WO2005104432A1 - Procede permettant de supprimer l'identificateur de trafic de session ainsi que des informations correspondantes - Google Patents

Procede permettant de supprimer l'identificateur de trafic de session ainsi que des informations correspondantes Download PDF

Info

Publication number
WO2005104432A1
WO2005104432A1 PCT/CN2005/000532 CN2005000532W WO2005104432A1 WO 2005104432 A1 WO2005104432 A1 WO 2005104432A1 CN 2005000532 W CN2005000532 W CN 2005000532W WO 2005104432 A1 WO2005104432 A1 WO 2005104432A1
Authority
WO
WIPO (PCT)
Prior art keywords
tid
bsf
expired
naf
user terminal
Prior art date
Application number
PCT/CN2005/000532
Other languages
English (en)
French (fr)
Inventor
Yingxin Huang
Wenlin Zhang
Original Assignee
Huawei Technologies Co.,Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co.,Ltd. filed Critical Huawei Technologies Co.,Ltd.
Publication of WO2005104432A1 publication Critical patent/WO2005104432A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic

Definitions

  • the present invention relates to the field of third-generation wireless communication technology, and particularly to a method for deleting a session transaction identifier (TID) and its corresponding information by an entity (BSF) that performs initial check and verification of user identity in a common authentication framework.
  • TID session transaction identifier
  • BSF entity
  • the common authentication framework is used by a variety of application business entities.
  • a common structure used to complete the verification of the user's identity.
  • the application of the common authentication framework can check and Authentication.
  • the above-mentioned multiple application services may be multicast / broadcast services, user certificate services, instant information provision services, etc., or they may be agency services.
  • the universal authentication framework can also be used to check and authenticate the user terminals of the application services.
  • FIG. 1 shows the structure of a general authentication framework.
  • the universal authentication framework is generally composed of a user terminal (UE) 101, an entity (BSF) 102 that performs initial check and verification of user identity, a user home network server (HSS) 103, and a network application entity (NAF) 104.
  • BSF 102 It is used to perform mutual authentication with the user terminal 101, and simultaneously generate a shared key between the BSF 102 and the user terminal 101;
  • HSS 103 stores a profile file for describing user information, and HSS 103 also generates Function of authentication information.
  • the BSF When a user needs to use a certain service, if he knows that he needs to perform mutual authentication with the BSF, he will contact the BSF directly for mutual rights, otherwise, the user will first contact the NAF corresponding to the service. If the NAF applies the universal authentication If the user rights framework requires the user terminal to perform identity verification with the BSF, the user terminal is notified to apply the universal authentication framework for identity verification, otherwise other corresponding processing is performed.
  • the mutual authentication process between the user terminal and the BSF is: After receiving the authentication request from the user terminal, the BSF first obtains the authentication information of the user terminal from the HSS, and then executes the authentication and key agreement protocol (AKA) with the user terminal. ) For mutual authentication.
  • AKA authentication and key agreement protocol
  • the user terminal and the BSF mutually authenticate each other and generate a shared key Ks at the same time.
  • the BSF allocates a session transaction identifier (B-TID) to the user terminal, and the B-TID is associated with Ks.
  • B-TID session transaction identifier
  • the user terminal After receiving the B-TID, the user terminal sends a connection request to the NAF again, and the request message carries the B-TID.
  • NAF After NAF receives the request, it first checks whether it is available locally. B-TID, if NAF finds the B-TID locally, then it determines whether the key Ks corresponding to the B-TID or the key derived from Ks is Within the validity period set by the BSF, if yes, perform normal communication with the user terminal; otherwise, notify the user terminal to re-authenticate with the BSF, and then interrupt communication with the user terminal.
  • the NAF If the NAF cannot find the B-TID locally, it queries the BSF. After the BSF finds the B-TID, it first sets a validity period for the key information corresponding to the B-TID, and then sends a successful response message to the NAF.
  • the response message includes the B-TID and the key information corresponding to the B-TID And the expiration date of the key information that has been set.
  • all information corresponding to the B-TID such as key information and expiration date, is collectively referred to as B-TID correspondence information.
  • NAF After NAF receives the success response message from BSF, it considers that the user terminal is a legal user authenticated by BSF, and NAF and the user terminal also share key information, that is, Ks or a key derived from Ks. At this time, NAF saves the B-TID applied to the user terminal and the key information corresponding to the B-TID. In the local database. After that, NAF performs normal communication with the user terminal.
  • the NAF is notified that the user terminal has no information about the user terminal. At this time, the NAF will notify the user terminal to perform identity authentication with the BSF.
  • a UE may have one or more B-TIDs to communicate with different NAFs; moreover, the key Ks is usually used as the root key and It is not directly applied, but it is participated by the derived key of Ks.
  • the key Ks is usually used as the root key and It is not directly applied, but it is participated by the derived key of Ks.
  • NAF1 and NAF2 are two different NAFs.
  • the process of establishing communication between a UE that has passed BSF authentication and NAF1 and NAF2 is as follows:
  • the UE When the UE sends a service request containing B-TID information to NAF1, if NAF1 does not query the B-TID locally, it will query the BSF. After the BSF queries the B-TID required by NAF1, it first according to a certain The algorithm uses the Ks and NAF1 identification information as parameters to generate a derived key Ks-NAF1, and sets a validity period for the Ks-NAF1. Then, the BSF queries the B-TID and the secret corresponding to the B-TID. The key Ks-NAF1 and the validity period of the key are sent to NAF1. After receiving the successful response message from the BSF, NAF1 considers the UE as a legal user authenticated by BSF.
  • the user terminal also uses the same algorithm and parameters to generate the key Ks-NAFl.
  • the UE and NAF1 share the key Ks-NAF1, and NAF1 and the UE use the B under the protection of the key Ks-NAF1.
  • -TID performs normal communication.
  • the UE When the UE sends a service request containing the B-TID to NAF2, if NAF2 does not query the B-TID locally, it will query the BSF. After the BSF query, the information such as Ks and NAF2 identification is used as parameters. A certain algorithm generates a derived key Ks-NAF2 for NAF2. BSF sends the queried B-TID, the key Ks-NAF2 corresponding to the B-TID, and the validity period of the key to NAF2. After successfully responding to the message, the UE is considered to be a legal user authenticated by the BSF. At this time, the client should also use the same method to generate Ks-NAF2. In this way, the key KS-NAF2 is shared between the UE and NAF2, and NAF2 and the UE use the B-TID for normal communication under the protection of the key Ks-NAF2.
  • Ks-NAF1 and KS-NAF2 are generated by the same root key Ks, they are being calculated.
  • the NAF identification used in the process is different, so Ks-NAFl and Ks-NAF2 are also different.
  • the validity periods of Ks, Ks-NAF1 and Ks-NAF2 are all independent of each other.
  • Ks-NAFl or Ks-NAF2 When the validity period of Ks, Ks-NAFl or Ks-NAF2 expires, the client and BSF will not delete locally saved Ks, Ks-NAFl or Ks-NAF2, and B corresponding to Ks, Ks-NAFl or Ks-NAF2 -TID.
  • NAF1 considers that Ks-NAFl is insecure and asks the UE to update Ks-NAFl, the UE will go back to the BSF for initial authentication and obtain a new B-TID and a new After Ks, a new Ks-NAF1 is derived from the new Ks, and then the UE uses the new B-TID to communicate with NAF1 under the protection of the new Ks-NAF1.
  • the KS-NAF2 currently being used by NAF2 is not affected by the Ks update, and can continue to be used.
  • a new KS-NAF2 is derived from the new Ks, and a new one is used between the ENE and NAF2.
  • the B-TID communicates under the protection of the new KS-NAF2. After that, the BSF deletes the expired B-TID and the information corresponding to the B-TID.
  • the disadvantage of the above deletion method is that before the validity period of the key expires, if the NAF considers the key to be insecure and asks the UE to update the key, the UE will use the updated B-TID and key to perform the NAF with the NAF. Communication, but the original insecure B-TID and key that has not reached the validity period are still stored on the BSF, and the original insecure B-TID and key that have not reached the validity period are not Will be deleted by BSF. In this way, the attacker will have the opportunity to use the B-TID and key that have no longer been applied but have not yet expired to steal network services. In addition, the B-TID and its corresponding information that are not expired but are no longer actually applied locally stored in the BSF are also a waste of BSF local resources. Summary of the invention
  • an object of the present invention is to provide a method for deleting a session transaction identifier and its corresponding information, so that the BSF deletes the B-TID and its corresponding information that have not expired but are no longer used, This prevents attackers from using their network services to steal and save local resources of the BSF.
  • a method for deleting a session transaction identifier and corresponding information includes the following steps: After the BSF determines that a B-TID that is no longer used and has not expired is locally stored, the deleted B.TID is deleted. B-TID and its corresponding information.
  • the method for determining that the BSF locally stores the B-TID that is no longer used and has not expired includes the following steps:
  • the BSF judges whether the authentication request from the user terminal includes a B-TID, and if so, determines that the B-TID stored locally is a B-TID that is no longer used and has not expired, otherwise step b is performed;
  • the BSF After the BSF confirms that the user terminal can only have one B-TID, it determines whether a B-TID corresponding to the user terminal is stored locally, and if so, determines that the user terminal corresponds to the user terminal.
  • the corresponding B-TID is already B-TID that is no longer used and has not expired.
  • the method further includes: the BSF determines whether the authentication request from the user terminal includes a NAF identifier corresponding to the B-TID, and if it is ,
  • the BSF Before the BSF deletes the B-TID and its corresponding information that are no longer used and have not expired, it informs the NAF associated with the B-TID other than the NAF identified in the authentication request, that the B-TID has expired, Otherwise notify all NAFs associated with the B-TID that the B-TID has expired
  • the method for determining that the BSF locally stores the B-TID that is no longer used and has not expired includes the following steps:
  • the BSF After the BSF returns the required B-TID and its corresponding information to the NAF requesting the inquiry, it determines whether the local area still holds the NAF identity and its inquiry based on the identity of the NAF and the identity of the user terminal it inquires. User terminal ID corresponding to and does not return The B-TID given to the NAF, if any, determines that the B-TID corresponding to both the NAF identity and the user terminal identity it inquires about and does not return is no longer used and has not expired. Preferably, all After the BSF determines that the B-TID that is no longer used and has not expired is stored locally, the method further includes: The BSF determines whether there are NAFs other than the requested query and the B-TID that is no longer used and has not expired. The TID is associated, and if so, it is notified that it is related to the B-TID. The associated NAF other than the requested query is that the B-TID has expired.
  • the method further includes: receiving a NAF that has notified that a B-TID has expired, and determining whether to notify the user terminal to perform key update according to its current configuration.
  • the BSF obtains the local B-TID that is no longer used and has not expired according to a query message requested by the UE for authentication or NAF, and then the B-TID that is no longer used and has not expired and All the information corresponding to the B-TID is deleted. This prevents the attacker from using the B-TID and key that are no longer applied but have not yet expired to steal network services, and also saves BSF local resources.
  • Figure 1 shows the structure of a general authentication framework
  • FIG. 2 is a flowchart of deleting a B-TID and corresponding information by using a BSF according to the first embodiment of the present invention
  • FIG. 3 is a flowchart of deleting a B-TID and corresponding information by a BSF using the second embodiment of the present invention. ⁇ Ways to implement the invention
  • the BSF obtains the B-TID that is no longer used and has not expired and is stored locally according to a query message requested by the UE for authentication or NAF, and then the B-TID that is no longer used and has not expired. And all the information corresponding to the B-TID is deleted. This prevents the attacker from using the B-TID and key that has not yet been applied but has not yet expired to steal network services, and also saves local resources of the BSF.
  • FIG. 2 is a flowchart of deleting a B-TID and corresponding information using a BSF according to the first embodiment of the present invention.
  • Step 201 After the AKA authentication protocol between the UE and the BSF is successful, the UE and the BSF share a key Ks, and the BSF allocates a B-TID to the UE, and the B-TID is associated with the key Ks; step 202, the UE Send a service request containing B-TID to NAF1;
  • Step 203 If NAF1 can query the B-TID in the service request locally, Be'J can perform normal communication with the UE; if NAF1 cannot query the B-TID locally, it queries the BSF, and the BSF queries the After the B-TID, the key Ks-NAFl is generated based on the Ks corresponding to the B-TID and the identity of NAF1. After setting the validity period for Ks-NAF1, the B-TID queried by NAF1 and the B-TID The key Ks-NAFl corresponding to the TID and the validity period of Ks-NAFl are returned to NAF1 together. At the same time, the UE also uses the same algorithm to generate the key Ks-NAFl. At this time, NAF1 and the UE share the key Ks-NAFl. And perform normal communication under the protection of the key Ks-NAF1;
  • Step 204 When NAF1 considers that the unexpired key Ks-NAF1 is not secure, it notifies the UE to perform key update.
  • NAF1 causes NAF1 to consider the unexpired key Ks-NAFl to be insecure. For example, NAF has been attacked, or NAF and BSF cannot communicate normally, and it is speculated that BSF may be attacked.
  • Step 205 after receiving the key update notification, the UE sends an authentication request to the BSF again; according to the operator's policy, the authentication request may include a B-TID that has been indicated as insecure It may not include a B-TID that has been indicated as unsafe;
  • BSF can clearly determine which is the B-TID that is no longer used and has not expired, that is, the B-TID corresponding to the UE is the B-TID that is no longer used and has not expired; when the UE can have more than one B-TID
  • the TID communicates with different NAFs
  • the BSF can determine which B-TID is no longer used and has not expired, that is, the B-TID included in the authentication request is no longer Used and unexpired B-TID; if the B-TID is not included in the authentication request, because the BSF does not know which B-TID corresponding to the UE is no longer used and has not expired, it will not be processed , Which is exactly the same as the existing process;
  • Step 206 The UE and the BSF execute an AKA mutual authentication protocol. After the authentication is successful, the BSF allocates a new B-TID to the UE, and shares a new key Ks with the UE; if the authentication request of the UE The message contains a B-TID that has been indicated as insecure, then step 207 is performed; if the UE's authentication request message does not contain a B-TID that has been indicated as insecure, the BSF determines whether the UE is based on the system configuration Can have more than one B-TID to communicate with different NAFs.
  • the UE can have more than one B-TID to communicate with different NAFs, it will be processed according to the normal procedure; if the UE can only have one B-TID -The TID communicates with a different NAF, and then judges whether the B-TID corresponding to the UE is stored locally. If so, step 208 is performed directly, otherwise, it is processed according to the normal process; step 207, the BSF notification and the B -All NAFs associated with the TID have their original B-TIDs. Has expired. In this embodiment, the BSF notifies NAF1 and NAF2 that their original B-TIDs have expired, and then step 208 is performed;
  • Step 208 the BSF deletes the locally saved B-TID that has been indicated as insecure and the information corresponding to the B-TID, that is, the BSF deletes the locally saved no longer used and not expired.
  • Step 209 The UE sends a service request including the new B-TID to NAF1.
  • Step 210 After the NAF1 successfully queries the BSF, it performs normal communication with the UE under the protection of the new key Ks or its derived key.
  • step 205 if the authentication request sent by the UE to the BSF again includes not only the B-TID that has been indicated as insecure, but also the identity of NAF1 corresponding to the B-TID, then when the UE After the AKA mutual authentication agreement is executed with BSF, and the authentication is successful, the BSF will notify the NAF associated with the B-TID except NAF1 that the B-TID has expired, that is, the BSF only sends its application B- to NAF2 Notice that the TID has expired. In this way, the network transmission load can be reduced.
  • Fig. 3 shows a flowchart of deleting a B-TID and corresponding information using a BSF according to the second embodiment of the present invention.
  • Step 301 After the AKA authentication protocol between the UE and the BSF is successful, the key Ks is shared between the UE and the BSF, and the BSF allocates a B-TID to the UE, and the B-TID is associated with the key Ks.
  • Step 302 the UE sends a NAF1 sends a service request containing B-TID;
  • Step 303 If NAF1 can query the B-TID in the service request locally, Be'J can perform normal communication with the UE; if NAF1 cannot query the B-TID locally, it queries the BSF, and the BSF queries the After the B-TID, according to the Ks corresponding to the B-TID and the identity of NAF1, a key Ks-NAF1 is generated. After the validity period is set for Ks-NAF1, the B-TID queried by NAF1 and the B-TID The key Ks-NAFl corresponding to the TID and the validity period of Ks-NAFl are returned to NAFl together. At the same time, the UE also uses the same algorithm to generate the key Ks-NAF1. At this time, NAF1 and the UE share the key Ks-NAFl, and Normal communication under the protection of the key Ks-NAF1;
  • Step 304 When NAF1 considers that the unexpired key Ks-NAF1 is not secure, notify the UE to perform key update; There are many factors that cause NAF1 to believe that the unexpired key Ks-NAF1 is insecure, for example, NAF has been attacked, or NAF and BSF cannot communicate normally, and it is speculated that BSF may be attacked;
  • Step 305 After receiving the key update notification, the UE sends an authentication request to the BSF again. After receiving the request, the BSF executes the AKA mutual authentication protocol with the UE. After the authentication is successful, the BSF is assigned to the UE. A new B is assigned to the UE. -TID, and shared a new key Ks with the UE; step 306, the UE sends a service request containing the new B-TID to NAF1;
  • Step 307 NAF1 queries the BSF for information about the new B-TID.
  • Step 308 After the UE identifier in the BSF query message finds the new B-TID, a new derived key Ks-NAF1 is generated according to the new Ks corresponding to the B-TID, the identity of NAF1, and the like.
  • the new derived key Ks-NAFl sets a validity period, and then includes the new B-TID, Ks-NAFl, and the validity period of the Ks-NAFl in the response message of the query success and returns it to NAF 1.
  • step 309 since the user terminal establishes only one connection with a NAF, the BSF determines whether the NAF1 and the UE identifier queried are requested to query whether the NAF1 and the UE identifier correspond to the NAF1 and the UE identifier. B-TID returned to NAF. If not, no processing is performed. If so, BSF determines that the B-TID corresponding to both the NAF ID and the UE ID and not returned is a B that is no longer used and has not expired.
  • the BSF judges whether there are NAFs other than the requested query associated with the B-TID that is no longer used and not expired, and if it is, it is notified of the B-TID that is no longer used and not expired TID-associated NAF, the B-TID has expired, and then proceed to step 310, otherwise directly. Perform step 310;
  • Step 310 The BSF deletes the non-returned B-TID and its corresponding information corresponding to the NAF and the UE, that is, deletes the B-TID and its corresponding information that are no longer used and have not expired;
  • Step 311 NAF1 and the UE apply new B-TID protection in new Ks-NAF1 ' Under normal communication.
  • the BSF performs a delete operation at a different time, which causes the BSF to determine a B-TID that is no longer used and has not expired.
  • the BSF determines and deletes the locally-used B-TID that is no longer used and has not expired; in the embodiment shown in FIG. 3, After receiving the B-TID query message from the NAF, the BSF determines and deletes the B-TID that is no longer used and has not expired, which is stored locally.
  • the NAF that received the original B-TID invalidation notification determines whether to use the existing key or notify the UE to perform key update according to its current configuration. If the NAF notifies the UE of the key update, the UE uses the updated B-TID to send a request to the NAF.
  • the BSF When the NAF makes an inquiry to the BSF, the BSF generates a new Ks-NAF according to the new Ks and NAF identification.
  • the purpose of the key update if NAF decides to continue to use the original B-TID and its key information, its existing communication will not be affected in any way.
  • the BSF may not send the B-TID invalidation notification to the NAF. At this time, the NAF will continue to use the original B-TID and its key information.
  • the above only provides a variety of application methods. In actual applications, operators can decide which method to use based on actual conditions.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Computer And Data Communications (AREA)

Description

技术领域
本发明涉及第三代无线通信技术领域， 特别是指在通用鉴权框架中 由执行用户身份初始检查验证的实体（BSF )删除会话事务标识（TID ) . 及其对应信息的方法。 发明背景
在第三代无线通信标准中， 通用鉴权框架是多种应用业务实体使用 . 的一个用于完成对用户身份进行验证的通用结构， 应用通用鉴权框架可 实现对应用业务的用户进行检查和身份验证。 上述多种应用业务可以是 多播 /广播业务、 用户证书业务、 信息即时提供业务等， 也可以是代理业 务。 当然， 对于以后'新开发的业务也可以应用通用鉴权框架对应用业务. 的用户终端进行检查和身份验证。
图 1所示为通用鉴权框架的结构示意图。 通用鉴权框架通常由用户 终端 （UE ) 101、 执行用户身份初始检查验证的实体（BSF ) 102、 用户 归属网络服务器（HSS ) 103和网络应用实体（NAF ) 104组成。 BSF 102. 用于与用户终端 101进行身份互验证，同时生成 BSF 102与用户终端 101 的共享密钥； HSS 103 中存储有用于描述用户信息的描述（Profile )文 件， 同时 HSS 103还兼有产生鉴权信息的功能。
用户需要使用某种业务时， 如果其知道需要与 BSF进行互鉴权， 则 . 直接与 BSF联系以进行互婆权，否则，用户会首先和该业务对应的 NAF 联系， 如果该 NAF应用通用鉴权框架且需要用户终端与 BSF进行身份 验证， 则通知用户终端应用通用鉴权框架进行身份验证， 否则进行其它 相应处理。 用户终端与 BSF之间的互认证过程是： BSF接到来自用户终端的鉴 权请求后， 首先从 HSS获取该用户终端的鉴权信息， 然后与用户终端执 行鉴权和密钥协商协议（AKA )以进行互鉴权。 认证成功后， 用户终端 和 BSF之间互相认证了身份并且同时生成了共享密钥 Ks。 之后， BSF 分配一个会话事务标识（B-TID )给用户终端，该 B-TID是与 Ks相关联的。
用户终端收到这个 B-TID后， 重新向 NAF发出连接请求， 且请求 消息中携带了该 B-TID。 NAF 收到请求后， 先在本地查询是否有该. B-TID, 如果 NAF在本地查询到了该 B-TID, 则再判断该 B-TID所对应 的密钥 Ks或由 Ks衍生的密钥是否处于 BSF所设定的有效期限内， 如 果是则与该用户终端进行正常的通信，否则通知该用户终端与 BSF重新 进行认证后， 中断与该用户终端的通信。
如果 NAF不能在本地查询到该 B-TID, 则向 BSF进行查询。 BSF 查询到该 B-TID后， 首先给该 B-TID对应的密钥信息设置有效期限， 然 后给 NAF发送成功的响应消息， 该响应消息中包含 B-TID、 该 B-TID 对应密钥信息以及已设置的密钥信息的有效期限。 在此， 将 B-TID所对 应的所有信息如密钥信息、 有效期限等统称为 B-TID对应信息。 NAF 收到来自 BSF的成功响应消息后， 即认为该用户终端是经过 BSF认证 的合法用户， 同时 NAF和用户终端也共享了密钥信息， 即 Ks或由 Ks 衍生的密钥。 此时， NAF将该用户终端所应用的 B-TID及与该 B-TID . 对应的密钥信息保存在本地的数据库中。之后， NAF与该用户终端进行 正常的通信。
如果 BSF不能在本地查询到该 B-TID, 则通知 NAF没有该用户终 端的信息， 此时， NAF将通知该用户终端与 BSF进行身份验证。
众所周知， 才艮据系统的配置不同， 一个 UE可以拥有一个或一个以 上的 B-TID与不同的 NAF进行通信； 而且， 密钥 Ks通常作为根密钥并 不直接应用而是由 Ks的衍生密钥参与应用。 当用户使用一个 B-TID与 不同 NAF进行通信时， 虽然其使用的 B-TID相同， 但用户与每个 NAF 之间所应用的共享密钥是不同的。
例如， 假设 NAF1和 NAF2是两个不同的 NAF, 某个已通过 BSF 鉴权的 UE与 NAF1和 NAF2之间建立通信的过程如下：
当 UE向 NAF1发出包含 B-TID信息的业务请求时， 如果 NAF1在 本地没有查询到该 B-TID, 则将向 BSF进行查询， BSF查询到 NAF1所 需的 B-TID后， 首先按照一定的算法， 以 Ks和 NAF1标识等信息作为 参数， 产生出衍生密钥 Ks-NAF1， 并为该 Ks-NAFl设置有效期限， 然 后， BSF将查询到的 B-TID、 与该 B-TID对应的密钥 Ks-NAFl以及该 密钥的有效期限发送给 NAFl , NAF1收到来自 BSF的成功响应消息后， 即认为该 UE是经过 BSF认证的合法用户。 此时， 用户端也使用相同的 算法和参数产生出密钥 Ks-NAFl , 这样， UE和 NAF1 就共享了密钥 Ks-NAFl , NAFl与该 UE在密钥 Ks-NAFl的保护下使用该 B-TID进行 正常的通信。
当 UE向 NAF2发出包含该 B-TID的业务请求时， 如果 NAF2在本 地没有查询到该 B-TID, 则将向 BSF进行查询， BSF查询到后， 以 Ks 和 NAF2标识等信息作为参数， 按照一定的算法为 NAF2产生衍生密钥 Ks-NAF2, BSF将查询到的 B-TID、 与该 B-TID对应的密钥 Ks-NAF2 以及该密钥的有效期限发送给 NAF2， NAF2收到来自 BSF的成功响应 消息后， 即认为该 UE是经过 BSF认证的合法用户。 此时， 用户端也应 用相同的方法产生 Ks-NAF2。 这样 UE 与 NAF2 之间就共享了密钥 KS-NAF2, 并且 NAF2与该 UE在密钥 Ks-NAF2的保护下使用该 B-TID 进行正常的通信。
Ks-NAFl与 KS-NAF2虽然是由相同的根密钥 Ks产生的，但在计算 过程中其应用的 NAF标识是不同的 ,所以 Ks-NAFl与 Ks-NAF2也不同。 而且， Ks、 Ks-NAFl与 Ks-NAF2的有效期都是相互独立的。
当 Ks、 Ks-NAFl或 Ks-NAF2的有效期到期后， 用户端和 BSF将 别删除本地保存的 Ks、 Ks-NAFl或 Ks-NAF2, 以及与 Ks、 Ks-NAFl或 Ks-NAF2对应的 B-TID。
如果在 Ks或 Ks-NAFl的有效期到期之前， NAF1认为 Ks-NAFl已 不安全，并要求 UE更新 Ks-NAFl时， UE将重新到 BSF进行初始鉴权， 得到新的 B-TID和新的 Ks后， 由新的 Ks衍生出新的 Ks-NAF 1， 然后 UE应用该新的 B-TID在新的 Ks-NAFl保护下与 NAF1进行通信。 在 NAF2正在使用的 KS-NAF2并不受 Ks更新的影响， 可以继续使用， 当. Ks-NAF2到期后， 再由新的 Ks衍生出新的 KS-NAF2, ΌΕ与 NAF2之 间再使用新的 B-TID在新的 KS-NAF2的保护下进行通信。 之后， BSF 删除已到期的 B-TID及与该 B-TID对应的信息。
上述删除方法的缺陷在于： 在密钥的有效期到期之前， 如果 NAF 认为该密钥已不安全，并要求 UE更新密钥后， UE将使用更新后的 B-TID 及密钥与该 NAF进行通信， 但原有不安全但没有到达有效期的 B-TID 及密钥还保存在 BSF上， 而且在该密钥到期之前，原有不安全但没有到 达有效期的 B-TID及密钥是不会被 BSF删除的。这样，攻击者将有机会, 使用实际已经不再被应用 , 但仍未到期的 B-TID及密钥盗用网络业务。 另夕卜， BSF本地存储的未到期的但实际已不再被应用的 B-TID及其对应 信息， 也是对 BSF本地资源的浪费。 发明内容
有鉴于此， 本发明的目的在于提供一种删除会话事务标识及其对应 信息的方法， 使 BSF将未到期但不再使用的 B-TID及其对应信息删除， 从而避免攻击者使用其盗用网络业务， 同时节省 BSF本地的资源。
为达到上述目的， 本发明的技术方案是这样实现的：
一种删除会话事务标识及其对应信息的方法，该方法包括以下步骤： BSF判定本地保存有已不再使用且未到期的 B-TID后 , 删除该已不 . 再使用且未到期的 B-TID及其对应信息。
较佳地，所述 BSF确定本地保存有已不再使用且未到期的 B-TID的 方法包括以下步骤：
a、 BSF判断来自用户终端的鉴权请求中是否包含 B-TID, 如果是， 则确定本地保存的该 B-TID为已不再使用且未到期的 B-TID, 否则执行 步驟 b;
b、 BSF确认该用户终端只能够拥有一个 B-TID后， 判断本地是否 已保存有与该用户终端对应的 B-TID, 如果是， 则确定该与用户终端对. 应的 B-TID为已不再使用且未到期的 B-TID。
较佳地， BSF确定本地保存有已不再使用且未到期的 B-TID后， 进 一步包括： BSF判断来自用户终端的鉴权请求中是否包含与该 B-TID对 应的 NAF标识， 如果是，
则 BSF删除已不再使用且未到期的 B-TID及其对应信息之前，通知 除去鉴权请求中已标识的 NAF之外的与该 B-TID相关联的 NAF 该 B-TID已失效， 否则通知所有与该 B-TID相关联的 NAF该 B-TID已失 效
较佳地，所述 BSF确定本地保存有已不再使用且未到期的 B-TID的 方法包括以下步骤：
BSF给请求查询的 NAF返回其所需要的 B-TID及其对应信息后， 根据该 NAF 的标识以及其所查询用户终端的标识， 判断本地是否还保 · 存有与该 NAF标识和其所查询的用户终端标识同时对应的并且不返回 给 NAF的 B-TID, 如果有， 则确定与该 NAF标识和其所查询的用户终 端标识同时对应的并且不返回的 B-TID 为已不再使用且未到期的. 较佳地， 所述 BSF判断出本地保存有已不再使用且未到期的 B-TID 后， 该方法进一步包括： BSF判断是否还有除请求查询以外的 NAF与 该已不再使用且未到期的 B-TID相关联， 如果是， 则通知与该 B-TID相. 关联的除请求查询以外的 NAF该 B-TID已失效。
较佳地， 该方法进一步包括： 接收到某 B-TID已失效通知的 NAF, 根据自身当前的配置决定是否通知用户终端进行密钥更新。
应用本发明， BSF根据 UE请求鉴权或 NAF的查询消息， 获取本地. 保存的已不再使用且未到期的 B-TID, 然后将该已不再使用且未到期的 B-TID及与该 B-TID对应的信息全部删除。 从而避免了攻击者使用实际 已不再被应用， 但仍未到期的 B-TID及密钥来盗用网络业务， 同时也节 省了 BSF本地的资源。 附图简要说明
图 1所示为通用鉴权框架的结构示意图；
图 2示为应用本发明实施例一的 BSF删除 B-TID及其对应信息的流 程图；
图 3示为应用本发明实施例二的 BSF删除 B-TID及其对应信息的流 程图。 · 实施本发明的方式
为使本发明的技术方案更加清楚， 下面结合附图及具体实施例再对 本发明做进一步地详细说明。 本发明的思路是： BSF根据 UE请求鉴权或 NAF的查询消息， 获取 本地保存的已不再使用且未到期的 B-TID, 然后将该已不再使用且未到 期的 B-TID及与该 B-TID对应的信息全部删除。从而避免了攻击者使用 实际已不再被应用， 但仍未到期的 B-TID及密钥盗用网络业务， 同时也. 节省了 BSF本地的资源。
图 2所示为应用本发明实施例一的 BSF删除 B-TID及其对应信息的 流程图。
步骤 201 , UE与 BSF进行 AKA鉴权协议成功后， UE和 BSF之间. 共享了密钥 Ks,且 BSF给 UE分配 B-TID,该 B-TID与密钥 Ks相关联； 步骤 202, UE向 NAF1发送包含 B-TID的业务请求；
步骤 203 , 如果 NAF1能够在本地查询出业务请求中的 B-TID, 贝' J 与该 UE进行正常的通信； 如果 NAF1不能在本地查询出该 B-TID则向 BSF进行查询， BSF查询到该 B-TID后， 根据该 B-TID对应的 Ks及 NAF1的标识等信息，产生密钥 Ks-NAFl ,为 Ks-NAFl设置有效期限后， 将 NAF1 所查询的 B-TID, 以及与该 B-TID对应的密钥 Ks-NAFl 和 Ks-NAFl 的有效期限一同返回给 NAF1， 同时， UE也使用相同的算法' 产生密钥 Ks-NAFl , 此时， NAF1与 UE共享了密钥 Ks-NAFl , 并在密 钥 Ks-NAFl的保护下进行正常的通信；
步骤 204, 当 NAF1认为未到期的密钥 Ks-NAFl已不安全时， 通知 UE进行密钥更新；
引起 NAF1认为未到期的密钥 Ks-NAFl已不安全的因素很多，比如， NAF受到了攻击，或 NAF与 BSF不能进行正常的通信而推测 BSF可能 受到了攻击等等；
步骤 205, UE接到密钥更新通知后， 再次向 BSF发出鉴权请求； ' 根据运营商的策略， 该鉴权请求中可以包含已被指示为不安全的 B-TID 也可以不包含已被指示为不安全的 B-TID;
由于一个 UE可以拥有一个或一个以上的 B-TID与不同 NAF进行通 信， 当 UE只能拥有一个 B-TID与所有的 NAF进行通信时， 无论该鉴 权请求中是否包含 B-TID, BSF都能够清楚地确定哪个是已不再使用且 未到期的 B-TID, 即与该 UE对应的 B-TID是不再使用且未到期的 B-TID; 当 UE能够拥有一个以上的 B-TID与不同 NAF进行通信时， 如 果鉴权请求中包含 B-TID,则 BSF能够确定哪个是不再使用且未到期的 B-TID, 即该鉴权请求中包含的 B-TID为不再使用且未到期的 B-TID; 如果鉴权请求中不包含 B-TID , 则由于 BSF不知道与该 UE对应的哪个 B-TID是不再使用且未到期的， 因而不对其进行处理， 即与现有流程的 处理方式完全相同；
步骤 206， UE与 BSF执行 AKA互鉴权协议， 鉴权成功后 BSF给 该 UE分配一个新的 B-TID, 并且与该 UE共享了一个新的密钥 Ks; 如. 果 UE的鉴权请求消息中包含了已被指示为不安全的 B-TID, 则执行步 骤 207; 如果 UE 的鉴权请求消息中没有包含已被指示为不安全的 B-TID,则 BSF根据系统配置判断该 UE是否能够拥有一个以上的 B-TID 与不同的 NAF进行通信， 如果该 UE能够拥有一个以上的 B-TID与不 . 同的 NAF进行通信， 则按常规流程进行处理； 如果该 UE只能拥有一个 B-TID与不同的 NAF进行通信，则再判断本地是否已保存有与该 UE对 应的 B-TID, 如果有， 则直接执行步骤 208, 否则按常规流程进行处理； 步骤 207, BSF通知与该 B-TID相关联的所有 NAF其原有的 B-TID . 已失效， 在本实施例中 , BSF通知 NAF1和 NAF2其原有的 B-TID已失 效， 然后执行步骤 208;
步骤 208, BSF删除本地已保存的已被指示为不安全的 B-TID及与 该 B-TID对应的信息， 即 BSF删除本地保存的不再使用且未到期的. B-TID;
步驟 209, UE向 NAFl发送包含新 B-TID的业务请求；
步骤 210, NAF1向 BSF查询成功后， 与该 UE在新的密钥 Ks或其. 衍生密钥的保护下进行正常的通信。
对于上述实施例， 在步骤 205中， 如果 UE再次向 BSF发出的鉴权 请求中不但包括已被指示为不安全的 B-TID, 还包括与该 B-TID对应的 NAF1的标识， 则当 UE与 BSF执行 AKA互鉴权协议， 且鉴权成功后， . BSF将通知除去 NAF1以外的与该 B-TID相关联的 NAF该 B-TID已失 效， 即 BSF只向 NAF2发送其应用的 B-TID已失效的通知。 这样， 可以 減轻网络传输负荷。
图 3所示为应用本发明实施例二的 BSF删除 B-TID及其对应信息的 · 流程图。
步骤 301 , UE与 BSF进行 AKA鉴权协议成功后 , UE和 BSF之间 共享了密钥 Ks,且 BSF给 UE分配 B-TID,该 B-TID与密钥 Ks相关联； 步骤 302, UE向 NAF1发送包含 B-TID的业务请求；
步骤 303 , 如果 NAF1能够在本地查询出业务请求中的 B-TID, 贝' J 与该 UE进行正常的通信； 如果 NAF1不能在本地查询出该 B-TID则向 BSF进行查询， BSF查询到该 B-TID后， 根据该 B-TID对应的 Ks及 NAF1的标识等信息，产生密钥 Ks-NAFl ,为 Ks-NAFl设置有效期限后， 将 NAF1 所查询的 B-TID， 以及与该 B-TID对应的密钥 Ks-NAFl 和 Ks-NAFl 的有效期限一同返回给 NAFl , 同时， UE也使用相同的算法 产生密钥 Ks-NAF1， 此时， NAF1与 UE共享了密钥 Ks-NAFl , 并在密 钥 Ks-NAFl的保护下进行正常的通信；
步骤 304, 当 NAF1认为未到期的密钥 Ks-NAFl已不安全时， 通知 UE进行密钥更新； 引起 NAF1认为未到期的密钥 Ks-NAFl已不安全的因素很多，比如， NAF受到了攻击，或 NAF与 BSF不能进行正常的通信而推测 BSF可能 受到了攻击等等；
步骤 305, UE接到密钥更新通知后， 再次向 BSF发出鉴权请求， BSF接收到该请求后与该 UE执行 AKA互鉴权协议， 鉴权成功后 BSF . 给该 UE分配一个新的 B-TID, 并且与该 UE共享了一个新的密钥 Ks; 步骤 306, UE向 NAF1发送包含新 B-TID的业务请求；
步骤 307, NAF1向 BSF查询该新 B-TID的信息；
步骤 308, BSF 居查询消息中的 UE标识查询到该新 B-TID后， . 跟据该 B-TID所对应的新 Ks 以及 NAF1 的标识等产生新的衍生密钥 Ks-NAFl ,并为该新的衍生密钥 Ks-NAFl设置有效期限， 然后将查询到 的新 B-TID、 Ks-NAFl 以及该 Ks-NAFl的有效期限包含在查询成功的 响应消息中返回给 NAF 1；
步骤 309， 由于用户终端与一个 NAF只建立一个连接， 因而 BSF 根据请求查询的 NAF1的标识， 以及其所查询的 UE标识判断本地是否 还保存有与该 NAF标识和 UE标识同时对应的并且是没返回给 NAF的 B-TID, 如果没有， 则不做处理， 如果有， 则 BSF确定与该 NAF标识和. UE 标识同时对应的并且没有返回的 B-TID 为不再使用且未到期的 B-TID, 之后， BSF再判断是否还有除请求查询以外的 NAF与该不再使 用且未到期的 B-TID相关联， 如果是， 则通知与该不再使用且未到期的 B-TID相关联的 NAF该 B-TID已失效， 然后再执行步骤 310, 否则直接. 执行步骤 310;
步骤 310, BSF删除与该 NAF和 UE同时对应的非返回的 B-TID及 其对应信息， 即删除不再使用且未到期的 B-TID及其对应信息；
步骤 311 , NAF1与该 UE应用新的 B-TID在新的 Ks-NAFl的保护' 下进行正常的通信。
上述两个实施例的主要区别在于 BSF执行删除操作的时机不同， 因 而导致 BSF确定不再使用且未到期的 B-TID的方式不同。图 2所示实施 例中， BSF接收到来自 UE的鉴权请求并鉴权成功后， 确定并删除本地 保存的已不再使用且未到期的 B-TID; 图 3所示实施例中， BSF接收到 来自 NAF的查询 B-TID的查询消息后， 确定并删除本地保存的已不再 使用且未到期的 B-TID。
对于上述两个实施例，接收到原有 B-TID失效通知的 NAF,根据自 身当前的配置决定是使用现有的密钥， 还是通知 UE进行密钥更新。 如 果 NAF通知 UE进行密钥更新， 则 UE使用已更新的 B-TID向该 NAF 发出请求， NAF向 BSF进行查询时， 由 BSF根据新的 Ks及 NAF标识. 产生新的 Ks-NAF, 从而实现密钥更新的目的； 如果 NAF决定继续使用 原有的 B-TID及其密钥信息， 则其现有的通信将不受任何影响。 当然， BSF也可以不向 NAF发送 B-TID失效的通知， 此时， NAF将继续使用 原有的 B-TID及其密钥信息。 以上只是提供了多种应用方式， 在实际应. 用中， 运营商可才 据实际情况决定釆用哪种方式。
以上所述仅为本发明的较佳实施例而已， 并不用以限制本发明， 凡 在本发明的精神和原则之内， 所作的任何修改、 等同替换、 改进等， 均 应包含在本发明的保护范围之内。

Claims

权利要求书
1、 一种删除会话事务标识及其对应信息的方法， 其特征在于， 该 方法包括以下步骤：
BSF判定本地保存有已不再使用且未到期的 B-TID后，删除该已不 再使用且未到期的 B-TID及其对应信息。
2、 根据权利要求 1所述的方法， 其特征在于， 所述 BSF判定本地 保存有已不再使用且未到期的 B-TID的方法包括以下步骤：
a、 BSF判断来自用户终端的鉴权请求中是否包含 B-TID, 如果是， 则确定本地保存的该 B-TID为已不再使用且未到期的 B-TID, 否则执行 步骤 b;
b、 BSF确认该用户终端只能够拥有一个 B-TID后， 判断本地是否 已保存有与该用户终端对应的 B-TID, 如果是， 则确定该与用户终端对 应的 B-TID为已不再使用且未到期的 B-TID。
3、 根据权利要求 2所述的方法， 其特征在于， BSF判定本地保存 有已不再使用且未到期的 B-TID后， 进一步包括： BSF判断来自用户终 端的鉴权请求中是否包含与该 B-TID对应的 NAF标识， 如果是，
则 BSF删除已不再使用且未到期的 B-TID及其对应信息之前，通知 除去鉴权请求中已标识的 NAP之外的与该 B-TID相关联的 NAF 该 B-TID已失效， 否则通知所有与该 B-TID相关联的 NAF该 B-TID已失 效。
4、 根据权利要求 1所述的方法， 其特征在于， 所述 BSF判定本地 保存有已不再使用且未到期的 B-TID的方法包括以下步骤：
BSF给请求查询的 NAF返回其所需要的 B-TID及其对应信息后， 根据该 NAF 的标识以及其所查询用户终端的标识， 判断本地是否还保 存有与该 NAF标识和其所查询的用户终端标识同时对应的并且不返回 给 NAF的 B-TID, 如果有， 则确定与该 NAF标识和其所查询的用户终 端标识同时对应的并且不返回的 B-TID 为已不再使用且未到期的 B-TID。
5、 根据权利要求 4所述的方法， 其特征在于， 所述 BSF判断出本 地保存有已不再使用且未到期的 B-TID后， 该方法进一步包括： BSF判 断是否还有除请求查询以外的 NAF与该已不再使用且未到期的 B-TID 相关联， 如果是， 则通知与该 B-TID相关联的除请求查询以外的 NAF 该 B-TID已失效。
6、 根据权利要求 3或 5所述的方法， 其特征在于， 该方法进一步 包括：接收到某 B-TID已失效通知的 NAF,根据自身当前的配置决定是 否通知用户终端进行密钥更新。
PCT/CN2005/000532 2004-04-22 2005-04-19 Procede permettant de supprimer l'identificateur de trafic de session ainsi que des informations correspondantes WO2005104432A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CNB2004100372072A CN100512137C (zh) 2004-04-22 2004-04-22 一种删除会话事务标识及其对应信息的方法
CN200410037207.2 2004-04-22

Publications (1)

Publication Number Publication Date
WO2005104432A1 true WO2005104432A1 (fr) 2005-11-03

Family

ID=35197343

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2005/000532 WO2005104432A1 (fr) 2004-04-22 2005-04-19 Procede permettant de supprimer l'identificateur de trafic de session ainsi que des informations correspondantes

Country Status (2)

Country Link
CN (1) CN100512137C (zh)
WO (1) WO2005104432A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1913439B (zh) * 2006-09-08 2011-05-04 中国移动通信集团公司 一种鉴权方法以及发送鉴权成功信息的方法
CN1949774B (zh) * 2006-11-02 2010-04-07 华为技术有限公司 一种Web应用程序会话管理方法与装置
EP3414927B1 (en) * 2016-02-12 2020-06-24 Telefonaktiebolaget LM Ericsson (PUBL) Securing an interface and a process for establishing a secure communication link
CN115379414A (zh) * 2019-09-25 2022-11-22 华为技术有限公司 证书发放方法和装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5361388A (en) * 1991-04-09 1994-11-01 Nec Corporation Message relaying system for a distributed processing system
JP2002094659A (ja) * 2000-09-13 2002-03-29 Toshiba Corp 通信システム
JP2002314571A (ja) * 2001-03-19 2002-10-25 Alcatel スイッチングノードのための分類およびタグ付け規則

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5361388A (en) * 1991-04-09 1994-11-01 Nec Corporation Message relaying system for a distributed processing system
JP2002094659A (ja) * 2000-09-13 2002-03-29 Toshiba Corp 通信システム
JP2002314571A (ja) * 2001-03-19 2002-10-25 Alcatel スイッチングノードのための分類およびタグ付け規則

Also Published As

Publication number Publication date
CN1691584A (zh) 2005-11-02
CN100512137C (zh) 2009-07-08

Similar Documents

Publication Publication Date Title
US7941121B2 (en) Method for verifying the validity of a user
US8275355B2 (en) Method for roaming user to establish security association with visited network application server
JP4768720B2 (ja) ネットワークにアクセスするユーザ端末に対してジェネリック認証アーキテクチャーを応用して管理する方法及びシステム
JP5414898B2 (ja) 有線ｌａｎのセキュリティアクセス制御方法及びそのシステム
US8559633B2 (en) Method and device for generating local interface key
CA2552917C (en) A method of obtaining the user identification for the network application entity
AU2002226278B2 (en) Use of a public key key pair in the terminal for authentication and authorisation of the telecommunication user with the network operator and business partners
WO2006097041A1 (fr) Forme d'authentification generale et procede pour mettre en place l'authentification
CN1921682B (zh) 增强通用鉴权框架中的密钥协商方法
WO2007079698A1 (fr) Procédé et système d'authentification d'entité, procédé et système d'authentification de bout en bout et centre d'authentification
WO2008034355A1 (fr) Procédé, dispositif et système d'authentification de service réseau
WO2006047956A1 (fr) Cadre d'authentification general et procede de mise a jour des informations de description de securite utilisateur dans le bsf
WO2005104432A1 (fr) Procede permettant de supprimer l'identificateur de trafic de session ainsi que des informations correspondantes
CN100563156C (zh) 实现用户信息同步及对用户终端鉴权的方法
JP2005217679A (ja) 通信相手の認証を行う認証サーバ
WO2008001988A1 (en) System and method for managing network/service access for linkage between network access and application service
WO2007095806A1 (fr) Système d'authentification générale et procédé d'accès à la fonction d'application de réseau du système
WO2007031027A1 (fr) Procede, systeme et appareil de negociation de cle entre ss et sp
WO2006047960A1 (fr) Procede et systeme de garantie de la confidentialite de l'identification d'utilisateur
WO2005046119A1 (en) A method of setting up the association between the session transaction identification and the network application entity
WO2008151569A1 (fr) Procédé, dispositif et système d'acquisition de clé
WO2005101723A1 (fr) Procede permettant d'obtenir une fonction d'application reseau permettant de gerer l'identification du trafic et les informations correspondantes

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KM KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SM SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): GM KE LS MW MZ NA SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LT LU MC NL PL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
NENP Non-entry into the national phase

Ref country code: DE

WWW Wipo information: withdrawn in national office

Country of ref document: DE

122 Ep: pct application non-entry in european phase