KR19990058592A - Terminal authentication key injection device and method for mobile communication network - Google Patents

Abstract

In the present invention, the subscriber and the authentication center have a unique secret key called the same authentication key (A-Key) in the mobile communication network, the authentication key injection that securely injects the authentication key to the subscriber station and the authentication center An apparatus and a method thereof, the method

Entering an arbitrary ten digits through the keypad 87, the ESN 82 which is the serial number of the terminal, the random number generated by the random number generator 85 and the key value of the predefined secret key 81 and The random number used to select the key value is injected into the input of the authentication key generation module, and the authentication key 84 and the authentication key decryption data 86 are generated, and the generated authentication key 84 is input to the terminal. Step, the data for decryption of the authentication key 96 is obtained from the secret key index 98, which is predefined in the authentication key generation module 97, which is input into the memory of the predefined secret key 91 which is stored in the secret key 99 ) And also change the ESN 82 according to the change code, and then enter the authentication key generation module 97 together with the secret key 99, where the authentication key generation module 97 receives the final authentication key 94; Creates and enters into database 32 It consists of several steps.

Description

AUTHENTIFICATION INPUT APPARATUS AND THE METHOD OF CELLULAR PHONE IN MOBILE COMMUNICATION NETWORK

The present invention relates to an apparatus for injecting a terminal authentication key of a mobile communication network and a method thereof, and more particularly, in a mobile communication network, a subscriber and an authentication center have a unique secret key called the same authentication key (A-Key). The present invention relates to an authentication key injection device and a method for safely injecting such an authentication key to a subscriber station and an authentication center.

1 is a block diagram of a general communication network, in which a terminal 20 carried by a subscriber, a base station 22 communicating with the terminal 20, an exchange station 24 controlling the base station, and subscriber information (i.e., Home location register 26, a register to which user identity is assigned for recording purposes such as ESN, DN, side information, current location, and ratification time, and authentication center 30 for retrieving whether the terminal is illegally used or duplicated. It consists of.

Since the mobile communication network uses a wireless section, the security function is weakened in the section, and thus, a network element called the authentication center 30 is used to find out whether the message and voice secretion and the illegal use and reproduction of the terminal are detected. The authentication center has a unique secret key called the authentication key with the terminal 20, and should not be known to anyone, nor should the value be passed to the network.

An overview of the operation of the authentication center 30 is shown in FIG. 2. In general, the authentication center 30 has a database 32 therein that contains authentication keys used in authentication procedures. The authentication key included in this database 32 may be generated directly in the authentication center 30, or may be generated at another place, for example, at a terminal registration agent. When the authentication key is generated inside the authentication center, the authentication key is transmitted to the terminal registration agents 34, 35, 36, 37-- via the communication lines 41, 43 via the customer management and billing center 33. On the other hand, when generating an authentication key other than the authentication center, it is transmitted to the authentication center through communication lines 41 and 43 connecting to the authentication center 30 through the customer management and charging center 33. In this case, the communication lines 41 and 43 are routed in either case.

In general, when the communication lines 41 and 43 are used as dedicated lines, no special security is required. For that reason, it had the ability to change or reference the authentication key with a terminal connected to the private network. This method does not have a big problem when the terminal registration agency can be trusted, but there is a disadvantage in that it is exposed unprotected when another terminal registration agent illegally reproduces the terminal. There is a need for a way to deliver private networks without knowledge. Moreover, since the communication lines 41 and 43 are often transmitted as printable characters, the communication lines 41 and 43 may easily leak their contents.

Recently introduced authentication key injection method using a wireless interval is shown in FIG. In this method, the terminals 38 and 39 and the authentication center 30 generate very large prime numbers and random numbers, respectively, and exchange the two numbers to generate authentication keys. Instead of using the communication lines 41 and 43 as shown in FIG. 2, a separate wireless section authentication key generation device 50 is used. The authentication keys are generated directly by using wireless communication between the terminals 38 and 39 and the wireless section authentication key generation device 50. Since the terminal needs to calculate the exponential power of 512bit or more and requires additional equipment, it is not used until now and can be used in the future.

Accordingly, the present invention is to overcome the above-mentioned conventional problems, an object of the present invention is to use a communication line and inject the authentication key in the authentication center other than the authentication center, the authentication via the communication line in the place other than the authentication center Instead of delivering the authentication key directly to the center, only the information necessary for decryption of the authentication key is transmitted so as to prevent confidential leakage of the authentication key value during transmission on the communication line.

In addition, an object of the present invention is to prevent a secret leakage of the authentication key value by allowing the terminal subscriber to independently change the authentication key after the authentication key is generated first with the help of the terminal registration agent. .

As an example of the terminal authentication key injection device of the mobile communication network for achieving the object of the present invention,

Authentication key injection module that generates authentication key generation and data for decryption of authentication key, printer capable of printing envelopes, NAM programming equipment for each manufacturer that enables direct communication with the terminal through a communication port mounted on the terminal, and customer management And a communication module of a terminal registration agency comprising a communication relay module for a charging center and a customer management and charging center communication module for communicating through a line.

A communication module for bidirectional communication with the communication relay module of the customer care and billing center, an authentication key injection module for decrypting the transmitted authentication key decryption data and generating an authentication key, and an authentication key generated in the authentication key injection module. It consists of an authentication center which consists of a data base.

In addition, as an example of the terminal authentication key injection method of the mobile communication network according to the present invention,

The terminal registration distributor is equipped with an authentication key injection module in an integrated computer with a dot printer, and the operator provides the authentication key injection software (authentic key injector) to the terminal registration distributor so as to distribute the authentication key injection software to the desired terminal subscriber. Preparation for injecting the authentication key into the terminal, Entering a random 10-digit number through the keypad, ESN, the serial number of the terminal, Random number generated by the random number generator, Key value of the predefined secret key and this key A random number used to select a value is injected into the input of the authentication key generation module to generate the authentication key and the authentication key decryption data,

Inputting the generated authentication key into the terminal;

The data for decryption of the authentication key is transmitted to the communication module of the authentication center through the communication relay module of the customer management and billing center through the communication module, and the data for decryption of the authentication key is obtained from the secret key index predefined in the authentication key generation module. This is inputted into the stored predefined secret key to obtain the secret key, and after changing the ESN according to the change code, the authentication key is input to the generation module together with the secret key, wherein the authentication key generation module generates the final authentication key. It is composed of steps that are input to the database.

With such a configuration, only the decryption code is transmitted in the network instead of the authentication key when the authentication key is injected, so that the authentication key is secured even when an eavesdropping occurs.

1 is a block diagram of a conventional mobile communication network

2 is a block diagram illustrating a step of injecting a wired terminal authentication key in a conventional mobile communication network.

3 is a block diagram for explaining a wireless terminal authentication key injection step of a conventional mobile communication network

4 is a block diagram of a terminal authentication key injection device of a mobile communication network according to the present invention;

5 is a block diagram of an authentication key injection module of a terminal registration agent according to the present invention;

Figure 6 is a block diagram of a terminal authentication key injection module of the authentication center according to the present invention

<Explanation of symbols for main parts of drawing>

20: terminal 22: base station

24: exchange office 26: home location register

30: authentication center 32, 38, 39: terminal authentication key

33: Customer Care and Billing Center

34, 35, 36, 37: terminal registration agent

50: wireless section authentication key generation equipment

62: authentication key injection module 64: communication module

68: communication relay module 72: customer care and billing center communication module

74: authentication key injection module 76: printer capable of printing envelopes

76: NAM programming equipment by terminal manufacturer

Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 4 to 6.

One embodiment according to the present invention operates as a wired communication network structure as shown in FIG. 4, the communication module of the terminal registration agent 34 according to the present invention includes an authentication key injection module 74 for generating authentication keys and generating authentication key decryption data, and a printer 76 capable of printing a paper bag. And, through the line 43, the NAM programming equipment 78 for each terminal manufacturer to directly communicate with the terminal through a communication port mounted on the terminal, and the communication relay module 68 for the customer care and billing center 33. It consists of a customer care and billing center communication module 72.

Referring to FIG. 5, in the authentication key injection module 74, the user presses a random number 10 digits with the keypad 87, and then, the random number 10 digits and the serial number of the terminal ESN 82; Electronic Serial Number), a 32-bit random number generated by the random number generator 85, a key value of the 64-bit predefined secret key 81, and a 12-bit random number used to select this key value. The authentication key is injected into the input of the generation module. However, any number 10 digits can be omitted, in which case the random number generator (85) takes its role. The 64-bit authentication key 84 and the 64-bit authentication key decryption data 86 are generated in accordance with the injected input.

The contents of the authentication key decryption data are as follows.

(1) 32-bit random value generated using random number generator

(2) Key value for finding the value of the 12-bit predefined secret key as a result of the subscriber inputting an arbitrary ten digits through the keypad 87

(3) As a result of the subscriber entering any ten digits via the keypad 87, an 8-bit predefined secret key table identification number

(4) 12-bit ESN change code and agency identification code that are automatically set when the authentication key injector software is installed

The random number generator 85 generates random numbers in the following manner.

Declare variable A for random number generation.

Set an arbitrary value to variable A. This is a one-time procedure for random number generation.

Whenever a random number is needed, get the random number by doing

○ Determine variable A as A × constant1 + constant2 . Here, constants 1 and 2 have a lot of influence on random numbers, so be very careful when selecting them. The equation currently used is:

A = A * 1103515245 + 12345;

Take only a portion of the variable A and use it to form a random number. For example, using the 20th to 28th numbers of variable A as a random number yields a random number from 0 to 255. For reference, since variable A is 32 digits in length, repeat the above method to find the random number exceeding 32.

The structure of the ESN 82 is composed of an 8-bit manufacturer's number and a 24-bit manufacturer's serial number. The reason why ESN is used in the present invention is that if the authentication key can be different for all terminals, it is advantageous in terms of authentication than it has the same value. For this reason, since all terminals have different values, the ESN includes the ESN in generating the authentication key, so the authentication key may have a different value.

The authentication key injector generates an authentication key using a code for decrypting the authentication key. The authentication key injector cleans up the input. The input value has a 128-bit length as shown in Table 1. The values are 32-bit random numbers, 64-bit predefined secret key values, and 32-bit modified ESN values.

Type of input value Random number Predefined secret key Changed ESN Length 32 bit 64 bit 32 bit Data needed to generate input 32-bit random number Key value of 12 bits Identification number of 8 bits 32bit ESN12bit change and dealer code

The 128-bit input is reduced to 64 bits. This method is as follows. This method is an important element of the present invention.

① Declare 8 variables of 8 bits.

② The eight declared variables are called B0, B1, B2 ---, B7 and set to 0.

③ 128bit input value is C0, C1, C2 ---, C15 and they are each 8bit in size.

④ B0 = C1 ◎ C11 ◎ C13 ◎ C0 ◎ C4 ◎ C9 ◎ C1 ◎ C6 ◎ C12 ◎ C7 ◎ C1 ◎ C6 ◎ C14 ◎ C13 ◎ C4 ◎ C10 ◎ C11 ◎ C2 ◎ C14 ◎ C9 ◎ C9

⑤ B1 = C1 ◎ C14 ◎ C14 ◎ C2 ◎ C5 ◎ C10 ◎ C2 ◎ C7 ◎ C14 ◎ C10 ◎ C2 ◎ C7 ◎ C4 ◎ C0 ◎ C5 ◎ C0 ◎ C14 ◎ C9 ◎ C3 ◎ C11 ◎ C12

⑥ B2, B3, ---, B7 can also be schematiced as above.

⑦ ◎ Operator is obtained as follows.

The operator is an operator to which the exchange law, the distribution law, and the distribution law do not apply. The operator calculates in order from left to right as follows. Explain with B0.

B0 = C1

B0 = ((B0 / 2 + C11) ＾ Ox04 + 17) AND OxFF

B0 = ((B0 / 2 + C13) ＾ Ox04 + 17) AND OxFF

---

B0 = ((B0 / 2 + C9) ＾ Ox04 + 17) AND OxFF

The authentication key 84 may be input to the terminal subscriber's terminals 38 and 39 in two ways. The first method is a bag that is sealed with paper through a paper bag printable printer 76 (not shown inside, such as a pay stub, and refers to an envelope that becomes a paper feed factor when printed with dot print). Is printed on and delivered to the subscriber. The subscriber then enters the printed envelope in a secret place and enters the authentication key there using the keypads of his terminals 38 and 39.

The second method is a method of injecting the authentication key through the NAM programming equipment 78 for each terminal manufacturer directly to the terminal using a communication port usually provided at the bottom of the terminal. On the other hand, the generated authentication key 84 is printed as described above and is also directly input to the terminal by the terminal manufacturer-specific NAM programming equipment 78.

Referring to FIG. 4, the data for decryption of the authentication key 86 is transmitted to the authentication center 30 through the communication module 72 of the customer care and billing center 33 through the communication module 72.

The authentication center 30 authenticates the communication module 64 for bidirectional communication with the communication relay module 68 of the customer care and billing center 33, and the authentication key to decrypt the data for decrypting the transmitted authentication key to generate an authentication key. The key injection module 62 and the base base 32 for storing the authentication key generated by the authentication key injection module 62.

The authentication key decryption data 96 is obtained by the secret key index 98, which is predefined in the authentication key generation module 97, which is inputted into the predefined secret key 91, which is stored in memory, to obtain the secret key 99. In addition, after changing the ESN 82 according to the change code, the authentication key is input to the generation module 97 together with the secret key 99. The authentication key generation module 97 generates a final authentication key 94 and inputs it to the database 32.

By the above configuration, the terminal authentication key injection device of the mobile communication network of the present invention operates as follows.

The terminal registration agents 35, 36, and 37 are equipped with an improved authentication key injection module in accordance with the present invention in an integrated computer with a dot printer, and the operator wants to use the authentication key injection software (called authentication key injection). It should be kept at the terminal registration agent for distribution.

First, the terminal subscriber will select the desired terminal.

Now the authentication key, which is a permanent secret key for the selected terminal, must be entered into the terminal and the authentication center.

In the terminal registration agent, the authentication key generation operation is started by pressing the setting key pad of the authentication key injector. In order to inject the authentication key directly into the terminal, the communication port of the terminal and the authentication key may be connected to the terminal of the injector. In addition, the subscriber may enter any ten digits, which may be omitted as described above.

Then, to select the ESN 82 which is the serial number of the terminal, the 32-bit random number generated by the random number generator 85, the key value of the 64-bit predefined secret key 81, and the key value. The 12-bit random number used is injected into the input of the authentication key generation module. The 64-bit authentication key 84 and the 64-bit authentication key decryption data 86 are generated in accordance with the injected input.

The generated authentication key 84 is delivered to the subscriber by printing in a bag sealed with a paper bag through the paper bag printable printer 76, when the terminal is not directly connected to the injector. The subscriber then enters the printed envelope in a secret place and enters the authentication key there using the keypads of his terminals 38 and 39. In addition, the authentication key can be injected directly into the terminal using a communication port usually provided at the bottom of the terminal. However, when the initial authentication key is injected, there is a risk of leaking the authentication key from the terminal registration agent that acts on it. To prevent this, the data code for decryption of the authentication key includes an agency code. If a person signing up at a particular agency generates a lot of authentication errors, that agent is classified and managed with care.

The data for decryption of the authentication key 86 is transmitted to the communication module 64 of the authentication center 30 through the communication relay module 68 of the customer care and billing center 33 through the communication module 72, and authentication. The key decryption data 96 is obtained by a predefined secret key index 98 in the authentication key generation module 97, which is input into a memorized predefined secret key 91 to obtain a secret key 99. Also, after changing the ESN 82 according to the change code, the authentication key is input to the generation module 97 together with the secret key 99. The authentication key generation module 97 generates a final authentication key 94 and inputs it to the database 32.

As described above, since the terminal authentication key injection device and the method of the mobile communication network according to the present invention, only the decryption code is transmitted instead of the authentication key in the network when the authentication key is injected, even if an eavesdropping occurs. Keep safe

In addition, since a very simple method is used, the overload of the authentication center is prevented, and the place where the authentication key is provided is included in the decryption code, thereby facilitating the cause analysis when an authentication error occurs.

What has been described above is just one embodiment for implementing the terminal authentication key injection device and method of the mobile communication network according to the present invention, the present invention is not limited to the above-described embodiment, the scope of the claims Various changes can be made by those skilled in the art without departing from the gist of the present invention.

Claims (12)

NAM for each terminal manufacturer to directly communicate with the terminal through an authentication key injection module 74 for generating authentication key generation and data for decryption of the authentication key, a printer 76 capable of printing a paper bag, and a communication port mounted in the terminal. Terminal registration agent 34 comprising a programming equipment 78, a customer care and billing center communication module 72 that communicates via a line 43 and a communication relay module 68 of the customer care and billing center 33. Communication module, A communication module 64 for bidirectional communication with the communication relay module 68 of the customer care and billing center 33, an authentication key injection module 62 for decrypting the transmitted authentication key decryption data and generating an authentication key; And an authentication center 30 including a base base 32 for storing authentication keys generated by the authentication key injection module 62. Terminal authentication key injection device of a mobile communication network, characterized in that consisting of. The method of claim 1, The authentication key injection module 74 is a random number that the user inputs to the keypad 87, an electronic serial number (ESN) 82, which is a serial number of the terminal, a random number generated by the random number generator 85, and previously. The key value of the defined secret key 81 and a random number used to select the key value are injected into the input of the authentication key generation module, so that the authentication key 84 and the authentication key decryption data 86 are generated. Terminal authentication key injection device of the mobile communication network. The method of claim 2, The random number may be omitted, in this case, the terminal authentication key injection device of a mobile communication network, characterized in that the random number generator (85) takes its place. The method of claim 2, wherein the content of the authentication key decryption data is (1) 32-bit random value generated using random number generator (2) Key value for finding the value of the 12-bit predefined secret key as a result of the subscriber inputting an arbitrary ten digits through the keypad 87 (3) As a result of the subscriber entering any ten digits via the keypad 87, an 8-bit predefined secret key table identification number (4) 12-bit ESN change code and agency identification code that are automatically set when the authentication key injector software is installed Terminal authentication key injection device, characterized in that the mobile communication network. The method of claim 1, The authentication key 84 is printed on a bag sealed with a paper bag through a paper bag printable printer 76 and delivered to the subscriber, and the subscriber goes to the covert place in a secret place where his terminal 38, 39 is located. The authentication key injection device of a mobile communication network, characterized in that for inputting the authentication key using the key pad. The method of claim 1, A terminal authentication key injection device for a mobile communication network, characterized in that the authentication key is injected into the terminal directly through the terminal manufacturer-specific NAM programming equipment 78 using a communication port usually provided at the bottom of the terminal. The terminal registration agents 35, 36, and 37 are equipped with an authentication key injection module in an integrated computer with a dot printer, and the operator can distribute the authentication key injection software (authentic key injection) to the desired terminal subscriber. Step on, A preparation step for injecting the authentication key into the selected new terminal; Inputting an arbitrary ten digits through the keypad 87, ESN 82 which is a serial number of the terminal, a random number generated by the random number generator 85 and a key value of the predefined secret key 81 and a random number used to select this key value is input to the authentication key generation module. Is injected into, to generate the authentication key 84 and authentication key decryption data 86, Inputting the generated authentication key 84 into the terminal; The data for decryption of the authentication key 86 is transmitted to the communication module 64 of the authentication center 30 through the communication relay module 68 of the customer care and billing center 33 through the communication module 72, and authentication. The key decryption data 96 is obtained by a predefined secret key index 98 in the authentication key generation module 97, which is input into a memorized predefined secret key 91 to obtain a secret key 99. Also, after changing the ESN 82 according to the change code, the authentication key generation module 97 is input to the authentication key generation module 97 together with the secret key 99. The authentication key generation module 97 generates a final authentication key 94 Step entered into database 32 Terminal authentication key injection method of a mobile communication network, characterized in that consisting of. The method of claim 7, wherein The authentication key injection module 74 is a random number that the user inputs to the keypad 87, an electronic serial number (ESN) 82, which is a serial number of the terminal, a random number generated by the random number generator 85, and previously. The key value of the defined secret key 81 and a random number used to select the key value are injected into the input of the authentication key generation module, so that the authentication key 84 and the authentication key decryption data 86 are generated. The terminal authentication key injection method of the mobile communication network. The method of claim 7, wherein The random number input may be omitted, in this case, the terminal authentication key injection method of the mobile communication network, characterized in that the random number generator (85) takes its place. The method of claim 8, wherein the contents of the authentication key decryption data is (1) 32-bit random value generated using random number generator (2) Key value for finding the value of the 12-bit predefined secret key as a result of the subscriber inputting an arbitrary ten digits through the keypad 87 (3) As a result of the subscriber entering any ten digits via the keypad 87, an 8-bit predefined secret key table identification number (4) 12-bit ESN change code and agency identification code that are automatically set when the authentication key injector software is installed Terminal authentication key injection method of a mobile communication network, characterized in that. The method of claim 7, wherein The authentication key 84 is printed on a bag sealed with a paper bag through a paper bag printable printer 76 and is delivered to the subscriber, where the subscriber goes to a secret place and there is a terminal 38 and 39 there. Method for injecting the authentication key terminal of the mobile communication network, characterized in that for inputting the authentication key using the key pad. The method of claim 7, wherein Method for injecting a terminal authentication key of a mobile communication network, characterized in that the authentication key is injected into the terminal directly through the NAM programming equipment 78 for each terminal manufacturer using a communication port usually provided at the bottom of the terminal.