WO2014113920A1 - Procédé et dispositif de réseau destinés à effectuer une authentification sécurisée d'un système de communication mobile - Google Patents

Procédé et dispositif de réseau destinés à effectuer une authentification sécurisée d'un système de communication mobile Download PDF

Info

Publication number
WO2014113920A1
WO2014113920A1 PCT/CN2013/070839 CN2013070839W WO2014113920A1 WO 2014113920 A1 WO2014113920 A1 WO 2014113920A1 CN 2013070839 W CN2013070839 W CN 2013070839W WO 2014113920 A1 WO2014113920 A1 WO 2014113920A1
Authority
WO
WIPO (PCT)
Prior art keywords
lte
hss
network element
access network
sgsn
Prior art date
Application number
PCT/CN2013/070839
Other languages
English (en)
Chinese (zh)
Inventor
陈璟
靳维生
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2013/070839 priority Critical patent/WO2014113920A1/fr
Priority to CN201380070864.4A priority patent/CN104937990B/zh
Publication of WO2014113920A1 publication Critical patent/WO2014113920A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery

Definitions

  • Embodiments of the present invention relate to the field of communications, and in particular, to a method and a network device for secure authentication of a mobile communication system.
  • Long Term Evolution Long Term Evolution
  • SAE System Architecture Evolution
  • 3rd Generation Partnership Project 3rd Generation Partnership Project
  • WCDMA Wideband Code Division Multiple Access
  • TD-SCDMA Time Division-Synchronous Code Division Multiple Access
  • CDMA Division Code Division Multiple Access 2000
  • the Universal Mobile Telecommunication System (UMTS) network and the LTE/SAE network have developed an Authentication and Key Agreement ("AKA") mechanism to perform UE and network. Two-way authentication.
  • the two-way authentication mechanism of the UMTS network is called UMTS AKA
  • the two-way authentication mechanism of the LTE/SAE network is called an Evolved Packet System (“EPS”) AKA.
  • UE User Equipment
  • UE accesses a 2G/3G core network through an LTE access network. Since the 2G/3G core network can only obtain UMTS AV from the HSS, the LTE UE refuses to use the UMTS AV for authentication when accessing through the LTE network. Therefore, the LTE UE cannot access the 2G/3G core network through the LTE access network.
  • the embodiments of the present invention provide a method and a network device for secure authentication of a mobile communication system, which enable the LTE UE to complete the secure authentication and access the 2G/3G network.
  • the first aspect provides a security authentication method for a mobile communication system, including: after the home subscriber server HSS receives the request for the authentication vector sent by the GPRS service support node SGSN, the HSS identifies that the LTE UE accesses the 2G or 3G network, The request for the authentication vector is sent by the SGSN to the SGSN after receiving the UMTS attach request attach request message sent by the access network element;
  • the HSS recognizes that after the LTE UE accesses the 2G or 3G network, the HSS generates a special authentication vector
  • the HSS sends the special authentication vector to the SGSN, so that the SGSN, the access network element, and the LTE UE complete the security authentication.
  • the UMTS attach request message is obtained by the access network element converting the attach request attach message, and the attach request message is sent by the LTE UE.
  • the SGSN, the access network element, and the LTE UE completing the security authentication include: sending, by the SGSN The UMTS AKA authentication challenge is performed to the access network element, and the access network element converts the UMTS AKA authentication challenge into an LTE AKA authentication challenge, and then sends the LTE UE to the LTE UE, and the LTE UE performs verification and generates according to the LTE AKA authentication challenge.
  • the LTE UE sends an LTE AKA authentication response including the RES to the access network element, so that the access network element, the SGSN, and the LTE UE further complete the security authentication.
  • the special authentication vector includes XRES, CK, and IK;
  • the SGSN compares whether the RES and the XRES are the same. When the comparison result is the same, the SGSN sends the CK and or IK to the access.
  • the network element, the access network element generates K ASME according to the CK and or IK, and the access network element and the LTE UE share the K ASME .
  • whether the SGSN compares whether the RES and the XRES are the same further includes: when the comparison result is different, the security authentication is suspended.
  • the HSS identifies that the LTE UE accesses the 2G or 3G network, and the HSS includes: a list including identification information of an LTE UE that accesses a 2G/3G network;
  • the HSS learns that the identifier information of the LTE UE is included in the list according to the identifier information in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G network.
  • the generating, by the HSS, the special authentication vector includes:
  • the HSS adds indication information to the request for the authentication vector, where the indication information is used to indicate that the HSS generates the special authentication vector;
  • the HSS generates EPS AV for the LTE UE
  • the HSS converts the EPS AV into a UMTS AV format, and the EPS AV converted to the UMTS AV format is the special authentication vector.
  • the HSS converting the EPS AV into the UMTS AV format includes:
  • the HSS uses RAND in the EPS AV as the RAND of the UMTS AV, the HSS uses the AUTN in the EPS AV as the AUTN of the UMTS AV, and the HSS uses the XRES in the EPS AV as the XRES of the UMTS AV, the HSS
  • the K ASME in the EPS AV is split into two parts, which are the CK and the IK of the UMTS AV, respectively.
  • a method for secure authentication of a mobile communication system including:
  • the SGSN receives the UMTS attach request message, and the UMTS attach request message is obtained by the access network element converting the attach request message sent by the LTE UE; the SGSN receives the sent by the access network element After the UMTS attach request message, the SGSN sends a request for the authentication vector to the HSS, so that the HSS receives the request of the SGSN and identifies that the LTE UE accesses the 2G or 3G network, so that the HSS generates the special authentication vector;
  • the SGSN After receiving the special authentication vector from the HSS, the SGSN sends a UMTS AKA authentication challenge to the access network element, so that the SGSN, the access network element, and the LTE UE complete security authentication.
  • the SGSN, the access network element, and the LTE UE complete the security authentication, including:
  • the access network element is sent to the LTE UE, and after the LTE UE performs verification according to the LTE AKA authentication challenge and generates a RES and a key K ASME , the LTE UE will The LTE AKA authentication response including the RES is sent to the access network element, so that the access network element, the SGSN, and the LTE UE further complete the security authentication.
  • the special authentication vector includes XRES, CK, and IK;
  • the SGSN compares whether the RES and the XRES are the same. When the comparison result is the same, the SGSN sends the CK and or IK to the access network element, and the access network element generates according to the CK and or IK. K ASME , the access network element and the The LTE UE shares the K ASME .
  • the second possible implementation manner of the second aspect further includes: when the comparison result is different, suspending the security authentication.
  • the HSS receives the request of the SGSN and identifies the LTE UE.
  • Access to 2G or 3G networks includes:
  • the HSS is provided with a list including identification information of LTE UEs accessing the 2G/3G network;
  • the HSS learns that the identifier information of the LTE UE is included in the list according to the identifier information in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G network.
  • the generating, by the HSS, the special authentication vector after receiving the request of the SGSN includes:
  • the HSS adds indication information to the request for the authentication vector, where the indication information is used to indicate that the HSS generates the special authentication vector;
  • the HSS generates EPS AV for the LTE UE
  • the HSS converts the EPS AV into a UMTS AV format, and the EPS AV converted to the UMTS AV format is the special authentication vector.
  • the HSS converts the EPS AV into the UMTS AV format including:
  • the HSS uses RAND in the EPS AV as the RAND of the UMTS AV, the HSS uses the AUTN in the EPS AV as the AUTN of the UMTS AV, and the HSS uses the XRES in the EPS AV as the XRES of the UMTS AV, the HSS
  • the K ASME in the EPS AV is split into two parts, which are the CK and the IK of the UMTS AV, respectively.
  • a method for secure authentication of a mobile communication system including:
  • the access network element converts the attach request message from the LTE UE into a UMTS attach request message
  • the access network element sends the UMTS attach request message to the SGSN, so that the SGSN sends a request for the authentication vector to the HSS, and the HSS receives the request of the SGSN to identify that the LTE UE accesses the 2G or 3G network.
  • the HSS In order for the HSS to generate a special authentication vector;
  • the access network element receives the UMTS AKA authentication challenge sent by the SGSN, and the UMTS AKA authentication challenge is sent after the SGSN receives the special authentication vector sent by the HSS;
  • the access network element converts the UMTS AKA authentication challenge into an LTE AKA authentication challenge and sends the challenge to the LTE UE, so that the access network element, the SGSN, and the LTE UE complete the security authentication.
  • the accessing the network element, the SGSN, and the LTE UE to complete the security authentication includes:
  • the LTE UE After the LTE UE verifies the LTE AKA authentication challenge, the RES and the key K ASME are generated;
  • the access network element receives the LTE AKA authentication response that is sent by the LTE UE and includes the RES, so that the access network element, the SGSN, and the LTE UE further complete the security authentication.
  • the special authentication vector includes XRES, CK, and IK;
  • the LTE AKA authentication response including the RES is converted into a UMTS AKA authentication response including the RES, where the access network element, the SGSN, and the LTE UE further perform security authentication, the access network element:
  • the network element sends the UMTS AKA authentication response including the RES to the SGSN, so that the SGSN compares whether the RES and the XRES are the same. When the comparison result is the same, the SGSN sends the CK and or IK to the SGSN.
  • Network access network element
  • the access network element generates K ASME according to the CK and or IK, the access network element and the LTE UE A total of KASME °
  • whether the SGSN compares whether the RES and the XRES are the same further includes: when the comparison result is different, the security authentication is suspended.
  • the HSS receives the request of the SGSN and identifies that the LTE UE accesses the 2G.
  • 3G networks include:
  • the HSS is provided with a list including identification information of LTE UEs accessing the 2G/3G network;
  • the HSS learns that the identifier information of the LTE UE is included in the list according to the identifier information in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G network.
  • the generating, by the HSS, the special authentication vector includes:
  • the HSS adds indication information to the request for the authentication vector, where the indication information is used to instruct the HSS to generate the special authentication vector; the HSS generates EPS AV for the LTE UE;
  • the HSS converts the EPS AV into a UMTS AV format, and the EPS AV converted to the UMTS AV format is the special authentication vector.
  • the HSS converting the EPS AV into the UMTS AV format includes:
  • the HSS uses RAND in the EPS AV as the RAND of the UMTS AV, the HSS uses the AUTN in the EPS AV as the AUTN of the UMTS AV, and the HSS uses the XRES in the EPS AV as the XRES of the UMTS AV, the HSS
  • the K ASME in the EPS AV is split into two parts, which are the CK and the IK of the UMTS AV, respectively.
  • the access network element generating the K ASME according to the CK and or the ⁇ includes:
  • an HSS including: a receiving module, an identifying module, a processing module, and a sending module;
  • the receiving module is configured to receive a request for an authentication vector sent by the SGSN, where the request for the authentication vector is sent by the SGSN to the SGSN after receiving the UMTS attach request message sent by the access network element, where the identifying module is used to Receiving the request for the authentication vector, the receiving module identifies that the LTE UE accesses the 2G or 3G network;
  • the processing module is configured to generate a special authentication vector after the identification module identifies that the LTE UE accesses the 2G or 3G network;
  • the sending module is configured to send the special authentication vector to the SGSN, so that the SGSN, the access network element, and the LTE UE complete the security authentication.
  • the UMTS attach request message is obtained by the access network element converting the attach request message, and the attach request message is sent by the LTE UE.
  • the SGSN, the access network element, and the LTE UE completing the security authentication include: sending, by the SGSN The UMTS AKA authentication challenge is performed to the access network element, and the access network element converts the UMTS AKA authentication challenge into an LTE AKA authentication challenge, and then sends the LTE UE to the LTE UE, and the LTE UE performs verification and generates according to the LTE AKA authentication challenge.
  • the LTE UE sends an LTE AKA authentication response including the RES to the access network element, so that the access network element, the SGSN, and the LTE UE further complete the security authentication.
  • the special authentication vector includes XRES, CK, and IK;
  • the SGSN compares whether the RES and the XRES are the same. When the comparison result is the same, the SGSN sends the CK and or IK to the access.
  • the network element, the access network element generates K ASME according to the CK and or IK, and the access network element and the LTE UE share the K ASME .
  • the SGSN comparing whether the RES and the XRES are the same further includes: when the comparison result is different, suspending the security authentication.
  • the HSS further includes a storage module, where the storage module is configured to store a list, the list Including identification information of an LTE UE that accesses a 2G/3G network;
  • the identification module knows that the identifier information of the LTE UE is included in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G network.
  • the processing module is configured to identify, by the identification module, that the LTE UE accesses the 2G or the fourth aspect, or the first to the fifth possible implementation manner of the fourth aspect, Generating special authentication vectors after the 3G network includes:
  • the processing module is configured to add indication information to the request for the authentication vector, where the indication information is used to indicate that the HSS generates the special authentication vector; the processing module is configured to generate an EPS AV for the LTE UE;
  • the processing module is configured to convert the EPS AV into a UMTS AV format, and the EPS AV converted to the UMTS AV format is the special authentication vector.
  • the processing module is configured to convert the EPS AV into the UMTS AV format, including:
  • the processing module is configured to use RAND in the EPS AV as the RAND of the UMTS AV, and the processing module is configured to use the AUTN in the EPS AV as the AUTN of the UMTS AV, and the processing module is used to use the XRES in the EPS AV As the XRES of the UMTS AV, the processing module is configured to split the K ASME in the EPS AV into two parts, respectively, as the CK and the IK of the UMTS AV.
  • the access network element generates a K ASME according to the CK and or IK, including:
  • an SGSN including: a receiving module; a sending module;
  • the receiving module is configured to receive a UMTS attach request message sent by an access network element, where the
  • the UMTS attach request is obtained by converting, by the access network element, the attach request message sent by the LTE UE;
  • the sending module is configured to send a request for an authentication vector to the HSS after the receiving module receives the UMTS attach request message, so that the HSS receives the request and identifies that the LTE UE accesses the 2G or 3G network, and thus The HSS generates the special authentication vector;
  • the receiving module is further configured to receive the special authentication vector from the HSS, where the sending module is further configured to send a UMTS AKA authentication challenge to the access network element after the receiving module receives the special authentication vector, so that the SGSN The access network element and the LTE UE complete the security authentication.
  • the SGSN, the access network element, and the LTE UE complete the security authentication, including:
  • the access network element is sent to the LTE UE, and after the LTE UE performs verification according to the LTE AKA authentication challenge and generates a RES and a key K ASME , the LTE UE will The LTE AKA authentication response including the RES is sent to the access network element, so that the access network element, the SGSN, and the LTE UE further complete the security authentication.
  • the SGSN further includes a processing module
  • the special authentication vector contains XRES, CK, IK;
  • the further completing the security authentication for the access network element, the SGSN, and the LTE UE includes: the access network element converting the LTE AKA authentication response into a UMTS AKA authentication response and transmitting the UMTS AKA authentication response to the receiving Module, the processing module is used to compare the RES and Whether the XRES is the same. When the comparison result is the same, the sending module sends the CK and or IK to the access network element, and the access network element generates the K ASME according to the CK and or IK. CK and or IK are sent by the sending module, and the access network element and the LTE UE share the K ASME .
  • the processing module is configured to compare whether the RES and the XRES are the same, and further includes: when the comparison result is different, the suspension is performed. safety certificate.
  • the HSS is configured to identify that the LTE UE accesses the 2G after receiving the request.
  • 3G networks include:
  • the HSS is provided with a list including identification information of LTE UEs accessing the 2G/3G network;
  • the HSS learns that the identifier information of the LTE UE is included in the list according to the identifier information in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G network.
  • the generating, by the HSS, the special authentication vector includes:
  • the HSS adds indication information to the request for the authentication vector, the indication information is used to indicate that the HSS generates the special authentication vector; the HSS generates EPS AV for the LTE UE;
  • the HSS converts the EPS AV into a UMTS AV format, and the EPS AV converted to the UMTS AV format is the special authentication vector.
  • the HSS converts the EPS AV into the UMTS AV format including:
  • the HSS uses RAND in the EPS AV as the RAND of the UMTS AV, the HSS uses the AUTN in the EPS AV as the AUTN of the UMTS AV, and the HSS uses the XRES in the EPS AV as the XRES of the UMTS AV, the HSS
  • the K ASME in the EPS AV is split into two parts, which are the CK and the IK of the UMTS AV, respectively.
  • a sixth aspect provides an access network element, including: a receiving module, a processing module, and a sending module;
  • the receiving module is configured to receive an attach request message from an LTE UE; the processing module is configured to convert the attach request message into a UMTS attach request message;
  • the sending module is configured to send the UMTS attach request message to the SGSN, so that the SGSN sends a request for the authentication vector to the HSS, and after receiving the request of the SGSN, the HSS identifies that the LTE UE accesses the 2G or 3G network, and further
  • the receiving module is further configured to receive a UMTS AKA authentication challenge sent by the SGSN, where the UMTS AKA authentication challenge is sent after the SGSN receives the special authentication vector sent by the HSS;
  • the processing module is further configured to convert the UMTS AKA authentication challenge into an LTE AKA authentication challenge, where the sending module is further configured to send the LTE AKA authentication challenge to the LTE UE, so that the access network element, the SGSN, and the LTE are The UE completes the security certification.
  • the security authentication of the access network element, the SGSN, and the LTE UE is performed by:
  • the LTE UE After the LTE UE verifies the LTE AKA authentication challenge, the RES and the key K ASME are generated;
  • the receiving module is configured to receive an LTE AKA authentication response that is sent by the LTE UE and includes the RES, so that the access network element, the SGSN, and the LTE UE further complete security authentication.
  • the special authentication vector includes XRES, CK, and IK;
  • the processing module is further configured to convert the LTE AKA authentication response including the RES into a UMTS AKA authentication response including the RES, where the sending module further comprises: the processing module further configured to: Also used to send the UMTS AKA authentication response containing the RES to the SGSN, so that the SGSN compares the RES and the XRES Similarly, when the comparison result is the same, the SGSN sends the CK and or IK to the access network element;
  • the processing module is further configured to generate a K ASME according to the CK and or IK, the access network element and the LTE UE being the KASME.
  • whether the SGSN compares whether the RES and the XRES are the same further includes: when the comparison result is different, the security authentication is suspended.
  • the HSS receives the request of the SGSN and identifies that the LTE UE accesses the 2G.
  • 3G networks include:
  • the HSS is provided with a list including identification information of LTE UEs accessing the 2G/3G network;
  • the HSS learns that the identifier information of the LTE UE is included in the list according to the identifier information in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G network.
  • the generating, by the HSS, the special authentication vector includes:
  • the HSS adds indication information to the request for the authentication vector, where the indication information is used to indicate that the HSS generates the special authentication vector;
  • the HSS generates EPS AV for the LTE UE
  • the HSS converts the EPS AV into a UMTS AV format, and the EPS AV converted to the UMTS AV format is the special authentication vector.
  • the HSS converting the EPS AV into the UMTS AV format includes:
  • the HSS uses RAND in the EPS AV as the RAND of the UMTS AV, the HSS uses the AUTN in the EPS AV as the AUTN of the UMTS AV, and the HSS uses the XRES in the EPS AV as the XRES of the UMTS AV, the HSS K ASME in the EPS AV (256bits) Split into two parts, respectively as the CK and the IK of the UMTS AV.
  • the HSS identifies that the LTE UE accesses the 2G/3G network, and the HSS generates a special authentication vector, and the LTE UE accesses the 2G/3G network to complete the security authentication through the SGSN and the access network element, so that the LTE UE can use the 2G. /3G core network resources.
  • FIG. 1 is a schematic flowchart of an authentication method of a mobile communication system according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of an authentication method of a mobile communication system according to another embodiment of the present invention
  • FIG. 3 is a schematic flow chart of an authentication method of a mobile communication system according to another embodiment of the present invention.
  • FIG. 4 is a schematic flow chart of an authentication method of a mobile communication system according to another embodiment of the present invention.
  • FIG. 5 is a schematic block diagram of a home subscriber server according to an embodiment of the present invention.
  • FIG. 6 is a schematic block diagram of a GPRS service support node according to an embodiment of the present invention.
  • FIG. 7 is a schematic block diagram of an access network element according to an embodiment of the present invention.
  • FIG. 8 is a schematic block diagram of a home subscriber server according to another embodiment of the present invention.
  • FIG. 9 is a schematic block diagram of a GPRS service support node according to another embodiment of the present invention.
  • FIG. 10 is a schematic block diagram of an access network element according to another embodiment of the present invention. detailed description
  • GSM Global System of Mobile communication
  • CDMA code division multiple access
  • WCDMA Wideband Code Division Multiple Access
  • GSM General Packet Radio Service
  • UMT Universal Mobile Telecommunication System
  • Wi-Fi Worldwide Interoperability for Microwave Access
  • the access network element in the embodiment of the present invention is an enhanced access network element for supporting the LTE UE to access the 2G/3G core network.
  • the access network element may have the following functions: The function of the LTE eNB, the LTE UE may access the 2G/3G core network through the access network element without modification, and the LTE UE considers that The LTE network is being accessed, instead of the 2G/3G core network; the access network element in the embodiment of the present invention can also implement the function of a Mobility Management Entity (called " ⁇ "). Such as the security protection function of the non-access stratum (“Non-Access Stratum").
  • FIG. 1 shows a schematic flow diagram of a method 100 of secure authentication of a mobile communication system in accordance with an embodiment of the present invention. As shown in FIG. 1, the method 100 includes:
  • the HSS After receiving the request for the authentication vector sent by the SGSN, the HSS identifies that the HSS is
  • the LTE UE accesses the 2G or 3G network, and the request for the authentication vector is received by the SGSN. Sending the UMTS attach request message sent by the network element to the SGSN;
  • the HSS recognizes that after the LTE UE accesses the 2G or 3G network, the HSS generates a special authentication vector
  • the HSS sends the special authentication vector to the SGSN, so that the SGSN, the access network element, and the LTE UE complete the security authentication.
  • the HSS in order to enable the LTE UE to use the 2G or 3G core network, after the HSS recognizes that the LTE UE accesses the 2G/3G core network, the HSS generates a special authentication vector for the LTE UE, so that the SGSN, the SGSN, The access network element and the LTE UE complete the security authentication to enable the LTE UE to access the 2G or 3G network, so that the LTE UE can use the 2G or 3G core network resources.
  • the UMTS attach request message is obtained by the access network element converting the attach request message, and the attach request message is sent by the LTE UE.
  • the SGSN, the access network element, and the LTE UE complete the security authentication, where the SGSN sends a UMTS AKA authentication challenge to the access network element, and the access network element authenticates the UMTS AKA.
  • the challenge is converted into an LTE AKA authentication challenge, and sent to the LTE UE, after the LTE UE performs verification according to the LTE AKA authentication challenge and generates a RES and a key K ASME , the LTE UE sends an LTE AKA authentication response including the RES to the LTE AKA authentication challenge.
  • Accessing the network element, so that the access network element, the SGSN, and the LTE UE further complete the security authentication.
  • the special authentication vector includes XRES, CK, and IK;
  • the security authentication is further performed by the access network element, the SGSN, and the LTE UE, including:
  • the access network element converts the LTE AKA authentication response into a UMTS AKA authentication response and sends the UMTS AKA authentication response to the SGSN, and the SGSN compares whether the RES and the XRES are the same. When the comparison result is the same, the The SGSN sends the CK and or IK to the access network element, and the access network element generates K ASME according to the CK and or IK, the access network element and the
  • the LTE UE shares the K ASME .
  • the SGSN compares whether the RES and the XRES are the same, and includes, when the comparison is If the results are different, the safety certification is suspended.
  • the HSS identification is that the LTE UE accesses the 2G or 3G network, including:
  • the HSS is provided with a list including identification information of LTE UEs accessing the 2G/3G network;
  • the HSS learns that the identifier information of the LTE UE is included in the list according to the identifier information in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G network.
  • the HSS generates a special authentication vector including:
  • the HSS adds indication information to the request for the authentication vector, where the indication information is used to indicate that the HSS generates the special authentication vector;
  • the HSS generates EPS AV for the LTE UE
  • the HSS converts the EPS AV into a UMTS AV format, and the EPS AV converted to the UMTS AV format is the special authentication vector.
  • the HSS converts the EPS AV into a UMTS AV format, including:
  • the HSS uses RAND in the EPS AV as the RAND of the UMTS AV, the HSS uses the AUTN in the EPS AV as the AUTN of the UMTS AV, and the HSS uses the XRES in the EPS AV as the XRES of the UMTS AV, the HSS
  • the K ASME in the EPS AV is split into two parts, which are the CK and the IK of the UMTS AV, respectively.
  • the access network element generates the K ASME according to the CK and or the ⁇ :
  • the message sent by the LTE UE is converted into a message applicable to the 2G or 3G network by the access network element, and the HSS identifies that the LTE UE accesses the 2G or 3G core through the access network element.
  • the HSS After the scenario of the network, the HSS generates a special authentication vector, and completes the security authentication between the LTE UE and the network through the access network element and the SGSN. There is no need to modify the LTE UE, so that the LTE UE can complete the secure authentication access to the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources.
  • FIG. 2 shows an illustration of a method 200 of secure authentication of a mobile communication system in accordance with an embodiment of the present invention.
  • Intentional flow chart. 2 and its description of the disclosed method may be based on the embodiment of the present invention and the method disclosed in FIG. 1 based on an embodiment of the present invention.
  • the method 200 includes:
  • the SGSN receives the UMTS attach request message, where the UMTS attach request is that the access network element converts the attach request message sent by the LTE UE, and S220, the SGSN receives the access network element by the access network.
  • the SGSN sends a request for the authentication vector to the HSS, so that the HSS receives the request of the SGSN and identifies that the LTE UE accesses the 2G or 3G network, so that the HSS generates the special Authentication vector
  • the SGSN After receiving the special authentication vector from the HSS, the SGSN sends a UMTS AKA authentication challenge to the access network element, so that the SGSN, the access network element, and the LTE UE complete the security authentication.
  • the HSS After the scenario in which the LTE UE accesses the 2G or 3G network is identified by the HSS, the HSS generates a special authentication vector, so that the SGSN, the access network element, and the LTE UE complete the security authentication, and the implementation does not require the LTE UE. Under the condition that the LTE UE can perform security authentication, the LTE UE can access the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources.
  • the SGSN, the access network element, and the LTE UE complete the security authentication, where the access network element converts the UMTS AKA authentication challenge into an LTE AKA authentication challenge and sends the LTE UE to the LTE UE.
  • the LTE UE After the LTE UE performs the verification according to the LTE AKA authentication challenge and generates the RES and the key K ASME , the LTE UE sends an LTE AKA authentication response including the RES to the access network element, so that the access network element, the The SGSN and the LTE UE further complete the security authentication.
  • the special authentication vector includes XRES, CK, and IK;
  • the security authentication is further performed by the access network element, the SGSN, and the LTE UE, including:
  • the access network element converts the LTE AKA authentication response into a UMTS AKA authentication response and sends the UMTS AKA authentication response to the SGSN, the SGSN comparing the RES with the XRES Whether the same is true, when the comparison result is the same, the SGSN sends the CK and or IK to the access network element, and the access network element generates K ASME according to the CK and or IK, the access network element
  • the K ASME is shared with the LTE UE.
  • whether the SGSN compares whether the RES and the XRES are the same further includes: when the comparison result is different, suspending the security authentication.
  • the method for the HSS to receive the request of the SGSN is that the LTE UE accesses the 2G or 3G network, including:
  • the HSS is provided with a list including identification information of LTE UEs accessing the 2G/3G network;
  • the HSS learns that the identifier information of the LTE UE is included in the list according to the identifier information in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G network.
  • the special authentication vector is generated after the HSS receives the request from the SGSN, including:
  • the HSS adds indication information to the request for the authentication vector, where the indication information is used to indicate that the HSS generates the special authentication vector;
  • the HSS generates EPS AV for the LTE UE
  • the HSS converts the EPS AV into a UMTS AV format, and the EPS AV converted to the UMTS AV format is the special authentication vector.
  • the HSS converts the EPS AV into a UMTS AV format, including:
  • the HSS uses RAND in the EPS AV as the RAND of the UMTS AV, the HSS uses the AUTN in the EPS AV as the AUTN of the UMTS AV, and the HSS uses the XRES in the EPS AV as the XRES of the UMTS AV, the HSS
  • the K ASME in the EPS AV is split into two parts, which are the CK and the IK of the UMTS AV, respectively.
  • the access network element generates the K ASME according to the CK and or the ⁇ :
  • the message sent by the LTE UE is converted into a message suitable for the 2G or 3G network by the access network element, and the HSS identifies that the LTE UE accesses the 2G or 3G network through the access network element.
  • the HSS After the scenario, the HSS generates a special authentication vector, and completes the security authentication between the LTE UE and the network through the access network element and the SGSN. There is no need to modify the LTE UE, and the LTE UE can complete the security authentication to access the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources.
  • FIG. 3 shows a schematic flow diagram of a method 300 of secure authentication of a mobile communication system in accordance with an embodiment of the present invention.
  • the method disclosed in Figure 3 and its description may be based on the embodiments of Figures 1 through 2 of the present invention and the methods disclosed in Figures 1 through 2 of the present invention.
  • the method 300 includes:
  • the access network element converts an attach request message from the LTE UE into a UMTS attach request message.
  • the access network element sends the UMTS attach request message to the SGSN, so that the SGSN sends a request for the authentication vector to the HSS, and the HSS receives the request of the SGSN and identifies that the LTE UE accesses the 2G or 3G.
  • Network in order for the HSS to generate a special authentication vector
  • the access network element receives the UMTS AKA authentication challenge sent by the SGSN, where the UMTS
  • the AKA authentication challenge is sent after the SGSN receives the special authentication vector sent by the HSS;
  • the access network element converts the UMTS AKA authentication challenge into an LTE AKA authentication challenge and sends the LTE UE to the LTE UE, so that the access network element, the SGSN, and the LTE UE complete the security authentication.
  • the information sent by the LTE UE is converted to be applicable to the network element of the access network.
  • the information of the 2G or 3G network system is identified by the HSS as the LTE UE accessing the 2G or 3G network.
  • the HSS generates a special authentication vector to enable the access network element, the SGSN, and the LTE UE to complete the security authentication.
  • the UE can complete the secure authentication access to the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources.
  • the accessing the network element, the SGSN, and the LTE UE to complete the security authentication includes: generating, by the LTE UE, the RES and the key K ASME after verifying the LTE AKA authentication challenge;
  • the access network element receives the LTE AKA authentication response that is sent by the LTE UE and includes the RES, so that the access network element, the SGSN, and the LTE UE further complete the security authentication.
  • the special authentication vector includes XRES, CK, and IK;
  • the access network element, the SGSN, and the LTE UE further complete the security authentication, including:
  • the access network element converts the LTE AKA authentication response including the RES into a UMTS AKA authentication response including the RES, and the access network element sends the UMTS AKA authentication response including the RES to the SGSN, so that the SGSN Comparing whether the RES and the XRES are the same, when the comparison result is the same, the SGSN sends the CK and or IK to the access network element;
  • the access network element generates K ASME according to the CK and or IK, and the access network element and the LTE UE jointly have the KASME °
  • whether the SGSN compares whether the RES and the XRES are the same further includes: when the comparison result is different, suspending the security authentication.
  • the HSS identifies that the LTE UE accesses the 2G or 3G network, including:
  • the HSS is provided with a list including identification information of LTE UEs accessing the 2G/3G network;
  • the HSS learns that the identifier information of the LTE UE is included in the list according to the identifier information in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G network.
  • the further generating the special authentication vector for the HSS comprises:
  • the HSS adds indication information to the request for the authentication vector, where the indication information is used to indicate that the HSS generates the special authentication vector;
  • the HSS generates EPS AV for the LTE UE
  • the HSS converts the EPS AV into a UMTS AV format, and the EPS AV converted to the UMTS AV format is the special authentication vector.
  • the HSS converts the EPS AV into a UMTS AV format including:
  • the HSS uses RAND in the EPS AV as the RAND of the UMTS AV, the HSS uses the AUTN in the EPS AV as the AUTN of the UMTS AV, and the HSS uses the XRES in the EPS AV as the XRES of the UMTS AV, the HSS
  • the K ASME in the EPS AV is split into two parts, which are the CK and the IK of the UMTS AV, respectively.
  • the access network element generates the K ASME according to the CK and or the ⁇ :
  • the message sent by the LTE UE is converted into a message suitable for the 2G or 3G network by the access network element, and the HSS identifies that the LTE UE accesses the 2G or 3G network through the access network element.
  • the HSS After the scenario, the HSS generates a special authentication vector, and completes the security authentication between the LTE UE and the network through the access network element and the SGSN. There is no need to modify the LTE UE, so that the LTE UE can complete the security authentication to access the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources.
  • FIG. 4 shows a schematic flow diagram of a method 400 of secure authentication of a mobile communication system in accordance with an embodiment of the present invention.
  • the method 400 includes:
  • the LTE UE accesses the 2G/3G core network through the access network element, and an RRC connection is established between the LTE UE and the access network element.
  • the LTE UE sends an attach request message to the access network element, and the access network element converts the attach request message received from the LTE UE into a UMTS attach request message identifiable by the SGSN of the 2G/3G core network in the UMTS system.
  • the network access NE sends the converted UMTS attach request message to the SGSN.
  • the SGSN sends a request for an authentication vector to the HSS. .
  • the HSS identifies that the LTE UE accesses the 2G/3G network, and includes:
  • the HSS is equipped with a list including LTE UEs accessing the 2G/3G network Identification information;
  • the HSS learns that the identifier information of the LTE UE is included in the list according to the identifier information in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G network.
  • the HSS generates the special authentication vector, including:
  • the HSS adds indication information to the request for the authentication vector, where the indication information is used to indicate that the HSS generates the special authentication vector;
  • the HSS generates EPS AV for the LTE UE
  • the HSS sets the 0th bit in the authentication management domain AMF to 1 to indicate that the authentication vector is EPS AV;
  • HSS generates RAND, AUTN, CK, IK and XRES;
  • the HSS derives KASME based on CK and IK.
  • EPS AV consists of K ASME , AUTN , XRES , RAND , where the 0th bit of the AMF parameter in the AUTN has a value of 1.
  • the HSS converts the EPS AV into a UMTS AV format such that the EPS AV can be sent to the SGSN through an existing UMTS authentication response.
  • the method for converting EPS AV into UMTS AV format includes: RAND, AUTN and XRES in EPS AV are used as RAND, AUTN and XRES of UMTS AV, and K ASME (256bits) in EPS AV is split into two parts, respectively as UMTS AV's CK (128bits) and IK (128bits). Alternatively, K ASME (256 bits) may also be split unevenly, and the ratio of the CK to the IK may be different.
  • the value of the 0th bit of the AMF in the AUTN is still 1.
  • the vector obtained by converting the EPS AV into the UMTS AV format is the special authentication vector.
  • the HSS transmits the special authentication vector to the SGSN;
  • the SGSN performs a UMTS AKA authentication procedure based on the special authentication vector received from the HSS.
  • the SGSN sends a UMTS AKA authentication challenge to the access network element, the UMTS AKA authentication challenge Contains RAND and AUTNo
  • the access network element converts the received UMTS AKA authentication challenge into an LTE AKA authentication challenge.
  • the RAND and AUTN in the UMTS AKA authentication challenge are sent to the LTE UE in the LTE AKA authentication challenge.
  • the LTE UE verifies the AUTN. Further, since the value of the 0th bit of the AMF in the AUTN is
  • the LTE UE will pass the check of AMF.
  • the LTE UE generates the RES and the key K ASME .
  • the LTE UE sends an LTE AKA authentication response to the access network element, and the LTE AKA authentication response includes the RES.
  • the access network element converts the LTE AKA authentication response into a UMTS AKA authentication response, and sends the RES in the LTE AKA authentication response to the SGSN in the UMTS AKA authentication response.
  • the SGSN compares whether the RES and the XRES are the same.
  • the security authentication is suspended;
  • the SGSN initiates a security mode process, in which CK and or IK are sent to the access network element.
  • the access network element generates K ASME according to CK and or IK.
  • the access network element generates K ASME according to CK and or IK.
  • the access network element and the LTE UE share the key K ASME .
  • the LTE NAS SMC process and the LTE AS SMC process are performed between the access network element and the LTE UE to establish an LTE air interface security.
  • the message sent by the LTE UE is converted into a message suitable for the 2G or 3G network by the access network element, and the HSS identifies that the LTE UE accesses the 2G or 3G network through the access network element.
  • the HSS After the scenario, the HSS generates a special authentication vector, and completes the security authentication between the LTE UE and the network through the access network element and the SGSN.
  • the LTE UE does not need to be modified, so that the LTE UE can complete the security authentication to access the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources. .
  • the home subscriber server HSS500 includes: a receiving module 510, an identification module 520, a processing module 530, a sending module 540;
  • the receiving module 510 is configured to receive a request for the authentication vector sent by the SGSN, where the request for the authentication vector is sent by the SGSN to the SGSN after receiving the UMTS attach request message sent by the access network element, where the After the receiving module 510 receives the request for the authentication vector, it is identified that the LTE UE accesses the 2G or 3G network;
  • the processing module 530 is configured to generate a special authentication vector after the identification module 520 identifies that the LTE UE accesses the 2G or 3G network;
  • the sending module 540 is configured to send the special authentication vector to the SGSN, so that the SGSN, the access network element, and the LTE UE complete the security authentication.
  • the HSS in order to enable the LTE UE to use the 2G or 3G core network, after the HSS recognizes that the LTE UE accesses the 2G/3G core network, the HSS generates a special authentication vector for the LTE UE, so that the SGSN, the SGSN, The access network element and the LTE UE complete the security authentication, so that the LTE UE can complete the security authentication to access the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources.
  • the UMTS attach request message is obtained by the access network element converting the attach request message, and the attach request message is sent by the LTE UE.
  • the security authentication is performed by the SGSN, the access network element, and the LTE UE, including:
  • the SGSN sends a UMTS AKA authentication challenge to the access network element, and the access network element converts the UMTS AKA authentication challenge into an LTE AKA authentication challenge and sends the challenge to the LTE UE, where the LTE UE performs the LTE AKA authentication challenge.
  • the LTE UE sends an LTE AKA authentication response including the RES to the access network element, so that the access network element, the SGSN, and the LTE UE further complete the security authentication.
  • the special authentication vector includes XRES, CK, and IK;
  • the security authentication is further performed by the access network element, the SGSN, and the LTE UE, including:
  • the access network element converts the LTE ⁇ authentication response into a UMTS AKA authentication response and sends the UMTS AKA authentication response to the SGSN, where the SGSN compares whether the RES and the XRES are the same. When the comparison result is the same, The SGSN sends the CK and or IK to the access network element, and the access network element generates K ASME according to the CK and or IK, and the access network element and the LTE UE share the K ASME .
  • whether the SGSN compares whether the RES and the XRES are the same further includes: when the comparison result is different, suspending the security authentication.
  • the HSS further includes a storage module 550, where the storage module 550 is configured to store a list, where the list includes identifier information of the LTE UE that accesses the 2G/3G network;
  • the identifying module 520 learns that the identifier information of the LTE UE is included in the list according to the identifier information in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G network.
  • the processing module 530 is configured to: after the identifying module 520 identifies that the LTE UE accesses the 2G or 3G network, generating a special authentication vector, including:
  • the processing module 530 is configured to add indication information to the request for requesting the authentication vector, where the indication information is used to indicate that the HSS generates the special authentication vector;
  • the processing module 530 is configured to generate an EPS AV for the LTE UE;
  • the processing module 530 is configured to set the 0th bit in the authentication management domain AMF to 1 to indicate that the authentication vector is EPS AV;
  • the processing module 530 is configured to generate RAND, AUTN, CK, IK, and XRES;
  • EPS AV consists of K ASME , AUTN , XRES , RAND , where the 0th bit of the AMF parameter in the AUTN has a value of 1.
  • the processing module 530 is configured to convert the EPS AV into a UMTS AV format, so that the method of the AV format includes: using RAND, AUTN, and XRES in the EPS AV as the RAND, AUTN, and XRES of the UMTS AV, and the EPS K ASME (256bits) in AV is split into two parts, which are CK (128bits) and IK (128bits) of UMTS AV.
  • the EPS AV is converted into the UMTS AV format
  • the value of the 0th bit of the AMF in the AUTN is still 1.
  • the vector obtained by converting the EPS AV into the UMTS AV format is the special authentication vector.
  • the access network element generates the K ASME according to the CK and or IK, including:
  • the access network element in accordance with the generation rule K ASME CKIIIK, which generates based on the K ASME and CK or IK. ⁇ indicates concatenation, IK is added after CK.
  • the message sent by the LTE UE is converted into a message suitable for the 2G or 3G network by the access network element, and the HSS identifies that the LTE UE accesses the 2G or 3G network through the access network element.
  • the HSS After the scenario, the HSS generates a special authentication vector, and completes the security authentication between the LTE UE and the network through the access network element and the SGSN. There is no need to modify the LTE UE, so that the LTE UE can complete the secure authentication access to the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources.
  • Figure 6 shows a schematic block diagram of a GPRS service support node 600 for secure authentication of a mobile communication system in accordance with an embodiment of the present invention. 6 and its description, the apparatus disclosed in FIG. 1 to FIG. 4 and the method disclosed in FIG. 1 to FIG. 4 based on the embodiment of the present invention may also be based on the embodiment of the present invention and FIG. 5 and FIG. Revealed device.
  • the GPRS service support node SGSN600 includes: a receiving module 610; a sending module 620;
  • the receiving module 610 is configured to receive a UMTS attach request message sent by an access network element, where the UMTS attach request is obtained by converting, by the access network element, an attach request message sent by the LTE UE;
  • the sending module 620 is configured to receive the UMTS attach request in the receiving module 610. After receiving the request, the request for the authentication vector is sent to the HSS, so that the HSS receives the request and identifies that the LTE UE accesses the 2G or 3G network, so that the HSS generates the special authentication vector; the receiving module 610 is further configured to receive The special authentication vector from the HSS, the sending module 620 is further configured to send a UMTS AKA authentication challenge to the access network element after the receiving module 610 receives the special authentication vector, so that the SGSN, the access network The network element and the LTE UE complete the security authentication.
  • the HSS After the scenario in which the LTE UE accesses the 2G or 3G core network is identified by the HSS, the HSS generates a special authentication vector, so that the SGSN, the access network element, and the LTE UE complete the security authentication, and the implementation does not need to be performed. Under the condition that the LTE UE is modified, the LTE UE can complete the security authentication to access the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources.
  • the SGSN, the access network element, and the LTE UE complete the security authentication, where the access network element converts the UMTS AKA authentication challenge into an LTE AKA authentication challenge and sends the LTE UE to the LTE UE.
  • the LTE UE After the LTE UE performs the verification according to the LTE AKA authentication challenge and generates the RES and the key K ASME , the LTE UE sends an LTE AKA authentication response including the RES to the access network element, so that the access network element, the The SGSN and the LTE UE further complete the security authentication.
  • the SGSN further includes a processing module 630;
  • the special authentication vector includes XRES, CK, and IK;
  • the security authentication is further performed by the access network element, the SGSN, and the LTE UE, including:
  • the access network element converts the LTE AKA authentication response into a UMTS AKA authentication response and sends the UMTS AKA authentication response to the receiving module 610, where the processing module 630 is configured to compare whether the RES and the XRES are the same, when the comparison is performed.
  • the sending module 620 sends the CK and or IK to the access network element, and the access network element generates K ASME according to the CK and or IK, and the CK and or IK are sent by the sending module 620.
  • the processing module 630 compares whether the RES and the XRES are the same. Further, when the comparison result is different, the security authentication is suspended.
  • the HSS After the HSS receives the request, it is identified that the LTE UE accesses the 2G or 3G network includes: the HSS is equipped with a list, and the list includes the identifier information of the LTE UE accessing the 2G/3G network;
  • the HSS learns that the identifier information of the LTE UE is included in the list according to the identifier information in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G network.
  • the generating the special authentication vector by the HSS includes:
  • the HSS adds indication information to the request for the authentication vector, where the indication information is used to indicate that the HSS generates the special authentication vector;
  • the HSS generates EPS AV for the LTE UE
  • the HSS converts the EPS AV into a UMTS AV format, and the EPS AV converted to the UMTS AV format is the special authentication vector.
  • the HSS converts the EPS AV into a UMTS AV format, including:
  • the HSS uses RAND in the EPS AV as the RAND of the UMTS AV, the HSS uses the AUTN in the EPS AV as the AUTN of the UMTS AV, and the HSS uses the XRES in the EPS AV as the XRES of the UMTS AV, the HSS
  • the K ASME in the EPS AV is split into two parts, which are the CK and the IK of the UMTS AV, respectively.
  • the access network element generates the K ASME according to the CK and or the ⁇ :
  • the message sent by the LTE UE is converted into a message suitable for the 2G or 3G network by the access network element, and the HSS identifies that the LTE UE accesses the 2G or 3G network through the access network element.
  • the HSS After the scenario, the HSS generates a special authentication vector, and completes the security authentication between the LTE UE and the network through the access network element and the SGSN. No modification to the LTE UE is required, so that the LTE UE can complete
  • the security authentication accesses the 2G or 3G network, so that the LTE UE uses 2G or 3G core network resources.
  • FIG. 7 shows a schematic block diagram of an access network element 700 for secure authentication of a mobile communication system in accordance with an embodiment of the present invention. 7 and its description, the apparatus disclosed in FIG. 1 to FIG. 4 and the method disclosed in FIG. 1 to FIG. 4 according to the embodiment of the present invention may also be based on the embodiments of the present invention and FIGS. 5 to 6 and The apparatus disclosed in Figures 5-6.
  • the access network element 700 includes: a receiving module 710, a processing module 720, and a sending module 730;
  • the receiving module 710 is configured to receive an attach request message from an LTE UE; the processing module 720 is configured to convert the attach request message into a UMTS attach request message;
  • the sending module 730 is configured to send the UMTS attach request message to the SGSN, so that the SGSN sends a request for the authentication vector to the HSS, and the HSS receives the request of the SGSN to identify that the LTE UE accesses the 2G or 3G network. In order for the HSS to generate a special authentication vector;
  • the receiving module 710 is further configured to receive the UMTS AKA authentication challenge sent by the SGSN, where the UMTS AKA authentication challenge is sent after the SGSN receives the special authentication vector sent by the HSS; the processing module 720 is further configured to authenticate the UMTS AKA.
  • the challenge is converted into an LTE AKA authentication challenge, and the sending module 730 is further configured to send the LTE AKA authentication challenge to the LTE UE, so that the access network element, the SGSN, and the LTE UE complete the security authentication.
  • the information sent by the LTE UE is converted into the information applicable to the 2G or 3G network system by the access network element, and the scene that the LTE UE accesses the 2G or 3G network is identified by the HSS, and is generated by the HSS.
  • the special authentication vector enables the access network element, the SGSN, and the LTE UE to complete the security authentication, so that the LTE UE can complete the security authentication to access the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources.
  • the access network element, the SGSN, and the LTE UE complete the security authentication, where the LTE UE verifies the LTE AKA authentication challenge, and generates a RES and a key K ASME ;
  • the receiving module 710 is configured to receive an LTE AKA authentication response that is sent by the LTE UE and includes the RES, so that the access network element, the SGSN, and the LTE UE further complete security authentication.
  • the special authentication vector includes XRES, CK, and IK;
  • the access network element, the SGSN, and the LTE UE further complete the security authentication, including:
  • the processing module 720 is further configured to convert the LTE AKA authentication response including the RES into a UMTS AKA authentication response including the RES, where the sending module 730 is further configured to send the UMTS AKA authentication response including the RES to the SGSN, so that The SGSN compares whether the RES and the XRES are the same. When the comparison result is the same, the SGSN sends the CK and or IK to the access network element.
  • the processing module 720 is further configured to generate a K ASME according to the CK and or IK, where the access network element and the LTE UE share the K ASME .
  • whether the SGSN compares whether the RES and the XRES are the same further includes: when the comparison result is different, suspending the security authentication.
  • the HSS After receiving the request from the SGSN, the HSS identifies that the LTE UE accesses the 2G or 3G network, including:
  • the HSS is provided with a list including identification information of LTE UEs accessing the 2G/3G network;
  • the HSS learns that the identifier information of the LTE UE is included in the list according to the identifier information in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G network.
  • the further generating the special authentication vector for the HSS comprises:
  • the HSS adds indication information to the request for the authentication vector, where the indication information is used to indicate that the HSS generates the special authentication vector;
  • the HSS generates EPS AV for the LTE UE
  • the HSS converts the EPS AV into a UMTS AV format, and the EPS AV converted to the UMTS AV format is the special authentication vector.
  • the HSS converts the EPS AV into a UMTS AV format including:
  • the HSS uses RAND in the EPS AV as the RAND of the UMTS AV, the HSS uses the AUTN in the EPS AV as the AUTN of the UMTS AV, and the HSS uses the XRES in the EPS AV as the XRES of the UMTS AV, the HSS
  • the K ASME (256 bits) in the EPS AV is split into two parts, which are the CK and the IK of the UMTS AV, respectively.
  • the message sent by the LTE UE is converted into a message applicable to the 2G or 3G network by the access network element, and the HSS identifies that the LTE UE accesses the 2G or 3G core through the access network element.
  • the HSS After the scenario of the network, the HSS generates a special authentication vector, and completes the security authentication between the LTE UE and the network through the access network element and the SGSN. There is no need to modify the LTE UE, so that the LTE UE can complete the secure authentication access to the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources.
  • FIG. 8 shows a schematic block diagram of a home subscriber server 800 for secure authentication of a mobile communication system in accordance with an embodiment of the present invention. 8 and its description, the apparatus disclosed in FIG. 1 to FIG. 4 and the method disclosed in FIG. 1 to FIG. 4 based on the embodiment of the present invention, and FIG. 5 to FIG. 7 based on the embodiment of the present invention and based on The apparatus disclosed in Figures 5 to 7 of the embodiment of the present invention.
  • the home subscriber server HSS800 includes: a receiver 810, a first processor 820, a second processor 830, and a transmitter 840;
  • the receiver 810 is configured to receive a request for an authentication vector sent by the SGSN, where the request for the authentication vector is sent by the SGSN to the SGSN after receiving the UMTS attach request message sent by the access network element, the first processor The 820 is configured to: after the receiver 810 receives the request for the authentication vector, identify that the LTE UE accesses the 2G or 3G network;
  • the second processor 830 is configured to generate a special authentication vector after the first processor 820 recognizes that the LTE UE accesses the 2G or 3G network;
  • the transmitter 840 is configured to send the special authentication vector to the SGSN, so that the SGSN, the access network element, and the LTE UE complete the security authentication.
  • the HSS in order to enable the LTE UE to use the 2G or 3G core network, in the HSS After the LTE UE accesses the 2G/3G core network, the HSS generates a special authentication vector for the LTE UE, so that the SGSN, the access network element, and the LTE UE complete the security authentication, so that the LTE UE accesses the 2G or 3G. Network, so that LTE UEs can use 2G or 3G core network resources.
  • the UMTS attach request message is obtained by the access network element converting the attach request message, and the attach request message is sent by the LTE UE.
  • the security authentication is performed by the SGSN, the access network element, and the LTE UE, including:
  • the SGSN sends a UMTS AKA authentication challenge to the access network element, and the access network element converts the UMTS AKA authentication challenge into an LTE AKA authentication challenge and sends the challenge to the LTE UE, where the LTE UE performs the LTE AKA authentication challenge.
  • the LTE UE sends an LTE AKA authentication response including the RES to the access network element, so that the access network element, the SGSN, and the LTE UE further complete the security authentication. .
  • the special authentication vector includes XRES, CK, and IK;
  • the security authentication is further performed by the access network element, the SGSN, and the LTE UE, including:
  • the access network element converts the LTE AKA authentication response into a UMTS AKA authentication response and sends the UMTS AKA authentication response to the SGSN, and the SGSN compares whether the RES and the XRES are the same. When the comparison result is the same, the The SGSN sends the CK and or IK to the access network element, and the access network element generates K ASME according to the CK and or IK, and the access network element and the LTE UE share the K ASME .
  • whether the SGSN compares whether the RES and the XRES are the same further includes: when the comparison result is different, suspending the security authentication.
  • the HSS further includes a memory 850, where the memory 850 is configured to store a list, where the list includes identifier information of the LTE UE that accesses the 2G/3G network;
  • the first processor 820 is located in the identifier information in the list, and the identifier information of the LTE UE is included in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G.
  • the internet is located in the identifier information in the list, and the identifier information of the LTE UE is included in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G. The internet.
  • the generating, by the second processor 830, the special authentication vector after the first processor 820 identifies that the LTE UE accesses the 2G or 3G network includes:
  • the second processor 830 is configured to add indication information to the request for the authentication vector, where the indication information is used to indicate that the HSS generates the special authentication vector;
  • the second processor 830 is configured to generate EPS AV for the LTE UE;
  • the second processor 830 is configured to set the 0th bit in the authentication management domain AMF to 1 to indicate that the authentication vector is EPS AV;
  • the second processor 830 is configured to generate RAND, AUTN, CK, IK and XRES;
  • EPS AV consists of K ASME , AUTN , XRES , RAND , where the 0th bit of the AMF parameter in the AUTN has a value of 1.
  • the second processor 830 is configured to convert the EPS AV into a UMTS AV format, so that the EPS AV can be sent to the SGSN through an existing UMTS authentication response.
  • the method of converting EPS AV into UMTS AV format includes: using RAND, AUTN and XRES in EPS AV as RAND, AUTN and XRES of UMTS AV, and splitting K ASME (256bits) in EPS AV into two parts, respectively as UMTS AV's CK (128bits) and IK (128bits).
  • K ASME 256bits
  • the value of the 0th bit of the AMF in the AUTN is still 1.
  • the vector obtained by converting the EPS AV into the UMTS AV format is the special authentication vector.
  • the access network element generates the K ASME according to the CK and or IK, including:
  • the access network element in accordance with the generation rule K ASME CKIIIK, which generates based on the K ASME and CK or IK. ⁇ indicates concatenation, IK is added after CK.
  • the message sent by the LTE UE is converted to be applicable to the network element of the access network.
  • the message of the 2G or 3G network is recognized by the HSS.
  • the LTE UE accesses the 2G or 3G through the access network element.
  • the HSS After the scenario of the network, the HSS generates a special authentication vector, and completes the security authentication between the LTE UE and the network through the access network element and the SGSN.
  • the LTE UE does not need to be modified, so that the LTE UE can complete the security authentication to access the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources.
  • Figure 9 shows a schematic block diagram of a GPRS service support node 900 for secure authentication of a mobile communication system in accordance with an embodiment of the present invention.
  • the apparatus disclosed in FIG. 1 to FIG. 4 and the method disclosed in FIG. 1 to FIG. 4 according to the embodiment of the present invention may also be based on the embodiment of the present invention, FIG. 5 and FIG. Revealed device.
  • the GPRS service supporting node SGSN900 includes: a receiver 910; a transmitter 920;
  • the receiver 910 is configured to receive a UMTS attach request message sent by an access network element, where the UMTS attach request is obtained by converting, by the access network element, an attach request message sent by the LTE UE;
  • the transmitter 920 is configured to send a request for an authentication vector to the HSS after the receiver 910 receives the UMTS attach request message, so that the HSS receives the request and identifies that the LTE UE accesses the 2G or 3G network, and further So that the HSS generates the special authentication vector;
  • the receiver 910 is further configured to receive the special authentication vector from the HSS, where the transmitter 920 is further configured to send a UMTS AKA authentication challenge to the access network element after the receiver 910 receives the special authentication vector. So that the SGSN, the access network element, and the LTE UE complete the security authentication.
  • the HSS After the scenario in which the LTE UE accesses the 2G or 3G core network is identified by the HSS, the HSS generates a special authentication vector, so that the SGSN, the access network element, and the LTE UE complete the security authentication, and the implementation does not need to be performed. Under the condition that the LTE UE is modified, the LTE UE can complete the security authentication to access the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources.
  • the SGSN, the access network element, and the LTE UE complete the security authentication, where the access network element converts the UMTS AKA authentication challenge into an LTE AKA authentication challenge and sends the LTE UE to the LTE UE.
  • the LTE UE After the LTE UE performs the verification according to the LTE AKA authentication challenge and generates the RES and the key K ASME , the LTE UE sends an LTE AKA authentication response including the RES to the access network element, so that the access network element, the The SGSN and the LTE UE further complete the security recognition Certificate.
  • the SGSN further includes a processor 930;
  • the special authentication vector includes XRES, CK, and IK;
  • the security authentication is further performed by the access network element, the SGSN, and the LTE UE, including:
  • the access network element converts the LTE ⁇ authentication response into a UMTS AKA authentication response and sends the UMTS AKA authentication response to the receiver 910
  • the processor 930 is configured to compare whether the RES and the XRES are the same, when the comparison When the result is the same, the transmitter 920 sends the CK and or IK to the access network element, and the access network element generates the K ASME according to the CK and or IK, and the CK and or IK are sent by the The 920 is sent, and the access network element and the LTE UE share the K ASME .
  • the comparing, by the processor 930, whether the RES and the XRES are the same further includes: when the comparison result is different, the security authentication is suspended.
  • the HSS After the HSS receives the request, it is identified that the LTE UE accesses the 2G or 3G network includes: the HSS is equipped with a list, and the list includes the identifier information of the LTE UE accessing the 2G/3G network;
  • the HSS learns that the identifier information of the LTE UE is included in the list according to the identifier information in the list, and the HSS identifies that the LTE UE accesses the 2G or 3G network.
  • the generating the special authentication vector by the HSS includes:
  • the HSS adds indication information to the request for the authentication vector, where the indication information is used to indicate that the HSS generates the special authentication vector;
  • the HSS generates EPS AV for the LTE UE
  • the HSS converts the EPS AV into a UMTS AV format, and the EPS AV converted to the UMTS AV format is the special authentication vector.
  • the HSS converts the EPS AV into a UMTS AV format, including:
  • the HSS uses the RAND in the EPS AV as the RAND of the UMTS AV, the HSS The AUTN in the EPS AV is used as the AUTN of the UMTS AV, and the HSS uses the XRES in the EPS AV as the XRES of the UMTS AV, and the HSS splits the K ASME in the EPS AV into two parts, respectively as the UMTS AV of the CK and the IK.
  • the access network element generates the K ASME according to the CK and or the ⁇ :
  • the message sent by the LTE UE is converted into a message suitable for the 2G or 3G network by the access network element, and the HSS identifies that the LTE UE accesses the 2G or 3G network through the access network element.
  • the HSS After the scenario, the HSS generates a special authentication vector, and completes the security authentication between the LTE UE and the network through the access network element and the SGSN. There is no need to modify the LTE UE, so that the LTE UE can complete the secure authentication access to the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources.
  • FIG. 10 shows a schematic block diagram of an access network element 1000 for secure authentication of a mobile communication system in accordance with an embodiment of the present invention. 10 and its description, the apparatus disclosed in FIG. 1 to FIG. 4 and the method disclosed in FIG. 1 to FIG. 4 based on the embodiment of the present invention may also be based on the embodiments of the present invention and FIGS. 5 to 9 and The apparatus disclosed in Figures 5-9.
  • the access network element 1000 includes: a receiver 1010, a processor 1020, and a transmitter 1030.
  • the receiver 1010 is configured to receive an attach request message from an LTE UE, where the processor 1020 is configured to convert the attach request message into a UMTS attach request message.
  • the transmitter 1030 is configured to send the UMTS attach request message to the SGSN, so that the SGSN sends a request for the authentication vector to the HSS, and the HSS receives the request of the SGSN to identify that the LTE UE accesses the 2G or 3G network.
  • the receiver 1010 is further configured to receive a UMTS AKA authentication challenge sent by the SGSN, where the UMTS AKA authentication challenge is sent after the SGSN receives the special authentication vector sent by the HSS;
  • the 1020 is further configured to convert the UMTS AKA authentication challenge into an LTE AKA authentication challenge, where the transmitter 1030 is further configured to send the LTE AKA authentication challenge to the LTE UE, where the access network element, the SGSN, and the LTE UE are used.
  • Complete safety certification is
  • the information sent by the LTE UE is converted into the information applicable to the 2G or 3G network system by the access network element, and the scene that the LTE UE accesses the 2G or 3G network is identified by the HSS, and is generated by the HSS.
  • the special authentication vector enables the access network element, the SGSN, and the LTE UE to perform security authentication, so that the LTE UE can use the existing 2G or 3G core network.
  • the access network element, the SGSN, and the LTE UE complete the security authentication, where the LTE UE verifies the LTE AKA authentication challenge, and generates a RES and a key K ASME ;
  • the receiver 1010 is configured to receive an LTE AKA authentication response that is sent by the LTE UE and includes the RES, so that the access network element, the SGSN, and the LTE UE further complete security authentication.
  • the special authentication vector includes XRES, CK, and IK;
  • the access network element, the SGSN, and the LTE UE further complete the security authentication, including:
  • the processor 1020 is further configured to convert the LTE AKA authentication response including the RES into a UMTS AKA authentication response including the RES, where the transmitter 1030 is further configured to send the UMTS AKA authentication response including the RES to the SGSN, so that The SGSN compares whether the RES and the XRES are the same. When the comparison result is the same, the SGSN sends the CK and or IK to the access network element.
  • the processor 1020 is further configured to generate a K ASME according to the CK and or IK, and the access network element and the LTE UE share the K ASME .
  • whether the SGSN compares whether the RES and the XRES are the same further includes: when the comparison result is different, suspending the security authentication.
  • the HSS After receiving the request from the SGSN, the HSS identifies that the LTE UE accesses the 2G or 3G network, including:
  • the HSS is provided with a list including identification information of LTE UEs accessing the 2G/3G network;
  • the HSS learns that the identifier information of the LTE UE is included in the identifier information in the list. In the list, the HSS recognizes that the LTE UE accesses the 2G or 3G network.
  • the further generating the special authentication vector for the HSS comprises:
  • the HSS adds indication information to the request for the authentication vector, where the indication information is used to indicate that the HSS generates the special authentication vector;
  • the HSS generates EPS AV for the LTE UE
  • the HSS converts the EPS AV into a UMTS AV format, and the EPS AV converted to the UMTS AV format is the special authentication vector.
  • the HSS converts the EPS AV into a UMTS AV format, including:
  • the HSS uses RAND in the EPS AV as the RAND of the UMTS AV, the HSS uses the AUTN in the EPS AV as the AUTN of the UMTS AV, and the HSS uses the XRES in the EPS AV as the XRES of the UMTS AV, the HSS
  • the K ASME (256 bits) in the EPS AV is split into two parts, which are the CK and the IK of the UMTS AV, respectively.
  • the message sent by the LTE UE is converted to be applicable to the network element of the access network.
  • the message of the 2G or 3G network is identified by the HSS.
  • the HSS After the LTE UE accesses the 2G or 3G core network through the access network element, the HSS generates a special authentication vector, and completes the LTE UE through the access network element and the SGSN. Security certification between the network and the network.
  • the LTE UE does not need to be modified, so that the LTE UE can complete the security authentication to access the 2G or 3G network, so that the LTE UE uses the 2G or 3G core network resources.
  • Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another.
  • a storage medium may be any available media that can be accessed by a computer. Take this as an example but Not limited to: Computer readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage media or other magnetic storage device, or can be used to carry or store desired program code in the form of an instruction or data structure. And any other medium that can be accessed by a computer. Also. Any connection may suitably be a computer readable medium.
  • a disk and a disc include a compact disc (CD), a laser disc, a compact disc, a digital versatile disc (DVD), a floppy disc, and a Blu-ray disc, wherein the disc is usually magnetically copied, and the disc is The laser is used to optically replicate the data.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente invention concerne un procédé et un dispositif de réseau destinés à effectuer une authentification sécurisée d'un système de communication mobile. Le procédé d'authentification sécurisée d'un système de communication mobile comprend les étapes suivantes : après réception d'une demande portant sur un vecteur d'authentification envoyée par un SGSN, un HSS identifie le fait qu'un UE LTE (Equipement utilisateur du type Evolution à Long Terme) accède à un réseau 2G ou 3G, la demande de vecteur d'authentification étant envoyée au SGSN après réception par le SGSN d'un message de demande de rattachement à un réseau UMTS (système de télécommunication universel pour les mobiles) envoyé par un élément de réseau d'un réseau d'accès ; le HSS génère un vecteur d'authentification spécial après avoir identifié le fait que l'UE LTE accédait à un réseau 2G ou 3G ; et le HSS envoie le vecteur d'authentification spécial au SGSN de manière à ce que le SGSN, l'élément de réseau du réseau d'accès, et l'UE LTE réalisent une authentification sécurisée. Le procédé et le dispositif de réseau décrits destinés à effectuer une authentification sécurisée d'un système de communication mobile permettent à un UE LTE d'utiliser un réseau 2G/3G.
PCT/CN2013/070839 2013-01-22 2013-01-22 Procédé et dispositif de réseau destinés à effectuer une authentification sécurisée d'un système de communication mobile WO2014113920A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2013/070839 WO2014113920A1 (fr) 2013-01-22 2013-01-22 Procédé et dispositif de réseau destinés à effectuer une authentification sécurisée d'un système de communication mobile
CN201380070864.4A CN104937990B (zh) 2013-01-22 2013-01-22 移动通信系统的安全认证的方法和网络设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2013/070839 WO2014113920A1 (fr) 2013-01-22 2013-01-22 Procédé et dispositif de réseau destinés à effectuer une authentification sécurisée d'un système de communication mobile

Publications (1)

Publication Number Publication Date
WO2014113920A1 true WO2014113920A1 (fr) 2014-07-31

Family

ID=51226805

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2013/070839 WO2014113920A1 (fr) 2013-01-22 2013-01-22 Procédé et dispositif de réseau destinés à effectuer une authentification sécurisée d'un système de communication mobile

Country Status (2)

Country Link
CN (1) CN104937990B (fr)
WO (1) WO2014113920A1 (fr)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101998348A (zh) * 2009-08-25 2011-03-30 中兴通讯股份有限公司 一种计费系统及其进行计费的方法
CN101730193B (zh) * 2009-06-09 2012-06-13 中兴通讯股份有限公司 一种选择网关节点的方法及系统
US20120159151A1 (en) * 2010-12-21 2012-06-21 Tektronix, Inc. Evolved Packet System Non Access Stratum Deciphering Using Real-Time LTE Monitoring
WO2012095197A1 (fr) * 2011-01-13 2012-07-19 Telefonaktiebolaget L M Ericsson (Publ) Commande d'itinérance pour réseau apn d'un système ims

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
BRPI0811693A2 (pt) * 2007-06-22 2015-03-31 Interdigital Tech Corp Método e dispositivo para o gerenciamento de recursos em operação de processo de passagem.
WO2009056938A2 (fr) * 2007-10-29 2009-05-07 Nokia Corporation Système et procédé pour authentifier un transfert de contexte
CN101909368B (zh) * 2009-06-08 2012-06-27 上海贝尔股份有限公司 无线网络安全解决方法和设备
CN101600205B (zh) * 2009-07-10 2011-05-04 华为技术有限公司 Sim卡用户设备接入演进网络的方法和相关设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101730193B (zh) * 2009-06-09 2012-06-13 中兴通讯股份有限公司 一种选择网关节点的方法及系统
CN101998348A (zh) * 2009-08-25 2011-03-30 中兴通讯股份有限公司 一种计费系统及其进行计费的方法
US20120159151A1 (en) * 2010-12-21 2012-06-21 Tektronix, Inc. Evolved Packet System Non Access Stratum Deciphering Using Real-Time LTE Monitoring
WO2012095197A1 (fr) * 2011-01-13 2012-07-19 Telefonaktiebolaget L M Ericsson (Publ) Commande d'itinérance pour réseau apn d'un système ims

Also Published As

Publication number Publication date
CN104937990B (zh) 2019-06-21
CN104937990A (zh) 2015-09-23

Similar Documents

Publication Publication Date Title
CN111670587B (zh) 用于多个注册的方法和设备
CN109587688B (zh) 系统间移动性中的安全性
JP6727294B2 (ja) ユーザ機器ｕｅのアクセス方法、アクセスデバイス、およびアクセスシステム
CN108781216B (zh) 用于网络接入的方法和设备
US20200162913A1 (en) Terminal authenticating method, apparatus, and system
JP4965671B2 (ja) 無線通信ネットワークにおけるユーザ・プロファイル、ポリシー及びｐｍｉｐキーの配布
RU2665064C1 (ru) Беспроводная связь, включающая в себя кадр обнаружения быстрого первоначального установления линии связи, fils, для сетевой сигнализации
WO2020221324A1 (fr) Procédé d'enregistrement et appareil de communication
CN112219415A (zh) 在第一网络中使用用于第二旧网络的订户标识模块的用户认证
JP2010533390A (ja) 端末が移動するときにセキュリティ機能を折衝するための方法、システム、および装置
EP3158785A1 (fr) Procédés et agencements pour l'identification d'équipements d'utilisateur à des fins d'authentification
CN110583036A (zh) 网络认证方法、网络设备及核心网设备
WO2013152740A1 (fr) Procédé, dispositif et système d'authentification destinés à un équipement utilisateur
WO2014113922A1 (fr) Procédé et dispositif de réseau destinés à l'authentification sécurisée d'un système de communication mobile
WO2014113921A1 (fr) Procédé et dispositif de réseau destinés à effectuer une authentification sécurisée d'un système de communication mobile
CN110226319A (zh) 用于紧急接入期间的参数交换的方法和设备
US10390224B2 (en) Exception handling in cellular authentication
WO2014113920A1 (fr) Procédé et dispositif de réseau destinés à effectuer une authentification sécurisée d'un système de communication mobile
JP2021524167A (ja) 複数の登録のための方法および装置
WO2014113918A1 (fr) Procédé et dispositif de réseau permettant une authentification de sécurité de système de communication mobile
US20230231708A1 (en) Method and apparatus for multiple registrations
CN118317302A (en) Authentication method and communication device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13872483

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 13872483

Country of ref document: EP

Kind code of ref document: A1