WO2010091589A1

WO2010091589A1 - Security authentication method

Info

Publication number: WO2010091589A1
Application number: PCT/CN2009/075968
Authority: WO
Inventors: 李志军; 宗在峰; 郝振武
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-02-16
Filing date: 2009-12-24
Publication date: 2010-08-19
Also published as: CN101808321A; CN101808321B

Abstract

A security authentication method includes that an interworking function (IWF) receives a registration request from a user equipment (UE) (301); the IWF performs security authentication on the UE according to authentication parameters or security authentication state for performing security authentication on the UE in an authentication network element (302). The present invention can reduce the complexity for performing security authentication on the UE by the IWF, and improve the efficiency for processing signaling by the IWF.

Description

A safe i-person authentication method

The present invention relates to a security authentication technology in a third generation mobile communication system, and more particularly to a security authentication method for implementing a circuit switched (CS) domain service under an evolved packet domain system (EPS) access.

In order to maintain the competitiveness of the 3rd Generation Partnership Project (3GPP, 3rd Generation Partnership Project) in the field of mobile communications, 3GPP is currently working on the research of packet switched cores (PS Core, Packet Switched Core) and global mobile communications. Evolution of the Universal Mobile Telecommunication System Radio Access Network (UTRAN). The goal is to enable Evolved PS Core (EPC) to provide higher transmission rates and shorter transmission delays, and to support Evolved UTRAN (Evolved UTRAN), GSM EDGE radio access. Mesh (GERAN, GSM EDGE Radio Access Network), mobility management between UTRAN, WLAN (Wireless Local Area Network) and other non-3GPP access networks. Among them, (GSM, Global System for Mobile communications) refers to the Global System for Mobile Communications (EDGE, Enhanced Data Rate for GSM Evolution), which refers to the enhanced data rate GSM evolution technology. This evolved mobile communication system is called the Evolved Packet System (EPS).

FIG. 1 is a network architecture diagram of a prior art user terminal (UE, User Equipment) implementing a circuit switched (CS) circuit under EPS network access. Among them, E-UTRAN can provide higher uplink and downlink rates, lower transmission delay and more reliable wireless transmission; the network elements included in E-UTRAN are evolved base stations (eNodeBs, evolved NodeBs), Used to provide radio resources for UE access. The Serving Gateway (S-GW) is a user plane entity responsible for routing data of user plane data. The Packet Data Network Gateway (P-GW) is responsible for the gateway function of the UE accessing the Packet Data Network (PDN). The P-GW and the S-GW can be combined in one physical entity. The Mobility Management Entity (MME) is a control plane entity that temporarily stores user data, manages and stores the UE context, assigns temporary identifiers to users, and authenticates users. GERAN/UTRAN is a radio access network of a GSM/Universal Mobile Telecommunications System (UMTS) network, including a base station and a base station controller portion. The Mobile Switching Center (MSC) / Visitor Location Register (VLR) belongs to the CS domain network element.

When the UE accesses the GSM/UMTS network, the basic voice service of the user and the supplementary service based on the voice service are provided through the CS domain. The EPS system itself does not provide and control CS services such as voice calls, and can only provide data for Internet Protocol (IP) data. In the prior art, the CS service, such as the voice of the UE under the EPS access, is implemented by the CS domain. After the UE accesses the EPS network, the UE and the MSC are transmitted through the IP signaling channel carried on the EPS network. The interaction signaling between the /VLR performs an interaction process such as location update and call signaling, and the voice media stream is transmitted through the IP user plane channel carried on the EPS network.

The network architecture shown in FIG. 1 can be used to implement the UE to perform CS services such as voice through CS domain control under the EPS network access. The network architecture is called CS service establishment on the PS bearer (CSoPS, CS over PS). In this network architecture, in order to avoid the modification and influence of the MSC/VLR, an Internet element (IWF, Interworking Function) is newly introduced to complete the relevant modification. On the one hand, the IWF provides an A/IU-CS interface with the MSC/VLR, and completes the conversion of the IP signaling message received from the UE into an A/IU-CS interface message and sends it to the MSC/VLR, and the reverse conversion. And the sending operation; on the other hand, the EPS treats the IWF as an application function point (AF, Application Function), and performs application service functions based on the IP layer. After the UE accesses the EPS network, the IP signaling channel carried on the EPS network interacts with the IWF and the MSC/VLR to perform an interaction process such as registration, location update, and voice call, thereby completing the establishment process of the bearer and the call setup. When the UE needs to switch from the EPS network to the UMTS/GSM network, when the MME receives the handover request, for the voice service, the MME needs to send a handover request message to the current IWF of the UE, so that the IWF converts the handover request message to the current control call. The MSC/VLR sends a handover request message, so the MME where the UE is currently located needs to be able to know the IWF where the UE is currently located.

The process of the UE accessing the CS domain through the EPS network in the prior art includes three main parts: 1. The UE accesses the EPS network and creates a bearer for the CSoPS; 2. The UE initiates registration with the IWF; The registration of the CS domain is initiated to the MSC. It can be seen that the UE needs to perform three times of security authentication on the UE when the UE accesses the network through the EPS and registers with the CS domain, including:

1) Access authentication when the UE accesses the EPS network: It is executed by the MME, and the UE is authenticated by the non-access stratum (NAS, Non Access Stratum) access control;

2) IP security authentication before the UE registers with the IWF: The IPSec protocol is used between the UE and the IWF to establish a secure IP connection to ensure mutual trust between the UE and the IWF;

3) Identity authentication when the UE registers with the CS domain: It is executed by the MSC, and the UE is authenticated by the CS authentication mechanism.

The access authentication when the UE accesses the EPS network and the identity authentication when the UE registers with the CS domain are all established mature mechanisms. These mechanisms have a similar idea: the UE and the network jointly hold a long-term key, and the Home Location Register (HLR, Home Subscriber Server) in the home network saves the UE. The important parameters of the authentication are sent to the authentication network element in the network, and the authentication network element calculates the authentication challenge for the UE, and the UE reversely calculates the authentication response according to the authentication challenge, and the authentication network element Verifying the correctness of the authentication response means authenticating the UE. The security authentication mechanism between the UE and the IWF uses an IPSec-based tunnel encryption mechanism. The authentication and encryption parameters used by the IWF to establish an IPSec tunnel are derived from Authentication Authorization Accounting (AAA). Month server. As shown in Figure 2, the IWF queries the AAA server (V-AAA) of the visited network for authentication and encryption parameters, and the V-AAA queries the AAA server (H-AAA) of the home network for authentication and encryption parameters, and H. -AAA obtains authentication and encryption parameters from the HSS of the home network.

The IPSec mechanism between the UE and the IWF can ensure the security authentication of the IWF to the UE. However, in practical applications, the following defects exist:

a. The IPSec tunnel encryption mechanism is used to greatly increase the complexity of the IWF processing signaling and reduce the efficiency of signaling processing for frequent signaling communication between the UE and the IWF. Moreover, the communication procedure is greatly increased for the UE. The complexity.

b. The IPSec tunnel encryption mechanism is adopted, so that the IWF needs to establish an interface with the AAA server to obtain parameters such as a long-term key for each UE. Therefore, the interface between the IWF and the AAA is only used to perform the transmission of the authentication parameters. However, it is necessary to deploy a complete set of Diameter protocol stations, which greatly increases the complexity of the IWF.

c. The usual AAA server is used for interworking between the mobile communication technology defined by the non-3GPP and the mobile communication technology defined by the 3GPP, and the use of the IPSec mechanism between the UE and the IWF, so that the CSoPS architecture must be introduced into the AAA server, thereby increasing the overall The complexity of the architecture. Summary of the invention

In view of the above, the main purpose of the present invention is to provide a security authentication method, which is to reduce the complexity of implementing the security authentication of the UE by the IWF, and improve the efficiency of the IWF processing signaling.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

The invention provides a security authentication method, the method comprising:

An Internet Element (IWF) receives a registration request from a User Terminal (UE);

The IWF performs an authentication parameter or a security authentication for performing security authentication on the UE according to the authentication network element. Status, performing security authentication on the UE.

The authentication network element is a mobility management entity (MME) in a packet domain system (EPS) network, and the IWF obtains an authentication parameter for performing security authentication on the UE from the MME, and performs the UE on the authentication parameter according to the authentication parameter. safety certificate.

The IWF obtains the authentication parameter from the MME, and specifically includes:

Obtaining, by the IWF, an address of the MME from a registration request of the UE;

The IWF requests the authentication parameter from the MME;

The MME sends an authentication parameter obtained from a Home Subscriber Server (HSS) to the IWF.

After the MME obtains the authentication parameter from the HSS, the MME actively sends the authentication parameter to the IWF.

The authentication parameter for performing security authentication on the UE is: an authentication parameter of the EPS network for performing access authentication on the UE, and/or an authentication parameter of the circuit switched service established on the packet switched bearer (CSoPS) service to the UE .

The authentication network element is an MME in the EPS network, and the IWF performs security authentication on the UE according to the security authentication status of the UE by the MME, and specifically includes:

The IWF obtains the address of the MME according to the MME information in the registration request of the UE; the IWF requests the MME to query the authentication status when the UE accesses the EPS network; and the MME returns to the IWF when the UE accesses the EPS network. Certification status;

The IWF verifies whether the UE passes the security authentication according to the authentication status when the UE accesses the EPS network, and returns a security authentication result to the UE.

After the UE successfully attaches to the EPS network, the EPS network establishes a bearer for the UE, and the MME After the IWF is allocated to the UE, the authentication status of the UE when the UE accesses the EPS network is actively sent to the IWF;

The authentication status of the UE when accessing the EPS network includes at least one of the following states: a security authentication status of the non-access stratum (NAS) authentication by the EPS network, a state in which the EPS network allows the UE to access, and an EPS network. A state is established for the UE to bear and assign an Internet Protocol (IP) address.

The authentication network element is a mobile switching center (MSC) in a circuit switched (CS) domain, and the IWF performs security authentication on the UE according to the security authentication status of the UE by the MSC, and specifically includes: the IWF receives the registration of the UE. And requesting, according to the identifier information used to indicate registration to the CS domain in the registration request, initiating a registration process of the CS domain to the MSC instead of the UE;

The IWF verifies whether the UE passes the security authentication according to the security authentication status when the UE initiates registration with the CS domain, and returns a security authentication result to the UE.

The authentication network element is an MSC in the CS domain, and the IWF performs security authentication on the UE according to the security authentication status of the UE by the MSC, and specifically includes:

When the IWF receives the registration request of the UE, and the registration request does not have the identifier information for initiating the registration to the CS domain, the UE performs the CS domain registration process to the MSC instead of the UE according to the policy configuration of the network;

The identifier information used by the UE to initiate registration to the CS domain in the registration request sent by the UE to the IWF is an indication that the UE initiates a location update procedure to the CS domain.

The authentication network element is an MSC in the CS domain, and the IWF performs security authentication on the UE according to the security authentication status of the UE by the MSC, and specifically includes: After receiving the registration request of the UE, the IWF pre-defaults the UE registration success, and determines whether to cancel the registration of the UE on the IWF according to the security authentication status of the MSC to the UE when the UE requests registration to the CS domain.

The security authentication method provided by the present invention is used by the IWF according to the authentication parameters stored in the home network when receiving the registration request from the UE, and is similar to that used when the UE accesses the EPS network or the UE registers with the CS domain. The authentication algorithm performs security authentication on the UE. The security authentication is performed on the UE according to the security authentication status when the UE accesses the EPS network or registers with the CS domain. The invention reduces the frequent signaling communication between the UE and the IWF, reduces the complexity of the IWF and the UE processing signaling, and improves the efficiency of the IWF processing signaling. In addition, the AAA server is no longer needed in the architecture of the present invention. The complexity of the overall architecture is reduced, and the complexity of implementing the IWF for secure authentication of the UE is also reduced. DRAWINGS

1 is a network architecture diagram of a UE implementing a CS service under an EPS network access in the prior art; FIG. 2 is a flowchart of obtaining an authentication and encryption parameter from an AAA server by an IWF in the prior art; Flow chart of the safety certification method;

4 is a flowchart of a security authentication method according to Embodiment 1 of the present invention;

5 is a flowchart of a security authentication method according to Embodiment 2 of the present invention;

6 is a flowchart of a security authentication method according to Embodiment 3 of the present invention;

FIG. 7 is a flowchart of a method for secure authentication according to Embodiment 4 of the present invention. detailed description

The technical solutions of the present invention are further elaborated below in conjunction with the accompanying drawings and specific embodiments. The security authentication method provided by the present invention is applied to the security authentication of the IWF to the UE when the CS domain service is implemented under the EPS access. As shown in FIG. 3, the method mainly includes the following steps: Step 301: The IWF receives the UE from the UE. Registration request. The UE sends a registration request to the IWF before registering with the IWF.

Step 302: The IWF performs security authentication on the UE according to the authentication parameter or the security authentication status of the security authentication of the UE by the authentication network element.

The authentication network element in the present invention includes: an MME in an EPS network, an MSC in a CS domain, and the like. Of course, the authentication network element of the present invention is not limited to the MME and MSC enumerated above. The IWF may obtain an authentication parameter for performing security authentication on the UE from the MME, and the authentication parameter may be at least one of the following two authentication parameters:

A. The MME itself uses an authentication parameter for performing NAS access authentication on the UE.

B. The authentication parameter of the CSoPS that is sent by the HSS to the MME and is used by the IWF to authenticate the UE.

The IWF may also perform security authentication on the UE according to the security authentication status of the UE by the MME; and may perform security authentication on the UE according to the security authentication status of the UE by the MSC.

The embodiment in which the IWF obtains the authentication parameter for performing security authentication on the UE from the MME, and performs security authentication on the UE, as shown in FIG. 4, mainly includes the following steps:

Step 401: The UE requests to attach to the EPS network, and requests the EPS network to establish an IP bearer for the IP network, and the request is sent to the MME through the E-UTR AN.

The UE may use a specific Access Point Name (APN, Access Point Name) for CSoPS to require the EPS network to establish a bearer dedicated to CSoPS.

Step 402: The MME obtains an authentication parameter for performing security authentication on the UE from the HSS, and performs an authentication operation on the UE by using the authentication parameter.

Since the UE is initially connected to the EPS network, the EPS network needs to authenticate the UE, and the EPS network uses the N AS authentication mechanism to authenticate the UE. After the authentication is passed, the MME will store information about the security authentication status of the NAS authentication for the UE.

It should be noted that NAS authentication is usually necessary, but for some special users and special applications (such as emergency calls), the NAS authentication process is not necessarily required. Step 403: Since the UE is initially accessing the EPS network, and the MME does not have the service configuration data of the UE, the MME sends a location update request to the HSS, and requests to download the service configuration data of the UE.

Step 404: The HSS returns a location update response to the MME, and carries the service configuration data of the UE and the authentication parameter for performing security authentication on the UE.

The authentication parameter that the HSS downloads to the MME in the present invention must include an authentication parameter for the EPS network to perform access authentication on the UE, and may further include an authentication for the IWF to perform security authentication on the UE under the CSoPS service. parameter. If the home network supports CSoPS and the UE has CSoPS capability, an authentication parameter dedicated to CSoPS is configured in the HSS.

Step 405: After receiving the location update response of the HSS, the MME stores the service configuration data of the UE and the authentication parameter for performing security authentication on the UE, and allocates the S-GW/P-GW according to the network situation and the indication of the service data configuration. The assigned S-GW/P-GW sends a bearer setup request.

Step 406: The S-GW/P-GW establishes a bearer of the corresponding CSoPS for the UE, and returns a bearer setup response to the MME after the establishment is completed, including an IP address allocated for the UE.

Step 407: The MME sends an attach response to the UE, and returns an IP address allocated to the UE to the MME.

When the UE is attached to the EPS network, the EPS network allocates an IWF of the visited network to the UE according to the APN provided by the UE for CSoPS, and returns the allocated IWF to the UE in the attach response. The IWF can be a specific IWF address or a Full Qualified Domain Name (FQDN) for discovering the IWF.

Step 408: The UE acquires an IWF address of the visited network from the EPS network.

It should be noted that if the UE obtains the FQDN of an IWF, the UE may initiate a Domain Name System (DNS) query to obtain a suitable IWF address after attaching to the EPS network.

Another process in which the UE obtains the IWF address of the visited network may be that the UE configures the home network. The IWF, and by initiating a request to the IWF of the home network, the IWF of the home network provides a suitable visited network IWF for the UE according to the visited network accessed by the UE. If the UE obtains the domain name of the IWF of the visited network, the UE may obtain the IP address of the IWF through a DNS query mechanism.

After the UE obtains the IWF address of the visited network, the UE may initiate registration with the corresponding IWF. The purpose of the registration is to enable the IWF to simulate the UE accessing the base station virtualized by the IWF, and enable the IWF to obtain the location information of the UE in the EPS network. And other necessary information.

Step 409: After obtaining the IWF address of the visited network, the UE initiates a registration request to the IWF. The information carried in the request mainly includes: an International Mobile Subscriber Identity (IMSI) of the UE, an IP address of the UE, and a UE connection. The location area information (TAI, Tracking Area Identity) of the EPS network, the address or identification information of the MME accessed by the UE.

Step 410: The IWF obtains an address of the MME currently attached by the UE according to the registration request of the UE.

When the UE registers with the IWF, it carries the identification information of the MME that the UE obtains when it is attached to the EPS network. The IWF can obtain the specific address of the MME by looking up the table or by using the DNS domain name mechanism.

Step 411: The IWF initiates an establishment request of the Sv interface to the MME, and queries the MME for the authentication parameter of the UE.

The Sv interface is used to establish the connection between the EPS network (with the MME as the main control core) and the CS network (the base station simulated by the IWF as the access terminal), so as to transmit the information and control signaling necessary for the interconnection between the networks.

Step 412: The MME establishes an Sv interface with the IWF, and returns a setup success response to the IWF after the establishment is completed, and the response carries the authentication parameter of the UE.

It should be noted that, if in the foregoing step 404, the MME obtains only the authentication parameters for the EPS network to perform access authentication for the UE from the HSS, the MME returns only for the EPS network. The authentication parameter for performing the access authentication on the UE; if the MME further obtains the authentication parameter of the CSoPS service to the UE in the foregoing step 404, the MME may choose to return at least one of the foregoing two authentication parameters, or The authentication parameters to be returned are selected according to the instructions of the IWF.

Step 413: The IWF calculates an authentication challenge by using an authentication algorithm according to the authentication parameter obtained from the MME.

Step 414: The IWF initiates an authentication challenge request to the UE.

Step 415: The UE inversely calculates the authentication response according to the authentication challenge and using an authentication algorithm. Step 416: The UE returns the calculated authentication response to the IWF.

Step 417: The IWF verifies whether the authentication response is correct, and sends a registration success response to the UE after verifying that the authentication response is correct.

For the process shown in FIG. 4, in step 409 to step 412, the IWF obtains the MME address from the registration request of the UE, and actively establishes an Sv interface with the MME, and queries the MME for the authentication parameter. However, the present invention provides a feasible method for the other embodiment of the process of FIG. 4, that is, in the process that the UE shown in FIG. 4 is attached to the EPS network, the UE is successfully attached to the EPS network, and the EPS network is established for the UE. After the bearer is allocated to the CSoPS, and the MME allocates the IWF to the UE (ie, step 407), the MME can actively establish an Sv interface with the IWF, and send the authentication parameter obtained in step 404 to the IWF through the interface. Then, when the UE initiates registration with the IWF, the IWF does not need to request the MME to establish an Sv interface again and requests to query the authentication parameters, and can directly use the authentication parameters sent by the previous MME to the IWF to perform security authentication on the UE.

An embodiment in which the IWF performs security authentication on the UE according to the MME's security authentication status, as shown in FIG. 5, mainly includes the following steps:

Step 501: The UE attaches to the EPS network, and through the NAS authentication, the EPS network establishes a bearer for the UE, and the UE obtains the allocated IP address.

The operation of this step is similar to the operations of steps 401 to 407 in the flow shown in FIG. 4, and details are not described herein again. Step 502: The UE acquires an IWF address of the visited network from the EPS network.

Step 503: The UE initiates a registration request to the IWF, where the information carried in the request mainly includes:

The IMSI of the UE, the IP address of the UE, the TAI of the UE accessing the EPS network, and the address or identification information of the MME accessed by the UE.

Step 504: The IWF obtains an address of the MME accessed by the UE.

Since the UE is never registered on the IWF, the IWF needs to verify whether the UE is legal after obtaining the IMSI, IP address, and the like from the registration request of the UE. The IWF may check whether the UE is authenticated by the EPS network from the UE status information of the MME.

Step 505: The IWF initiates an establishment request of the Sv interface to the MME, and queries the MME for the authentication status of the UE.

The IWF requests the MME to verify the authentication status of the UE by providing the MME with information such as the IMSI and IP address of the UE.

Step 506: The MME establishes an Sv interface with the IWF, and returns a setup success response to the IWF after the establishment is completed, where the response carries the authentication status of the UE.

If the UE successfully authenticates on the MME, the MME stores the complete context data of the UE, where the information such as the IMSI and the IP address of the UE is recorded, and the MME queries the context data stored by the MME according to the information such as the IMSI and the IP address provided by the IWF. Whether there is a corresponding information such as the IMSI and the IP address, if any, the UE is considered to have passed the access authentication of the EPS network, and returns the authentication status of the UE to the IWF, that is, the information indicates that the UE has passed the access of the EPS network. Certification. On the other hand, if there is no corresponding IMSI and IP address of the UE on the MME, the UE is considered to have no access authentication through the EPS, and the MME identifies that the UE does not pass the EPS network access authentication.

It should be noted that the authentication status when the UE accesses the EPS network includes at least one of the following states:

a. The EPS network performs the NAS authentication security authentication status on the UE (if the EPS network is paired) The UE performs the NAS authentication process);

b. The state in which the EPS network allows the UE to access;

c. The EPS network establishes a state for the UE to bear and allocate an Internet Protocol IP address.

Step 507: After obtaining the authentication status of the UE accessing the EPS network from the MME, the IWF sends a registration success response to the UE if it confirms that the UE has passed the access authentication of the EPS network, otherwise rejects the registration of the UE.

The process shown in Figure 5 is that the IWF actively establishes an Sv interface with the MME and queries the MME for the authentication status of the UE through the interface. However, the present invention provides a feasible method for the other embodiment of the process of FIG. 5, that is, after the UE successfully attaches to the EPS network, the EPS network establishes a bearer for the CSoPS for the UE, and the MME allocates the IWF to the UE. The MME can actively establish an Sv interface with the IWF, and send the authentication status of the UE to the IWF through the interface. Then, when the UE initiates registration with the IWF, the IWF does not need to request the MME to establish an Sv interface and query the authentication status of the UE, and can directly determine whether the UE has passed the EPS network by using the authentication status sent by the previous MME to the IWF. Certification.

An embodiment in which the IWF performs security authentication on the UE according to the security authentication status of the UE by the MSC, as shown in FIG. 6, mainly includes the following steps:

Step 601: The UE attaches to the EPS network, and through the NAS authentication, the EPS network establishes a bearer for the UE, and the UE obtains the allocated IP address.

The operation of this step is similar to the operations of steps 401 to 407 in the flow shown in FIG. 4, and details are not described herein again.

Step 602: The UE acquires an IWF address of the visited network from the EPS network.

Step 603: The UE initiates a registration request to the IWF, where the information carried in the request mainly includes:

The UE may carry an identifier indicating the registration to the CS domain in the registration request. Information indicating that the UE wishes to achieve registration for the CS network. The identifier information used to indicate the registration to the CS domain may be the identifier information of the location update process initiated by the CS domain, indicating that the UE wants to register to the CS network through the CS domain location update process. In this way, the registration request initiated by the UE to the IWF and the CS domain simultaneously constitutes a joint registration request.

Step 604: After receiving the registration request of the UE, the IWF obtains the IMSI of the UE, the IP address of the UE, the TAI of the UE accessing the EPS network, the address or identifier of the MME accessed by the UE, and the like, according to the registration. The identifier information used to indicate registration to the CS domain is determined in the request, and the UE needs to initiate a registration process to the CS domain.

It should be noted that if the UE carries the TAI of the EPS network in the registration request, the IWF may convert the TAI into a CS domain location information (LAI, Location Area Identity) through a certain mapping rule; if the UE is in the joint registration request With the LAI carried, the IWF can directly use the LAI.

Step 605: The IWF initiates a location update request of the CS domain to the MSC instead of the UE, and the request carries the LAI.

Step 606: The MSC initiates a location update request to the HLR, and requests to download the service configuration data of the UE.

Since the UE is not registered on the MSC, the MSC needs to obtain an authentication parameter from the HLR to authenticate the UE.

Step 607: After receiving the location update request sent by the MSC, the HLR returns a location update response to the MSC, where the response carries the service configuration data of the UE and the authentication parameter for performing security authentication on the UE.

Step 608: The MSC calculates an authentication challenge by using an authentication algorithm according to the authentication parameter returned by the HLR.

Step 609: The MSC sends an authentication challenge request to the UE by using the IWF.

Step 610: The UE calculates an authentication response by using an authentication algorithm according to the long-term key stored by the UE. Should.

The long-term key stored in the UE is consistent with the long-term key stored in the HLR/HSS.

Step 611: The UE returns an authentication response to the MSC through the IWF.

Step 612: After receiving the authentication response, the MSC verifies whether the authentication response is correct, to determine whether the UE is a legitimate user, and sends a location update response to the IWF after determining the validity. The location update response is the security authentication status when the UE registers with the CS domain.

Step 613: After receiving the location update response sent by the MSC, the IWF sends a registration success response to the UE.

Since the IWF is a location update for the CS and the UE, the registration success response needs to be sent to the UE after receiving the location update response of the MSC.

In addition, in the process shown in FIG. 6, the IWF receives the registration request of the UE, and initiates a location update to the CS domain according to the identifier information used to indicate registration to the CS domain in the registration request, so that the UE sends the location update to the CS domain. registered. However, the present invention further provides a feasible method for the other embodiment of the process of FIG. 6, that is, if the registration request initiated by the UE does not carry the identifier information indicating that the registration is initiated to the CS domain, the IWF receives the registration request. Then, according to the policy configuration of the network, the UE can actively initiate the location update request of the CS domain to the MSC, and use the MSC to authenticate the UE to the UE, so that the IWF considers that the UE is the IWF. Secure and trustworthy, and according to this, the IWF requests registration from the IWF through the UE. In the process, the IWF will also need to map the TAI of the EPS network to the LAI of the CS domain.

In addition, as another implementation manner of Embodiment 3 of the present invention, the security authentication method in Embodiment 4 of the present invention is as shown in FIG. 7, which is different from Embodiment 3 in that after receiving the registration request of the UE, the IWF may Pre-default UE registration is successful, and registration by the UE, as shown in steps 703 and 704; then the UE initiates a location update request to the CS domain, and the MSC performs authentication of the CS domain for the UE, in the process, if authentication is performed Failure (ie, the UE does not pass the authentication), then the IWF intercepts the authentication failure response in step 712, and the IWF will actively initiate step 713 to fetch Eliminate the registration of the UE on the IWF. On the other hand, if the UE passes the authentication of the CS domain, the IWF may intercept the authentication success response in step 712, so that the UE passes the security authentication, and thus does not actively cancel the UE registration on the IWF.

In summary, the present invention implements the security authentication of the IWF to the UE when the UE implements the CS domain service by accessing the EPS network, which is beneficial to improving the authentication efficiency of the IWF to the UE and improving the IWF processing signaling capability.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

Claim

A security authentication method, characterized in that the method comprises:

The IWF performs security authentication on the UE according to an authentication parameter or a security authentication state in the authentication network element for performing security authentication on the UE.

The security authentication method according to claim 1, wherein the authentication network element is a mobility management entity (MME) in a packet domain system (EPS) network, and the IWF obtains security from the MME from the MME. The authentication parameter of the authentication, and performing security authentication on the UE according to the authentication parameter.

The security authentication method according to claim 2, wherein the IWF obtains the authentication parameter from the MME, specifically:

The IWF requests the authentication parameter from the MME;

The security authentication method according to claim 2, wherein the IWF obtains an authentication parameter from the MME, specifically:

The security authentication method according to claim 1, or 2, or 3, or 4, wherein the authentication parameter for performing security authentication on the UE is: the authentication of the EPS network to the UE for access authentication The weight parameter, and/or the circuit switched service establishes an authentication parameter for the UE on the packet switched bearer (CSoPS) service.

The security authentication method according to claim 1, wherein the authentication network element is an MME in an EPS network, and the IWF enters the UE according to a security authentication status of the MME to the UE. Line safety certification, including:

The security authentication method according to claim 1, wherein the authentication network element is an MME in the EPS network, and the IWF performs security authentication on the UE according to the security authentication status of the UE by the MME, and specifically includes:

After the UE is successfully attached to the EPS network, the EPS network establishes a bearer for the UE, and after the MME allocates the IWF to the UE, the MME actively sends the authentication status when the UE accesses the EPS network to the IWF;

The security authentication method according to claim 6 or 7, wherein the authentication state when the UE accesses the EPS network includes at least one of the following states: the EPS network performs a non-access stratum (NAS) on the UE. The security authentication status of the authentication, the state in which the EPS network allows the UE to access, and the state in which the EPS network establishes a bearer and allocates an Internet Protocol (IP) address for the UE.

The security authentication method according to claim 1, wherein the authentication network element is a mobile switching center (MSC) in a circuit switched (CS) domain, and the IWF is based on a security authentication status of the UE by the MSC. The UE performs security authentication, which specifically includes:

When receiving the registration request of the UE, the IWF, according to the identifier information used to indicate registration to the CS domain in the registration request, initiates a registration process of the CS domain to the MSC instead of the UE;

Determining, according to the security authentication status when the UE initiates registration with the CS domain, the IWF Whether the UE passes the security authentication and returns a security authentication result to the UE.

The security authentication method according to claim 1, wherein the authentication network element is an MSC in the CS domain, and the IWF performs security authentication on the UE according to the security authentication status of the UE by the MSC, specifically:

The security authentication method according to claim 9 or 10, wherein the registration request sent by the UE to the IWF is used to indicate that the registration information is initiated to the CS domain, and the UE initiates a location update process to the CS domain. Instructions.

The security authentication method according to claim 1, wherein the authentication network element is an MSC in the CS domain, and the IWF performs security authentication on the UE according to the security authentication status of the UE by the MSC, and specifically includes:

After receiving the registration request of the UE, the IWF pre-defaults the UE registration success, and determines whether to cancel the UE registration on the IWF according to the security authentication status of the MSC to the UE when the UE requests registration to the CS domain.