CN1852595A - Method for authent ation of access of wireless communication terminal - Google Patents

Method for authent ation of access of wireless communication terminal Download PDF

Info

Publication number
CN1852595A
CN1852595A CNA2005101266338A CN200510126633A CN1852595A CN 1852595 A CN1852595 A CN 1852595A CN A2005101266338 A CNA2005101266338 A CN A2005101266338A CN 200510126633 A CN200510126633 A CN 200510126633A CN 1852595 A CN1852595 A CN 1852595A
Authority
CN
China
Prior art keywords
terminal
core net
authentication
wireless terminal
page
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CNA2005101266338A
Other languages
Chinese (zh)
Other versions
CN100499900C (en
Inventor
陈顺林
刘洋
赵新春
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to CNB2005101266338A priority Critical patent/CN100499900C/en
Publication of CN1852595A publication Critical patent/CN1852595A/en
Application granted granted Critical
Publication of CN100499900C publication Critical patent/CN100499900C/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Abstract

The method is applicable to flow for network side to page the called terminal. The method includes steps: radio access network sends paging response message returned from the called terminal to the core network; the core network authenticates the called terminal of sending the paging response message. If authentication is passed, then, the terminal is allowed to access system; otherwise if it is failure, refusing access. When authentication is failure, if network side detects that a called terminal with identical international mobile station id (IMSI) is already passed the authentication, then the method also stops the called terminal to access system. After legal terminal accesses system, the invention prevents replicated terminal to access system without authentication from monitoring communication content of legal terminal. Thus, the invention guarantees communication security of legal user.

Description

A kind of method for authent ation of access of wireless communication terminal
Technical field
The present invention relates to wireless communication field, relate in particular to a kind of method that is applied to the authent ation of access of wireless communication terminal of network side paging terminal called flow process.
Background technology
Along with the large-scale application of CDMA2000 system, Communication Security Problem occurs in network frequently.In the application of reality, the possibility that just exists wireless terminal to be replicated, the i.e. international mobile subscriber identification code of two wireless terminals (International Mobile Subscriber Identity, IMSI) and wireless terminal Electronic Serial Number (ESN) in full accord, only have the master key of wireless terminal inconsistent.For convenience of description, claim that the terminal of duplicating of legal terminal is false wireless terminal, there is not master key in this terminal; Claim that the legal wireless terminal that is replicated is true wireless terminal, the master key of this terminal and network side attaching position register (Home LocationRegister, HLR) middle master key unanimity of preserving.
At present, in the CDMA2000 system, the mechanism of access authentication is: network side calculates AUTHR that AUTHR and wireless terminal report relatively with RAND, ESN, IMSI, SSD_A, if equate just to think that authentication passes through, allows the wireless terminal connecting system.The authenticating result computational methods of wireless terminal and network side are as follows:
AUTHR=Auth_Signature(RAND,ESN,AUTH_DATA,SSD_A)
Wherein:
AUTHR is an authenticating result;
Auth_Signature is an authentication feature program;
RAND is a random number in the system message;
ESN is the Electronic Serial Number of wireless terminal;
AUTH_DATA is the part of wireless terminal IMSI;
SSD_A is the sub-key of wireless terminal, is used for the Shared Secret Data of authentication, presses CAVE (Cellular Authentication and Voice Encryptionalgorithm) algorithm by the master key (A_KEY) of wireless terminal and ESN and generates.
In the CDMA2000 system, to the terminal called access authentication process as shown in Figure 1, comprise step:
1, when the network side paging wireless terminal, core net sends beep-page message (Paging) to wireless access network;
2, wireless access network sends beep-page message (General Page Message) to wireless terminal;
3, after wireless terminal is received beep-page message, return page-response message (PageResponse), carry authenticating result AUTHR to Access Network; To be wireless terminal calculate by authentication feature program with ESN, IMSI and the SSD_A of RAND and this wireless terminal this locality this AUTHR; Wherein SSD_A is generated by the CAVE algorithm by the ESN of this wireless terminal this locality and A_KEY;
4, the page-response message of Access Network forwarding wireless terminal is carried authenticating result AUTHR to core net;
5, after core net is received the page-response message of wireless terminal, utilize ESN, the IMSI of RAND and this wireless terminal and the SSD_A that core net calculates to calculate authenticating result AUTHR by authentication feature program; Wherein, SSD_A is that the pairing A_KEY of IMSI by this wireless terminal of storing in the ESN of this terminal and the network side attaching position register generates by the CAVE algorithm; Whether the AUTHR that core net compares wireless terminal calculating is identical with the AUTHR of core net calculating, if identical, then authentication is passed through, otherwise, failed authentication;
6, if authentication is passed through, core net allows the wireless terminal connecting system with assignment message (Assignment) notice wireless access network.
In actual CDMA2000 network, when having false wireless terminal, false wireless terminal can both insert identical Traffic Channel simultaneously with true wireless terminal.False wireless terminal can rely on the successful authentication of true wireless terminal and connecting system, monitors the business of true wireless terminal, and the communication security of true wireless terminal just can not get assurance, and as shown in Figure 2, detailed process is as follows:
1, when the network side paging wireless terminal, core net sends beep-page message (Paging) to wireless access network;
2, wireless access network sends beep-page message (General Page Message) to wireless terminal;
3, after true wireless terminal is received beep-page message, return page-response message, carry authenticating result AUTHR0 to Access Network; To be true wireless terminal calculate according to authentication feature program with ESN, IMSI and the SSD_A of RAND and true wireless terminal this locality AUTHR0; Wherein, SSD_A is generated by the CAVE algorithm by the ESN of true wireless terminal this locality and A_KEY;
4, Access Network transmit true wireless terminal page-response message to core net, carry authenticating result AUTHR0;
5, after false wireless terminal is received beep-page message, return page-response message, carry authenticating result AUTHR1 to Access Network; To be false wireless terminal calculate by authentication feature program with the ESN and the IMSI of RAND and false wireless terminal this locality AUTHR1; Because false wireless terminal does not have the A_KEY value, can not generate corresponding SSD_A value, therefore the AUTHR1 that calculates is not equal to AUTHR0; Access network discovery has been received the page-response message of true wireless terminal, and just the page-response message with false wireless terminal abandons;
6, after core net was received the page-response message of true wireless terminal, the SSD_A that calculates with ESN, IMSI and the core net of RAND and true wireless terminal generated authenticating result AUTHR by authentication feature program; Wherein, SSD_A is generated by the CAVE algorithm by the pairing A_KEY of IMSI of the true wireless terminal of storing in the ESN of true wireless terminal and the network side attaching position register, and whether the AUTHR0 that core net is calculated than serious wireless terminal is identical with the AUTHR that core net is calculated; If identical, then authentication is passed through, otherwise, failed authentication;
7, authentication is passed through, and core net is notified wireless access network with assignment message, allows true wireless terminal connecting system; In true wireless terminal connecting system process, false wireless terminal does not pass through yet connecting system equally of authentication, and like this, false wireless terminal just can be monitored the Content of Communication of true wireless terminal, and very wireless terminal communications safety can not get assurance.
This shows that also there is deficiency in the access authentication of CDMA2000 system at present, has the illegal connecting system of false wireless terminal, monitors the Content of Communication of true wireless terminal, the communication security of validated user has been subjected to threat.Therefore, the fail safe of necessary raising access authentication and completeness.
Summary of the invention
The invention provides a kind of method of authent ation of access of wireless communication terminal, the communication security of legal terminal not have the problem of assurance when solving network side paging terminal called in the prior art.
The inventive method is applied to network side paging terminal called flow process, and this method comprises:
A, wireless access network send to core net with the page-response message that terminal called returns;
B, core net are carried out authentication to the terminal called that sends described page-response message.
In the described steps A, terminal called carries the authenticating result that self calculates in the page-response message of returning; Among the described step B, the authenticating result that authenticating result that core net is carried described page-response message and core net calculate compares, if both identical then authentications successes, otherwise, failed authentication.
According to said method of the present invention, if the authentication success, core net notice Access Network is with current terminal called connecting system;
If failed authentication, core net notice Access Network is refused current terminal called connecting system.
According to said method of the present invention, when failed authentication, core net further detects the terminal called authentication success that whether has identical international mobile subscriber identification code IMSI in this paging, if then core net initiates to stop this paging flow process.
Described core net is initiated to stop this paging flow process, and comprising: core net sends clear command to wireless access network;
Wireless access network stops the terminal called connecting system of this paging, and it is former because terminal is replicated to inform that terminal called stops.
Described terminal called comprises the legal terminal that has master key A_KEY and does not have the illegal terminal of master key A_KEY.
The inventive method is applied in the CDMA2000 system.
Beneficial effect of the present invention is as follows:
The present invention is forwarded to core net by wireless access network with the called paging response message of receiving, core net is carried out authentication to the wireless terminal that each sends page-response message, and when failed authentication, refuses this terminal connecting system; Simultaneously, if detecting the terminal authentication of existing identical IMSI, passes through network side, then also to stop the legal terminal connecting system that authentication is passed through, and inform that termination is former because terminal is replicated, thereby avoid illegal terminal can monitor the dialog context of legal terminal, guarantee the communication security of validated user, improved the completeness of access authentication.
Description of drawings
Fig. 1 be in the prior art CDMA2000 system to the flow chart of terminal called access authentication;
Fig. 2 for CDMA2000 system in the prior art to a plurality of flow charts with terminal called access authentication of identical IMSI;
Fig. 3 is the flow chart of CDMA2000 of the present invention system to the terminal called access authentication.
Embodiment
The paging of wireless terminal responses network side, according to the precedence that page-response message arrives, two kinds of situations are arranged: network side at first receives the page-response message of false wireless terminal, or network side at first receives the page-response message of true wireless terminal.For the latter, two kinds of situations are arranged again, after promptly network side passes through true wireless terminal authentication, receive the page-response message of true wireless terminal once more, or receive once more and the page-response message of false wireless terminal with above-mentioned three kinds of situations the inventive method is described in detail below respectively.
Embodiment one: network side at first receives the page-response message of false wireless terminal, by core net the called wireless terminal that sends this page-response message is carried out authentication, its connecting system of refusal behind the failed authentication, and concrete steps comprise:
1, when the network side paging wireless terminal, core net sends beep-page message (Paging) to wireless access network;
2, wireless access network sends beep-page message (General Page Message) to wireless terminal;
3, after false wireless terminal is received beep-page message, return page-response message, carry authenticating result AUTHR1 to Access Network; To be false wireless terminal calculate by authentication feature program with the ESN and the IMSI of RAND and this terminal this locality AUTHR1;
4, Access Network is transmitted page-response message to core net, carries authenticating result AUTHR1;
5, after core net was received the page-response message of false wireless terminal, with the ESN and the IMSI of RAND and this vacation wireless terminal, and the SSD_A that core net calculates calculated authenticating result AUTHR according to authentication feature program; Wherein, SSD_A is that the pairing A_KEY of IMSI by this terminal of storing in the ESN of this terminal and the network side attaching position register generates according to the CAVE algorithm; Whether the authenticating result AUTHR1 that core net comparison page-response message is carried is identical with the authenticating result AUTHR that core net calculates; If both identical then authentication successes, otherwise, failed authentication;
6, because RAND, the ESN of true and false wireless terminal is identical with IMSI, but false wireless terminal does not have A_KEY, can not generate SSD_A, so AUTHR1 and AUTHR are inequality, failed authentication, and core net notice wireless access network is refused this vacation wireless terminal connecting system.
Embodiment two: if network side at first receives the page-response message of true wireless terminal, by core net the called wireless terminal that sends this page-response message is carried out authentication, authentication allows its connecting system by the back.If wireless access network is received the page-response message with identical IMSI that false wireless terminal sends once more, then it is transmitted to core net, core net also will be carried out authentication to the terminal called that sends this page-response message; Behind the failed authentication, refuse false wireless terminal connecting system, stop the true wireless terminal that authentication passes through simultaneously and continue connecting system, concrete steps comprise as shown in Figure 3:
1, when the network side paging wireless terminal, core net sends beep-page message (Paging) to wireless access network;
2, wireless access network sends beep-page message (General Page Message) to wireless terminal;
3, after true wireless terminal is received beep-page message, return page-response message, carry authenticating result AUTHR0 to wireless access network; To be true wireless terminal calculate by authentication feature program with ESN, IMSI and the SSD_A of RAND and this terminal this locality AUTHR0; Wherein, SSD_A is generated according to the CAVE algorithm by the ESN of this terminal this locality and A_KEY;
4, wireless access network transmit true wireless terminal page-response message to core net, carry authenticating result AUTHR0;
5, after core net was received the page-response message of true wireless terminal, the SSD_A that calculates with ENS, IMSI and the core net of RAND and true wireless terminal generated authenticating result AUTHR by authentication feature program; Wherein, SSD_A is that A_KEY by the IMSI correspondence of the true wireless terminal of storing in the ESN of true wireless terminal and the network side attaching position register generates according to the CAVE algorithm; Whether the authenticating result AUTHR0 that carries in the core net comparison page-response message is identical with the authenticating result AUTHR that core net calculates; If both identical then authentication successes, otherwise, failed authentication;
6, because the A_KEY that preserves in the A_KEY that is stored in true wireless terminal and the network side attaching position register is identical, so AUTHR0 is identical with AUTHR, and authentication is passed through, and core net allows this true wireless terminal connecting system with assignment message notice wireless access network;
7, after false wireless terminal is received beep-page message, return page-response message, carry authenticating result AUTHR1 to wireless access network; To be false wireless terminal calculate by authentication feature program with the ESN and the IMSI of RAND and this terminal this locality AUTHR1;
8, wireless access network transmit false wireless terminal page-response message to core net, carry authenticating result AUTHR1;
9, after core net is received the page-response message of false wireless terminal, false wireless terminal is carried out authentication: core net calculates authenticating result AUTHR with ESN, the IMSI of RAND and this vacation wireless terminal and the SSD_A that core net calculates by authentication feature program; Wherein, SSD_A is generated according to the CAVE algorithm by the ESN of false wireless terminal and the pairing A_KEY of IMSI that is stored in the false wireless terminal in the network side attaching position register; Relatively whether the authenticating result AUTHR that calculates of the authenticating result AUTHR1 that carries of this page-response message and core net is identical for core net;
10, because false wireless terminal does not have A_KEY information, therefore, the authenticating result AUTHR that authenticating result AUTHR1 that it reports and core net are calculated is inequality, failed authentication; Simultaneously, network side detects with its true wireless terminal with identical IMSI authentication and passes through, in order to protect the communication security of true wireless terminal, core net initiates to stop business procedure: send clear command (Clear command) and give wireless access network, to stop false wireless terminal and true wireless terminal connecting system;
11, after wireless access network is received clear command, stop true wireless terminal and false wireless terminal connecting system, and it is former because terminal is replicated to inform that terminal called stops.
Embodiment three: if network side at first receives the page-response message of true wireless terminal, by core net the called wireless terminal that sends this page-response message is carried out authentication, authentication allows its connecting system by the back.If wireless access network is received the page-response message that true wireless terminal sends once more, then it is transmitted to core net, core net also will be carried out authentication to the terminal called that sends this page-response message; After authentication is passed through, allow true wireless terminal connecting system.Network side takes place receive many page-response message of true wireless terminal, may be because this wireless terminal roams into another service area when sending page-response message, the Access Network of new service area sends page-response message to core net, causes core net to receive what many page-response message of the same wireless terminal that former service area and new service area send caused.
The process that the above-mentioned terminal that a plurality of transmissions is had the page-response message of identical IMSI is carried out authentication identification is called the robust authentication.
Describe as can be known by above flow process, the present invention is forwarded to core net by wireless access network with the called paging response message received (comprising the page-response message that page-response message that true wireless terminal returns and false wireless terminal return), and core net is all carried out authentication to each user terminal that sends page-response message; When failed authentication, in this paging, passed through authentication if having the terminal called of identical IMSI, show the terminal called that sends current page-response message for duplicating terminal, for ensuring communication safety, core net initiates to end operation flow.
Obviously, those skilled in the art can carry out various changes and modification to the present invention and not break away from the spirit and scope of the present invention.Like this, if of the present invention these are revised and modification belongs within the scope of claim of the present invention and equivalent technologies thereof, then the present invention also is intended to comprise these changes and modification interior.

Claims (7)

1, a kind of method for authent ation of access of wireless communication terminal is applied to network side paging terminal called flow process, and this method comprises:
A, wireless access network send to core net with the page-response message that terminal called returns;
B, core net are carried out authentication to the terminal called that sends described page-response message.
2, the method for claim 1 is characterized in that, in the described steps A, terminal called carries the authenticating result that self calculates in the page-response message of returning; Among the described step B, the authenticating result that authenticating result that core net is carried described page-response message and core net calculate compares, if both identical then authentications successes, otherwise, failed authentication.
3, method as claimed in claim 2 is characterized in that, if the authentication success, core net notice Access Network is with current terminal called connecting system;
If failed authentication, core net notice Access Network is refused current terminal called connecting system.
4, method as claimed in claim 3, it is characterized in that when failed authentication, core net further detects the terminal called authentication success that whether has identical international mobile subscriber identification code IMSI in this paging, if then core net initiates to stop this paging flow process.
5, method as claimed in claim 4 is characterized in that, described core net is initiated to stop this paging flow process, and comprising: core net sends clear command to wireless access network;
Wireless access network stops the terminal called connecting system of this paging, and it is former because terminal is replicated to inform that terminal called stops.
As the described method of claim 1-5, it is characterized in that 6, described terminal called comprises the legal terminal that has master key A_KEY and do not have the illegal terminal of master key A_KEY.
7, method as claimed in claim 6 is characterized in that, this method is applied in the CDMA2000 system.
CNB2005101266338A 2005-12-02 2005-12-02 Method for authentication of access of wireless communication terminal Expired - Fee Related CN100499900C (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CNB2005101266338A CN100499900C (en) 2005-12-02 2005-12-02 Method for authentication of access of wireless communication terminal

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CNB2005101266338A CN100499900C (en) 2005-12-02 2005-12-02 Method for authentication of access of wireless communication terminal

Publications (2)

Publication Number Publication Date
CN1852595A true CN1852595A (en) 2006-10-25
CN100499900C CN100499900C (en) 2009-06-10

Family

ID=37134058

Family Applications (1)

Application Number Title Priority Date Filing Date
CNB2005101266338A Expired - Fee Related CN100499900C (en) 2005-12-02 2005-12-02 Method for authentication of access of wireless communication terminal

Country Status (1)

Country Link
CN (1) CN100499900C (en)

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008125062A1 (en) * 2007-04-16 2008-10-23 Huawei Technologies Co., Ltd. Method of admittance judgment and paging user in mobile communication system, system and device thereof
CN100488314C (en) * 2007-01-24 2009-05-13 中兴通讯股份有限公司 A method for restricting the access of the user terminal in the 3G network
WO2010060242A1 (en) * 2008-11-27 2010-06-03 中兴通讯股份有限公司 An authentication method for the mobile terminal and a system thereof
CN101203031B (en) * 2006-12-14 2010-07-14 中兴通讯股份有限公司 Method for preventing illegal terminal from interfering legal terminal
CN101170461B (en) * 2007-12-04 2010-10-06 中控科技集团有限公司 A method and device for enhancing network security
WO2011044816A1 (en) * 2009-10-15 2011-04-21 中兴通讯股份有限公司 Monitoring method and monitoring device for user equipment
CN102325325A (en) * 2011-06-29 2012-01-18 中兴通讯股份有限公司 Illegal terminal detection method and device
CN101350748B (en) * 2007-07-20 2012-02-29 中兴通讯股份有限公司 Method and system for accessing control terminal after being losing to obtain data summary calculation parameter
CN102325325B (en) * 2011-06-29 2016-12-14 中兴通讯股份有限公司 The method and device of detection illegal terminal
CN114025348A (en) * 2020-07-15 2022-02-08 中国移动通信有限公司研究院 Communication security protection method, device and computer readable storage medium

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101203031B (en) * 2006-12-14 2010-07-14 中兴通讯股份有限公司 Method for preventing illegal terminal from interfering legal terminal
CN100488314C (en) * 2007-01-24 2009-05-13 中兴通讯股份有限公司 A method for restricting the access of the user terminal in the 3G network
WO2008125062A1 (en) * 2007-04-16 2008-10-23 Huawei Technologies Co., Ltd. Method of admittance judgment and paging user in mobile communication system, system and device thereof
CN101350748B (en) * 2007-07-20 2012-02-29 中兴通讯股份有限公司 Method and system for accessing control terminal after being losing to obtain data summary calculation parameter
CN101170461B (en) * 2007-12-04 2010-10-06 中控科技集团有限公司 A method and device for enhancing network security
WO2010060242A1 (en) * 2008-11-27 2010-06-03 中兴通讯股份有限公司 An authentication method for the mobile terminal and a system thereof
US8571522B2 (en) 2008-11-27 2013-10-29 Zte Corporation Authentication method for the mobile terminal and a system thereof
WO2011044816A1 (en) * 2009-10-15 2011-04-21 中兴通讯股份有限公司 Monitoring method and monitoring device for user equipment
CN102325325A (en) * 2011-06-29 2012-01-18 中兴通讯股份有限公司 Illegal terminal detection method and device
CN102325325B (en) * 2011-06-29 2016-12-14 中兴通讯股份有限公司 The method and device of detection illegal terminal
CN114025348A (en) * 2020-07-15 2022-02-08 中国移动通信有限公司研究院 Communication security protection method, device and computer readable storage medium

Also Published As

Publication number Publication date
CN100499900C (en) 2009-06-10

Similar Documents

Publication Publication Date Title
CN1210920C (en) Method of checking amount of transmitted data
CN1852595A (en) Method for authent ation of access of wireless communication terminal
CN1230031C (en) Integrity protection during initial registration of subscriber in telecommunications network
CN1244249C (en) Authentication in mobile communications network
CN1157982C (en) A security procedure in universal mobile telephone service
CN1256594A (en) Method for establishing agreement of session key
CN1835436A (en) General power authentication frame and method of realizing power auttientication
CN108353283B (en) Method and apparatus for preventing attacks from a pseudo base station
CN1476265A (en) Method of providing non legal mobile equipment subscriber information
CN1921682A (en) Method for enhancing key negotiation in universal identifying framework
CN1268150C (en) Method for establishing connection between terminal and operating mobile radio network, mobile radio network and terminal used in such method
CN101039312A (en) Method and apparatus for preventing service function entity of general authentication framework from attack
CN1382357A (en) Authentication of subscriber station
CN1852550A (en) Safety communication method
CN100484292C (en) Method, system and base station for locking illegal copied mobile terminal
CN100346668C (en) Updating protocal method of secret keys
CN1601960A (en) Safety authentication method of cell phone bank system
CN1849003A (en) Method for right discrimination to user
CN1599492A (en) Method for sharing mobile terminal by multi-user
CN1315344C (en) Method of transmitting data in cluster business
CN1812620A (en) Method for realizing right discriminating to network by terminal in CDMA network
CN1601943A (en) Method of selecting safety communication algorithm
CN1549621A (en) Method for realizing legal monitoring
CN1905480A (en) Base station starting method
CN1516503A (en) Method for limiting illegal mobile telephone

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant
CF01 Termination of patent right due to non-payment of annual fee
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20090610