WO2012000327A1

WO2012000327A1 - Method and device for realizing authentication

Info

Publication number: WO2012000327A1
Application number: PCT/CN2011/071783
Authority: WO
Inventors: 胡帅来
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-06-29
Filing date: 2011-03-14
Publication date: 2012-01-05
Also published as: CN101883362B; CN101883362A

Abstract

The present invention discloses a method and device for realizing authentication, each of them can append an authentication vector obtaining tag to a terminal which has been allocated with a low grade authentication vector; when the terminal accesses to a high level network, a high grade authentication vector applicable to the high level network is obtained according to the authentication vector obtaining tag of the terminal. Both of the method and device for realizing authentication in the present invention can avoid meaningless authentication failure, contribute to the normal communication of the terminal, and improve the user satisfaction.

Description

Method and device for realizing authentication

The present invention relates to the field of communications, and in particular, to a method and apparatus for implementing authentication. Background technique

At present, although 3G networks are gradually becoming popular, operators often adopt a gradual transition strategy for market and cost considerations, and thus the 2G&3G mobile switching center/visit location register (MSC/VLR) is co-networked. . In the mobile communication network in the transition phase, the original 2G MSC/VLR and the newly built 2G&3G MSC/VLR hybrid network usually appear.

Under the above network conditions, the terminal can roam from the 2G MSC/VLR to the 2G&3G MSC/VLR, and can also roam from the 2G network to the 3G network within the 2G&3G MSC/VLR. During the roaming process, the MSC/VLR needs to process the authentication process. There are two key points in the process of processing the authentication: the first is to acquire and save the authentication vector, and the second is to select the correct authentication vector to initiate the authentication process.

For the acquisition of the authentication vector, the MSC/VLR is mainly obtained through two channels:

The home location register/authentication center (HLR/Auc) is responsible for generating the authentication vector of the terminal, and the MSC/VLR can obtain the authentication vector from the HLR/Auc and save it. Of course, in order to avoid repeatedly obtaining the authentication vector, HLR/Auc can provide multiple sets of authentication vectors at one time.

In addition to obtaining the authentication vector from the HLR/Auc, the MSC/VLR can obtain the authentication vector from the previous MSC/VLR through the MAP-SEND-IDENTIFICATION message in the 3GPP TS 29.002 protocol when processing the location update procedure across the VLR. save.

For 2G terminals, the authentication vector generated by HLR/Auc is determined by the random number RAND, period Looking at the triples composed of XRES and encryption key CK; for 3G terminals, the authentication vector generated by HLR/Auc is composed of RAND, XRES, CK, integrity key IK, and authentication token AUTN. Quintuple.

When the authentication vector is obtained from the previous MSC/VLR, if the MSC/VLR is connected with a lower MAP protocol version, then only the triples can be passed in the MAP-SEND-IDENTIFICATION message due to the limitation of the version. Of course, for the MSC/VLR, the triplet can be derived from the quintuple, but not vice versa. Therefore, even for a 3G terminal, the 2G MSC/VLR can only provide the converted triples to the 2G&3G MSC/VLR. After the MSC/VLR initiates the authentication process, the MSC/VLR needs to select an appropriate authentication vector according to the current radio access type and terminal type of the terminal to ensure successful authentication.

As mentioned above, after the terminal roams from the 2G MSC/VLR to the 2G&3G MSC/VLR, the authentication vector obtained by the 2G&3G MSC/VLR from the 2G MSC/VLR can only be a triple.

The 2G&3G MSC/VLR can be connected to both the 2G Base Station Controller (BSC) and the 3G Radio Network Controller (RNC). If the terminal is accessed through the BSC at this time, the triplet is used according to the definition of the 3GPP TS 33.102 protocol. Successful authentication can be performed, and the authentication vector obtained by the 2G&3G MSC/VLR from the 2G MSC/VLR is available. However, if the terminal roams from the BSC under the 2G&3G MSC/VLR to the RNC, subsequent authentication if the saved triplet is still used will result in authentication failure. Or the terminal roams directly from the 2G MSC/VLR to the RNC under the 2G&3G MSC/VLR, and the authentication fails for the same reason.

In the other case, if the MSC/VLR or the HLR and the 2G MSC/VLR are connected by a lower MAP protocol version, then only the triplet can be passed in the MAP-SEND-IDENTIFICATION message due to the version restriction. , then no matter which level of network the terminal first accesses, as long as roaming to a high-level network (such as RNC under 3G network or RNC under 2G&3G network), the MSC/VLR of the high-level network can only obtain ternary Group. Once the triplet authentication vector is used, the result is also an authentication failure.

In summary, if the MAP protocol version is a high version, as long as the terminal roams from the low-level network to the high-level network, the MSC/VLR of the high-level network can only obtain the authentication vector of the terminal from the MSC/VLR of the previous network. Go to the triplet authentication vector. If the version of the MAP protocol is a low version, the MSC/VLR of the high-level network can only obtain the triplet when acquiring the authentication vector of the terminal from the MSC/VLR of the previous network, regardless of where the terminal roams to the high-level network. Authentication vector.

The networking scenario involving the above authentication process is shown in Figure 1. In Figure 1, the 2G MSC/VLR 100 only supports connection to the BSC 120, while the 2G&3G MSC/VLR 110 supports both BSC 121 and RNC 122 access. The connection S220 between the 2G MSC/VLR 100 and the 2G&3G MSC/VLR 110 is limited by the capabilities of the device and can only be communicated using the lower version of the MAP protocol; and the 2G&3G MSC/VLR 110 can access the 2G MSC through the connection. /VLR 100 obtains the authentication vector of the terminal.

The 2G MSC/VLR 100 and the 2G&3G MSC/VLR 110 are connected to the HLR/Auc through S200 and S222 respectively, and the MAP protocol is also used. Of course, the S200 may also be limited by the ability of the device to communicate with the lower version of the MAP protocol. The 2G MSC/VLR 100 and 2G&3G MSC/VLR 110 will obtain the authentication vector of the terminal from the HLR/Auc through their respective connections.

When the terminal 000 roams from the 2G MSC/VLR 100 to the 2G&3G MSC/VLR 110, the specific application scenario is shown in FIG. 2, and the process shown in FIG. 2 includes the following steps:

Step 201: The 3G terminal roams from the 2G MSC/VLR to the 2G&3G MSC/VLR, and accesses the network through the RNC. The terminal initiates a location update process to provide information about the previous location area.

Step 202: The 2G&3G MSC/VLR obtains the address of the 2G MSC/VLR according to the location area information, and sends a MAP-SEND-IDENTIFICATION request message to obtain the user identifier and the authentication vector from the 2G MSC/VLR.

Step 203: Since the 2G&3G MSC/VLR and the 2G MSC/VLR are connected by a lower version of the MAP protocol, the authentication vector returned by the 2G MSC/VLR is triplet information. Step 204: The 2G&3G MSC/VLR determines that it is a 3G terminal and is an RNC access. If the authentication vector is a triplet information, the authentication vector is not saved, but is directly discarded, and the MAP message is sent to the HLR/ Auc gets a new authentication vector.

Step 205: The HLR/Auc returns the authentication vector of the terminal.

Step 206: The 2G&3G MSC/VLR initiates the authentication process using the authentication vector obtained from the HLR/Auc.

It can be seen that in the scenario shown in FIG. 2, in the terminal authentication process, a unnecessary authentication failure is caused because the appropriate authentication vector is not obtained. This is obviously not conducive to the normal communication of the terminal, reducing user satisfaction. Summary of the invention

In view of this, the main object of the present invention is to provide a method and apparatus for implementing authentication to avoid unnecessary authentication failure.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

A method for implementing authentication, the method comprising:

Adding an authentication vector acquisition flag to the terminal to which the low-level authentication vector is assigned; when the terminal accesses the high-level network, acquiring the high-level authentication vector applicable to the high-level network according to the authentication vector acquisition flag of the terminal .

The process of obtaining the authentication vector includes:

Determining that the terminal is a terminal corresponding to the high-level network, and searching for an authentication vector acquisition flag set by the terminal, and when finding the authentication vector acquisition flag, acquiring a high-level authentication vector applicable to the high-level network.

The method further includes:

Deleting the low-level authentication vector saved for the terminal, clearing the authentication vector acquisition flag added for the terminal.

After obtaining the authentication vector, the authentication vector is further applied to initiate an authentication process. The terminal is a 3G terminal, and the high-level network is a 2G&3G network.

An apparatus for implementing authentication, the apparatus comprising an authentication vector acquisition mark maintenance unit and an authentication vector processing unit; wherein

The authentication vector acquisition flag maintenance unit is configured to add an authentication vector acquisition flag to the terminal to which the low-level authentication vector is assigned;

The authentication vector processing unit is configured to: when the terminal accesses the high-level network, obtain an authentication vector acquisition flag of the terminal added by the identifier maintenance unit according to the authentication vector, and obtain an identifier suitable for a high-level network. High level authentication vector.

When the authentication vector processing unit acquires the authentication vector, it is specifically used to determine that the terminal is a terminal corresponding to the high-level network, and finds an authentication vector acquisition flag set by the terminal, when the authentication is found. When the vector gets the tag, it gets a high-level authentication vector for the high-level network.

The authentication vector processing unit is further configured to:

Deleting the low-level authentication vector saved for the terminal, and notifying the authentication vector acquisition flag maintenance unit to clear the authentication vector acquisition flag added for the terminal.

The apparatus further includes an authentication unit for initiating an authentication process based on the high-level authentication vector applicable to the high-level network acquired by the authentication vector processing unit.

The device is disposed in a functional entity capable of performing authentication management processing on the terminal, including the mobile switching center MSC/visiting location register VLR;

The terminal is a 3G terminal, and the high-level network is a 2G&3G network.

The method and device for realizing authentication of the invention can avoid unnecessary authentication failure, facilitate normal communication of the terminal, and improve user satisfaction. DRAWINGS

1 is a schematic diagram of a hybrid networking architecture of the prior art;

2 is a prior art authentication flowchart; FIG. 3 is a flowchart of an authentication process according to an embodiment of the present invention; FIG.

4 is a schematic diagram of an authentication process of the present invention;

FIG. 5 is a diagram of an authentication apparatus according to an embodiment of the present invention. detailed description

In practical applications, under the condition of hybrid networking, if the authentication vector obtained by the 2G&3G MSC/VLR from the 2G MSC/VLR is a triple, in order to reduce the probability of subsequent authentication failure, the 2G&3G MSC/VLR can be as follows The principle processes the authentication vector:

When the terminal is a 3G terminal and accesses through the 2G network, the 2G&3G MSC/VLR can set an authentication vector acquisition flag associated with the user to indicate that the terminal saves the authentication vector due to the 2G network access. When the terminal roams to the 3G network and accesses the 2G&3G MSC/VLR, it can be determined whether the terminal is set with the authentication vector acquisition flag, and if so, the authentication vector saved by the terminal is an unsuitable triplet. Therefore, the authentication vector is directly deleted, and the authentication vector acquisition flag can be cleared, and then the HLR/Auc is re-acquired to obtain an authentication vector suitable for the 3G network.

Since the authentication vector for the 3G network in the form of a five-tuple is obtained, the unnecessary authentication failure shown in FIG. 2 can be avoided.

The above operation ideas can be represented as shown in Figure 3. Referring to Figure 3, Figure 3 depicts the authentication process for the first time accessing the 2G network after the terminal roams to the 2G&3G MSC/VLR. The most important points are: 2G&3G MSC/VLR sets the authentication vector acquisition flag according to the terminal type and access type, and deletes the saved information by judging the identification of the authentication vector when the terminal roams again to the 3G network. It does not apply to the authentication vector of the 3G network, and instead obtains the authentication vector applicable to the 3G network to the HLR/Auc, thereby avoiding authentication failure. The process shown in Figure 3 includes the following steps:

Step 301: The terminal is a 3G terminal, roaming from the 2G MSC/VLR to the 2G&3G MSC/VLR, and accessing the network through the BSC. The terminal initiates a location update process to provide information about the previous location area.

Step 302: The 2G&3G MSC/VLR obtains the address of the 2G MSC/VLR according to the location area information, and sends a MAP-SEND-IDENTIFICATION request message to the 2G MSC/VLR. Get the user ID and authentication vector.

Step 303: Since the 2G&3G MSC/VLR and the 2G MSC/VLR are connected by a lower version of the MAP protocol, the authentication vector returned by the 2G MSC/VLR is triplet information.

Step 304: The 2G&3G MSC/VLR determines that the terminal is a 3G terminal, and accesses through the BSC. Therefore, while the authentication vector is saved according to the prior art, an authentication vector acquisition flag is set for the terminal in the self record to indicate The terminal stores an authentication vector due to 2G network access.

Step 305: The 2G&3G MSC/VLR initiates an authentication process.

Step 306: The terminal continues to roam from the 2G network of the 2G&3G MSC/VLR to the 3G network, and initiates a location update process.

Step 307: The 2G&3G MSC/VLR determines that the terminal is a 3G terminal and is accessed through the RNC. Therefore, it searches for the authentication vector acquisition flag set for the terminal in its own record. When the authentication vector acquisition flag is found, The description indicates that the authentication vector saved for the terminal is a triad that is not applicable, so the authentication vector can be directly deleted, and the authentication vector acquisition flag can be cleared.

Step 308: The 2G&3G MSC/VLR obtains an authentication vector for the 3G network from the HLR/Auc through the MAP message.

Step 309: HLR/Auc returns the user's authentication vector.

Step 310: The 2G&3G MSC/VLR initiates an authentication process using an authentication vector for the 3G network obtained from the HLR/Auc.

It can be seen from the above description that when a terminal such as a 3G terminal such as a 2G&3G network accesses a low-level network such as 2G, an authentication vector acquisition flag can be added to the terminal; and when the terminal accesses the high-level network, The authentication vector acquisition flag of the terminal acquires an authentication vector suitable for a high-level network.

It should be noted that if the MAP protocol version is a low version, the MSC/VLR of the high-level network obtains the end from the MSC/VLR of the previous network regardless of where the terminal roams to the high-level network. At the end of the authentication vector, only the triplet authentication vector as the low-level authentication vector can be obtained, and the high-level authentication vector applicable to the high-level network, which is embodied as the 5-tuple authentication vector, cannot be obtained. In this case, an authentication vector acquisition flag may be added to the terminal; and when the terminal accesses the high-level network, the authentication vector applicable to the high-level network is obtained according to the authentication vector acquisition flag of the terminal.

The foregoing operation method may represent the process shown in FIG. 4. The process shown in FIG. 4 includes the following steps: Step 410: Add an authentication vector acquisition flag to the terminal that is assigned the low-level authentication vector. For example, when the terminal corresponding to the high-level network accesses through the low-level network, an authentication vector acquisition flag is added to the terminal; or, for the terminal that has communicated through the low-version MAP protocol, an authentication vector acquisition flag is added to the terminal.

Step 420: When the terminal accesses the high-level network, obtain the high-level authentication vector applicable to the high-level network according to the authentication vector acquisition flag of the terminal.

In order to ensure that the above operations can be carried out smoothly, the device shown in Figure 5 can be set. Referring to FIG. 5, FIG. 5 is a diagram of an authentication apparatus according to an embodiment of the present invention. The apparatus includes a connected authentication vector acquisition token maintenance unit and an authentication vector processing unit, and further includes an authentication unit. The device may be disposed in a functional entity such as an MSC/VLR capable of performing authentication management on the terminal or the like.

In a specific application, the authentication vector acquisition flag maintenance unit may add an authentication vector acquisition flag to the terminal for the terminal to which the low-level authentication vector is assigned. The authentication vector processing unit is configured to: when the terminal accesses the high-level network, obtain the markup maintenance unit to the authentication vector acquisition flag set for the terminal; and when the authentication vector acquisition flag is found, Obtaining a high-level authentication vector suitable for a high-level network according to the authentication vector acquisition flag.

Further, the acquired high-level authentication vector applicable to the high-level network may also be sent to the authentication unit, and the authentication unit initiates an authentication process for the terminal.

In addition, when the authentication vector processing unit determines that it is necessary to acquire a high-level authentication vector suitable for the high-level network, the low-level authentication vector previously saved for the terminal may be deleted; The authentication vector acquisition flag maintenance unit clears the authentication vector acquisition flag added for the terminal, and the authentication vector acquisition flag maintenance unit clears the authentication vector acquisition flag added for the terminal according to the received notification.

The operations that can be implemented by the above units are disclosed in detail in the foregoing technical description, and are not described herein again.

In summary, the method for realizing the authentication of the present invention can avoid the unnecessary authentication failure shown in FIG. 2, which is beneficial to the normal communication of the terminal and improves the user satisfaction.

The above description is only for the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included. Within the scope of protection of the present invention.

Claims

Claim

A method for implementing authentication, characterized in that the method comprises:

2. The method according to claim 1, wherein the process of obtaining the authentication vector comprises:

3. The method according to claim 2, wherein the method further comprises: deleting a low-level authentication vector saved for the terminal, and clearing an authentication vector acquisition flag added for the terminal.

The method according to claim 2, wherein after the authentication vector is acquired, the authentication vector is further applied to initiate an authentication process.

The method according to any one of claims 1 to 4, wherein the terminal is a 3G terminal, and the high-level network is a 2G&3G network.

A device for implementing authentication, characterized in that the device comprises an authentication vector acquisition flag maintenance unit and an authentication vector processing unit;

7. The apparatus according to claim 6, wherein the authentication vector processing unit When the authentication vector is obtained, it is specifically used to determine that the terminal is a terminal corresponding to the high-level network, and finds an authentication vector acquisition flag set by the terminal. When the authentication vector acquisition flag is found, the application is obtained. High-level authentication vector for high-level networks.

8. The apparatus according to claim 7, wherein the authentication vector processing unit is further configured to:

The method according to claim 7, wherein the apparatus further comprises an authentication unit, configured to initiate authentication according to the high-level authentication vector applicable to the high-level network acquired by the authentication vector processing unit. process.

The device according to any one of claims 6 to 9, wherein the device is disposed in a functional entity capable of performing authentication management processing on the terminal, including the mobile switching center MSC/visiting location register VLR. ;

The terminal is a 3G terminal, and the high-level network is a 2G&3G network.