WO2012163203A1

WO2012163203A1 - Method and device for updating dynamic authentication parameters of user equipment and aaa

Info

Publication number: WO2012163203A1
Application number: PCT/CN2012/074603
Authority: WO
Inventors: 邱永庆; 詹亚军
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-05-31
Filing date: 2012-04-24
Publication date: 2012-12-06
Also published as: CN102202305A

Abstract

Disclosed is a method for updating dynamic authentication parameters of a user equipment, comprising: an authentication, authorization, accounting server (AAA) authenticating received authentication parameters of a user equipment (UE), which are sent by a packet-based network, determining whether the dynamic authentication parameters of the UE meet an updating condition after successful authentication, updating the dynamic authentication parameters of the UE when the dynamic authentication parameters meet the updating condition, and triggering an over-the-air activation entity OTAF to update the updated dynamic authentication parameters to the UE. Also disclosed are a device, for realizing the method, for updating dynamic authentication parameters of a user equipment and an AAA. According to the present invention, the possibility that the account of a UE user is stolen is maximally reduced, and even if the account is stolen, the loss of the UE user whose account is stolen can be maximally lowered.

Description

User equipment dynamic authentication parameter updating method and device, AAA technical field

The present invention relates to a user equipment (UE, User Equipment) anti-duplication technology, and more particularly to a method and device for updating a user equipment dynamic authentication parameter, an authentication, authorization, and accounting server (AAA, Authentication, Authorization, Accounting). Background technique

For the user equipment (UE, User Equipment) with separate card, the relevant information of the user identification card is directly written in the card, and the user identification card is collectively produced by the operator, and the card is bound with the user number, and the user purchases the card through the operation network. , insert the card into the UE, you can complete the account opening and use the services provided by the operator.

For UEs with integrated machine cards, their marketing is not controlled by the operator, and the operator cannot set centralized parameters for the UE. By introducing the over-the-air technology (OTA), after purchasing the UE, the user purchases an account opening card, uses the UE to dial the special service center number, and at the prompt of the voice, completes the account opening through self-service, and provides the service provider. Service.

OTA is classified from the initiators and can be divided into two categories, namely:

1. OTASP (Over the Air Service Provisioning), initiated by the user side, triggered by dialing the OTA function code;

2. The OTAPA (Over the Air Parameter Administration) is initiated by the network side to complete the delivery of the required parameters.

At present, some criminals obtain relevant parameters of the UE's subscriber identity card through various channels, and copy it to some UEs or subscriber identity cards, and use the copied UE or subscriber identity card to steal the service of the copied subscriber. The service used by the UE is stolen, giving the legitimate UE user And the operator caused great losses.

In the current situation where there is no better protection mechanism, it is usually only possible to determine whether the UE user is stolen by the UE user's service record or the UE user's cost abnormality. Thus, even if it is determined that the UE user has stolen the related service, the UE user is The damage caused is also quite large. At present, there is no better means of protection against hacking. In particular, UEs with integrated machine cards are more likely to be stolen and more difficult to control because they do not uniformly set the relevant parameter information of the subscriber identity card through the operator. Summary of the invention

In view of this, the main object of the present invention is to provide a method and apparatus for updating a user equipment dynamic authentication parameter, a verification, authorization, and accounting server, which can effectively prevent copying of a UE user identification number.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

A method for updating a dynamic authentication parameter of a user equipment includes:

The AAA authenticates the authentication parameter of the UE sent by the received packet network, and determines whether the dynamic authentication parameter of the UE satisfies the update condition after the authentication succeeds, updates the dynamic authentication parameter of the UE when it is satisfied, and triggers the OTAF to update. The subsequent dynamic authentication parameters are updated to the UE.

Preferably, the authentication parameter includes at least one of the following parameters:

Network Access Identifier (NAI), Challenge Handshake Authentication Protocol (CHP) password, CHAP warfare, and packet network access IP.

Preferably, the dynamic authentication parameter includes at least one of the following parameters:

Dynamic AAA NAI and dynamic passwords.

Preferably, the dynamic authentication parameter of the UE satisfies an update condition, which is:

The dynamic NAI or dynamic password of the UE is empty; Or the dynamic AAANAI of the UE is the original AAANAI, or the dynamic password of the UE is the original password;

Or the dynamic AAANAI or the dynamic PWD of the UE reaches the set usage count; or the dynamic AAANAI or the dynamic PWD of the UE reaches the set duration of use; or the UE is in the update state of the dynamic authentication parameter. , but not updated successfully.

Preferably, the dynamic AAA NAI includes a user identifier format and domain name information; and the dynamic authentication parameter of the UE is updated, as follows:

Updating the user identifier format and/or domain name of the dynamic NAI of the UE, and/or updating the dynamic password of the UE.

Preferably, the authentication parameter of the UE sent by the AAA to the received packet network is: the UE accesses the packet network by using a packet domain service, and performs a point-to-point protocol PPP and a link control protocol with the access network AN. LCP negotiation;

The AN obtains the authentication parameter of the UE, and sends the authentication parameter of the UE to the AN AAA through an access request message defined by the A12 interface.

Preferably, the authentication parameter of the UE sent by the AAA to the received packet network is: after the UE is authenticated by the access network, performing LCP negotiation with the packet data serving node PDSN;

And the PDSN obtains the UE authentication parameter, and sends the authentication parameter of the UE to the AAA by using a remote dial-up user authentication service RADIUS access request message.

An apparatus for updating a dynamic authentication parameter of a user equipment, comprising: a receiving unit, an authentication unit, a determining unit, and an updating unit, where

a receiving unit, configured to receive an authentication parameter of a UE sent by a packet network;

An authentication unit, configured to authenticate the authentication parameter of the UE;

a determining unit, configured to determine whether the dynamic authentication parameter of the UE meets an update condition after the authentication is passed, and trigger an update unit when satisfied; And an updating unit, configured to update the dynamic authentication parameter of the UE, and trigger the OTAF to update the updated dynamic authentication parameter to the UE.

NAI, CHAP password, CHAP challenge, and packet network access IP;

The dynamic authentication parameter includes at least one of the following parameters:

Dynamic AAA NAI and dynamic passwords.

The dynamic NAI or dynamic password of the UE is empty;

Or the dynamic AAANAI of the UE is the original AAANAI, or the dynamic password of the UE is the original password;

Preferably, the dynamic AAA NAI includes a user identifier format and domain name information; the update unit is further configured to: update a user identifier format and/or a domain name of the dynamic NAI of the UE, and/or The dynamic password of the UE is updated.

A verification, authorization, and accounting server includes the foregoing updating device for dynamic authentication parameters of user equipment.

In the present invention, the AAA updates the dynamic authentication parameters of the UE by performing authentication and authorization on the UE, and then, after the update, triggers the OTAF to send the updated dynamic authentication parameters to the UE, thereby completing the UE authentication parameters (NAI and password). Dynamic update. In this way, even if the UE user is hacked, because some parameters of the UE dynamically change, the hacked UE cannot pass the AAA authentication because it cannot receive the dynamic authentication parameter, and cannot access the network, thereby maximally avoiding the UE user being hacked. Possibly, even if it is stolen, it can minimize the loss of hacked UE users. DRAWINGS

1 is a schematic structural diagram of an application network according to the present invention;

2 is a flowchart of a method for updating a dynamic authentication parameter of a user equipment according to Embodiment 1 of the present invention; FIG. 3 is a flowchart of a method for updating a dynamic authentication parameter of a user equipment according to Embodiment 2 of the present invention; A flowchart of a method for updating a user equipment authentication code; FIG. 5 is a schematic structural diagram of a device for updating a user equipment dynamic authentication parameter according to the present invention. detailed description

The basic idea of the present invention is: AAA updates the dynamic authentication parameters of the UE by performing authentication and authorization on the UE, and then sends the updated dynamic authentication parameters to the UE by triggering the OTAF, thereby completing the UE authentication parameters (NAI and Dynamic update of the password).

FIG. 1 is a schematic structural diagram of an application network according to the present invention. As shown in FIG. 1, the figure shows a schematic diagram of a UE accessing a packet data network in a Code Division Multiple Access (CDMA) system. The network elements in the figure and their networking modes are clearly defined in the relevant protocols. The network elements that are not closely related to the implementation of the technical solution of the present invention will not describe their functions. Only the network elements related to the present invention and their functions will be described accordingly.

The technical solution of the present invention is mainly for the machine-integrated UE to complete the user opening work through the OTASP, and the authentication information of the UE user is also stored in the AAA. At this time, the basic information of the UE user is stored in each related network element. Specifically, in the OTAF, parameters such as MIN, ESN, MDN, OTAPWD of the UE user, and NAM, PRL, Validation, 3GPD of the user terminal are stored. In the Home Location Register (HLR), parameters such as the MIN, ESN, MDN, and AKey of the UE user, and the location information of the terminal in the circuit domain are included. In AN AAA, it includes the user's IMSI, MDN, original AN-AAA NAI and original PWD, dynamic AN-AAANAI and dynamic PWD (dynamic password), ESN, MEID and other parameters. In AAA, contains the user's original account NAIUSERNAME, original PASSWORD, dynamic account NAIUSERNAME, dynamic password PASSWORD, IMSI, MDN, CDMANAI service Identification and other parameters. In the present invention, AN-AAA refers to the AAA on the access network side, and usually does not charge a fee, and AAA is the AAA on the core network side. In the present invention, whether AN-AAA or AAA, the functions implemented in the present invention are the same, except that the network to which they belong is different. In the following embodiments, different application scenarios are distinguished. Based on the above network structure, the essence of the technical solution of the present invention is further elaborated.

The present invention will be further described in detail below with reference to the accompanying drawings.

Embodiment 1

FIG. 2 is a flowchart of a method for updating a dynamic authentication parameter of a user equipment according to Embodiment 1 of the present invention. As shown in FIG. 2, the method for updating a dynamic authentication parameter of a user equipment in this example specifically includes the following steps:

Step 101: The UE user uses the packet domain service (such as accessing the Internet, sending and receiving multimedia messages, and accessing the wireless application protocol (WAP)) to enable the UE to access the wireless network; the UE and the access network (AN, Access Network) Establish a point-to-point protocol (PPP, Point to Point Protocol) and link control protocol (LCP) negotiation.

Step 102: The AN obtains the AN AAA Network Access Identifier (NAI) of the UE user, and the Challenge Handshake Authentication Protocol (CHP Password) and CHAP in the process of performing PPP interaction with the UE. Access authentication parameters such as CHAP-Challenge.

Step 103: The AN sends an access request message defined by the A12 interface to the AN-AAA, including

Authentication parameters such as AN-AAANAL CHAP Password, CHAP-Challenge and AN-IP.

Step 104: The AN-AAA performs an authentication check according to the authentication parameter in the access request message. If the verification succeeds, the AN is returned successfully and the related information is authorized. Otherwise, the access rejection is returned, and the process is terminated.

Step 105: The AN-AAA determines whether the user's NAI or password has reached the update condition. Some update conditions can be:

1) Dynamic AN-AAANAI and dynamic password (PWD) are empty;

2) Dynamic AN-AAANAI ⁼ original AN-AAANAI, or dynamic PWD = original PWD;

3) Dynamic AN-AAANAI or dynamic PWD has reached the number of uses;

4) Dynamic AN-AAANAI or dynamic PWD has reached the specified period of use;

5) Already in the update state, but the last update was not successful, and the authentication parameters are pending update status.

AN-AAA generates new dynamics according to the rules AN-AAA NAI and dynamic PWD. These rules are determined according to the actual application and can be:

1) For the dynamic NAI, it includes the identity information and domain information of the NAI, so that the identity information of the NAI can be changed, or the domain information of the NAI can be changed, or the identity information and domain information of the NAI can be changed at the same time;

2) For dynamic passwords, a new encrypted password can be calculated using the corresponding password generation algorithm, usually using the MD5 algorithm. Those skilled in the art will appreciate that any other encryption algorithm can be implemented.

The AN-AAA sends a dynamic AN-AAA NAI and a dynamic PWD update request (ie, sends an UpAuthParaReq message) to the OTAF (Over the Air Service Provisioning Function), and the UpAuthParaReq message carries the relevant parameters of the UE, including the international mobile subscriber identity. (IMSI, International Mobile Subscriber Identification Number), Mobile Directory Number (MDN, Mobile Directory Number), New AN-AAA NAI, New PWD, Old AN-AAA NAI, Old PWD, etc. The update flag is set to the status of the authentication parameter to be updated.

Step 106: The OTAF receives the AN-AAA authentication parameter update request, initiates an OTAPA process, and performs an air update of the UE authentication parameter (AN-AAA NAI or PWD).

Step 107, the OTAF returns the update result to the AN-AAA (eg, by UpAuthParaAck) The message carries the update result. The AN-AAA determines that if the update is successful, the new AN-AAA NAI and PWD take effect, and the UE user update flag is set as the authentication parameter to complete the update.

Embodiment 2

FIG. 3 is a flowchart of a method for updating a dynamic authentication parameter of a user equipment according to Embodiment 2 of the present invention. As shown in FIG. 3, the method for updating a dynamic authentication parameter of a user equipment in this example includes the following steps:

Step 201: After the UE is authenticated by the access network, the UE performs LCP negotiation with the Packet Data Serving Node (PDSN), and the access authentication parameters such as CHAP Password and CHAP-Challenge.

Step 203: The PDSN sends a Radius access request message to the AAA, where the authentication parameters include AAANAI, CHAP Password, CHAP-Challenge, and PDSN-IP.

Step 204: The AAA performs authentication verification according to the authentication parameter in the RADIUS (Remote Authentication Dial In User Service) access request message. If the verification succeeds, the PDSN returns success and authorizes related information, otherwise returns Access denied, the process is terminated.

Step 205, the AAA determines whether the user's NAI or password has reached the update condition, and the update conditions may be:

1) Dynamic AAANAI and dynamic PWD (Password) are empty;

2) Dynamic AAA NAI=Original AAA NAI, or dynamic? ^0=Original PWD;

3) Dynamic AAANAI or Dynamic PWD has reached the number of uses;

4) Dynamic AAANAI or Dynamic PWD has reached the specified deadline;

5) Already in the update state, but the last update was not successful.

AAA generates new dynamic AAA NAI and dynamic PWD according to rules. These rules are determined according to the actual application, and can be: 1) For NAI, the identity information of the NAI may be changed, or the domain information of the NAI may be changed, or the identity information and domain information of the NAI may be changed at the same time;

2) For passwords, a new encrypted password can be calculated using a certain cryptographic algorithm, usually using the MD5 algorithm.

AAA sends dynamic AAA NAI and dynamic PWD update requests to OTAF

(UpAuthParaReReq message), the parameters carried in the UpAuthParaReReq message include IMSI, MDN, new AAANAI, new PWD, old AAANAI, old PWD, etc., and the UE user update flag is set to the authentication parameter to be updated.

Step 206: The OTAF receives the AAA authentication parameter update request, initiates an OTAPA process, and performs an air update of the UE authentication parameter (AAA NAI or PWD).

Step 207: The OTAF returns the update result to the AAA (the update result is carried by the UpAuthParaAck message), and the AAA determines that if the update is successful, the new AAANAI, the new PWD takes effect, and the UE user update flag is set as the authentication parameter. Update.

The following describes the actual usage scenarios in which a certain type of UE dynamically updates the NAI through AN-AAA to further clarify the essence of the technical solution of the present invention.

The preconditions of the implementation of the application example are as follows: The machine-integrated UE completes the user activation work through the OTASP, wherein the local number parameter of the UE is set to the IMSI format, so that the NAI of the UE is composed of the following: IMSI format] @domain name. The basic information of the user is stored in the corresponding network element. Specifically, in the OTAF, the user's mobile identification number (MIN, Mobile Identification Number), electronic serial number 'J number (ESN, Electronic Serial Number), MDN, air password (OTAPWD, Over the Air PWD), and UE are included. Parameters such as the Number Assignment Module (NAM), Preferred Roaming List (PRL), and so on.

In the HLR, parameters such as the user's MIN, ESN, MDN, authentication code (AKey), and UE location information in the circuit domain are included. In the AN-AAA, parameters such as the IMSI, the MDN, the original AN-AAA NAI, the dynamic ΑΝ-AAANAL·ESN, and the Mobile Equipment Identifier (MEID) of the user are included.

FIG. 4 is a flowchart of a method for updating a user equipment authentication code according to an application example of the present invention. As shown in FIG. 4, the method for updating a user equipment authentication code according to an application example of the present invention specifically includes the following steps:

Step 301: The UE user uses the packet domain service or the like, the UE accesses the wireless network, and establishes PPP and LCP negotiation with the AN.

Step 302: The AN obtains access authentication parameters such as AN-AAA NAI, CHAP Password, and CHAP-Challenge of the UE by performing PPP interaction with the UE.

Step 303: The AN sends an access request message defined by the A12 interface to the AN-AAA, where the access request message carries AN-AAANAI (for [IMSI format]@domain name), CHAP Password, CHAP-Challenge, and AN-IP, Authentication parameters such as ESN.

Step 304: The AN-AAA performs an authentication check according to the authentication parameter in the access request message. If the verification succeeds, the AN is returned successfully and the related information is authorized. Otherwise, the access rejection is returned, and the process is terminated.

Step 305: The AN-AAA determines whether the user's NAI or password has reached the update condition. The update conditions are:

1) Dynamic AN-AAANAI is empty;

2) Dynamic AN-AAA NAI = original AN-AAA NAI;

3) Dynamic AN-AAANAI has reached the number of uses;

4) Dynamic AN-AAANAI has reached the specified period of use;

5) The update status has been reached, but the last update was not successful and the authentication parameters are pending.

AN-AAA generates new dynamics by rules AN-AAANAI (Dynamic Access Identifier):

1) Identity information: Select an unused one from the dynamic IMSI pool to update the user's identity Information

2) The domain name remains unchanged.

This way NAI becomes [new IMSI format] @domain name.

AN-AAA sends a dynamic AN-AAA NAI update request (UpAuthParaReq message) to the OTAF. The parameters include IMSI, MDN, new AN-AAA NAI, old PWD, old AN-AAA NAI, old PWD, and the UE. The user update flag is set to the status of the authentication parameter to be updated.

Step 306: The OTAF receives the AN-AAA authentication parameter update request, initiates an OTAPA process, and sets the UE local number parameter to a new IMSI format for over-the-air update.

Step 307, the OTAF returns the update result to the AN-AAA (implemented by the UpAuthParaAck message), and the AN-AAA determines, according to the update result, if the update is successful, the new AN-AAA NAI takes effect, and the user update flag is set as the authentication parameter. This update is completed.

FIG. 5 is a schematic structural diagram of a device for updating a dynamic authentication parameter of a user equipment according to the present invention. As shown in FIG. 5, the apparatus for updating a dynamic authentication parameter of a user equipment of the present invention includes a receiving unit 50, an authentication unit 51, a determining unit 52, and an updating unit 53. , among them,

The receiving unit 50 is configured to receive an authentication parameter of the UE sent by the packet network.

The authentication unit 51 is configured to authenticate the authentication parameter of the UE.

Determining unit 52, configured to determine whether the dynamic authentication parameter of the UE satisfies an update condition after the authentication is passed, and triggers the update unit 53 when satisfied;

The updating unit 53 is configured to update the dynamic authentication parameter of the UE, and trigger the OTAF to update the updated dynamic authentication parameter to the UE.

The above authentication parameters include at least one of the following parameters:

NAI, CHAP password, CHAP challenge, and packet network access IP;

Dynamic AAA NAI and dynamic passwords.

The dynamic authentication parameters of the UE meet the update conditions, which are: The dynamic NAI or dynamic password of the UE is empty;

The dynamic AAA NAI includes a user identifier format and domain name information. The updating unit 53 is further configured to: update a user identifier format and/or a domain name of the dynamic NAI of the UE, and/or a dynamic password for the UE. Update.

It should be understood by those skilled in the art that the functions of the above processing unit in the updating device of the user equipment dynamic authentication parameter of the present invention can be implemented by means of corresponding hardware circuits, or processors and corresponding execution software. The related functions of the above processing units can be understood by referring to the related description of the foregoing embodiments.

The present invention also describes a verification, authorization, and accounting server, including the update device for the user equipment dynamic authentication parameters shown in FIG.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Industrial applicability

The technical solution of the present invention updates the dynamic authentication parameter of the UE by performing authentication and authorization on the UE, and then sends the updated dynamic authentication parameter to the UE by triggering the OTAF, thereby completing the UE authentication parameter (NAI and password). Dynamic update. In this way, even if the UE user is hacked, because some parameters of the UE dynamically change, the hacked UE cannot access the network because it cannot receive the dynamic authentication parameter, and cannot access the network, thereby maximally protecting the rights of the UE user.

Claims

Claim

A method for updating a dynamic authentication parameter of a user equipment, where the method includes: a user equipment that is sent by the authentication, authorization, and accounting server AAA to the received packet network.

The authentication parameter of the UE is authenticated. After the authentication is passed, it is determined whether the dynamic authentication parameter of the UE meets the update condition. When the content is satisfied, the dynamic authentication parameter of the UE is updated, and the air activation entity OTAF is triggered to update the updated dynamic authentication parameter. To the UE.

2. The method according to claim 1, wherein the authentication parameter comprises at least one of the following parameters:

Network access identity NAI, challenge handshake authentication protocol password CHAP password, CHAP challenge, and packet network access IP.

3. The method according to claim 1, wherein the dynamic authentication parameter comprises at least one of the following parameters:

Dynamic AAA NAI and dynamic passwords.

4. The method according to claim 3, wherein the dynamic authentication parameter of the UE satisfies an update condition, which is:

The dynamic NAI or dynamic password of the UE is empty;

5. The method according to claim 3, wherein the dynamic AAA NAI comprises a user identification code format and domain name information;

Updating the dynamic authentication parameters of the UE is:

Updating the user identification code format and/or domain name of the dynamic NAI of the UE, and/or, Updating the dynamic password of the UE.

The method according to claim 1, wherein the authentication parameter of the UE sent by the AAA to the received packet network is:

The UE accesses the packet network by using a packet domain service, and performs peer-to-peer protocol PPP and link control protocol LCP negotiation with the access network AN;

The AN obtains the authentication parameter of the UE, and sends the authentication parameter of the UE to the AN AAA by using an A12 access request message.

After the UE is authenticated by the access network, the UE performs LCP negotiation with the packet data serving node PDSN;

8. An apparatus for updating a dynamic authentication parameter of a user equipment, where the apparatus includes a receiving unit, an authentication unit, a determining unit, and an updating unit, where

a determining unit, configured to determine, after the authentication is passed, whether the dynamic authentication parameter of the UE satisfies an update condition, and if yes, trigger an update unit;

And an updating unit, configured to update the dynamic authentication parameter of the UE, and trigger the OTAF to update the updated dynamic authentication parameter to the UE.

9. The apparatus according to claim 8, wherein the authentication parameter comprises at least one of the following parameters:

NAI, CHAP password, CHAP challenge, and packet network access IP;

The dynamic authentication parameter includes at least one of the following parameters: Dynamic AAA NAI and dynamic password.

10. The apparatus according to claim 9, wherein the dynamic authentication parameter of the UE satisfies an update condition, which is:

The dynamic NAI or dynamic password of the UE is empty;

11. The apparatus according to claim 9, wherein the dynamic AAANAI includes a user identification code format and domain name information;

The updating unit is further configured to: update a user identifier format and/or a domain name of the dynamic NAI of the UE, and/or update a dynamic password of the UE.

12. A verification, authorization and accounting server, comprising the apparatus of any one of claims 8 to 11.