sends the authentication vector to the terminal through the SN (Serving network).

In the embodiment of the present application, the HN side uses the symmetric key EK generated in the registration phase to calculate and generate the authentication vector, and the terminal side uses the symmetric key EK generated in the registration phase and the authentication vector for authentication. Since both the HN side and the terminal side have the symmetric key EK generated in the registration phase and can perform corresponding processing, the solution of the embodiment of the present application does not need to add encryption and decryption operations on the authentication vector on the HN side and the terminal side, which can reduce data processing delay.

Referring to FIG. 2 , FIG. 2 is a flow chart of an authentication method provided in an embodiment of the present application, which is applied to a terminal, as shown in FIG. 2 , and includes the following steps:

Step 201: Obtain an authentication vector of the HN, where the authentication vector is calculated by the HN using the symmetric key EK generated during the registration phase.

The composition of the authentication vector may refer to the description of the aforementioned method embodiment.

Step 202: Perform authentication according to the authentication vector and the symmetric key EK.

On the terminal side, the symmetric key EK can be generated in the registration phase as follows:

Generate a public-private key pair. The terminal can generate an ECC (Elliptic Curve Cryptography) temporary public-private key pair through the ECIES (Elliptic Curve Integrate Encrypt Scheme) parameters provided by the home network. Afterwards, the terminal can generate a key data string K based on the private key of the terminal (i.e., the temporary private key) and the public key of the HN. Optionally, the terminal also sends the public key of the terminal to the HN. Therefore, the final output of the terminal is the ECC temporary public key of the terminal (the public key of the terminal), the ciphertext value, the MAC-tag and other parameters (allowing the sender to send additional symbol indications).

The length of the key data string K is enckeylen+icblen+mackeylen. The bytes starting from the leftmost of the key data string K and with a length of enckeylen are the symmetric key EK, and enckeylen represents the key length. In addition, icblen represents the database length, and mackeylen represents the verification key length. The bytes in the middle of K with a length of icblen are parsed as ICB, and the rightmost bytes of K with a length of mackeylen are used as the MAC key MK.

Optionally, the terminal may also send indication information to the HN, wherein the indication information is used to instruct the HN to obtain the authentication vector using the symmetric key EK. The indication information may be carried in the other parameters mentioned above. For example, the terminal may add a tag to the other parameters. When tag=1, it indicates that the HN side saves the symmetric encryption key EK and replaces the root key k with the saved symmetric encryption key EK in the authentication vector generation stage. If there is no tag value in the other parameters or tag=0, the HN side generates the authentication vector according to the existing 5G AKA process.

When performing authentication, the terminal may split the AUTN into CONC and MAC values; calculate AK according to the RAND and the symmetric key EK; calculate SQN _HN according to the AK and the CONC; calculate xMAC value according to the shared key k, SQN _HN and RAND; perform authentication according to the xMAC value and the MAC value. The process of performing authentication according to the xMAC value and the MAC value is the same as that in the prior art.

In the embodiment of the present application, the HN side uses the symmetric key EK generated in the registration phase to calculate and generate the authentication vector, and the terminal side uses the symmetric key EK generated in the registration phase and the authentication vector for authentication. Since both the HN side and the terminal side have the symmetric key EK generated in the registration phase and can perform corresponding processing, the solution of the embodiment of the present application does not need to add encryption and decryption operations on the authentication vector on the HN side and the terminal side, which can reduce data processing delay.

Referring to FIG. 3 , FIG. 3 is a flow chart of generating a symmetric key EK on the terminal side in an embodiment of the present application, which may include:

During the initial negotiation (registration) phase of 5G-AKA: 1) The UE generates an ECC temporary public-private key pair (Eph.key pair generation) through the ECIES parameters provided by the home network. 2) The UE calculates the shared key k (Eph.shared key) based on the temporary private key and the public key of HN. 3) The UE generates a key data string K of length enckeylen+icblen+mackeylen based on the shared key k. The leftmost byte of K with a length of enckeylen (i.e., encryption key length) is parsed as the encryption key EK, the middle byte of K with a length of icblen (i.e., data block length) is parsed as ICB (Initial Counter Block), and the rightmost byte of K with a length of mackeylen (i.e., verification key length) is used as the MAC key MK (integrity protection key). 4) The UE uses the encryption key and ICB to encrypt the original plaintext (the content in the plain-text) and generate the ciphertext (Eph.Ciphertext Value). 5) The MAC key MK is used to perform integrity protection on the ciphertext and generate a MAC-tag (integrity protection check code). Ultimately, the output of the UE is the UE ECC temporary public key, ciphertext, MAC-tag (integrity protection check code) and other parameters (allowing the sender to send additional symbol indications).

In the embodiment of the present application, a tag is added to other parameters. When tag=1, it indicates that the HN side saves the symmetric encryption key EK and replaces the root key k with the saved symmetric encryption key EK in the authentication vector generation phase AK←f5(k,RAND). If there is no tag value in other parameters or tag=0, the HN side generates the authentication vector according to the existing 5G AKA process.

Referring to FIG. 4 , FIG. 4 is a flow chart of generating a symmetric key EK on the HN side in an embodiment of the present application, which may include:

After the HN side receives the user's ciphertext (SUCI (Subscription Concealed Identifier)), temporary public key, MAC-tag and other parameters, the SIDF (Subscription Identifier De-concealing Function) module completes the decryption of SUCI. 1) Generate a shared key k based on the UE's temporary public key and the HN's private key. 2) Generate a key data string K of enckeylen+icblen+mackeylen based on the shared key, etc. Parse the leftmost byte of K with a length of enckeylen as the encryption key EK, parse the middle byte of K with a length of icblen as ICB, and use the rightmost byte of K with a length of mackeylen as the MAC key MK. 3) Use the encryption key EK and the ICB key to decrypt the SUCI to obtain plaintext. 4) Use the integrity protection key to perform integrity protection on the SUCI and generate an integrity protection check code to be verified.

Referring to FIG. 5 , FIG. 5 is a flow chart of an authentication method in an embodiment of the present application, which may include:

Step 501: HN generates an authentication vector, wherein the authentication vector includes a four-tuple formed by RAND, AUTN, HXRES, and Kseaf.

Among them, RAND is a 128-bit random number, AUTN is an authentication token (including CONC and MAC values, where CONC is the exclusive OR of AK and SQN _HN ; HXRES is the hash value of RAND and XRES, and XRES represents the expected response (eXpectedRreponse).

MAC is calculated based on f1(k, SQN _HN , RAND), AK is calculated based on f5(EK, RAND), XRES is calculated based on f2(k, RAND), and Kseaf is obtained based on k, RNAD, ID _SN , SQN _HN (Kseaf←Keyderivation(k, RNAD, ID _SN , SQN _HN )). k represents the shared key, and ID _SN represents the ID of SN.

Step 502: HN sends an authentication vector to SN.

Step 503: After receiving the authentication vector sent by the HN, the SN sends (RAND, AUTN) to the UE.

Step 504: After receiving (RAND, AUTN), the UE first splits AUTN into CONC and MAC, then calculates AK using the symmetric key EK and RAND (AK←f5(EK, RAND)), then performs an XOR operation on AK and CONC to obtain _SQNHN ( _SQNHN ←AK⊕CONC), and finally calculates the xMAC value (xMAC←f1(k, _SQNHN , RAND)).

The UE compares xMAC with the received MAC value.

(1) If the xMAC value is different from the MAC value, the authentication fails and the UE sends a MAC_Failure message to the SN.

(2) If xMAC and MAC are the same but SQNUE>SQNHN, the UE considers that a sequence number asynchronization problem has occurred and will resynchronize. The UE returns Sync_Failure and AUTS (resynchronization parameters). The SN sends Sync_Failure, AUTS, RAND, and SUCI to the HN.

(3) If xMAC is the same as MAC and SQN _UE < SQN _HN , the authentication of HN is completed. The UE side generates RES (RES←f2(K, RAND)) and Kseaf, and sends the response value RES to the SN for authentication. Kseaf is obtained according to k, RNAD, ID _SN , SQN _HN (Kseaf←Keyderivation(k, RNAD, ID _SN , SQN _HN )).

After receiving RES, SN hashes RES and RAND to obtain HRES (HRES←Hash(RAND, XRES)), and compares HRES with HXRES sent by HN. If the two are the same, the authentication is completed. After successful authentication, RES needs to be sent to HN to prevent malicious SNs.

After receiving the RES sent by the SN, the HN compares it with the XRES. If the two are the same, the HN returns the SUPI to the SN and completes the authentication of the UE.

In the embodiment of the present application, the HN side uses the symmetric key EK generated in the registration phase to calculate and generate the authentication vector, and the terminal side uses the symmetric key EK generated in the registration phase and the authentication vector for authentication. Since both the HN side and the terminal side have the symmetric key EK generated in the registration phase and can perform corresponding processing, the scheme of the embodiment of the present application does not need to add encryption and decryption operations on the authentication vector on the HN side and the terminal side, which can reduce data processing delay, and the above scheme can reduce the impact on the verification of existing terminals.

Refer to FIG. 6 , which is a structural diagram of an authentication device provided in an embodiment of the present application, which is applied to HN.

As shown in FIG6 , the authentication device includes:

The first generating module 601 is used to generate an authentication vector, where the authentication vector is calculated using the symmetric key EK generated in the registration phase; the first sending module 602 is used to send the authentication vector to the terminal.

Optionally, the authentication vector includes: a four-tuple formed by RAND, AUTN, HXRES, and Kseaf; wherein,

AUTN includes CONC and MAC values; the CONC is calculated based on the sequence number SQN _HN of AK and HN, and the AK is calculated using the symmetric key EK and the RAND;

HXRES is a hash value of RAND and XRES, where XRES is calculated based on RAND and a shared key k.

Optionally, the symmetric key EK is generated in the following manner:

Obtaining a public key of the terminal;

A key data string K is generated according to the public key of the terminal and the private key of the HN, wherein the bytes starting from the leftmost side of the key data string K and having a key length enckeylen as the length are the symmetric key EK.

Optionally, the device further comprises:

The first receiving module is configured to receive instruction information from the terminal, where the instruction information is used to instruct the HN to obtain the authentication vector using the symmetric key EK.

The device provided in the embodiment of the present application can execute the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

See Figure 7, which is a structural diagram of an authentication device provided in an embodiment of the present application, which is applied to a terminal. As shown in Figure 7, the authentication device includes:

The first acquisition module 701 is used to acquire the authentication vector of the HN, where the authentication vector is calculated by the HN using the symmetric key EK generated in the registration phase; the first authentication module 702 is used to perform authentication based on the authentication vector and the symmetric key EK.

Optionally, the authentication vector includes: a four-tuple formed by RAND, AUTN, HXRES, and Kseaf; wherein,

AUTN includes CONC and MAC values; the CONC is calculated based on the sequence number SQN _HN of AK and HN, and the AK is calculated using the symmetric key EK and the RAND;

HXRES is a hash value of RAND and XRES, where XRES is calculated based on RAND and a shared key k.

Optionally, the first authentication module includes:

A first processing submodule, configured to split the AUTN into CONC and MAC values;

A first calculation submodule, configured to calculate AK according to the RAND and the symmetric key EK;

A second calculation submodule, configured to calculate and obtain SQN _HN according to the AK and the CONC;

The third calculation submodule is used to calculate the xMAC value according to the shared key k, SQN _HN and RAND;

The first authentication submodule is used to perform authentication according to the xMAC value and the MAC value.

Optionally, the symmetric key EK is generated in the following manner:

Generate a public-private key pair;

A key data string K is generated according to the private key of the terminal and the public key of the HN, wherein the bytes starting from the leftmost side of the key data string K and having a key length enckeylen as the length are the symmetric key EK.

Optionally, the device may further include:

The first sending module is configured to send instruction information to the HN, where the instruction information is used to instruct the HN to obtain the authentication vector using the symmetric key EK.

Optionally, the device may further include:

The second sending module is used to send the public key of the terminal to the HN.

The device provided in the embodiment of the present application can execute the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

See Figure 8, which is a structural diagram of an authentication device provided in an embodiment of the present application, which is applied to HN. As shown in Figure 8, the authentication device includes: a processor 801 and a transceiver 802;

The processor 801 is used to generate an authentication vector, where the authentication vector is calculated using the symmetric key EK generated in the registration phase;

The transceiver 802 is configured to send the authentication vector to a terminal.

Optionally, the authentication vector includes: a four-tuple formed by RAND, AUTN, HXRES, and Kseaf; wherein,

AUTN includes CONC and MAC values; the CONC is calculated based on the sequence number SQN _HN of AK and HN, and the AK is calculated using the symmetric key EK and the RAND;

HXRES is a hash value of RAND and XRES, where XRES is calculated based on RAND and a shared key k.

Optionally, the symmetric key EK is generated in the following manner:

Obtaining a public key of the terminal;

A key data string K is generated according to the public key of the terminal and the private key of the HN, wherein the bytes starting from the leftmost side of the key data string K and having a key length enckeylen as the length are the symmetric key EK.

Optionally, the transceiver 802 is further configured to receive indication information from the terminal, where the indication information is used to instruct the HN to obtain the authentication vector using the symmetric key EK.

The device provided in the embodiment of the present application can execute the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

See Figure 9, which is a structural diagram of an authentication device provided in an embodiment of the present application, which is applied to a terminal. As shown in Figure 9, the authentication device includes: a processor 901 and a transceiver 902;

The processor 901 is configured to obtain an authentication vector of the HN, where the authentication vector is calculated by the HN using the symmetric key EK generated in the registration phase; and perform authentication according to the authentication vector and the symmetric key EK.

Optionally, the authentication vector includes: a four-tuple formed by RAND, AUTN, HXRES, and Kseaf; wherein,

AUTN includes CONC and MAC values; the CONC is calculated based on the sequence number SQN _HN of AK and HN, and the AK is calculated using the symmetric key EK and the RAND;

HXRES is a hash value of RAND and XRES, where XRES is calculated based on RAND and a shared key k.

Optionally, the processor 901 is configured to:

Splitting the AUTN into CONC and MAC values;

Calculate AK based on the RAND and the symmetric key EK;

Calculate SQN _HN according to the AK and the CONC;

The xMAC value is calculated based on the shared key k, SQN _HN and RAND;

Authentication is performed based on the xMAC value and the MAC value.

Optionally, the symmetric key EK is generated in the following manner:

Generate a public-private key pair;

A key data string K is generated according to the private key of the terminal and the public key of the HN, wherein the bytes starting from the leftmost side of the key data string K and having a key length enckeylen as the length are the symmetric key EK.

Optionally, the transceiver 902 is further configured to send indication information to the HN, where the indication information is used to instruct the HN to obtain the authentication vector using the symmetric key EK.

Optionally, the transceiver 902 is further configured to send the public key of the terminal to the HN.

The device provided in the embodiment of the present application can execute the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

It should be noted that the division of units in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

An embodiment of the present application provides a communication device, including: a memory, a processor, and a program stored in the memory and executable on the processor; the processor is used to read the program in the memory to implement the steps in the authentication method described above.

The embodiment of the present application also provides a readable storage medium, on which a program is stored. When the program is executed by the processor, each process of the above-mentioned authentication method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. Among them, the readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state drive (SSD)), etc.

It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, disk, CD), and includes a number of instructions for a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims (16)

1. An authentication method applied to a home network HN, comprising:

generating an authentication vector which is obtained by calculation by using the symmetric key EK generated in the registration stage;

And sending the authentication vector to the terminal.

2. The method of claim 1, wherein the authentication vector comprises: a quadruple formed by the random number RAND, authentication token AUTN, hash expected response HXRES, anchor key Kseaf; wherein,

AUTN includes a parameter CONC and a message authentication code MAC value; the CONC is obtained by calculation according to sequence numbers SQN _HN of an anonymous key AK and an anonymous key HN, and the AK is obtained by calculation by using the symmetric key EK and the RAND;

HXRES is a hash value of the RAND and the expected response XRES, which is calculated from the RAND and the shared key k.

3. Method according to claim 1 or 2, characterized in that the symmetric key EK is generated in the following way:

Acquiring a public key of the terminal;

and generating a key data string K according to the public key of the terminal and the private key of the HN, wherein bytes with the key length enckeylen as the length from the leftmost side of the key data string K are taken as the symmetric key EK.

4. The method according to claim 1, wherein the method further comprises:

And receiving indication information of the terminal, wherein the indication information is used for indicating the HN to obtain the authentication vector by using the symmetric key EK.

5. An authentication method applied to a terminal, comprising:

Acquiring an authentication vector of a home network HN, wherein the authentication vector is obtained by calculation of the HN by using a symmetric key EK generated in a registration stage;

and authenticating according to the authentication vector and the symmetric key EK.

6. The method of claim 5, wherein the authentication vector comprises: a quadruple formed by the random number RAND, authentication token AUTN, hash expected response HXRES, anchor key Kseaf; wherein,

AUTN includes a parameter CONC and a message authentication code MAC value; the CONC is obtained by calculation according to sequence numbers SQN _HN of an anonymous key AK and an anonymous key HN, and the AK is obtained by calculation by using the symmetric key EK and the RAND;

HXRES is a hash value of the RAND and the expected response XRES, which is calculated from the RAND and the shared key k.

7. The method of claim 6, wherein said authenticating based on said authentication vector and said symmetric key EK comprises:

splitting the AUTN into a CONC and MAC value;

obtaining AK according to the RAND and the symmetric key EK by calculation;

calculating according to the AK and the CONC to obtain SQN _HN;

obtaining xMAC value according to the shared secret k, the SQN _HN and the RAND calculation;

and authenticating according to the xMAC value and the MAC value.

8. The method according to any of claims 5 to 7, characterized in that the symmetric key EK is generated in the following way:

Generating a public-private key pair;

And generating a key data string K according to the private key of the terminal and the public key of the HN, wherein bytes with the key length enckeylen as the length from the leftmost side of the key data string K are taken as the symmetric key EK.

9. The method according to any one of claims 5 to 7, further comprising:

And sending indication information to the HN, wherein the indication information is used for indicating the HN to obtain the authentication vector by using the symmetric key EK.

10. The method of claim 8, wherein the method further comprises:

And sending the public key of the terminal to the HN.

11. An authentication apparatus applied to HN, comprising:

the first generation module is used for generating an authentication vector which is obtained by calculation by using the symmetric key EK generated in the registration stage;

and the first sending module is used for sending the authentication vector to the terminal.

12. An authentication apparatus applied to a terminal, comprising:

A first obtaining module, configured to obtain an authentication vector of a home network HN, where the authentication vector is obtained by calculating by the HN using a symmetric key EK generated in a registration stage;

and the first authentication module is used for performing authentication according to the authentication vector and the symmetric key EK.

13. An authentication apparatus applied to HN, comprising: a processor and a transceiver;

The processor is used for generating an authentication vector, and the authentication vector is obtained by calculation by using the symmetric key EK generated in the registration stage;

the transceiver is configured to send the authentication vector to a terminal.

14. An authentication apparatus applied to a terminal, comprising: a processor and a transceiver;

The processor is configured to obtain an authentication vector of a home network HN, where the authentication vector is obtained by calculating by the HN using a symmetric key EK generated in a registration phase; and authenticating according to the authentication vector and the symmetric key EK.

15. A communication device, comprising: a memory, a processor, and a program stored on the memory and executable on the processor; -characterized in that the processor is arranged to read a program in a memory for implementing the steps in the authentication method according to any one of claims 1 to 10.

16. A readable storage medium storing a program, wherein the program when executed by a processor implements the steps in the authentication method according to any one of claims 1 to 10.