WO2017166419A1 - 伪基站识别方法、伪基站识别装置和终端 - Google Patents

伪基站识别方法、伪基站识别装置和终端 Download PDF

Info

Publication number
WO2017166419A1
WO2017166419A1 PCT/CN2016/084067 CN2016084067W WO2017166419A1 WO 2017166419 A1 WO2017166419 A1 WO 2017166419A1 CN 2016084067 W CN2016084067 W CN 2016084067W WO 2017166419 A1 WO2017166419 A1 WO 2017166419A1
Authority
WO
WIPO (PCT)
Prior art keywords
base station
pseudo
sres
server
terminal
Prior art date
Application number
PCT/CN2016/084067
Other languages
English (en)
French (fr)
Inventor
董志伟
Original Assignee
宇龙计算机通信科技(深圳)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 宇龙计算机通信科技(深圳)有限公司 filed Critical 宇龙计算机通信科技(深圳)有限公司
Publication of WO2017166419A1 publication Critical patent/WO2017166419A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/128—Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud

Definitions

  • the present invention relates to the field of terminal technologies, and in particular, to a pseudo base station identification method, a pseudo base station identification apparatus, and a terminal.
  • the terminal selects a strong signal according to the strength of the pilot signal transmitted by the base station.
  • the pseudo base station transmits a strong signal, it is easy for the terminal to select the pseudo base station to connect, and disconnect the previously connected legal base station.
  • the IMSI International Mobile Subscriber Identification Number
  • SMS causes a certain loss to the user.
  • the present invention is based on the above problems, and proposes a new technical solution that can accurately identify a pseudo base station.
  • the first aspect of the present invention provides a pseudo base station identification method, including: after selecting a base station to be connected, generating a random number and a terminal authentication key issued by a server corresponding to the base station a plurality of pseudo SRES values; transmitting the plurality of pseudo SRES values to the server for the server to authenticate each of the plurality of pseudo SRES values; if the server is received And responding to the successful authentication of each of the pseudo SRES values, and identifying the base station as a pseudo base station.
  • the base station in the process of authenticating the base station, since only the legitimate base station is facing the true SRES The value of (Signed Response) can be authenticated. Therefore, if the base station authenticates multiple pseudo SRES values, the base station is a pseudo base station, so that the base station can be accurately identified.
  • the method further includes: generating a true SRES value according to the random number and the authentication key; and failing to authenticate each of the pseudo SRES values if receiving the server And responding, sending the true SRES value to the server, and registering the terminal to the network corresponding to the base station when receiving the server successfully authenticating the true SRES value.
  • the step of generating a plurality of pseudo SRES values according to the random number sent by the server corresponding to the base station and the authentication key of the terminal specifically: generating The parameters of the first algorithm of the SRES value are modified to form a second algorithm; the second algorithm is employed and the plurality of pseudo SRES values are generated based on the random number and the authentication key.
  • the parameters of the algorithm for generating the true SRES value may be modified to generate a plurality of pseudo SRES values according to the modified algorithm. For example, each time the value of the algorithm is modified, a pseudo SRES value may be generated. In addition, a plurality of numerical values different from the true SRES value may be randomly generated as a plurality of pseudo SRES values.
  • the method further includes: after identifying that the base station is a pseudo base station, prohibiting the terminal from being registered in a communication network corresponding to the base station.
  • the terminal is prohibited from being registered in the corresponding communication network, and the information such as the IMSI of the terminal is prevented from being intercepted by the base station, thereby preventing the related information of the terminal from being leaked, thereby ensuring The security of the terminal data. Moreover, the terminal is also prevented from receiving the fraud information sent by the pseudo base station, thereby avoiding property damage to the user.
  • the method further includes: after identifying that the base station is a pseudo base station, sending reminding information.
  • the base station when the base station is identified as a pseudo base station, by sending a reminder message, for example, a pop-up notification bar is displayed to connect the pseudo base station, and the user is not allowed to believe the received information to prevent being deceived, thereby improving user vigilance and ensuring The user's property is safe.
  • a reminder message for example, a pop-up notification bar is displayed to connect the pseudo base station, and the user is not allowed to believe the received information to prevent being deceived, thereby improving user vigilance and ensuring The user's property is safe.
  • a second aspect of the present invention provides a pseudo base station identifying apparatus, including: a first generating unit, configured to: after selecting a base station to be connected, according to a random number sent by a server corresponding to the base station, and an authentication secret of the terminal Key, generating a plurality of pseudo SRES values; a sending unit, configured to send the plurality of pseudo SRES values to the server, for the server to perform a value for each of the plurality of pseudo SRES values And an identifying unit, configured to identify the base station as a pseudo base station if receiving a response of the server that successfully authenticates each of the pseudo SRES values.
  • the method further includes: a second generating unit, configured to generate a true SRES value according to the random number and the authentication key; and a processing unit, if the server is received Transmitting the true SRES value to the server in response to each of the pseudo SRES values failing to authenticate, and when the server successfully receives the true SRES value, the terminal is successfully Registered in the network corresponding to the base station.
  • a second generating unit configured to generate a true SRES value according to the random number and the authentication key
  • a processing unit if the server is received Transmitting the true SRES value to the server in response to each of the pseudo SRES values failing to authenticate, and when the server successfully receives the true SRES value, the terminal is successfully Registered in the network corresponding to the base station.
  • the first generating unit includes: a modifying subunit, configured to modify a parameter of a first algorithm used to generate a true SRES value to form a second algorithm; and generate a subunit And generating, by the second algorithm, the plurality of pseudo SRES values based on the random number and the authentication key.
  • the parameters of the algorithm for generating the true SRES value may be modified to generate a plurality of pseudo SRES values according to the modified algorithm. For example, each time the value of the algorithm is modified, a pseudo SRES value may be generated. In addition, a plurality of numerical values different from the true SRES value may be randomly generated as a plurality of pseudo SRES values.
  • the method further includes: a forbidding unit, configured to, after identifying the base station as a pseudo base station, prohibiting the terminal from being registered in a communication network corresponding to the base station.
  • the terminal if the base station is identified as a pseudo base station, the terminal is prohibited from registering in the corresponding communication network, and the information such as the IMSI of the terminal is prevented from being intercepted by the base station, thereby avoiding the related information of the terminal. The information was leaked, thus ensuring the security of the terminal data. Moreover, the terminal is also prevented from receiving the fraud information sent by the pseudo base station, thereby avoiding property damage to the user.
  • the method further includes: a reminding unit, configured to send reminder information after identifying that the base station is a pseudo base station.
  • the base station when the base station is identified as a pseudo base station, by sending a reminder message, for example, a pop-up notification bar is displayed to connect the pseudo base station, and the user is not allowed to believe the received information to prevent being deceived, thereby improving user vigilance and ensuring The user's property is safe.
  • a reminder message for example, a pop-up notification bar is displayed to connect the pseudo base station, and the user is not allowed to believe the received information to prevent being deceived, thereby improving user vigilance and ensuring The user's property is safe.
  • a third aspect of the present invention provides a terminal, the terminal comprising a processor and a memory, wherein the memory stores a set of program codes, and the processor is configured to call a program code stored in the memory, Do the following:
  • the base station is identified as a pseudo base station.
  • the processor further performs:
  • the terminal is registered in the network corresponding to the base station.
  • the processor when the processor generates multiple pseudo SRES values according to the random number sent by the server corresponding to the base station and the authentication key of the terminal, the processor specifically executes:
  • the plurality of pseudo SRES values are generated using the second algorithm and based on the random number and the authentication key.
  • the processor further performs:
  • the terminal After identifying that the base station is a pseudo base station, the terminal is prohibited from registering in a communication network corresponding to the base station.
  • the processor further performs:
  • an alert message is sent.
  • the pseudo base station can be accurately identified.
  • FIG. 1 is a flow chart showing a pseudo base station identification method according to an embodiment of the present invention
  • FIG. 2 is a block diagram showing the structure of a pseudo base station identifying apparatus according to an embodiment of the present invention
  • FIG. 3 is a block diagram showing the structure of a pseudo base station identifying apparatus according to another embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • FIG. 1 is a flow chart showing a pseudo base station identification method according to an embodiment of the present invention.
  • a pseudo base station identification method includes:
  • Step 102 After selecting the base station to be connected, generate a plurality of pseudo SRES values according to the random number sent by the server corresponding to the base station and the authentication key of the terminal;
  • Step 104 Send the plurality of pseudo SRES values to the server, for the server to authenticate each pseudo SRES value of the plurality of pseudo SRES values;
  • Step 106 If receiving a response of the server that successfully authenticates each of the pseudo SRES values, identifying the base station as a pseudo base station.
  • the base station in the process of authenticating the base station, since only the legitimate base station is facing the true SRES The value of (Signed Response) can be authenticated. Therefore, if the base station authenticates multiple pseudo SRES values, the base station is a pseudo base station, so that the base station can be accurately identified. After the base station to be connected is selected, if the function of identifying the pseudo base station is turned on, a plurality of pseudo SRES values are generated according to the random number sent by the server corresponding to the base station and the authentication key of the terminal. The user can determine whether to enable the function of identifying the pseudo base station according to his actual needs.
  • the method further includes: generating a true SRES value according to the random number and the authentication key; and failing to authenticate each of the pseudo SRES values if receiving the server And responding, sending the true SRES value to the server, and registering the terminal to the network corresponding to the base station when receiving the server successfully authenticating the true SRES value.
  • the step of generating a plurality of pseudo SRES values according to the random number sent by the server corresponding to the base station and the authentication key of the terminal specifically: generating The parameters of the first algorithm of the SRES value are modified to form a second algorithm; the second algorithm is employed and the plurality of pseudo SRES values are generated based on the random number and the authentication key.
  • the parameters of the algorithm for generating the true SRES value may be modified to generate a plurality of pseudo SRES values according to the modified algorithm. For example, each time the value of the algorithm is modified, a pseudo SRES value may be generated. In addition, a plurality of numerical values different from the true SRES value may be randomly generated as a plurality of pseudo SRES values.
  • the method further includes: after identifying that the base station is a pseudo base station, prohibiting the terminal from being registered in a communication network corresponding to the base station.
  • the terminal is prohibited from being registered in the corresponding communication network, and the information such as the IMSI of the terminal is prevented from being intercepted by the base station, thereby preventing the related information of the terminal from being leaked, thereby ensuring The security of the terminal data. Moreover, the terminal is also prevented from receiving the fraud information sent by the pseudo base station, thereby avoiding property damage to the user.
  • the method further includes: after identifying that the base station is a pseudo base station, sending reminding information.
  • the base station when the base station is identified as a pseudo base station, by sending a reminder message, for example, a pop-up notification bar is displayed to connect the pseudo base station, and the user is not allowed to believe the received information to prevent being deceived, thereby improving user vigilance and ensuring The user's property is safe.
  • a reminder message for example, a pop-up notification bar is displayed to connect the pseudo base station, and the user is not allowed to believe the received information to prevent being deceived, thereby improving user vigilance and ensuring The user's property is safe.
  • FIG. 2 is a block diagram showing the structure of a pseudo base station identifying apparatus according to an embodiment of the present invention.
  • a pseudo base station identification apparatus 200 includes: a first generation unit 202, a transmission unit 204, and an identification unit 206, wherein the first generation unit 202 is configured to select a to-be-connected After the base station, the plurality of pseudo SRES values are generated according to the random number sent by the server corresponding to the base station and the authentication key of the terminal, and the sending unit 204 is configured to send the multiple pseudo SRES values to the server.
  • the identifying unit 206 is configured to successfully authenticate each of the pseudo SRES values if the server is received In response, the base station is identified as a pseudo base station.
  • the base station in the process of authenticating the base station, since only the legitimate base station can authenticate the true SRES (Signed Response) value, if the base station authenticates the multiple pseudo SRES values, It is indicated that the base station is a pseudo base station, so that the base station is accurately identified.
  • the base station to be connected is selected, if the function of identifying the pseudo base station is turned on, a plurality of pseudo SRES values are generated according to the random number sent by the server corresponding to the base station and the authentication key of the terminal. The user can determine whether to enable the function of identifying the pseudo base station according to his actual needs.
  • the method further includes: a second generating unit 208, configured to generate a true SRES value according to the random number and the authentication key; and a processing unit 210, configured to receive the The server sends a response to the failure of each of the pseudo SRES values to the server, and sends the true SRES value to the server, and after receiving the server successfully authenticating the true SRES value,
  • the terminal is registered in the network corresponding to the base station.
  • the first generating unit 202 includes: a modifying subunit 2022, configured to modify a parameter of a first algorithm used to generate a true SRES value to form a second algorithm; generate Subunit 2024, configured to generate the plurality of pseudo SRES values based on the random number and the authentication key by using the second algorithm.
  • the parameters of the algorithm for generating the true SRES value may be modified to generate a plurality of pseudo SRES values according to the modified algorithm. For example, each time the value of the algorithm is modified, a pseudo SRES value may be generated. In addition, a plurality of numerical values different from the true SRES value may be randomly generated as a plurality of pseudo SRES values.
  • the method further includes: a prohibiting unit 212, configured to, after identifying the base station as a pseudo base station, prohibiting the terminal from being registered in a communication network corresponding to the base station.
  • the terminal is prohibited from being registered in the corresponding communication network, and the information such as the IMSI of the terminal is prevented from being intercepted by the base station, thereby preventing the related information of the terminal from being leaked, thereby ensuring The security of the terminal data. Moreover, the terminal is also prevented from receiving the fraud information sent by the pseudo base station, thereby avoiding property damage to the user.
  • the method further includes: a reminding unit 214, configured to send reminder information after identifying that the base station is a pseudo base station.
  • the base station when the base station is identified as a pseudo base station, by sending a reminder message, for example, a pop-up notification bar is displayed to connect the pseudo base station, and the user is not allowed to believe the received information to prevent being deceived, thereby improving user vigilance and ensuring The user's property is safe.
  • a reminder message for example, a pop-up notification bar is displayed to connect the pseudo base station, and the user is not allowed to believe the received information to prevent being deceived, thereby improving user vigilance and ensuring The user's property is safe.
  • FIG. 3 is a block diagram showing the structure of a pseudo base station identifying apparatus according to another embodiment of the present invention.
  • a pseudo base station identification apparatus 300 includes a data module 302, a processing module 304, and a display module 306.
  • the data module 302 is configured to store the IMSI number, the KI (Key Identifier) value of the terminal, the random number sent by the server, the calculated true SRES value, and multiple pseudo SRES values, and the foregoing information is stored. Used as a data source for terminal authentication.
  • the IMSI number and the KI value are basic information of a subscriber SIM (Subscriber Identity Module) card, and the random number is used to calculate a true SRES value and a plurality of pseudo SRES values.
  • the processing module 304 is configured to process the random number sent by the server and send it to the SIM card, and the SIM card calculates the true SRES value according to the random number and the KI value, and saves the data in the data module 302. Calculate multiple pseudo SRES values.
  • the true SRES value is: 8600250920146
  • the multiple pseudo SRES values are: 8600250920147, 8600250920148, 8600250920149.
  • multiple pseudo SRES values are sent to the server for authentication. If the server authenticates multiple pseudo SRES values, the response from the server that authenticates multiple pseudo SRES values is received.
  • the display module 306 is configured to: when the processing result of the processing module 304 is that the response to the multiple pseudo SRES values is received, a dialog box for popping up is displayed to remind the user that the currently selected base station is a pseudo base station, and pay attention to the individual.
  • the leakage of information and the information received may be fraudulent information, pay attention to anti-fraud.
  • FIG. 4 shows a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • the terminal 400 includes the pseudo base station identification apparatus 200 according to any one of the above aspects, and therefore, the terminal 400 has any one of the above technical solutions.
  • the same technical effects of the pseudo base station identification device 200 are not described herein.
  • FIG. 5 is a schematic block diagram of a terminal according to an embodiment of the present invention.
  • the terminal 7 may include: at least one processor 71, such as a CPU, at least one communication bus 72 and a memory 73; and the communication bus 72.
  • the connection communication between these components is implemented;
  • the memory 73 may be a high speed RAM memory or a non-volatile memory such as at least one disk memory.
  • a set of program codes is stored in the memory 73, and the processor 71 is configured to call the program code stored in the memory 73 for performing the following operations:
  • the base station is identified as a pseudo base station.
  • the processor 71 further performs:
  • the terminal is registered in the network corresponding to the base station.
  • the processor 71 when the processor 71 generates a plurality of pseudo SRES values according to the random number sent by the server corresponding to the base station and the authentication key of the terminal, the processor 71 performs:
  • the plurality of pseudo SRES values are generated using the second algorithm and based on the random number and the authentication key.
  • the processor 71 further performs:
  • the terminal After identifying that the base station is a pseudo base station, the terminal is prohibited from registering in a communication network corresponding to the base station.
  • the processor 71 further performs:
  • an alert message is sent.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明提出了一种伪基站识别方法、伪基站识别装置和终端，其中，所述伪基站识别方法包括：在选择待连接的基站之后，根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值；将所述多个伪SRES数值发送至所述服务器，以供所述服务器对所述多个伪SRES数值中的每个伪SRES数值进行鉴权；若接收到所述服务器的对所述每个伪SRES数值均鉴权成功的响应，则识别所述基站为伪基站。通过本发明的技术方案，可以准确地识别出伪基站。

Description

伪基站识别方法、伪基站识别装置和终端
本申请要求于2016年3月28日提交中国专利局，申请号为201610184478.3、发明名称为“伪基站识别方法、伪基站识别装置和终端”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及终端技术领域，具体而言，涉及一种伪基站识别方法、一种伪基站识别装置和一种终端。
背景技术
目前，终端根据基站发射的导频信号强度，选择信号强的进行连接。在现有技术的根据基站发射信号强弱连接的方案中，当伪基站发射强信号时，容易造成终端选择伪基站进行连接，而断开之前连接的合法基站。
而终端与伪基站进行鉴权过程中，容易造成终端的IMSI(International Mobile Subscriber Identification Number，国际移动用户识别码)被伪基站截取，同时伪基站会向终端发送相应的诈骗短信，导致用户相信诈骗短信给用户造成一定的损失。
因此，如何准确地识别出伪基站成为亟待解决的问题。
发明内容
本发明正是基于上述问题，提出了一种新的技术方案，可以准确地识别出伪基站。
有鉴于此，本发明的第一方面提出了一种伪基站识别方法，包括：在选择待连接的基站之后，根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值；将所述多个伪SRES数值发送至所述服务器，以供所述服务器对所述多个伪SRES数值中的每个伪SRES数值进行鉴权；若接收到所述服务器的对所述每个伪SRES数值均鉴权成功的响应，则识别所述基站为伪基站。
在该技术方案中，在对基站鉴权的过程中，由于只有合法的基站对真SRES (Signed Response，签署响应)数值才能鉴权通过，因此，若基站对多个伪SRES数值鉴权通过，说明该基站为伪基站，从而准确地对基站进行识别。
在上述技术方案中，优选地，还包括：根据所述随机数和所述鉴权密钥，生成真SRES数值；以及若接收到所述服务器的对所述每个伪SRES数值均鉴权失败的响应，则将所述真SRES数值发送至所述服务器，并在接收到所述服务器对所述真SRES数值鉴权成功时，将所述终端注册到所述基站对应的网络中。
在该技术方案中，若对每个伪SRES数值均鉴权失败，且对真SRES数值鉴权成功，说明该基站为合法的基站，则将终端注册到基站对应的网络中，以保证终端的正常使用。
在上述任一技术方案中，优选地，所述根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值的步骤，具体包括：对用于生成真SRES数值的第一算法的参数进行修改，以形成第二算法；采用所述第二算法并基于所述随机数和所述鉴权密钥，生成所述多个伪SRES数值。
在该技术方案中，可以对生成真SRES数值的算法的参数进行修改，以根据修改后的算法生成多个伪SRES数值，例如，每修改一次该算法的数值，就可以生成一伪SRES数值。另外，还可以随机生成与真SRES数值不同的多个数值作为多个伪SRES数值。
在上述任一技术方案中，优选地，还包括：在识别所述基站为伪基站之后，禁止所述终端注册到所述基站对应的通信网络中。
在该技术方案中，若识别出基站为伪基站，则禁止该终端注册到对应的通信网络中，避免了终端的IMSI等信息被基站截取，从而避免了终端的相关信息遭到泄露，从而保证了终端数据的安全性。而且，也避免终端接收到伪基站发来的诈骗信息，从而避免给用户造成财产损失。
在上述任一技术方案中，优选地，还包括：在识别所述基站为伪基站之后，发出提醒信息。
在该技术方案中，在识别出基站为伪基站时，通过发出提醒信息，例如，弹出通知栏显示连接上伪基站，请用户不要相信接收到的信息以防被骗，从而提高用户警惕，保证用户的财产安全。
本发明的第二方面提出了一种伪基站识别装置，包括：第一生成单元，用于在选择待连接的基站之后，根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值；发送单元，用于将所述多个伪SRES数值发送至所述服务器，以供所述服务器对所述多个伪SRES数值中的每个伪SRES数值进行鉴权；识别单元，用于若接收到所述服务器的对所述每个伪SRES数值均鉴权成功的响应，则识别所述基站为伪基站。
在该技术方案中，在对基站鉴权的过程中，由于只有合法的基站对真SRES(Signed Response，签署响应)数值才能鉴权通过，因此，若基站对多个伪SRES数值鉴权通过，说明该基站为伪基站，从而准确地对基站进行识别。
在上述技术方案中，优选地，还包括：第二生成单元，用于根据所述随机数和所述鉴权密钥，生成真SRES数值；以及处理单元，用于若接收到所述服务器的对所述每个伪SRES数值均鉴权失败的响应，则将所述真SRES数值发送至所述服务器，并在接收到所述服务器对所述真SRES数值鉴权成功时，将所述终端注册到所述基站对应的网络中。
在该技术方案中，若对每个伪SRES数值均鉴权失败，且对真SRES数值鉴权成功，说明该基站为合法的基站，则将终端注册到基站对应的网络中，以保证终端的正常使用。
在上述任一技术方案中，优选地，所述第一生成单元包括：修改子单元，用于对用于生成真SRES数值的第一算法的参数进行修改，以形成第二算法；生成子单元，用于采用所述第二算法并基于所述随机数和所述鉴权密钥，生成所述多个伪SRES数值。
在该技术方案中，可以对生成真SRES数值的算法的参数进行修改，以根据修改后的算法生成多个伪SRES数值，例如，每修改一次该算法的数值，就可以生成一伪SRES数值。另外，还可以随机生成与真SRES数值不同的多个数值作为多个伪SRES数值。
在上述任一技术方案中，优选地，还包括：禁止单元，用于在识别所述基站为伪基站之后，禁止所述终端注册到所述基站对应的通信网络中。
在该技术方案中，若识别出基站为伪基站，则禁止该终端注册到对应的通信网络中，避免了终端的IMSI等信息被基站截取，从而避免了终端的相关信 息遭到泄露，从而保证了终端数据的安全性。而且，也避免终端接收到伪基站发来的诈骗信息，从而避免给用户造成财产损失。
在上述任一技术方案中，优选地，还包括：提醒单元，用于在识别所述基站为伪基站之后，发出提醒信息。
在该技术方案中，在识别出基站为伪基站时，通过发出提醒信息，例如，弹出通知栏显示连接上伪基站，请用户不要相信接收到的信息以防被骗，从而提高用户警惕，保证用户的财产安全。
本发明的第三方面提出了一种终端，所述终端包括处理器和存储器，其中，所述存储器中存储一组程序代码，且所述处理器用于调用所述存储器中存储的程序代码，用于执行以下操作：
在选择待连接的基站之后，根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值；
将所述多个伪SRES数值发送至所述服务器，以供所述服务器对所述多个伪SRES数值中的每个伪SRES数值进行鉴权；
若接收到所述服务器的对所述每个伪SRES数值均鉴权成功的响应，则识别所述基站为伪基站。
优选地，所述处理器还执行：
根据所述随机数和所述鉴权密钥，生成真SRES数值；以及
若接收到所述服务器的对所述每个伪SRES数值均鉴权失败的响应，则将所述真SRES数值发送至所述服务器，并在接收到所述服务器对所述真SRES数值鉴权成功时，将所述终端注册到所述基站对应的网络中。
优选地，所述处理器根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值时，具体执行：
对用于生成真SRES数值的第一算法的参数进行修改，以形成第二算法；
采用所述第二算法并基于所述随机数和所述鉴权密钥，生成所述多个伪SRES数值。
优选地，所述处理器还执行：
在识别所述基站为伪基站之后，禁止所述终端注册到所述基站对应的通信网络中。
优选地，所述处理器还执行：
在识别所述基站为伪基站之后，发出提醒信息。
通过本发明的技术方案，可以准确地识别出伪基站。
附图说明
图1示出了根据本发明的一个实施例的伪基站识别方法的流程示意图；
图2示出了根据本发明的一个实施例的伪基站识别装置的结构示意图；
图3示出了根据本发明的另一个实施例的伪基站识别装置的结构示意图；
图4示出了根据本发明的一个实施例的终端的结构示意图；
图5为本发明实施例提供的一种终端的结构示意图。
具体实施方式
为了可以更清楚地理解本发明的上述目的、特征和优点，下面结合附图和具体实施方式对本发明进行进一步的详细描述。需要说明的是，在不冲突的情况下，本申请的实施例及实施例中的特征可以相互组合。
在下面的描述中阐述了很多具体细节以便于充分理解本发明，但是，本发明还可以采用其他不同于在此描述的其他方式来实施，因此，本发明的保护范围并不受下面公开的具体实施例的限制。
图1示出了根据本发明的一个实施例的伪基站识别方法的流程示意图。
如图1所示，根据本发明的一个实施例的伪基站识别方法，包括：
步骤102，在选择待连接的基站之后，根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值；
步骤104，将所述多个伪SRES数值发送至所述服务器，以供所述服务器对所述多个伪SRES数值中的每个伪SRES数值进行鉴权；
步骤106，若接收到所述服务器的对所述每个伪SRES数值均鉴权成功的响应，则识别所述基站为伪基站。
在该技术方案中，在对基站鉴权的过程中，由于只有合法的基站对真SRES (Signed Response，签署响应)数值才能鉴权通过，因此，若基站对多个伪SRES数值鉴权通过，说明该基站为伪基站，从而准确地对基站进行识别。其中，在选择待连接的基站之后，若开启识别伪基站的功能，则根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值。用户可以根据自己的实际需求来确定是否开启识别伪基站的功能。
在上述技术方案中，优选地，还包括：根据所述随机数和所述鉴权密钥，生成真SRES数值；以及若接收到所述服务器的对所述每个伪SRES数值均鉴权失败的响应，则将所述真SRES数值发送至所述服务器，并在接收到所述服务器对所述真SRES数值鉴权成功时，将所述终端注册到所述基站对应的网络中。
在该技术方案中，若对每个伪SRES数值均鉴权失败，且对真SRES数值鉴权成功，说明该基站为合法的基站，则将终端注册到基站对应的网络中，以保证终端的正常使用。
在上述任一技术方案中，优选地，所述根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值的步骤，具体包括：对用于生成真SRES数值的第一算法的参数进行修改，以形成第二算法；采用所述第二算法并基于所述随机数和所述鉴权密钥，生成所述多个伪SRES数值。
在该技术方案中，可以对生成真SRES数值的算法的参数进行修改，以根据修改后的算法生成多个伪SRES数值，例如，每修改一次该算法的数值，就可以生成一伪SRES数值。另外，还可以随机生成与真SRES数值不同的多个数值作为多个伪SRES数值。
在上述任一技术方案中，优选地，还包括：在识别所述基站为伪基站之后，禁止所述终端注册到所述基站对应的通信网络中。
在该技术方案中，若识别出基站为伪基站，则禁止该终端注册到对应的通信网络中，避免了终端的IMSI等信息被基站截取，从而避免了终端的相关信息遭到泄露，从而保证了终端数据的安全性。而且，也避免终端接收到伪基站发来的诈骗信息，从而避免给用户造成财产损失。
在上述任一技术方案中，优选地，还包括：在识别所述基站为伪基站之后，发出提醒信息。
在该技术方案中，在识别出基站为伪基站时，通过发出提醒信息，例如，弹出通知栏显示连接上伪基站，请用户不要相信接收到的信息以防被骗，从而提高用户警惕，保证用户的财产安全。
图2示出了根据本发明的一个实施例的伪基站识别装置的结构示意图。
如图2所示，根据本发明的一个实施例的伪基站识别装置200，包括：第一生成单元202、发送单元204和识别单元206，其中，第一生成单元202用于在选择待连接的基站之后，根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值；发送单元204，用于将所述多个伪SRES数值发送至所述服务器，以供所述服务器对所述多个伪SRES数值中的每个伪SRES数值进行鉴权；识别单元206，用于若接收到所述服务器的对所述每个伪SRES数值均鉴权成功的响应，则识别所述基站为伪基站。
在该技术方案中，在对基站鉴权的过程中，由于只有合法的基站对真SRES(Signed Response，签署响应)数值才能鉴权通过，因此，若基站对多个伪SRES数值鉴权通过，说明该基站为伪基站，从而准确地对基站进行识别。其中，在选择待连接的基站之后，若开启识别伪基站的功能，则根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值。用户可以根据自己的实际需求来确定是否开启识别伪基站的功能。
在上述技术方案中，优选地，还包括：第二生成单元208，用于根据所述随机数和所述鉴权密钥，生成真SRES数值；以及处理单元210，用于若接收到所述服务器的对所述每个伪SRES数值均鉴权失败的响应，则将所述真SRES数值发送至所述服务器，并在接收到所述服务器对所述真SRES数值鉴权成功时，将所述终端注册到所述基站对应的网络中。
在该技术方案中，若对每个伪SRES数值均鉴权失败，且对真SRES数值鉴权成功，说明该基站为合法的基站，则将终端注册到基站对应的网络中，以保证终端的正常使用。
在上述任一技术方案中，优选地，所述第一生成单元202包括：修改子单元2022，用于对用于生成真SRES数值的第一算法的参数进行修改，以形成第二算法；生成子单元2024，用于采用所述第二算法并基于所述随机数和所述鉴权密钥，生成所述多个伪SRES数值。
在该技术方案中，可以对生成真SRES数值的算法的参数进行修改，以根据修改后的算法生成多个伪SRES数值，例如，每修改一次该算法的数值，就可以生成一伪SRES数值。另外，还可以随机生成与真SRES数值不同的多个数值作为多个伪SRES数值。
在上述任一技术方案中，优选地，还包括：禁止单元212，用于在识别所述基站为伪基站之后，禁止所述终端注册到所述基站对应的通信网络中。
在该技术方案中，若识别出基站为伪基站，则禁止该终端注册到对应的通信网络中，避免了终端的IMSI等信息被基站截取，从而避免了终端的相关信息遭到泄露，从而保证了终端数据的安全性。而且，也避免终端接收到伪基站发来的诈骗信息，从而避免给用户造成财产损失。
在上述任一技术方案中，优选地，还包括：提醒单元214，用于在识别所述基站为伪基站之后，发出提醒信息。
在该技术方案中，在识别出基站为伪基站时，通过发出提醒信息，例如，弹出通知栏显示连接上伪基站，请用户不要相信接收到的信息以防被骗，从而提高用户警惕，保证用户的财产安全。
图3示出了根据本发明的另一个实施例的伪基站识别装置的结构示意图。
如图3所示，根据本发明的另一个实施例的伪基站识别装置300，包括：数据模块302、处理模块304和显示模块306。
1、数据模块302，用来存储终端的IMSI号、KI(Key Identifier，鉴权密钥)值、服务器下发的随机数、计算出来的真SRES值以及多个伪SRES值，存储上述信息是用于作为终端鉴权的数据源。其中，IMSI号、KI值为终端SIM(Subscriber Identity Module，用户识别模块)卡的基本信息，随机数用于计算真SRES值以及多个伪SRES值。
2、处理模块304，用于处理服务器下发的随机数，并将其发送给SIM卡，SIM卡根据该随机数和KI值来进行计算真SRES值，将其保存在数据模块302中，再计算多个伪SRES值。例如，真SRES值为：8600250920146、多个伪SRES值为：8600250920147、8600250920148、8600250920149。然后将多个伪SRES值发送给服务器进行鉴权，若服务器对多个伪SRES值都鉴权通过，则接收到来自服务器的对多个伪SRES值都鉴权通过的响应。
3、显示模块306，用于在处理模块304的处理结果为接收到对多个伪SRES值都鉴权通过的响应时，弹出提醒的对话框，提醒用户当前选择的基站为伪基站，注意个人信息的泄漏及接收的信息可能为欺诈信息，注意防骗。
图4示出了根据本发明的一个实施例的终端的结构示意图。
如图4所示，根据本发明的一个实施例的终端400，包括上述技术方案中任一项所述的伪基站识别装置200，因此，该终端400具有和上述技术方案中任一项所述的伪基站识别装置200相同的技术效果，在此不再赘述。
图5为本发明实施例提供的一种终端的示意框图，如图5所示，该终端7可以包括：至少一个处理器71，例如CPU，至少一个通信总线72以及存储器73；通信总线72用于实现这些组件之间的连接通信；存储器73可以是高速RAM存储器，也可以是非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。存储器73中存储一组程序代码，且处理器71用于调用存储器73中存储的程序代码，用于执行以下操作：
在选择待连接的基站之后，根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值；
将所述多个伪SRES数值发送至所述服务器，以供所述服务器对所述多个伪SRES数值中的每个伪SRES数值进行鉴权；
若接收到所述服务器的对所述每个伪SRES数值均鉴权成功的响应，则识别所述基站为伪基站。
优选地，所述处理器71还执行：
根据所述随机数和所述鉴权密钥，生成真SRES数值；以及
若接收到所述服务器的对所述每个伪SRES数值均鉴权失败的响应，则将所述真SRES数值发送至所述服务器，并在接收到所述服务器对所述真SRES数值鉴权成功时，将所述终端注册到所述基站对应的网络中。
优选地，所述处理器71根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值时，具体执行：
对用于生成真SRES数值的第一算法的参数进行修改，以形成第二算法；
采用所述第二算法并基于所述随机数和所述鉴权密钥，生成所述多个伪SRES数值。
优选地，所述处理器71还执行：
在识别所述基站为伪基站之后，禁止所述终端注册到所述基站对应的通信网络中。
优选地，所述处理器71还执行：
在识别所述基站为伪基站之后，发出提醒信息。
以上结合附图详细说明了本发明的技术方案，通过本发明的技术方案，可以准确地识别出伪基站。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (15)

  1. 一种伪基站识别方法，其特征在于，包括：
    在选择待连接的基站之后，根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值；
    将所述多个伪SRES数值发送至所述服务器，以供所述服务器对所述多个伪SRES数值中的每个伪SRES数值进行鉴权；
    若接收到所述服务器的对所述每个伪SRES数值均鉴权成功的响应，则识别所述基站为伪基站。
  2. 根据权利要求1所述的伪基站识别方法，其特征在于，还包括：
    根据所述随机数和所述鉴权密钥，生成真SRES数值；以及
    若接收到所述服务器的对所述每个伪SRES数值均鉴权失败的响应，则将所述真SRES数值发送至所述服务器，并在接收到所述服务器对所述真SRES数值鉴权成功时，将所述终端注册到所述基站对应的网络中。
  3. 根据权利要求1所述的伪基站识别方法，其特征在于，所述根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值的步骤，具体包括：
    对用于生成真SRES数值的第一算法的参数进行修改，以形成第二算法；
    采用所述第二算法并基于所述随机数和所述鉴权密钥，生成所述多个伪SRES数值。
  4. 根据权利要求1至3中任一项所述的伪基站识别方法，其特征在于，还包括：
    在识别所述基站为伪基站之后，禁止所述终端注册到所述基站对应的通信网络中。
  5. 根据权利要求1至3中任一项所述的伪基站识别方法，其特征在于，还包括：
    在识别所述基站为伪基站之后，发出提醒信息。
  6. 一种伪基站识别装置，其特征在于，包括：
    第一生成单元，用于在选择待连接的基站之后，根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值；
    发送单元，用于将所述多个伪SRES数值发送至所述服务器，以供所述服务器对所述多个伪SRES数值中的每个伪SRES数值进行鉴权；
    识别单元，用于若接收到所述服务器的对所述每个伪SRES数值均鉴权成功的响应，则识别所述基站为伪基站。
  7. 根据权利要求6所述的伪基站识别装置，其特征在于，还包括：
    第二生成单元，用于根据所述随机数和所述鉴权密钥，生成真SRES数值；以及
    处理单元，用于若接收到所述服务器的对所述每个伪SRES数值均鉴权失败的响应，则将所述真SRES数值发送至所述服务器，并在接收到所述服务器对所述真SRES数值鉴权成功时，将所述终端注册到所述基站对应的网络中。
  8. 根据权利要求6所述的伪基站识别装置，其特征在于，所述第一生成单元包括：
    修改子单元，用于对用于生成真SRES数值的第一算法的参数进行修改，以形成第二算法；
    生成子单元，用于采用所述第二算法并基于所述随机数和所述鉴权密钥，生成所述多个伪SRES数值。
  9. 根据权利要求6至8中任一项所述的伪基站识别装置，其特征在于，还包括：
    禁止单元，用于在识别所述基站为伪基站之后，禁止所述终端注册到所述基站对应的通信网络中。
  10. 根据权利要求6至8中任一项所述的伪基站识别装置，其特征在于，还包括：
    提醒单元，用于在识别所述基站为伪基站之后，发出提醒信息。
  11. 一种终端，其特征在于，所述终端包括处理器和存储器，其中，所述存储器中存储一组程序代码，且所述处理器用于调用所述存储器中存储的程序代码，用于执行以下操作：
    在选择待连接的基站之后，根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值；
    将所述多个伪SRES数值发送至所述服务器，以供所述服务器对所述多个伪SRES数值中的每个伪SRES数值进行鉴权；
    若接收到所述服务器的对所述每个伪SRES数值均鉴权成功的响应，则识别所述基站为伪基站。
  12. 根据权利要求11所述的终端，其特征在于，所述处理器还执行：
    根据所述随机数和所述鉴权密钥，生成真SRES数值；以及
    若接收到所述服务器的对所述每个伪SRES数值均鉴权失败的响应，则将所述真SRES数值发送至所述服务器，并在接收到所述服务器对所述真SRES数值鉴权成功时，将所述终端注册到所述基站对应的网络中。
  13. 根据权利要求11所述的终端，其特征在于，所述处理器根据所述基站对应的服务器下发的随机数和终端的鉴权密钥，生成多个伪SRES数值时，具体执行：
    对用于生成真SRES数值的第一算法的参数进行修改，以形成第二算法；
    采用所述第二算法并基于所述随机数和所述鉴权密钥，生成所述多个伪SRES数值。
  14. 根据权利要求11至13中任一项所述的终端，其特征在于，所述处理器还执行：
    在识别所述基站为伪基站之后，禁止所述终端注册到所述基站对应的通信网络中。
  15. 根据权利要求11至13中任一项所述的终端，其特征在于，所述处理器还执行：
    在识别所述基站为伪基站之后，发出提醒信息。
PCT/CN2016/084067 2016-03-28 2016-05-31 伪基站识别方法、伪基站识别装置和终端 WO2017166419A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610184478.3 2016-03-28
CN201610184478.3A CN105722085A (zh) 2016-03-28 2016-03-28 伪基站识别方法、伪基站识别装置和终端

Publications (1)

Publication Number Publication Date
WO2017166419A1 true WO2017166419A1 (zh) 2017-10-05

Family

ID=56158291

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/084067 WO2017166419A1 (zh) 2016-03-28 2016-05-31 伪基站识别方法、伪基站识别装置和终端

Country Status (2)

Country Link
CN (1) CN105722085A (zh)
WO (1) WO2017166419A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107959935A (zh) * 2017-11-09 2018-04-24 广德宝达精密电路有限公司 一种新型伪基站识别设备
CN110996321A (zh) * 2019-11-12 2020-04-10 江苏恒宝智能系统技术有限公司 一种eSIM卡鉴权的方法
US10771979B2 (en) 2017-01-03 2020-09-08 Alibaba Group Holding Limited Fake base station short message identification

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107241781A (zh) * 2016-03-29 2017-10-10 努比亚技术有限公司 移动终端开机注册网络的方法及装置
WO2018001278A1 (zh) * 2016-06-30 2018-01-04 北京奇虎科技有限公司 基站重定向方法和基站重定向装置
CN106211169A (zh) * 2016-07-28 2016-12-07 努比亚技术有限公司 伪基站识别装置及方法
CN109068330B (zh) * 2018-10-29 2022-01-11 Oppo广东移动通信有限公司 伪基站识别处理方法、设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2002102103A2 (de) * 2001-06-12 2002-12-19 Giesecke & Devrient Gmbh Authentisierungsverfahren
CN103874068A (zh) * 2014-03-20 2014-06-18 工业和信息化部电信研究院 一种识别伪基站的方法和装置
CN105101200A (zh) * 2014-05-23 2015-11-25 中国移动通信集团公司 一种伪基站识别方法、装置及终端设备
CN105407479A (zh) * 2014-09-10 2016-03-16 中国移动通信集团设计院有限公司 一种信息识别方法、信息网关、sim卡及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2002102103A2 (de) * 2001-06-12 2002-12-19 Giesecke & Devrient Gmbh Authentisierungsverfahren
CN103874068A (zh) * 2014-03-20 2014-06-18 工业和信息化部电信研究院 一种识别伪基站的方法和装置
CN105101200A (zh) * 2014-05-23 2015-11-25 中国移动通信集团公司 一种伪基站识别方法、装置及终端设备
CN105407479A (zh) * 2014-09-10 2016-03-16 中国移动通信集团设计院有限公司 一种信息识别方法、信息网关、sim卡及系统

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10771979B2 (en) 2017-01-03 2020-09-08 Alibaba Group Holding Limited Fake base station short message identification
CN107959935A (zh) * 2017-11-09 2018-04-24 广德宝达精密电路有限公司 一种新型伪基站识别设备
CN110996321A (zh) * 2019-11-12 2020-04-10 江苏恒宝智能系统技术有限公司 一种eSIM卡鉴权的方法

Also Published As

Publication number Publication date
CN105722085A (zh) 2016-06-29

Similar Documents

Publication Publication Date Title
WO2017166419A1 (zh) 伪基站识别方法、伪基站识别装置和终端
US11727396B2 (en) Processing electronic tokens
US9756056B2 (en) Apparatus and method for authenticating a user via multiple user devices
CN104765999B (zh) 一种对用户资源信息进行处理的方法、终端及服务器
TW201914256A (zh) 一種身份驗證方法、裝置及電子設備
CN106779716B (zh) 基于区块链账户地址的认证方法、装置及系统
CN109583181B (zh) 一种认证方法、装置及机器可读存储介质
CN104243458B (zh) 一种安全的网络游戏登录方法及系统
CN106559783B (zh) 一种对wifi网络的认证方法、装置和系统
US20150143545A1 (en) Function for the Challenge Derivation for Protecting Components in a Challenge-Response Authentication Protocol
CN104079562B (zh) 一种基于支付终端的安全认证方法及相关装置
CN107733838A (zh) 一种移动终端客户端身份认证方法、装置和系统
US10839362B2 (en) Offline pin authentication method and system for IC card
US20170011393A1 (en) Personal identification and anti-theft system and method using disposable random key
KR20120099782A (ko) 본인 인증 방법, 본인 인증 시스템 및 휴대형 통신단말기
KR101499906B1 (ko) Ｏｔｐ 생성기능을 구비한 스마트카드 및 ｏｔｐ 인증서버
CN107453871B (zh) 口令生成方法、口令验证方法、支付方法及装置
CN105024813B (zh) 一种服务器、用户设备以及用户设备与服务器的交互方法
US20170295017A1 (en) System and method for mobile cross-authentication
CN109587683B (zh) 短信防监听的方法及系统、应用程序和终端信息数据库
US20240106633A1 (en) Account opening methods, systems, and apparatuses
CN110944300B (zh) 短信服务系统、转发接口装置及防御服务器
CN111246464B (zh) 身份鉴别方法、装置和系统、计算机可读存储介质
CN102655454A (zh) 动态令牌交易确认方法及装置
CN108271156B (zh) 一种鉴别伪基站的方法及装置

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16896193

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 16896193

Country of ref document: EP

Kind code of ref document: A1