WO2010060296A1

WO2010060296A1 - Authentication method, trusted environment unit and home nodeb

Info

Publication number: WO2010060296A1
Application number: PCT/CN2009/072108
Authority: WO
Inventors: 王绍斌; 张宁; 丁小燕; 李茜
Original assignee: 华为技术有限公司
Priority date: 2008-11-03
Filing date: 2009-06-03
Publication date: 2010-06-03
Also published as: CN101827361A; CN101827361B; CN101822083B; CN101822083A

Abstract

An authentication method, trusted environment (TrE) unit and home nodeB (HNB) are disclosed in embodiments of the present invention. The method includes: performing equipment identity authentication for HNB, performing identity authentication for TrE which is set in said HNB, performing authentication for the identity binding relationship between said HNB and said TrE, performing non-identity authentication for said HNB, and obtaining the non-identity authentication data of said HNB and storing it in said TrE. Embodiments of the present invention take full advantage of the characteristics of the TrE and store the non-identity authentication data obtained after the first HNB authentication in the TrE. When the HNB restarts, related non-identity authentication can be executed by the TrE, and thus the burden of HNB authentication on network side is reduced.

Description

Authentication method, trusted environment unit and home base station

This application claims priority to Chinese Patent Application No. 200810175958.9, entitled "Identification Method, Trusted Environment Unit and Home Base Station", filed on November 3, 2008, the entire contents of which are incorporated by reference. In this application. Technical field

The embodiments of the present invention relate to the field of wireless communications technologies, and in particular, to an authentication method, a trusted environment unit, and a home base station based on a trusted environment of a home base station. Background technique

The home base station (Home NodeB; hereinafter referred to as HNB) is also called a femtocell base station, and is proposed for a macro base station used in a third generation mobile communication (3rd Generation; 3G) cellular mobile communication system. The HNB's transmit power is only +15db and the indoor coverage is 50 meters. It functions like a Wireless Fidelity (WiFi) wireless access node (Access Point; hereinafter referred to as AP), enabling users to connect to a home broadband network via Ethernet. The development of HNB by mobile operators is firstly to improve indoor coverage, improve indoor broadband access speed, and meet the needs of users for various multimedia services. In addition, in order to alleviate the pressure of macro base stations, macro base stations mainly serve outdoor users; It can cope with the pressure of wireless carriers and mobile virtual network operators.

The Hosting Party Module (hereinafter referred to as HPM) is a physical entity that is separate from the physical device of the HNB and includes a certificate for authenticating and authenticating the mobile network operator (hereinafter referred to as: Hosting) Party) The credibility of identity. The user is similar to the mobile phone user, and the module is similar to the Subscriber Identity Module (SIM) card. HPM is provided to users by mobile network operators. The HPM can be removed from the HNB, which means that the HPM can be replaced when the HNB is replaced. HPM enables HNBs to have user-based user identity without affecting HNB Producer. The greatest significance of HPM is that when the HNB equipment manufacturer and the HNB service provider are separated, the users applying for the service are effectively authenticated.

Trusted Enviroment (hereinafter referred to as TrE) is a logically or physically independent entity deployed on the HNB. It refers to a secure storage environment on the HNB to store some sensitive data on the HNB. Trust of HNB device identity, etc.

In the process of implementing the embodiments of the present invention, the inventors found that at least the following problems exist in the prior art:

In the prior art, each restart of the HNB requires an entire and repeated authentication process with the core network, which undoubtedly increases the burden on the network side server. Summary of the invention

The embodiment of the invention provides an authentication method, a trusted environment unit and a home base station, so as to reduce the burden on the network side for HNB authentication.

An embodiment of the present invention provides an authentication method based on a trusted environment of a home base station, including: performing device identity authentication on the HNB;

Authenticating the TrE set on the HNB;

Authenticating the identity binding relationship between the HNB and the TrE;

Performing non-identity authentication on the HNB;

Acquiring and storing non-identity authentication data of the HNB in the TrE.

An embodiment of the present invention provides another authentication method based on a trusted environment of a home base station, including: performing device identity authentication on the HNB;

Authenticate the TrE;

Authenticating the identity binding relationship between the HNB and the TrE;

The HNB is non-identified by the TrE.

An embodiment of the present invention provides another authentication method based on a trusted environment of a home base station, including:

The TrE receives the UE identity sent by the user equipment (User Equipment; hereinafter referred to as UE) Certificate request;

The UE is authenticated by the TrE.

The embodiment of the invention provides a trusted environment unit, including:

An authentication data storage module, configured to store non-identity authentication data of the HNB;

The authentication module is configured to perform non-identity authentication of the HNB according to the non-identity authentication data of the HNB stored by the authentication data storage module.

The embodiment of the present invention further provides a home base station, including a TrE unit, where the TrE unit is provided with:

The embodiment of the present invention provides an authentication method, a trusted environment unit, and a home base station, and fully utilizes the characteristics of the TrE to store the non-identity authentication data after the HNB authentication for the first time in the TrE. When the HNB is restarted, the TrE can be adopted. Perform related non-identity authentication, thereby reducing the burden on the network side for HNB authentication. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor.

1 is a flow chart of a first embodiment of an authentication method based on a trusted environment of a home base station according to the present invention;

2 is a signaling flow diagram of a second embodiment of an authentication method based on a trusted environment of a home base station according to the present invention;

3 is a signaling flow of a third embodiment of an authentication method based on a trusted environment of a home base station according to the present invention; Cheng Tu

4 is a signaling flow diagram of a fourth embodiment of an authentication method based on a trusted environment of a home base station according to the present invention;

5 is a signaling flow diagram of a fifth embodiment of an authentication method based on a trusted environment of a home base station according to the present invention;

6 is a flow chart of a sixth embodiment of an authentication method based on a trusted environment of a home base station according to the present invention;

7 is a signaling flow diagram of a seventh embodiment of an authentication method based on a trusted environment of a home base station according to the present invention;

8 is a signaling flow diagram of an eighth embodiment of an authentication method based on a trusted environment of a home base station according to the present invention;

FIG. 9 is a signaling flow diagram of a ninth embodiment of an authentication method based on a trusted environment of a home base station according to the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The network type of the following embodiments of the present invention may be: Global System for Mobile Communication (hereinafter referred to as GSM) network, code division multiple access (for the purpose of making the purpose, technical solution, and advantages of the embodiments of the present invention clearer) Code Division Multiple Access; hereinafter referred to as: CDMA) Network, Wideband CDMA (WCDMA) network, Worldwide Interoperability for Microwave Access (WMAX) network, Time Division Synchronization Code Division Multiple Access (Time Division-Synchronous CDMA; hereinafter referred to as: TD-SCDMA) network or long-term evolution (Long Term Evolution; hereinafter referred to as: LTE) network. The type of the wireless access device may be: a home base station, a pico base station (Pico), a universal mobile telecommunications system AP (hereinafter referred to as UMTS AP), a Wimax type (Femto) base station, or a Wimax macro base station. The following types of user equipments in the embodiments of the present invention may be: mobile terminals such as mobile phones, notebook computers, or personal digital assistants (hereinafter referred to as PDAs).

Since the HNB is a user equipment deployed in the user's home, the equipment belonging to the operator is used to complete the access function to the user, and the dual role makes the operator's security requirements for the HNB high. Therefore, when the home base station is powered on and establishes a physical connection with the operator, the operator needs to perform relevant authentication on the HNB. The non-identity authentication of the HNB in the prior art is based on a non-trusted environment, the security storage capability is low, the function of the TrE is not fully utilized, and the application space of the TrE is reduced to some extent; and since the TrE has independent identity information, And the identity information can be associated with HNB and HPM. After the HNB is loaded with the TrE, the authentication of the HNB by the network side involves the authentication of the TrE and the authentication of the TrE and the HNB. How does the embodiment of the present invention implement the authentication process of the HNB configured with the TrE on the network side, and How TrE with higher secure storage performance enables localization of HNB-related authentication.

First embodiment

FIG. 1 is a flow chart of a first embodiment of a method for authenticating a trusted environment of a home base station according to the present invention. As shown in FIG. 1 , this embodiment describes an authentication process when an HNB is initially started, and includes the following steps:

Step 11. Perform device identity authentication on the HNB.

The network side first needs to authenticate the identity of the HNB device itself. The identity authentication of the HNB is mainly based on the identity credential authentication. The HNB identity credential has two presentation modes, one is based on the certificate, and the other is based on the authentication. And the Authentication and Key Agreement (AKA) credential. The authentication process is mainly the security gateway and authentication authorization statistics on the network side (Authorization Authorization and Accounting; AAA) The server interacts with the HNB for the authentication process.

Step 12: Perform identity authentication on the TrE set on the HNB.

Certificate-based authentication can also be used for TrE authentication. The authentication process is mainly the interaction between the security gateway on the network side and the AAA server (authentication, authorization, and accounting server) and the TrE on the HNB.

Step 13. Authenticate the identity binding relationship between the HNB and the TrE.

The authentication of the binding relationship is mainly performed by the AAA server. The AAA server queries the pre-stored binding relationship according to the identity of the TrE, and then compares the HNB identity identifiers sent by the HNB to prove the binding relationship.

Step 14: Perform non-identification on the HNB. The non-authentication performed on the HNB may include: identity authentication for the HPM on the HNB, location authentication for the HNB, and identity verification for the UE.

Step 15. Acquire and store the non-authentication data of the HNB in the TrE. Corresponding to the above-mentioned non-authentication type, the non-authentication data may include: authentication data of the HPM, location authentication data of the HNB, and UE authentication data.

After the non-identity authentication succeeds, part of the authentication data maintained by the network side (mainly related authentication data about non-identity authentication) is downloaded to the local TrE of the HNB. When the HNB is restarted or re-authenticated, the non-identification process can be performed in the HNB local TrE, which fully utilizes the functions of the TrE, and also makes the restart or re-authentication process do not require the participation of the core network, reducing the The burden on the network side.

Second embodiment

2 is a signaling flowchart of a second embodiment of a method for authenticating a trusted environment of a home base station according to the present invention. As shown in FIG. 2, this embodiment describes the authentication process of the HNB at the initial startup, which specifically includes the following steps:

Step 101: An IKE_SA_INIT (IKE Authentication Initialization) connection is established between the HNB and the security gateway (Secure Gateway; SGW for short). Step 102: The HNB sends an IKE-AUTH-REQ authentication request (IKE authentication request) to the SGW, where the request carries the identity identifiers of the HNB and the TrE. It should be noted here that there are two ways to present HNB identity credentials, one based on certificates and the other based on AKA credentials. This embodiment describes the case based on the AKA credential. If a certificate-based authentication mechanism is adopted, a certificate verification process is required between the HNB and the SGW.

Step 103: The SGW verifies the identity of the TrE. Certification for TrE is based on certificate-based authentication.

Step 104: The SGW sends an Authentication Request/Identity request (authentication request) to the AAA server, where the request carries the identity of the HNB and the TrE.

Step 105: The AAA server performs HNB identity authentication. The specific identity authentication process may be similar to the following process: The AAA server initiates an AKA (Authentication and Key Agreement Protocol) identity authentication challenge request, and acquires an AV (authentication vector), and runs the AKA algorithm. , accepting the HNB identity authentication 4 mega war response, thereby achieving two-way authentication between the HNB and the network side.

Step 106: The AAA server authenticates the binding relationship between the HNB and the TrE. The specific binding authentication process may be similar to the following process: AAA from the related database network element (such as Home Location Register (HLR)) Obtaining the binding relationship between the HNB and the TrE, the AAA server queries the pre-stored binding relationship according to the identity of the TrE transmitted by the HNB, and compares it with the received HNB identity to verify the binding relationship.

Step 107: The AAA server sends a TrE identity authentication success and an authentication response (successation response/success) to the SGW.

Step 108: The SGW notifies the HNB that the authentication succeeds by using an IKE-AUTH-RES (IKE Authentication Response) message.

Step 109: After receiving the authentication success message, the HNB triggers the platform integrity authentication of the HNB. Step 110: The HNB platform integrity authentication is performed between the HNB and the integrity authentication server. Integrity authentication requires the network side to store reference metrics for HNB integrity. The data is stored on existing NEs. For example, you can add storage functions to existing NEs, such as the HLR. On the newly added network element. After the integrity authentication is completed, a corresponding secure channel is established between the HNB and the SGW.

Step 111: The HNB and the network side perform subsequent related non-identity authentication, such as location authentication of the HNB, authentication of the HPM, and identity authentication of the UE. At the same time, the AAA server needs to obtain relevant data for non-authentication authentication from the authentication database.

Step 112: After the non-identity authentication succeeds, download part of the authentication data (mainly data for non-authentication authentication) maintained by the AAA server to the local TrE of the HNB. Thus, when the HNB is restarted or re-authenticated, the authentication process is performed in the HBR local TrE.

It should be noted that, in this embodiment and the following embodiments, in the authentication process of the HNB on the network side, the network element such as the AAA server and the SGW server is specifically described, but the authentication of the HNB in the embodiment of the present invention is described. The process is not limited to the above-mentioned network element. It can be known by those skilled in the art that after the HNB is first started, the HNB device identity authentication, TrE identity authentication, and both are completed by interaction with the SGW and the AAA server on the network side. After the relationship and platform integrity authentication, relevant non-identity authentication is performed. After the non-identity authentication is successful, part of the authentication data maintained by the network side (mainly related authentication data related to non-identity authentication) is downloaded to the local HNB. In TrE. When the HNB is restarted or re-authenticated, the non-identification process can be performed in the local TrE of the HNB, which fully utilizes the functions of the TrE, and also makes the restart or re-authentication process unnecessary to be associated with the SGW and the AAA server. The interaction of the network side server reduces the burden on the network side.

Third embodiment

FIG. 3 is a signaling flowchart of a method for authenticating a home base station trusted environment according to a third embodiment of the present invention. As shown in FIG. 3, this embodiment focuses on the identity authentication process of the HPM on the network side when the HNB is initially started. Is a further detailed illustration of steps 111 to 112 in the second embodiment described above.

HPM certification refers to the certification of mobile network operators to users of HNB. Usually have two fields Scenery:

Scene A, HPM and HNB device binding scenarios

In this scenario, the HNB device authentication is completed, that is, the HPM authentication is completed. EAP-AKA (Extensible Authentication Protocol - Key Agreement Protocol) and certificate authentication, which do not require additional authentication, can be used as HPM certification, which is suitable for HPM non-mobile scenarios.

Scenario B. The authentication scenario in which the HPM is separated from the HNB device. There are two solutions in this scenario.

B1, certificate-based HNB device authentication and EAP-AKA-based HPM authentication

The scheme first uses the respective certificates between HNB and SGW for device authentication, and then performs EAP-AKA HPM certification.

Binding of B2, HPM ID and HNB device ID

HNB is a device with embedded HPM. Each device has an EI (device number) to indicate its identity. The HNB-EI is placed in the HNB by the manufacturer at the factory. The HLR on the network side stores the HNB-EI record corresponding to each HPM-ID. This record represents the binding relationship between this HNB-EI and HPM-ID. The AAA server performs authentication of the binding relationship based on this record.

In the authentication scenario in which the HPM authentication is separated from the HNB device authentication in this embodiment, the binding relationship between the HPM and the HNB device may not be authenticated. In this embodiment, the authentication process for the HPM includes the following steps:

Step 1110: The TrE obtains the identity of the HPM of the HNB, and the process can be implemented by using an interface between the HNB and the TrE.

Step 1111: The HNB sends an IKE-AUTH-REQ authentication request (IKE authentication request) to the SGW, where the request carries the identity of the HPM and the TrE.

Step 1112: The SGW sends an Authentication Request/Identity request (authentication request) to the AAA server, and sends an Authentication Request/Identity request, which carries the identity of the HPM and the TrE.

Step 1113: The AAA server acquires multiple AV vectors (authentication vectors) from the HLR. Step 1114: The AAA server initiates an EAP Request / AKA (SIM) challenge request (EAP Request / AKA Challenge) to the SGW.

Step 1115: The SGW sends an EAP Request / AKA (SIM) challenge request to the HNB through an IKE-AUTH-RES (IKE Authentication Response) message.

Step 1116: The HNB returns the EAP through the IKE-AUTH-REQ (IKE Authentication Request) message.

Reponse / AKA (SIM) challenge (EAP Response / AKA Challenge) to SGW.

Step 1117: The SGW returns the EAP Reponse / AKA (SIM) challenge to the AAA server.

In step 1114, step 1117, the EAP-AKA authentication process is performed between the AAA server and the HNB, thereby completing the authentication of the HPM.

Step 1118: The AAA server performs HPM and TrE binding relationship verification. The AAA server verifies the identity of the TrE based on the HPM-based identity query pre-stored binding relationship.

Step 1119: The AAA server sends an Authentication Response / EAP-AKA (SIM) success to the SGW (HPM identity authentication success and binding relationship authentication success response).

Step 1120: The SGW sends the HPM identity authentication success and the binding relationship authentication success response to the HNB through the IKE-AUTH-RES message.

Step 1121: The HNB initiates an HNB Boot Request (Initial Start Request) to the AHR (AP Home Registration Server).

Step 1122: The AHR obtains the HPM authentication vector from the AAA through the retrieving authentication data message, and the requested authentication vector may be multiple, to ensure that each local authentication is fresh.

Step 1123: The AAA server responds to the request and returns the stored unused AV vector (the parameter XRES (desired response value), RAND (random number), AUTN (authentication token)) included in the authentication vector to the AHR.

Step 1124: The AHR sends an initial startup response (Boot response) to the HNB, and carries the authentication data of the HPM. Step 1125: The TrE securely stores the authentication data of the HPM, thereby implementing localization of the authentication data.

In this embodiment, after the first startup of the HNB, the identity authentication of the HPM in the non-identity authentication is completed through interaction with the SGW and the AAA server on the network side. After the authentication succeeds, the HPM authentication data maintained by the network side is downloaded to the HNB local. In the TrE. When the HNB is restarted or re-authenticated, the HPM identity authentication process can be performed in the HNB local TrE, and does not need to interact with the network side servers such as the SGW and the AAA server, thus fully utilizing the TrE function, reducing the The burden on the network side.

Fourth embodiment

4 is a signaling flowchart of a fourth embodiment of a method for authenticating a home base station trusted environment according to the present invention. As shown in FIG. 4, this embodiment focuses on the location authentication of the HNB by the network side when the HNB is initially started. Process. This is also a further detailed illustration of steps 111 to 112 in the second embodiment described above. Specifically, the following steps are included:

Step 2110: The HNB initiates an initial startup request (boot request) to the AHR, and carries the current location information of the HNB.

Step 2111: The AHR performs location authentication.

Step 2112: The AHR sends an initial startup response (Boot response) to the HNB, and carries the encrypted authenticated location information.

Step 2113: After receiving the location information, the HNB will transmit the location information to the TrE.

Step 2114: The TrE verifies the information source. If the verification is passed, the location information is used as a reference value of the location information of the current user (corresponding to the current HPM), and is stored securely.

After the HNB is first started, the location authentication of the HNB in the non-identity authentication is completed by the interaction with the SGW and the AAA server on the network side. After the authentication succeeds, the location authentication data of an HNB maintained by the network side is downloaded to the HNB. Local TrE. When the HNB is restarted or re-authenticated, the location authentication process of the HNB can be performed in the local TrE of the HNB, and there is no need to interact with the network side servers such as the SGW, the AAA server, and the AHR. The TrE's functionality reduces the burden on the network side.

Fifth embodiment

FIG. 5 is a signaling flowchart of a fifth embodiment of a method for authenticating a trusted environment of a home base station according to the present invention. As shown in FIG. 5, this embodiment focuses on the first time that the HNB initiates authentication after the initial startup of the HNB. Process flow. This is also a further detailed illustration of steps 111 to 112 in the second embodiment described above. Specifically, the following steps are included:

Step 3110: The UE initiates an identity authentication request by using the HNB, and carries the identity identification information in the request, and the request is sent to the AAA server.

Step 3111: The AAA server may run the AKA algorithm to perform identity authentication on the UE.

Step 3112: The AAA server sends the encrypted UE authentication data through the authentication response (may be RAND, AUTN, XRES, etc. in the AV stored in the AAA, and may be multiple groups) to be sent to the HNBo.

Step 3113: The HNB sends a response message that the authentication succeeds to the UE.

Step 3114: The HNB sends the encrypted UE authentication data to the TrE.

Step 3115: The TrE decrypts the authentication data, and securely stores the UE authentication data.

In this embodiment, after the first startup of the HNB, the UE and the HNB complete the identity authentication of the UE in the non-identity authentication by interacting with the SGW and the AAA server on the network side, and the identity authentication data of the UE maintained by the network side after the authentication succeeds. Download to HNB local TrE. When the HNB is restarted or re-authenticated, or when the UE needs to re-authenticate, the identity authentication process of the UE can be performed in the local TrE of the HNB, and the interaction between the UE and the HNB is required, and the SGW and the AAA server are not required. And the interaction of network-side servers such as AHR, which fully utilizes the functions of the TrE and reduces the burden on the network side.

Sixth embodiment

FIG. 6 is a flowchart of a sixth embodiment of a method for authenticating a trusted environment of a home base station according to the present invention. As shown in FIG. 6, this embodiment focuses on an authentication process for restarting or re-authenticating in an HNB, by using the foregoing first embodiment. As can be seen from the fifth embodiment, after the HNB is started for the first time, it passes through the network. After the network side authenticates the HNB, part of the authentication data maintained by the network side (mainly related authentication data about non-identity authentication) is downloaded to the local TrE of the HNB. In this way, when the HNB is restarted or re-authenticated, the related non-identity authentication can be performed directly locally without the participation of the network side. This embodiment specifically includes the following steps:

Step 21: Perform identity authentication on the HNB.

Step 22. Perform identity authentication on the TrE.

Step 23: Authenticate the identity binding relationship between the HNB and the TrE.

Steps 21 to 23 may specifically adopt the processes in step 101 to step 110 in the second embodiment, and details are not described herein again.

Step 24. Perform non-identity authentication on the HNB through the TrE. Non-identity authentication can include:

HPM authentication, location authentication data for HNB, and authentication for UE.

In this embodiment, the non-identity authentication data acquired in the authentication process when the HNB is first started is stored in the TrE. When the HNB is restarted or re-authenticated, the relevant non-identity authentication can be performed based on the non-identity authentication data stored in the local TrE. There is no need to interact with network-side servers such as SGW, AAA server, and AHR, which fully utilizes the TrE function and reduces the burden on the network side.

Seventh embodiment

FIG. 7 is a signaling flowchart of a seventh embodiment of a method for authenticating a trusted environment of a home base station according to the present invention. As shown in FIG. 7, this embodiment focuses on an identity authentication process for an HPM during HNB restart or re-authentication. The authentication process described in this embodiment is a specific exemplary description of step 24 in the sixth embodiment. When the HNB is started again, it also goes through steps 21 to 23 in the sixth embodiment. This embodiment includes the following steps:

Step 4110: The HPM initiates an identity authentication request to the TrE, which can be completed through an interface between the HNB and the TrE.

Step 4111: The TrE queries the authentication vector (A V ) that it has not used.

Step 4112: The TrE initiates an authentication challenge request to the HPM, where the request carries an AV (where AV contains vRAND and AUTN parameters).

Step 4113: The HPM calculates RES based on the received RAND and AUTN parameters and its stored key (response values calculated from the key and AUTN and RAND).

Step 4114: The HPM returns an authentication challenge response, and the RES is carried in the response.

Step 4115: The TrE performs HPM identity authentication. The TrE compares the received RES with the stored XRES (the parameter that is downloaded to the TrE after the authentication process is completed when the HNB is first started). If they match, the TrE succeeds in the HPM authentication and generates a successful authentication result. Otherwise, the authentication result of the authentication failure is generated.

Step 4116: The TrE returns the authentication result to the HPM.

Step 4117: The TrE notifies the AAA server on the network side of the authentication result.

In this embodiment, the TrE stores the identity authentication data of the acquired HPM in the authentication process when the HNB is first started. When the HNB is restarted or re-authenticated, the identity authentication of the relevant HPM can be performed based on the identity authentication data of the HPM stored in the local TrE. There is no need to interact with network-side servers such as SGW, AAA server, and AHR, which fully utilizes the TrE function and reduces the burden on the network side.

Eighth embodiment

FIG. 8 is a signaling flowchart of an eighth embodiment of a method for authenticating a home base station trusted environment according to the present invention. As shown in FIG. 8, this embodiment focuses on a location authentication process for an HNB during HNB restart or re-authentication. The authentication process described in this embodiment is also a specific exemplary description of step 24 in the sixth embodiment, and the HNB restart or re-authentication also goes through steps 21 to 23 in the sixth embodiment. This embodiment includes the following steps:

Step 5110: The HNB sends a location authentication request to the TrE, where the location authentication request carries the current location information of the HNB.

Step 5111, TrE performs location authentication. The TrE compares the current location information with the location information stored in the TrE. If they match, the location authentication result of the successful authentication is generated, otherwise the location authentication result of the authentication failure is generated. Step 5122, the TrE notifies the HNB of the location authentication result.

Step 5113: The TrE notifies the AHR of the network side of the location authentication result.

In this embodiment, the TrE stores the obtained in the authentication process when the HNB is first started.

HNB location authentication data. When the HNB is restarted or re-authenticated, the location authentication of the relevant HNB may be performed based on the location authentication data of the HNB stored in the local TrE. No need to work with SGW again,

The interaction between the AAA server and the network side server such as the AHR fully utilizes the functions of the TrE, reducing the burden on the network side.

Ninth embodiment

FIG. 9 is a signaling flowchart of a ninth embodiment of a method for authenticating a trusted environment of a home base station according to the present invention. As shown in FIG. 9, this embodiment focuses on the UE performing the identity authentication again after the UE first passes the network side. The certification process at the time of certification. After the initial startup of the HNB, if a certain UE has already performed identity authentication with the network side, the UE authentication data related to the UE is already stored in the local TrE, so that when the HNB receives the identity authentication of the same UE again. When requested, the certification can be done directly through the TrE. The re-authentication performed by the UE may be after the initial startup of the HNB, or when the HNB is restarted or re-authenticated. The authentication process of this embodiment is as follows:

Step 6110: The TrE receives the UE identity authentication request sent by the UE, where the request carries the identity identifier of the UE.

Step 6111: The TrE compares the identity identifier of the UE carried in the UE identity authentication request with the identity identifier of the UE stored in the TrE. If they are consistent, the UE authentication result of the successful authentication is generated, otherwise the UE authentication result of the authentication failure is generated. .

Step 6112: The TrE notifies the UE of the UE identity authentication result.

Step 6113: The TrE notifies the AAA server of the network side of the UE identity authentication result.

In this embodiment, the TrE stores the UE identity authentication data of the acquired HNB in the authentication process when the HNB is initially started. When the HNB is restarted or re-authenticated, the relevant UE identity authentication may be performed based on the UE identity authentication data stored in the local TrE. There is no need to interact with network-side servers such as SGW, AAA server, and AHR, which fully utilizes the functions of TrE. Less burden on the network side.

Tenth embodiment

This embodiment is an embodiment of a TrE unit including an authentication data storage module and an authentication module. The authentication data storage module is configured to store non-identity authentication data of the HNB; the authentication module is configured to perform non-identity authentication of the HNB according to the non-identity authentication data of the HNB stored by the authentication data storage module.

The authentication data storage module may include: an HPM authentication data storage module and/or a UE authentication data storage module and/or an HNB location authentication data storage module. The authentication module includes: an HPM identity authentication module and/or an HNB location authentication module and/or a UE identity authentication module. The HPM identity authentication module needs to invoke the data stored in the HPM authentication data storage module when performing identity authentication on the HPM. Similarly, the HNB location authentication module and the HNB location authentication data storage module, the UE identity authentication module, and the UE authentication data storage module. There is also a corresponding correspondence.

Eleventh embodiment

The embodiment of the present invention further provides a home base station, which includes a TrE unit as shown in the tenth embodiment, and is not further described herein.

It can be seen from the foregoing embodiment that the embodiment of the present invention fully utilizes the characteristics of the TrE, and stores the non-identity authentication data after the HNB authentication for the first time in the TrE. When the HNB is restarted, the related non-identity authentication can be performed through the TrE. Therefore, the burden on the HNB authentication of the network side is alleviated, and the HPM-ID and the HNB-ID are not needed to implement the binding of the device and the user identity, thereby avoiding the burden of the operator to additionally establish a database.

It should be noted that: the non-identity authentication in the embodiment of the present invention refers to: in addition to the device identity authentication and the TrE identity authentication of the HNB, some authentications related to the HNB, such as HNB location authentication, HPM authentication, and access to the HNB. UE authentication.

The elements of the examples and the algorithm steps described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both, in order to clearly illustrate the interchangeability of hardware and software, in the above description. The composition and steps of the various examples have been generally described in terms of function. Whether such functions are performed in hardware or software depends on the particular application of the technical solution and the functions described, but such implementation should not be considered to be beyond the scope of the present invention.

The steps of a method or algorithm described in connection with the embodiments disclosed herein can be implemented in hardware, a software module executed by a processor, or a combination of both. Software modules can be placed in random access memory

(RAM), memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium.

It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or some of the technical features are equivalently replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Rights request

An authentication method based on a trusted environment of a home base station, the method comprising: performing device identity authentication on a home base station;

Performing identity authentication on a trusted environment set on the home base station;

Authenticating an identity binding relationship between the home base station and the trusted environment; performing non-identity authentication on the home base station;

Acquiring and storing non-identity authentication data of the home base station in the trusted environment.

The home base station trusted environment-based authentication method according to claim 1, wherein the home base station performs non-authentication verification, and acquires and stores the non-identity authentication data of the home base station in the trusted Specifically, the environment is: performing identity authentication on the user identity module on the home base station, and acquiring and storing the authentication data of the user identity module in the trusted environment.

The method for authenticating a home base station trusted environment according to claim 2, wherein the user identity module on the home base station is authenticated, and the authentication data of the user identity module is acquired and stored. Specifically in the trusted environment:

Obtaining an identity of the user identity module by using the trusted environment;

Sending a user identity module identity authentication request to a verification, authorization, and accounting server, where the request carries the identity module of the user identity and the identity of the trusted environment;

Performing identity authentication of the user identity module and binding authentication of the user identity module to the trusted environment by the verification, authorization, and accounting server;

The user identity module authentication data is obtained from the AP home registration server and stored in the trusted environment.

The home base station trusted environment-based authentication method according to claim 1, wherein the home base station performs non-authentication verification, and acquires and stores the non-identity authentication data of the home base station in the trusted Specifically, the environment is: performing location authentication on the home base station, and acquiring and storing location authentication data of the home base station in the trusted environment.

The home base station trusted environment-based authentication method according to claim 4, wherein the home base station performs location authentication, and the location authentication data of the home base station is acquired and stored in the trusted environment. Specifically:

Initiating an initial startup request to the AP home registration server, where the initial startup request carries current location information of the home base station;

Performing location authentication on the home base station by using the AP home registration server; receiving an initial startup response returned by the AP home registration server, where the initial startup response carries the authenticated location information;

The authenticated location information is stored in the trusted environment.

The home base station trusted environment-based authentication method according to claim 1, wherein the home base station performs non-authentication verification, and acquires and stores the non-identity authentication data of the home base station in the trusted Specifically, the environment is: performing authentication on the UE, and acquiring and storing the authentication data of the UE in the trusted environment.

The authentication method of the home base station trusted environment according to claim 6, wherein the authentication of the UE is performed, and the authentication data of the UE is obtained and stored in the trusted environment:

Receiving, by the UE, a UE authentication request, and forwarding the request to the authentication, authorization, and accounting server, where the UE authentication request carries the identity identification information of the UE;

Identity authentication of the UE by the verification, authorization, and accounting server;

Receiving UE authentication data returned by the verification, authorization, and accounting server;

The UE authentication data is stored in the trusted environment.

The authentication method of the home base station trusted environment according to claim 1, wherein after the identity binding relationship between the home base station and the trusted environment is authenticated, the method further includes: The platform integrity is certified.

9. An authentication method based on a trusted environment of a home base station, the method comprising: performing device identity authentication on a home base station; Authenticate the trusted environment;

Authenticating an identity binding relationship between the home base station and the trusted environment; performing non-identity authentication on the home base station by using the trusted environment.

The authentication method of the home base station trusted environment according to claim 9, wherein the non-identification of the home base station by the trusted environment is: The user identity module on the home base station performs identity authentication.

The authentication method of the home base station trusted environment according to claim 10, wherein the authentication of the user identity module on the home base station by the trusted environment is specifically:

The user identity module initiates an authentication request to the trusted environment;

The trusted environment initiates an authentication challenge request to the user identity module, the request carrying RAND and AUTN parameters;

The user identity module calculates a RES according to a key stored therein;

The user identity module initiates an authentication challenge response, and the response carries an RES parameter; the trusted environment determines whether the values of the RES and the XRES are consistent, and if they are consistent, generating a user identity module identity authentication result of successful authentication, Otherwise, the identity authentication result of the user identity module that failed the authentication is generated;

The trusted environment returns the user identity module identity authentication result to the user identity module;

The trusted environment notifies the authentication, authorization, and accounting server of the identity of the user identity module.

The authentication method of the home base station trusted environment according to claim 9, wherein the non-identification of the home base station by the trusted environment is: The home base station performs location authentication.

13. The home base station trusted environment-based authentication method according to claim 12, The location authentication of the home base station by using the trusted environment is: the home base station sends a location authentication request to the trusted environment, where the location authentication request carries current location information of the home base station ;

The trusted environment compares the current location information with the location information stored in the trusted environment. If they are consistent, the location authentication result of the successful authentication is generated, otherwise the location authentication result of the authentication failure is generated;

The trusted environment notifies the AP of the location authentication result to the AP home registration server.

The authentication method of the home base station trusted environment according to claim 9, wherein the non-identification of the home base station by the trusted environment is specifically:

The UE is authenticated by the trusted environment.

An authentication method based on a trusted environment of a home base station, the method comprising: receiving, by the trusted environment, a UE identity authentication request sent by the UE;

The UE is authenticated by the trusted environment.

The authentication method of the home base station trusted environment according to claim 15, wherein the UE identity authentication request carries an identity of the UE, and the identity authentication of the UE by the trusted environment is performed. Specifically:

The trusted environment compares the identity of the UE that is carried in the UE identity authentication request with the identity of the UE that is stored in the trusted environment, and if yes, generates a UE authentication result that is successfully authenticated, otherwise generates UE authentication result that fails authentication;

The trusted environment notifies the authentication, authorization, and accounting server of the UE identity authentication result.

17. A trusted environment unit, comprising:

An authentication data storage module, configured to store non-identity authentication data of the home base station;

And an authentication module, configured to perform non-identity authentication of the home base station according to the non-identity authentication data of the home base station stored by the authentication data storage module.

The trusted environment unit according to claim 17, wherein the authentication data storage module comprises: a user identity module authentication data storage module and/or a UE authentication data storage. A storage module and/or a home base station location authentication data storage module.

The trusted environment unit according to claim 17, wherein the authentication module comprises: a user identity module identity authentication module and/or a home base station location authentication module and/or a UE identity authentication module.

20. A home base station, comprising: a trusted environment unit, wherein: the trusted environment unit is provided with: