WO2004102883A1

WO2004102883A1 - A kind of method to realize user authentication

Info

Publication number: WO2004102883A1
Application number: PCT/CN2004/000497
Authority: WO
Inventors: Jianghai Gao; Yang Shao; Dianfu Chen; Zhuo Li
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2003-05-16
Filing date: 2004-05-17
Publication date: 2004-11-25
Also published as: CN1549494A

Abstract

The present invention disclose a kind of method to realize user authentication, which is applied to the multi-mode network at least included IS95/CDMA200 I X network, the method include that: A. Set expanding authentication (EPA) protocol beforehand which support that client end and authentication point use user status identification module (UIM) to authenticate, said authentication point is non-IS95/CDMA200 1 X network in multi-mode network; B. Client end use the user information as the user status identification, proceed the EPA authentication with authentication point. The present invention realizes user authentication for non-IS95/CDMA200 I X network using IS95/CDMA200 I X network, the method can reduce invest cost, and be authentication security, attendance for convenience.

Description

Method for implementing user authentication

The present invention relates to authentication technology between a user and a network, and in particular, it includes at least

In a multimode network of an IS95 / CDMA2000 lx network, a method for performing user authentication on a non-IS95 / CDMA2000 lx network in a multimode network using the IS95 / CDMA2000 lx network. Background of the invention

The RFC2284 document defines an extended authentication protocol for the point-to-point (PPP) protocol, namely the extended authentication (EAP) protocol. This protocol can be extended on the basis of the EAP protocol to support other authentication mechanisms and provide end-to-end authentication methods. The intermediate device does not need to adopt a specific authentication mechanism. In detail, when the authentication is performed between the authentication client and the authentication server, the authentication mechanism carried by both parties on the EAP protocol can be adopted, and no intermediate device is required to support it. The EAP authentication protocol is defined differently according to different bearer types. For example, the EAP authentication protocol is carried on the PPP protocol, called EAPoPPP; the EAP authentication protocol is carried on the Remote Access Dial-In User Service (RADIUS) protocol, called EAPoRadius; the EAP authentication protocol is used on the 802.1x protocol, called EAPoL.

As shown in FIG. 1, the EAP authentication protocol message includes four fields: a code, a code, an identifier, a length, a data, and a type. The Data field includes two types: Type and TypeData. Each field is transmitted from left to right during transmission.

The Code field occupies one byte and is used to identify the type of the EAP packet. As shown in Table 1, this domain has four types of values, where 1 represents the Request domain, 2 represents the Response domain, 3 represents the Success domain, and 4 represents the Failure domain. Type value meaning

1 Request

2 Response

3 Success

4 Failure

The Identifier field occupies one byte and is used to match the Request message and the Response message. The Length field occupies two bytes and is used to indicate the length of the EAP packet. It includes four fields: Code, Identifier, Length, and Data.

The Data field occupies zero or more bytes. This field uses a format related to the Code field type value.

The Type field occupies one byte and mainly defines various authentication mechanisms. The Type field appears only in Request and Response messages. In RFC 2284, Type can be six types: Identity, Notification, Nak :, MD5 (MD5 -Challenge), One-Time Password, and Smart Card (Generic Token Card). .

As shown in Table 2, the type value is 1 for Identity; the type value is 2 for Notification; the type value is 3 for Nak; the type value is 4 for MD5-Challenge; the type value is 5 for One-Time Password; the type value is 6 means Generic Token Card. In addition, the type values of 1, 2, 4, 5, and 6 are applicable to Requset and Respone, and the type value of 3 is only applicable to Response messages.

Identity is used to query the identity of the user. Each Request request of the Identity type must correspond to a Response response of the Identity type.

Notification is used by the device to send a displayable message to the client. The client should display this message to the user, and if it cannot display it, log it. Every A Notification request message must correspond to a Notification response message.

Nak is only applicable to Response packets. When the expected authentication mechanism in the Request message is not accepted, a Nak-type Response message should be sent.

MD5-Challenge is similar to MD5 in CHAP protocol. The MD5-Challenge type Request request message includes a Challenge message. Each MD5-Challenge type Request request message must correspond to a MD5-Challenge type or Nak type Response response message.

One-Time Password type Request request contains one OTP Challenge request request. One = One-Time Password type response message must correspond to one One-Time Password type or ak type.

The Generic Token Card type is defined to require users to enter various Token Card information. The Generic Token Card type Request request message contains an ASCII text message, and the corresponding Generic Token Card type Response response message contains the relevant Token Card information required for authentication. This information is usually read by the user from the Token Card device and entered in ACSII text.

Table 2

TypeData, this field occupies zero or more bytes, and is related to the type value of the Type field Format.

For users in a CDMA IS95 / CDMA 2000 lx network, the client and the authentication point are the mobile switching center (MSC) / visit location register (VLR) and medium access register (HLR) / authentication center (AC) on the network side. Complete certification together. The shared secret data (SSD) is stored in the terminal and HLR / AC as one of the authentication input parameters, and the same (password) A-key is stored in the terminal and HLR / AC, which is used to update the SSD. When authentication is required, the authentication result is calculated by using the parameters such as SSD, random number, electronic serial number (ESN), and mobile station identification number (MIN) through the cellular authentication and voice encryption (CAVE) algorithm, and the MSC / VLR or HLR / The AC compares whether the authentication results are consistent. If they are not consistent, the system will initiate an SSD update. After the SSD update is successful, that is, the SSDs on the terminal side and the network side remain consistent. The next time the user accesses, the authentication result calculated by the user terminal using the SSD should be Consistent with the authentication results calculated in HLR / AC, authentication can be successful.

Currently, with the development of market economy and science and technology, more and more operators need to operate multiple networks at the same time. For example, operators with IS95 / CDMA2000 lx networks want to continue to expand their services to CDMA2000 lxDO networks, and operators of WLAN networks also want to expand their services to CDMA2000 lxDO networks. In a CDMA2000 lxDO network, a special AN authentication, authorization, and accounting server (AAA) must be established for authentication. This authentication method requires users who have multiple code division multiple access (CDMA) networks to open accounts in two places, HLR and AN AAA. The authentication methods are not unified, maintenance is not convenient, and it is not conducive to unified operation. Then a national private network of AN AAA is set up for authentication, and the network construction cost is high. Summary of the Invention

In view of this, an object of the present invention is to provide a method for implementing user authentication, so as to implement user authentication in a multi-mode network including at least an IS95 / CDMA2000 lx network, and Low cost and easy maintenance.

A method for implementing user authentication is applied to a multi-mode network including at least an IS95 / CDMA2000 lx network, and the method includes:

A. Pre-set EAP protocol that supports client and authentication point to use user identity module (UIM) for authentication, the authentication point is a non-IS95 / CDMA2000 lx network in a multi-mode network;

B. The client uses the user information in the UIM as the user identity, and performs EAP-UIM authentication with the authentication point.

The EAP protocol described in step A is set to a message code (Code), an identifier (Identifier), a length (Length), and data (Data), and the Data further includes a type (Type) and a data type (TypeData).

The Type is set to seven types including Identity, Notification Nak, MD5-Challenge, One-Time Password, Generic Token Card, and UIM.

The values from 1 to 6 correspond to the set Type. The Type is UIM, and the value can be any value greater than 6.

The TypeData is set to include three fields: Type, Length, and Data.

The Type, Length, and Data values are greater than or equal to 1 and less than or equal to 255, and the Type, Length, and Data values are not equal.

The step B further includes:

Bl. The client sends the user identity to the authentication point.

B2. The authentication point generates a random number for authenticating the client according to the user identity, and calculates a corresponding first authentication number according to the random number and the shared secret data (SSD) contained in the authentication point to form an authentication set. ;

B3. The client calculates a corresponding second authentication number according to the random number and the SSD of the client. B4. The authentication point compares whether the first authentication number is consistent with the second authentication number. If they are the same, the authentication succeeds; otherwise, the authentication fails.

Step B1 further includes:

B11. The authentication point sends a client request user identity (EAP-Request / Identity) message to the client, asking the client to send its own identity;

B12. The client sends the user identity to the authentication point through an identity response (EAP-Response / Identity).

B13> After receiving the EAP-Response / Identity message, the authentication point sends an EAP-Request / UIM / Start message to the client to start EAP-UIM authentication.

B14. After receiving the EAP-Request / UIM / Start message, the client sends an EAP-UIM authentication protocol start response (EAP-Response / UIM / Start) message to the authentication point.

Step B14 further includes:

After receiving the EAP-Response / UIM / Start message, the authentication point sends an EAP-UIM authentication protocol authentication request (EAP-Request / UIM / Challenge) message to the client, and sends the random number obtained from the authentication server to the client. end.

Step B3 further includes: the client sends the second authentication number calculated by itself to the authentication point through an EAP-UIM authentication protocol authentication response (EAP-Response / UIM / Challenge) message.

After the authentication fails, the method further includes:

E. Update the SSDs in the client and the authentication server to ensure that the SSDs at both ends are equal, and then return to step B for execution.

The invention implements the IS95 / CDMA2000 lx network to authenticate users using the IS95 / CDMA2000 lx network by expanding the EAP authentication protocol. This method can reduce cost investment, authentication security, and convenient maintenance. 4 / ϋ 0 0 Brief description of the drawings

FIG. 1 is a schematic diagram of an EAP protocol message format in the prior art;

FIG. 2 is a schematic flowchart of implementing the method of the present invention;

FIG. 3 is a schematic flowchart of a specific embodiment of performing first authentication according to the present invention; FIG.

FIG. 4 is a schematic flowchart of a specific embodiment for performing an authentication according to the present invention. Mode of Carrying Out the Invention

The core content of the present invention is: By further expanding the EAP authentication protocol, a user identity recognition module (UIM) in an IS95 / CDMA2000 lx network is used to authenticate non-IS95 / CDMA2000 lx network users. UIM is not only used in CDMA IS95 and CDMA 2000 lx networks, but also in other networks, such as WLAN networks and CDMA EVDO networks. When it is used in these networks, an authentication protocol is needed to carry its authentication mechanism.

The networking structure for implementing the present invention includes a client, an authentication point, and an authentication server. The authentication server indicates that the network can terminate the communication between the EAP protocol and the authentication point through the AAA protocol, such as the communication through the Radius protocol. In addition, the authentication server can communicate with the CDMA network and can obtain the authentication set from the HLR of the CDMA network; the authentication point and the authentication server can communicate through the existing AAA communication protocol, such as the Radius protocol; the client Refers to the terminal that contains the UIM module. It includes two cases. One is that the terminal and the UIM module are not separated, that is, the case where the machine card is not separated. The other is that the terminal and the UIM module are separated. Communication through the relevant interface, that is, the normal machine-card separation state.

Referring to FIG. 2, the method for implementing the present invention includes the following steps:

Step 201: preset an EAP protocol supporting the client and the authentication point to use UIM for authentication; Step 202: The client uses the user information in the UIM as the user identity, and starts EAP-UIM authentication with the authentication point.

Step 203: The authentication point generates a random number for authenticating the user terminal according to the user identity, and calculates a corresponding first authentication number according to the random number and the SSD contained in the authentication point to form an authentication set.

Step 204: The client calculates a corresponding second authentication number according to the random number and the SSD of the client.

Step 205: The authentication point compares whether the first authentication number and the second authentication number are consistent. If they are the same, the authentication succeeds; otherwise, the authentication fails.

The technical solution of the present invention will be described in detail below with reference to the drawings and specific embodiments.

The invention is extended on the EAP authentication protocol to generate a new authentication protocol EAP-UIM. The authentication protocol format of the present invention includes four parts: Code, Identifier, Length, and Data, where Data includes two types: Type and TypeData, which is the same as the prior art. However, the Type parameter and TypeData parameter are different from the prior art.

Furthermore, a new type of UIM is further added in the TYPE field of the EAP protocol in the prior art, and the value can be a value greater than 6, which can be applied to Requset and Respone messages. For example, if the TYPE field is defined as 31, it indicates that the packet type adopts the EAP-UIM protocol.

The TYPE-DATA field includes three types: Type and Lengths Value. The TYPE field is used to indicate the message type of the EAP-UIM protocol. As shown in Table 3, three types of values are specified in this embodiment; the Length field is used to describe the length of the EAP-UIM message, and specifically includes the length of the Type, Length, and Data fields; the Value field uses the type value of the Type field Related formats. Value

11 Start

12 Challenge

13 Update Table 3

The method of using UIM to authenticate users is the same as the method of user authentication in CDMA IS95 / CDMA 2000 lx networks in the prior art. The first authentication fails in the first authentication, mainly due to the user terminal side and the network side. Due to inconsistent SSDs, after an authentication failure, an SSD update operation needs to be performed to make the SSDs at both ends consistent.

As shown in Figure 3, the specific process of the user's first authentication is as follows:

Step 301: The authentication point sends a client request user identity (EAP-Request / Identity) message to the client, and requires the client to send its own identity;

Step 302: The client obtains the identity information stored in the UIM, uses the identity information as the user identity, and sends the user identity to the authentication point in response to a user identity (EAP-Response / Identity) message.

Step 303: After receiving the EAP-Response Identity message, the authentication point sends an EAP-UIM authentication protocol start request (EAP-Request / UIM / Start) message to the client to start the EAP-UIM authentication protocol process. Here, The authentication point uses the extended protocol request to obtain the user identity. In the following steps, the TYPE and TYPEDATE parameters in the extended protocol will also be used to transmit the EAP-UIM authentication information between the client and the authentication point.

Step 304: After receiving the EAP-Request / UIM / Start message, the client returns an EAP-UIM authentication protocol start response (EAP-Response / UIM / Start) message to the authentication point; step 305 '. The authentication point receives After EAP-Response / UIM / Start, it passes the authentication service The W server exchanges to obtain an authentication set of a random number (rand) and its corresponding second authentication number (AUTH2), and then sends an EAP-UIM authentication protocol authentication request (EAP-Request / UIM / Challenge) report to the client. The document contains a random number. Here, the process by which the authentication server obtains an authentication set is as follows: a random number is generated according to the user identity, and the corresponding second authentication number is calculated according to the SSD stored on the network side;

Step 306: After receiving the EAP-Request / UIM / Challenge message, the client encrypts the SSD stored in Rand and UIM to obtain the first authentication number (AUTH1), and then updates the response message through the EAP-UIM authentication protocol. The text (EAP-Response UIM / Challenge) is sent to the authentication point, and the message carries AUTH1;

Step 307: After receiving the EAP-Response / UIM / Challenge message, the authentication point will compare the authentication server with AUTH1 and the AUTH2 saved by itself. If they are the same, the authentication point will notify the authentication point of success, otherwise, the authentication will fail and then authenticate. Click to determine whether the Update process is required. If necessary, start the Update process, update the SSD, and perform step 308; otherwise, the authentication fails and the process exits.

Step 308: The authentication point obtains an SSD authentication random number (RANDSSD) and its corresponding authentication number. The authentication number is calculated according to the network side and the RANDSSD, and then the authentication point sends an EAP-UIM authentication protocol update response to the client. Text (EAP-Request / UIM / Update) message, which contains an SSD authentication random number (RANDSSD);

Step 309: After receiving the EAP-Request UIM / Update message, the client calculates the corresponding authentication number according to the RANDSSD and the SSD saved by the client, and sends an EAP-UIM authentication protocol authentication response (EAP-Respnse) to the authentication point. / UIM / Challenge) packet, which contains the authentication number calculated by the client;

Step 310: After receiving the EAP-Respnse / UIM / Challenge message, the authentication point determines whether the authentication numbers calculated by the network side and the client are the same. If they are the same, the client returns a EAP-UTM authentication protocol authentication request (EAP-Request / UIM / Challenge), otherwise, the SSD update fails;

Step 311: After receiving the EAP-Request / UIM / Challenge, the client updates its SSD, and sends the calculated SSD to the authentication point through an EAP-Response / UIM / Update message.

Step 312: After receiving the EAP-Response / UIM / Update, the authentication point updates the SSD on the network side to determine whether the SSD is updated. If the update is completed, the Update process is ended, and an EAP-Request / UIM / Challenge message is sent to the client. Re-certify;

Step 313: After receiving the EAP-Request / UIM / Challenge message, the client returns an EAP-Response / UIM / Challenge message to the authentication point.

Step 314: After the authentication point judges that the authentication is successful according to the EAP-Response / UIM / Challenge, it sends an EAP-Success message to the client;

After the SSD is certified for the first time, since the SSDs of the client and the authentication point are consistent, the subsequent certification process is only the certification process. As shown in Figure 4, the certification process for non-first certification is as follows:

Step 401: The authentication point sends an EAP-Request / Identity message to the client, requesting the client to send its own identity;

Step 402: After receiving the EAP-Request / Identity message, the client uses the identity information stored in the UIM as the user identity, and sends the user identity to the authentication point through the EAP-Response / Identity message;

Step 403: After receiving the EAP-Response / Identity message, the authentication point sends an EAP-Request / UIM / Start message to the client to start the EAP-UIM authentication protocol. Step 404: The client receives the EAP-Request After the / UIM / Start message, an EAP-Response / UIM / Start message is returned to the authentication point;

Step 405: After the authentication point receives the EAP-Response / UIM / Start message, it sends a message from the authentication server. The Rand obtained by the server and the corresponding second authentication number (AUTH2), and then sends the Rand to the client through the EAP-Request / UIM / Challenge message; the second authentication number is based on the random number and saved on the network side. Calculated by the SSD;

Step 406: After receiving the EAP-Request / UIM / Challenge message, the client encrypts the password stored in Rand and UIM to obtain AUTH1, and the client sends the EAP-Response / UIM / Challenge message to the authentication point. Where the message carries AUTH1;

Step 407: After receiving the EAP-Response / UIM / Challenge message, the authentication point sends the received message to the authentication server through the AAA communication protocol with the authentication server. The authentication server compares AUTH1 with AUTH2 stored by itself. If they are consistent, the authentication point is notified of success, and then the authentication point sends an EAP-Success message to the client to notify the client of successful authentication.

The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention shall be included in the present invention. Within the scope of protection.

Claims

Claim

1. A method for implementing user authentication, which is applied to a multi-mode network including at least an IS95 / CDMA2000 lx network, and is characterized in that the method includes the following steps:

A. Pre-set extended authentication (EAP) protocol that supports client and authentication point to use user identity module (UIM) for authentication, the authentication point is a non-IS95 / CDMA2000 lx network in a multi-mode network;

2. The method according to claim 1, wherein the EAP protocol in step A is set to a message code (Code), an identifier (Identifier), a length (Length), and data (Data), and the Data And further includes type (Type) and data type

(TypeData).

3. The method according to claim 2, wherein the Type is set to include an identity (Identity), a notification (Notification), a rejection (Nak), and an MD5 challenge

(MD5-Challenge), one-time password (One-Time Password), smart card (Generic Token Card), user identification module (UIM) seven types.

4. The method according to claim 3, wherein the values of 1 to 6 are respectively corresponding to the set Type, the Type is UIM, and the value is any value greater than 6.

5. The method according to claim 2, wherein the TypeData is set to include three fields: Type, Length, and Data.

6. The method according to claim 5, wherein the Type, Length, and Data values are greater than or equal to 1 and less than or equal to 255, and the Type, Length, and Data values are not equal.

7. The method according to claim 1, wherein step B is further Including:

Bl. The client sends the user identity to the authentication point.

B3. The client calculates a corresponding second authentication number according to the random number and the SSD of the client.

B4. The authentication point compares whether the first authentication number and the second authentication number are consistent. If they are the same, the authentication succeeds; otherwise, the authentication fails.

8. The method according to claim 7, wherein step B1 further comprises: B11. The authentication point sends a client requesting user identity to the client.

(EAP-Request / Identity) message, requesting the client to send its own identity;

B12. The client sends the user identity to the authentication point through an identity response (EAP-Response / Identity) message.

B13. After receiving the EAP-Response / Identity message, the authentication point sends it to the client.

EAP-UIM authentication protocol start request (EAP-Request UIM / Start) message to start EAP-UIM authentication;

B14. After receiving the EAP-Request / UIM / Start message, the client sends it to the authentication point.

The EAP-UIM authentication protocol starts a response (EAP-Response UIM / Start) message.

9. The method according to claim 8, wherein step B14 further comprises:

After receiving the EAP-Response / UIM / Start message, the authentication point sends an EAP-UIM authentication protocol authentication request (EAP-Request / UIM / Challenge) message to the client, and sends the random number obtained from the authentication server to the client. .

10. The method according to claim 7, wherein step B3 further comprises The client sends the second authentication number calculated by itself to the authentication point through an EAP-UIM authentication protocol authentication response (EAP-Response / UIM / Challenge) message.

11. The method according to claim 7, wherein after the authentication fails, the method further comprises: