WO2018045841A1 - 入网认证处理方法及装置 - Google Patents

入网认证处理方法及装置 Download PDF

Info

Publication number
WO2018045841A1
WO2018045841A1 PCT/CN2017/094400 CN2017094400W WO2018045841A1 WO 2018045841 A1 WO2018045841 A1 WO 2018045841A1 CN 2017094400 W CN2017094400 W CN 2017094400W WO 2018045841 A1 WO2018045841 A1 WO 2018045841A1
Authority
WO
WIPO (PCT)
Prior art keywords
user equipment
pmsi
signature token
network
authentication
Prior art date
Application number
PCT/CN2017/094400
Other languages
English (en)
French (fr)
Inventor
游世林
蔡继燕
梁爽
彭锦
林兆骥
赵孝武
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP17848014.1A priority Critical patent/EP3512229B1/en
Priority to EP20199611.3A priority patent/EP3793233A1/en
Priority to US16/332,681 priority patent/US20230048689A1/en
Publication of WO2018045841A1 publication Critical patent/WO2018045841A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H04L63/0414—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/72—Subscriber identity

Definitions

  • the present invention relates to the field of communications, and in particular, to a network authentication processing method and apparatus.
  • the future mobile network will provide access services for more and more IoT terminals.
  • Internet of Things access brings new challenges and opportunities to mobile networks. Different types of Internet of Things have different needs for the network. Some require the network to provide high real-time and high-reliability services, such as telemedicine, while others require regular small data transmission services, such as remote meter reading systems.
  • mobile networks may need to be properly optimized to meet business needs. More and more Internet of Things puts more and more different optimization requirements on mobile networks. Some of the optimization requirements may be contradictory. Therefore, a converged core network is increasingly unable to meet various Internet of Things. demand.
  • FIG. 1 is a schematic diagram of the future 5G network access in the related technology.
  • the user equipment completes initial registration in the service network 1
  • the service network 1 obtains an authentication authentication vector and user subscription data from the home network of the user equipment
  • the service network 1 completes mutual authentication with the user equipment, and then the user
  • the device can attach to the service network 2 and then perform related data services.
  • the service network 1 and the service network 2 include an access network and a core network
  • the home network includes a user data center/authentication authentication center.
  • IMSI International Mobile Subscriber Identification Number
  • PMSI Enhanced Privacy Mobile Subscriber Identifier
  • Kpmsi Mobile Network Code
  • Step S201 the user equipment initiates an attach request message to the service network, where the message carries the PMSI;
  • Step S202 the service network queries the corresponding home network according to the MCC and the MNC of the PMSI, and sends an authentication authentication request message to the home network, where the message carries the PMSI;
  • PMSI_next MCC
  • index number, K1), wherein the K1 home network encrypts the encryption key K1 of the PMSI_next, K1 key generation function (Kpmsi, RAND), Where RAND is a random number in the authentication vector;
  • step S205 the service network sends a user authentication request message to the user equipment, where the message carries the authentication token AUTN in the authentication vector, which is used for authenticating the network of the user equipment, and the message also carries the random number RAND and the encrypted PMSI_next;
  • index number, K2), where K2 key a function (Kpmsi, signature authentication K), wherein the signature authentication K is also stored in the user equipment and the home network, and the user equipment sends a PMSI confirmation message to the service network, the message carrying ACKTN;
  • Step S207 the serving network forwards a PMSI acknowledgment message to the home network, where the message carries an ACKTN;
  • the embodiment of the invention provides a network authentication processing method and device, so as to solve at least the problem that the home network is processed when the signature authentication fails in the network access process of the related technology.
  • a network authentication processing method including: receiving an acknowledgment message sent by a user equipment, where the acknowledgment message carries the user equipment generated according to the first initial enhanced privacy mobile identifier PMSI.
  • the first signature token is used to verify whether the first signature token is legal. If the verification result is no, the acquiring PMSI performs network access authentication processing on the user equipment.
  • the obtaining, by the PMSI, the network access authentication process on the user equipment includes: sending a first signature token authentication failure message to the user equipment, and notifying the user equipment to re-initiate an attach request;
  • the attach request re-acquires the first PMSI, and performs network access authentication processing on the user equipment.
  • acquiring the PMSI to perform the network access authentication process on the user equipment includes: generating a second PSMI according to the first PSMI, and sending the location to the user equipment Determining a second PSMI according to the feedback of the user equipment, acquiring a second signature token generated by the user equipment according to the second PSMI; re-authenticating the user by verifying the validity of the second signature token
  • the device performs network access authentication.
  • performing network access authentication processing on the user equipment includes: verifying whether the second signature token is legal; if the verification result is negative And sending, by the user equipment and the service network, a second signature token authentication failure message, to notify the user equipment that the device is not legal; if the verification result is yes, replacing the first PMSI pair with the second PMSI
  • the user equipment performs an attach process.
  • the method before receiving the acknowledgement message sent by the user equipment, the method further includes: receiving an attach request sent by the user equipment, where the attach request carries a first PMSI, the first PMSI And including the user data center identifier; generating, by the user data center corresponding to the user data center, an encrypted first PMSI; and sending the encrypted first PMSI to the user equipment, where the encrypted first PMSI is used to generate the The first signature token is described.
  • the method before receiving the confirmation message sent by the user equipment, the method further includes: acquiring the PMSI by hashing the international mobile subscriber identity IMSI by using a hash function.
  • the receiving the confirmation message sent by the user equipment includes: receiving a location update request sent by the service network, where the location update request carries the first signature forwarded by the user equipment to the service network Token.
  • an access authentication processing apparatus including: a first receiving module, configured to receive an acknowledgment message sent by a user equipment, where the acknowledgment message carries the user equipment according to the first
  • the initial enhanced privacy mobile identity identifies a first signature token generated by the PMSI
  • the verification module is configured to verify whether the first signature token is legal
  • the obtaining module is configured to acquire the PMSI to the user if the verification result is negative
  • the device performs network access authentication.
  • the acquiring module is further configured to send a first signature token authentication failure message to the user equipment, to notify the user equipment to re-initiate an attach request; and root Acquiring the first PMSI according to the attach request, performing network access authentication processing on the user equipment.
  • the acquiring module is further configured to generate a second PSMI according to the first PSMI, and send the second PSMI to the user equipment; and obtain the And performing, by the user equipment, the second signature token generated by the second PSMI; and performing the network access authentication process on the user equipment by verifying the validity of the second signature token.
  • the acquiring module is further configured to verify whether the second signature token is legal; if the verification result is no, send the second signature token authentication to the user equipment and the service network. a failure message notifying that the user equipment is illegal; and in the case that the verification result is yes, replacing the first PMSI with the second PMSI to perform attachment processing on the user equipment.
  • the method further includes: a second receiving module, configured to receive an attach request sent by the user equipment, where the attach request carries a first PMSI, where the first PMSI includes a user data center identifier; a module, configured to generate an encrypted first PMSI by using a user data center corresponding to the user data center identifier, and a sending module, configured to send the encrypted first PMSI to the user equipment, where the encrypting the first PMSI is Generating the first signature token.
  • a second receiving module configured to receive an attach request sent by the user equipment, where the attach request carries a first PMSI, where the first PMSI includes a user data center identifier
  • a module configured to generate an encrypted first PMSI by using a user data center corresponding to the user data center identifier
  • a sending module configured to send the encrypted first PMSI to the user equipment, where the encrypting the first PMSI is Generating the first signature token.
  • the method further includes: a second acquiring module, configured to acquire the PMSI by hashing the international mobile subscriber identity IMSI by using a hash function.
  • the first receiving module is further configured to receive a location update request sent by the service network, where the location update request carries the first signature command that is forwarded by the user equipment to the service network. brand.
  • a storage medium is further provided.
  • the storage medium is configured to store program code for performing the following steps: receiving an acknowledgment message sent by the user equipment, wherein the acknowledgment message carries a first signature command generated by the user equipment according to the first initial enhanced privacy mobile identity PMSI Card; verifying whether the first signature token is legal; If the verification result is no, the acquiring PMSI performs network access authentication processing on the user equipment.
  • the storage medium is further configured to store program code for performing the following steps: acquiring the PMSI to perform the network access authentication process on the user equipment, including: sending the first signature token authentication failure to the user equipment And the message is sent to the user equipment to re-initiate the attach request; the first PMSI is re-acquired according to the attach request, and the user equipment is subjected to the network access authentication process.
  • the storage medium is further configured to store program code for performing the following steps: acquiring the PMSI to perform network access authentication processing on the user equipment, including: generating a second PSMI according to the first PSMI, and The user equipment sends the second PSMI; according to the feedback of the user equipment, acquiring a second signature token generated by the user equipment according to the second PSMI; and verifying the legality of the second signature token And re-authenticating the user equipment into the network.
  • the storage medium is further configured to store program code for performing the following steps: re-authenticating the user equipment by the verification of the validity of the second signature token includes: verifying the Whether the second signature token is legal or not; if the verification result is no, the second signature token authentication failure message is sent to the user equipment and the service network, to notify the user equipment that the device is not legal; And performing, by using the second PMSI, the first PMSI to perform an attach process on the user equipment.
  • the storage medium is further configured to store the program code for performing the following steps: before receiving the confirmation message sent by the user equipment, the method further includes: receiving an attach request sent by the user equipment, where The first PMSI includes a user data center identifier, and the user data center corresponding to the user data center identifier generates an encrypted first PMSI; and the encrypted first PMSI is sent to the User equipment, wherein the encrypted first PMSI is used to generate the first signature token.
  • the storage medium is further configured to store program code for performing the following steps: before receiving the confirmation message sent by the user equipment, further comprising: hashing the international mobile subscriber identity IMSI by using a hash function , obtaining the PMSI.
  • the storage medium is further configured to store program code for performing the following steps: receiving the confirmation message sent by the user equipment comprises: receiving a location update request sent by the service network, where the location update request carries Decoding the first signature token forwarded by the user equipment to the service network
  • the acknowledgment message sent by the user equipment is received by the user equipment, where the acknowledgment message carries the first signature token generated by the user equipment according to the first initial enhanced privacy mobile identifier PMSI; whether the first signature token is valid; If the result is no, the PMSI is obtained to perform network access authentication processing on the user equipment. If the authentication of the first signature token is invalid, that is, the signature authentication fails, the PMSI obtains the network access authentication process for the user equipment. Therefore, when the network authentication process of the related technology fails, the signature authentication failure is not described. How the home network handles the problem.
  • FIG. 2 is a schematic diagram of a flow of an international mobile subscriber identity IMSI for user equipment access service network protection user privacy in the related art
  • FIG. 3 is a block diagram showing the hardware structure of a computer terminal of a network authentication processing method according to an embodiment of the present invention
  • FIG. 4 is a flowchart of a method for processing an incoming network authentication according to an embodiment of the present invention
  • FIG. 5 is a schematic flowchart of a process for protecting a user privacy international mobile subscriber identity code and a process for processing a signature authentication failure according to an embodiment of the present invention
  • FIG. 6 is a schematic diagram of a process for protecting a user privacy international mobile subscriber identity signature verification failure according to an embodiment of the present invention
  • FIG. 7 is a structural block diagram of a network access authentication processing apparatus according to an embodiment of the present invention.
  • FIG. 8 is a block diagram showing a preferred structure of an incoming network authentication processing apparatus according to an embodiment of the present invention.
  • FIG. 9 is a block diagram showing a preferred structure of an incoming network authentication processing apparatus according to an embodiment of the present invention.
  • FIG. 3 is a hardware block diagram of a computer terminal of a network authentication processing method according to an embodiment of the present invention.
  • computer terminal 30 may include one or more (only one shown) processor 302 (processor 302 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA)
  • processor 302 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA)
  • a memory 304 for storing data
  • a transmission device 306 for communication functions.
  • computer terminal 30 may also include more or fewer components than shown in FIG. 3, or have a different configuration than that shown in FIG.
  • the memory 304 can be used to store software programs and modules of the application software, such as the program instructions/modules corresponding to the network authentication processing method in the embodiment of the present invention, and the processor 302 executes each of the software programs and modules stored in the memory 304.
  • a functional application and data processing, that is, the above method is implemented.
  • Memory 304 can include high speed random access memory and can also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 304 can further include memory remotely located relative to processor 302, which can be connected to computer terminal 30 over a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, and a mobile communication network. And their combinations.
  • Transmission device 306 is arranged to receive or transmit data via a network.
  • the above-described network specific example may include a wireless network provided by a communication provider of the mobile terminal 30.
  • transmission device 306 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet.
  • NIC Network Interface Controller
  • the transmission device 306 can be a Radio Frequency (RF) module for communicating with the Internet wirelessly.
  • RF Radio Frequency
  • FIG. 4 is a flowchart of a network authentication processing method according to an embodiment of the present invention. As shown in FIG. 4, the process includes the following steps:
  • Step S402 receiving an acknowledgment message sent by the user equipment, where the acknowledgment message carries a first signature token generated by the user equipment according to the first initial enhanced privacy mobile identity PMSI;
  • Step S404 verifying whether the first signature token is legal
  • Step S406 If the verification result is no, the acquiring PMSI performs network access authentication processing on the user equipment.
  • the PMSI is obtained to perform the network access authentication process on the user equipment. Therefore, the network access process of the related technology cannot be explained. How to deal with the home network when signature authentication fails.
  • the obtaining the PMSI to perform the network access authentication process on the user equipment includes: sending a first signature token authentication failure message to the user equipment, notifying the user equipment to re-initiate the attach request; and re-acquiring the first PMSI according to the attach request, to the user
  • the device performs network access authentication. For example, after the home network authentication signature token ACKTN fails, the ACKTN authentication fails to be sent to the user equipment through the service network, and the user equipment uses the original PMSI to perform the re-attachment process.
  • the obtaining the PMSI to perform the network access authentication process on the user equipment includes: generating the second PSMI according to the first PSMI, and sending the second PSMI to the user equipment; and acquiring, according to the feedback of the user equipment, the acquiring, by the user equipment, the second PSMI.
  • Second signature token pass the test The validity of the second signature token is verified, and the user equipment is re-authenticated.
  • performing network access authentication processing on the user equipment includes: verifying whether the second signature token is legal; and if the verification result is no, the user equipment and The service network sends a second signature token authentication failure message to notify the user that the device is illegal. If the verification result is yes, the second PMSI is used to replace the first PMSI to perform the attachment processing on the user equipment.
  • a PMSI_next_new is generated, the PMSI_next_new is sent to the user equipment for re-signature authentication to obtain ACKTN_new, the home network authentication ACKTN_new is successful, the PMSI is set to PMSI_next_new, and the user equipment is also set to PMSI_next_new.
  • the home network sends an ACKTN re-authentication failure to the user equipment and the service network.
  • the service network and the home network will consider the user equipment as an illegal user, and will reject the attach request sent by the user equipment again.
  • the user equipment considers that the home network is illegal and does not initiate. Attach request message.
  • the method before receiving the acknowledgment message sent by the user equipment, the method further includes: receiving an attach request sent by the user equipment, where the attach request carries the first PMSI, the first PMSI includes the user data center identifier, and the user data center And identifying the corresponding user data center to generate an encrypted first PMSI; and sending the encrypted first PMSI to the user equipment, where the first PMSI is encrypted for generating the first signature token.
  • the method before receiving the confirmation message sent by the user equipment, the method further includes: acquiring the PMSI by hashing the international mobile subscriber identity IMSI by using a hash function. Through the above steps, the PMSI is lost when the home network fails, so that the home network can work normally.
  • the receiving the confirmation message sent by the user equipment includes: receiving a location update request sent by the service network, where the location update request carries the first signature forwarded by the user equipment to the service network Token.
  • the user device authenticates the message from the user.
  • the PMSI_next is obtained, and the PMSI_next is signed to obtain the signature token ACKTN, and the user authentication response message is sent back to the service network.
  • the message carries the signature token ACKTN
  • the service network sends a location update request to the home network, and the message carries the signature authentication token ACKTN.
  • the network authentication ACKTN is legal, confirms the validity of the PMSI_next, and completes the attach request message to the user equipment through the service network.
  • the user equipment determines the validity of the PMSI_next and replaces the original PMSI with the PMSI_next.
  • FIG. 5 is a schematic flowchart of a process for protecting a user's privacy international mobile subscriber identity code and a process for processing a signature authentication failure according to an embodiment of the present invention. As shown in FIG. 5, the process includes the following steps:
  • 8-10 user identifiers (letters and letters) Number), where 8-10 bits of user identification intercept function (hash function (IMSI, Kpmsi), intercept length), where the intercept length is 8-10;
  • Step S504 the user equipment sends an initial attach request message to the service network 1, the message carries the PMSI;
  • Step S506 the service network queries the corresponding home network according to the MCC and the MNC of the PMSI, and queries the user data center corresponding to the home network according to the user data center identifier, and sends an authentication authentication request message to the home network user data center.
  • the message carries a PMSI;
  • index number, K1), where the K1 home network encrypts the PMSI_next Encryption key K1, K1 key generation function (Kpmsi, RAND), where RAND is a random number in the authentication vector;
  • step S512 the service network sends a user authentication request message to the user equipment, where the message carries the authentication token AUTN in the authentication vector, and is used for authenticating the network of the user equipment, the message also carrying the random number RAND and the encrypted PMSI_next;
  • index number, K2), where K2 key generation function (Kpmsi, signature authentication K), wherein the signature authentication K is also stored in the user equipment and the home network, and the user equipment sends a user authentication success response message to the service network, the message carrying ACKTN and XRES;
  • Step S516 the service network compares the received XRES with the XRES in the security vector. If they are equal, the authentication user equipment succeeds, and the request message is updated to the home network location, and the message carries the ACKTN;
  • Step S520 the home network sends a location update response message to the service network, where the message carries user subscription data and PMSI_next;
  • Step S522 the service network saves the user subscription data and the PMSI_next, and sends an attach response success message to the user equipment.
  • the above is a process in which the user equipment uses the PMSI to successfully attach, and the following is a process in which the home network signature authentication ACKTN fails;
  • Step S518a the home network authentication ACKTN fails
  • Step S520a the home network sends a location update failure response message to the service network, where the message carries an ACKTN authentication failure cause value;
  • Step S522 the service network sends an attach failure response message to the user equipment, where the message carries an ACKTN authentication failure cause value;
  • IMSI, Kpmsi user identifier
  • Step S526a The serving network queries the corresponding home network according to the MCC and the MNC of the original PMSI, and queries the user data center corresponding to the home network according to the user data center identifier, and sends an authentication authentication request message to the home network user data center.
  • the message carries the original PMSI, the original tag;
  • FIG. 6 is a schematic diagram of a process for protecting a user privacy international mobile subscriber identity signature verification failure according to an embodiment of the present invention. As shown in FIG. 6, the process includes the following steps:
  • Step S602 performing an attaching process according to step S502 to step S516;
  • Step S604 the home network signature authentication ACKTN fails
  • index number, K1), where the K1 home network encrypts the encryption key K1 of the PMSI_next_new, K1 key generation function (Kpmsi, RAND), where RAND is a random number in the authentication vector;
  • Step S610 the service network sends a PMSI user re-authentication request to the user equipment, where the message carries the encrypted PMSI_next_new;
  • index number, K2), where K2 key generation function ( Kpmsi, signature authentication K), wherein the signature authentication K is also stored in the user equipment and the home network, and the user equipment sends a PMSI user re-authentication response message to the service network, the message carrying ACKTN_new;
  • Step S614 the service network sends a PMSI re-authentication request response message to the home network, where the message carries ACKTN_new;
  • Step S616 the home network uses the same calculation method of the user equipment to verify the validity of the ACKTN signature token.
  • Step S620 the home network sends a location update response message to the service network, where the message carries the user subscription data and PMSI_next_new;
  • Step S622 the service network saves the user subscription data and PMSI_next_new, and sets the user to the user.
  • the backup response response success message is sent back;
  • Step S616a the home network authentication ACKTN_new fails
  • Step S618a the home network sends a location update failure response message to the service network, where the message carries an ACKTN re-authentication failure cause value;
  • step S620 the service network sends an attach failure response message to the user equipment, where the message carries the ACKTN re-authentication failure cause value, and the user equipment determines that the home network is an illegal network, no longer re-registers, and the service network and the home network determine that the user equipment is illegal.
  • the user rejects all non-emergency business requests.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium (such as ROM/RAM, magnetic).
  • the disc, the optical disc includes a number of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.
  • an in-network authentication processing device is also provided, which is used to implement the foregoing embodiments and preferred embodiments, and has not been described again.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 7 is a structural block diagram of a network access authentication processing apparatus according to an embodiment of the present invention, as shown in FIG. 7 Show that the device includes:
  • the first receiving module 72 is configured to receive an acknowledgment message sent by the user equipment, where the acknowledgment message carries the first signature token generated by the user equipment according to the first initial enhanced privacy mobile identifier PMSI;
  • the verification module 74 is connected to the first receiving module 72, and is configured to verify whether the first signature token is legal;
  • the first obtaining module 76 is connected to the foregoing verification module 74, and is configured to acquire the PMSI to perform network access authentication processing on the user equipment if the verification result is negative.
  • the first acquiring module is further configured to send a first signature token authentication failure message to the user equipment, to notify the user equipment to re-initiate the attach request, and re-acquire the first PMSI according to the attach request, and perform the user equipment on the user equipment.
  • Network access authentication is further configured to send a first signature token authentication failure message to the user equipment, to notify the user equipment to re-initiate the attach request, and re-acquire the first PMSI according to the attach request, and perform the user equipment on the user equipment.
  • the first acquiring module is further configured to: generate a second PSMI according to the first PSMI, and send a second PSMI to the user equipment; and acquire, according to the feedback of the user equipment, the second generated by the user equipment according to the second PSMI.
  • the signature token is used; and the user device is re-authenticated by verifying the validity of the second signature token.
  • the first acquiring module is further configured to verify whether the second signature token is legal; if the verification result is no, the second signature token authentication failure message is sent to the user equipment and the service network, and the notification is sent. The user equipment is not legal; and if the verification result is yes, the second PMSI is used to replace the first PMSI to perform attachment processing on the user equipment.
  • FIG. 8 is a block diagram of a preferred structure of an incoming network authentication processing apparatus according to an embodiment of the present invention. As shown in FIG. 8, the apparatus includes, in addition to all the modules shown in FIG.
  • the second receiving module 82 is configured to receive an attach request sent by the user equipment, where the attach request carries the first PMSI, and the first PMSI includes the user data center identifier;
  • the generating module 84 is connected to the second receiving module 82, and configured to generate an encrypted first PMSI by using a user data center corresponding to the user data center identifier;
  • the sending module 86 is connected to the generating module 84, and is configured to send the encrypted first PMSI. And sending to the user equipment, wherein the first PMSI is encrypted for generating the first signature token.
  • FIG. 9 is a block diagram of a preferred structure of an access authentication processing apparatus according to an embodiment of the present invention. As shown in FIG. 9, the apparatus includes: in addition to all the modules shown in FIG. 7 and FIG.
  • the second obtaining module 92 is configured to acquire the PMSI by hashing the international mobile subscriber identity IMSI using a hash function.
  • the first receiving module is further configured to receive a location update request sent by the service network, where the location update request carries the first signature command that is forwarded by the user equipment to the service network. brand.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination.
  • the forms are located in different processors.
  • Embodiments of the present invention also provide a storage medium.
  • the above storage medium may be configured to store program code for performing the following steps:
  • the acknowledgment message sent by the user equipment is received, where the acknowledgment message carries the first signature token generated by the user equipment according to the first initial enhanced privacy mobile identifier PMSI.
  • the storage medium is further configured to store program code for performing the following steps: obtaining the PMSI to perform network access authentication processing on the user equipment includes:
  • S2 Re-acquire the first PMSI according to the attach request, and perform network access authentication processing on the user equipment.
  • the storage medium is further arranged to store a process for performing the following steps Sequence code: Obtaining the PMSI to perform network access authentication on the user equipment includes:
  • S3 Performing network access authentication processing on the user equipment by verifying the validity of the second signature token.
  • the storage medium is further configured to store program code for performing the following steps: by verifying the validity of the second signature token, re-authenticating the user equipment into the network includes:
  • the second PMSI is used to replace the first PMSI to perform attachment processing on the user equipment.
  • the storage medium is further configured to store program code for performing the following steps: before receiving the confirmation message sent by the user equipment, the method further includes:
  • the storage medium is further configured to store program code for performing the following steps: before receiving the confirmation message sent by the user equipment, the method further includes:
  • the PMSI is obtained by hashing the international mobile subscriber identity IMSI using a hash function.
  • the storage medium is further arranged to store a process for performing the following steps Sequence code:
  • Sequence code The confirmation message sent by the receiving user equipment includes:
  • the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • a mobile hard disk e.g., a hard disk
  • magnetic memory e.g., a hard disk
  • the processor performs: receiving, according to the stored program code in the storage medium, an acknowledgement message sent by the user equipment, where the acknowledgement message carries the user equipment generated according to the first initial enhanced privacy mobile identifier PMSI.
  • the first signature token is used to verify whether the first signature token is legal. If the verification result is negative, the PMSI is obtained to perform network access authentication processing on the user equipment.
  • the processor performs, according to the stored program code in the storage medium, that the acquiring the PMSI to perform the network access authentication process on the user equipment includes: sending a first signature token authentication failure message to the user equipment, notifying the user equipment Re-initiating the attach request; re-acquiring the first PMSI according to the attach request, and performing network access authentication processing on the user equipment.
  • the processor performs, according to the stored program code in the storage medium, the obtaining the PMSI to perform the network access authentication process on the user equipment, including: generating the second PSMI according to the first PSMI, and sending the second PSMI to the user equipment.
  • the PSMI is obtained according to the feedback of the user equipment, and the second signature token generated by the user equipment according to the second PSMI is obtained; and the user equipment is re-authenticated by the verification of the validity of the second signature token.
  • the processor performs, according to the stored program code in the storage medium: by verifying the validity of the second signature token, re-authenticating the user equipment into the network includes: verifying the second signature token. If the verification result is no, the second signature token authentication failure message is sent to the user equipment and the service network to notify the user that the device is illegal; if the verification result is yes, the second PMSI is used to replace the first one. The PMSI attaches the user equipment.
  • the processor performs, according to the stored program code in the storage medium, before receiving the confirmation message sent by the user equipment, the method further includes: receiving an attach request sent by the user equipment, where the attach request carries the first a PMSI, the first PMSI includes a user data center identifier; the encrypted first PMSI is generated by the user data center corresponding to the user data center identifier; and the encrypted first PMSI is sent to the user equipment, where the first PMSI is encrypted for generating the first signature. Token.
  • the processor performs, according to the stored program code in the storage medium, before receiving the confirmation message sent by the user equipment, further comprising: hashing the international mobile subscriber identity IMSI by using a hash function. Way, get PMSI.
  • the processor is executed according to the stored program code in the storage medium: receiving the confirmation message sent by the user equipment, comprising: receiving a location update request sent by the service network, where the location update request carries the user equipment The first signature token forwarded to the service network.
  • modules or steps of the embodiments of the present invention can be implemented by a general computing device, which can be concentrated on a single computing device or distributed in multiple computing devices.
  • they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different
  • the steps shown or described herein are performed sequentially, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps are fabricated into a single integrated circuit module.
  • embodiments of the invention are not limited to any specific combination of hardware and software.
  • the PMSI obtains the network access authentication process for the user equipment.
  • the problem that the home network can be handled when the signature authentication fails is not described in the network access process of the related technology.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明实施例提供了一种入网认证处理方法及装置，该方法包括：接收用户设备发送的确认消息，其中，确认消息携带有用户设备根据第一初始增强隐私移动标识PMSI生成的第一签名令牌；验证第一签名令牌是否合法；在验证结果为否的情况下，获取PMSI对用户设备进行入网认证处理。通过本发明实施例，可以解决相关技术的入网流程中没有说明签名认证失败时归属网络如何处理的问题。

Description

入网认证处理方法及装置 技术领域
本发明涉及通信领域，具体而言，涉及一种入网认证处理方法及装置。
背景技术
移动通信在二十多年时间里得到了飞速发展，给人们的生活方式、工作方式以及社会政治、经济等各方面都带来了巨大的影响。人类社会进入高效的信息化时代，各个方面业务应用需求呈现爆发式增长，给未来无线移动带宽系统在频率、技术以及运营等各方面都带来了巨大的挑战。
未来的移动网络除了为人人通信提供服务外，还将为越来越多的物联网终端提供接入服务。物联网接入给移动网络带来了新的挑战和机遇。不同类型的物联网对网络的需求千差万别，有的要求网络提供高实时高可靠服务，如远程医疗，有的则要求提供有规律的小数据量传输服务，如远程抄表系统。针对不同的业务需求，移动网络可能需要适当优化才能满足业务需求。越来越多的物联网对移动网络提出了越来越多不同的优化需求，其中，有些优化需求还可能相互矛盾，因此，一张融合的核心网越来越无法满足各种不同的物联网需求。
随着网络不断升级改造，5G技术的出现，针对网络的隐私性保护要求越来越高，图1是相关技术中未来5G网络接入的示意图。如图1所示，用户设备在服务网络1完成初始注册，服务网络1从用户设备的归属网络获取鉴权认证向量和用户签约数据，服务网络1完成与用户设备之间的相互认证，然后用户设备可以在服务网络2进行附着，然后进行相关的数据业务。其中服务网络1和服务网络2包括接入网和核心网，归属网络包括用户数据中心/鉴权认证中心。
图2是相关技术中用户设备接入服务网络保护用户隐私国际移动用户识别码(International Mobile Subscriber Identification Number，简称IMSI) 流程示意图，其中用户设备中和归属网络中均保存用户的IMSI，初始的增强隐私移动标识(Privacy enhanced Mobile Subscriber Identifier，简称PMSI)，以及对应的Kpmsi，其中IMSI和PMSI均有相同移动国家码(Mobile Country Code，简称为MCC)和移动网络号(Mobile Network Code，简称为MNC)。
步骤S201，用户设备向服务网络发起附着请求消息，所述消息携带PMSI；
步骤S202，服务网络根据PMSI的MCC和MNC查询到对应的归属网络，向归属网络发送鉴权认证请求消息，所述消息携带PMSI；
步骤S203，归属网络根据PMSI找到对应的IMSI，生成对应的安全向量，然后生成下次附着的PMSI_next，其中PMSI_next＝MCC|MNC|截取函数(散列函数(Kpmsi，PMSI)，n)，其中Kpmsi为散列密钥，n为截取长度，由于PMSI_next可能和已有其他用户设备的PMSI相同，因此增加索引号为散列次数，索引号从0开始计数，向服务网络发送鉴权认证响应消息，所述消息携带安全向量，加密的PMSI_next，其中加密PMSI_next＝加密函数(PMSI_next|索引号，K1)，其中K1归属网络加密PMSI_next的加密密钥K1，K1＝密钥生成函数(Kpmsi，RAND)，其中RAND为鉴权向量中的随机数；
步骤S204，归属网络设备设置：PMSI_pre＝PMSI，PMSI＝PMSI_next，pending标识＝1，其中pending标识＝1时表示目前PMSI无效，PMSI_pre有效；
步骤S205，服务网络向用户设备发送用户认证请求消息，所述消息携带鉴权向量中认证令牌AUTN，用于用户设备认证网络的合法性，所述消息还携带随机数RAND以及加密的PMSI_next；
步骤S206，用户设备通过AUTN认证成功后，使用归属网络同样的方法获取K1，解密加密的PMSI_next，并使用K2签名计算PMSI_next，签名令牌ACKTN＝签名函数(PMSI_next|索引号，K2)，其中K2＝密钥 生成函数(Kpmsi，签名认证K)，其中签名认证K也分别保存在用户设备中和归属网络中，用户设备向服务网络发送PMSI确认消息，所述消息携带ACKTN；
步骤S207，服务网络向归属网络转发PMSI确认消息，所述消息携带ACKTN；
步骤S208，用户设备设置：PMSI_pre＝PMSI，PMSI＝PMSI_next，如果用户设备下次需要使用PMSI注册，则使用PMSI进行注册；
步骤S209，归属网络使用用户设备同样计算方式，验证ACKTN签名令牌的合法性，设置：PMSI_pre＝PMSI，PMSI＝PMSI_next，pending标识＝0，其中pending标识＝0表明PMSI合法。
但是，相关技术的入网流程中没有说明ACKTN签名认证失败时归属网络应该怎么处理。
发明内容
本发明实施例提供了一种入网认证处理方法及装置，以至少解决相关技术的入网流程中没有说明签名认证失败时归属网络如何处理的问题。
根据本发明的一个实施例，提供了一种入网认证处理方法，包括：接收用户设备发送的确认消息，其中，所述确认消息携带有所述用户设备根据第一初始增强隐私移动标识PMSI生成的第一签名令牌；验证所述第一签名令牌是否合法；在验证结果为否的情况下，获取PMSI对所述用户设备进行入网认证处理。
在本发明实施例中，获取所述PMSI对所述用户设备进行入网认证处理包括：向所述用户设备发送第一签名令牌认证失败消息，通知所述用户设备重新发起附着请求；根据所述附着请求重新获取所述第一PMSI，对所述用户设备进行入网认证处理。
在本发明实施例中，获取所述PMSI对所述用户设备进行入网认证处理包括：根据所述第一PSMI生成第二PSMI，并向所述用户设备发送所 述第二PSMI；根据所述用户设备的反馈，获取所述用户设备根据所述第二PSMI生成的第二签名令牌；通过验证所述第二签名令牌的合法性，重新对所述用户设备进行入网认证处理。
在本发明实施例中，通过验证所述第二签名令牌的合法性，重新对所述用户设备进行入网认证处理包括：验证所述第二签名令牌是否合法；在验证结果为否的情况下，向所述用户设备和服务网络发送第二签名令牌认证失败消息，通知所述用户设备不合法；在验证结果为是的情况下，使用所述第二PMSI替换所述第一PMSI对所述用户设备进行附着处理。
在本发明实施例中，在接收所述用户设备发送的所述确认消息之前，还包括：接收所述用户设备发送的附着请求，其中，所述附着请求携带第一PMSI，所述第一PMSI包括用户数据中心标识；通过所述用户数据中心标识对应的用户数据中心生成加密第一PMSI；将所述加密第一PMSI发送给所述用户设备，其中，所述加密第一PMSI用于生成所述第一签名令牌。
在本发明实施例中，在接收用户设备发送的确认消息之前，还包括：通过使用散列函数散列国际移动用户识别码IMSI的方式，获取所述PMSI。
在本发明实施例中，接收用户设备发送的确认消息包括：接收服务网络发送的位置更新请求，其中，所述位置更新请求携带有所述用户设备转发给所述服务网络的所述第一签名令牌。
根据本发明的另一个实施例，提供了一种入网认证处理装置，包括：第一接收模块，设置为接收用户设备发送的确认消息，其中，所述确认消息携带有所述用户设备根据第一初始增强隐私移动标识PMSI生成的第一签名令牌；验证模块，设置为验证所述第一签名令牌是否合法；获取模块，设置为在验证结果为否的情况下，获取PMSI对所述用户设备进行入网认证处理。
在本发明实施例中，所述获取模块，还设置为向所述用户设备发送第一签名令牌认证失败消息，通知所述用户设备重新发起附着请求；以及根 据所述附着请求重新获取所述第一PMSI，对所述用户设备进行入网认证处理。
在本发明实施例中，所述获取模块，还设置为根据所述第一PSMI生成第二PSMI，并向所述用户设备发送所述第二PSMI；根据所述用户设备的反馈，获取所述用户设备根据所述第二PSMI生成的第二签名令牌；以及通过验证所述第二签名令牌的合法性，重新对所述用户设备进行入网认证处理。
在本发明实施例中，所述获取模块，还设置为验证所述第二签名令牌是否合法；在验证结果为否的情况下，向所述用户设备和服务网络发送第二签名令牌认证失败消息，通知所述用户设备不合法；以及在验证结果为是的情况下，使用所述第二PMSI替换所述第一PMSI对所述用户设备进行附着处理。
在本发明实施例中，还包括：第二接收模块，设置为接收所述用户设备发送的附着请求，其中，所述附着请求携带第一PMSI，所述第一PMSI包括用户数据中心标识；生成模块，设置为通过所述用户数据中心标识对应的用户数据中心生成加密第一PMSI；发送模块，设置为将所述加密第一PMSI发送给所述用户设备，其中，所述加密第一PMSI用于生成所述第一签名令牌。
在本发明实施例中，还包括：第二获取模块，设置为通过使用散列函数散列国际移动用户识别码IMSI的方式，获取所述PMSI。
在本发明实施例中，第一接收模块，还设置为接收服务网络发送的位置更新请求，其中，所述位置更新请求携带有所述用户设备转发给所述服务网络的所述第一签名令牌。
根据本发明实施例的又一个实施例，还提供了一种存储介质。该存储介质设置为存储用于执行以下步骤的程序代码：接收用户设备发送的确认消息，其中，所述确认消息携带有所述用户设备根据第一初始增强隐私移动标识PMSI生成的第一签名令牌；验证所述第一签名令牌是否合法；在 验证结果为否的情况下，获取PMSI对所述用户设备进行入网认证处理。
在本发明实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：获取所述PMSI对所述用户设备进行入网认证处理包括：向所述用户设备发送第一签名令牌认证失败消息，通知所述用户设备重新发起附着请求；根据所述附着请求重新获取所述第一PMSI，对所述用户设备进行入网认证处理。
在本发明实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：获取所述PMSI对所述用户设备进行入网认证处理包括：根据所述第一PSMI生成第二PSMI，并向所述用户设备发送所述第二PSMI；根据所述用户设备的反馈，获取所述用户设备根据所述第二PSMI生成的第二签名令牌；通过验证所述第二签名令牌的合法性，重新对所述用户设备进行入网认证处理。
在本发明实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：通过验证所述第二签名令牌的合法性，重新对所述用户设备进行入网认证处理包括：验证所述第二签名令牌是否合法；在验证结果为否的情况下，向所述用户设备和服务网络发送第二签名令牌认证失败消息，通知所述用户设备不合法；在验证结果为是的情况下，使用所述第二PMSI替换所述第一PMSI对所述用户设备进行附着处理。
在本发明实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：在接收所述用户设备发送的所述确认消息之前，还包括：接收所述用户设备发送的附着请求，其中，所述附着请求携带第一PMSI，所述第一PMSI包括用户数据中心标识；通过所述用户数据中心标识对应的用户数据中心生成加密第一PMSI；将所述加密第一PMSI发送给所述用户设备，其中，所述加密第一PMSI用于生成所述第一签名令牌。
在本发明实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：在接收用户设备发送的确认消息之前，还包括：通过使用散列函数散列国际移动用户识别码IMSI的方式，获取所述PMSI。
在本发明实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：接收用户设备发送的确认消息包括：接收服务网络发送的位置更新请求，其中，所述位置更新请求携带有所述用户设备转发给所述服务网络的所述第一签名令牌
通过本发明实施例，接收用户设备发送的确认消息，其中，确认消息携带有用户设备根据第一初始增强隐私移动标识PMSI生成的第一签名令牌；验证第一签名令牌是否合法；在验证结果为否的情况下，获取PMSI对用户设备进行入网认证处理。由于在验证第一签名令牌不合法的情况下，也即，签名认证失败的情况下，获取PMSI对用户设备进行入网认证处理，因此，可以解决相关技术的入网流程中没有说明签名认证失败时归属网络如何处理的问题。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是相关技术中未来5G网络接入的示意图；
图2是相关技术中用户设备接入服务网络保护用户隐私国际移动用户识别码IMSI流程示意图；
图3是本发明实施例的一种入网认证处理方法的计算机终端的硬件结构框图；
图4是根据本发明实施例的入网认证处理方法的流程图；
图5是根据本发明实施例的保护用户隐私国际移动用户识别码流程示意图和签名认证失败处理流程示意图；
图6是根据本发明实施例的保护用户隐私国际移动用户识别码签名认证失败处理流程示意图；
图7是根据本发明实施例的入网认证处理装置的结构框图；
图8是根据本发明实施例的入网认证处理装置的优选结构框图；
图9是根据本发明实施例的入网认证处理装置的优选结构框图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明实施例。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
实施例1
本申请实施例1所提供的方法实施例可以在计算机终端或者类似的运算装置中执行。以运行在计算机终端上为例，图3是本发明实施例的一种入网认证处理方法的计算机终端的硬件结构框图。如图3所示，计算机终端30可以包括一个或多个(图中仅示出一个)处理器302(处理器302可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)、用于存储数据的存储器304、以及用于通信功能的传输装置306。本领域普通技术人员可以理解，图3所示的结构仅为示意，其并不对上述电子装置的结构造成限定。例如，计算机终端30还可包括比图3中所示更多或者更少的组件，或者具有与图3所示不同的配置。
存储器304可用于存储应用软件的软件程序以及模块，如本发明实施例中的入网认证处理方法对应的程序指令/模块，处理器302通过运行存储在存储器304内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的方法。存储器304可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器304可进一步包括相对于处理器302远程设置的存储器，这些远程存储器可以通过网络连接至计算机终端30。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网 及其组合。
传输装置306设置为经由一个网络接收或者发送数据。上述的网络具体实例可包括移动终端30的通信供应商提供的无线网络。在一个实例中，传输装置306包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置306可以为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网进行通讯。
在本实施例中提供了一种运行于上述计算机终端的入网认证处理方法，图4是根据本发明实施例的入网认证处理方法的流程图，如图4所示，该流程包括如下步骤：
步骤S402，接收用户设备发送的确认消息，其中，确认消息携带有用户设备根据第一初始增强隐私移动标识PMSI生成的第一签名令牌；
步骤S404，验证第一签名令牌是否合法；
步骤S406，在验证结果为否的情况下，获取PMSI对用户设备进行入网认证处理。
通过上述步骤，由于在验证第一签名令牌不合法的情况下，也即，签名认证失败的情况下，获取PMSI对用户设备进行入网认证处理，因此，可以解决相关技术的入网流程中没有说明签名认证失败时归属网络如何处理的问题。
在本发明实施例中，获取PMSI对用户设备进行入网认证处理包括：向用户设备发送第一签名令牌认证失败消息，通知用户设备重新发起附着请求；根据附着请求重新获取第一PMSI，对用户设备进行入网认证处理。例如，归属网络认证签名令牌ACKTN失败后，通过服务网络向用户设备发送ACKTN认证失败，用户设备使用原始PMSI进行再附着流程。
在本发明实施例中，获取PMSI对用户设备进行入网认证处理包括：根据第一PSMI生成第二PSMI，并向用户设备发送第二PSMI；根据用户设备的反馈，获取用户设备根据第二PSMI生成的第二签名令牌；通过验 证第二签名令牌的合法性，重新对用户设备进行入网认证处理。
在本发明实施例中，通过验证第二签名令牌的合法性，重新对用户设备进行入网认证处理包括：验证第二签名令牌是否合法；在验证结果为否的情况下，向用户设备和服务网络发送第二签名令牌认证失败消息，通知用户设备不合法；在验证结果为是的情况下，使用第二PMSI替换第一PMSI对用户设备进行附着处理。
例如，归属网络认证签名令牌ACKTN失败后，产生一个PMSI_next_new，将PMSI_next_new发送用户设备给进行再签名认证得到ACKTN_new，归属网络认证ACKTN_new成功，设置PMSI为PMSI_next_new，用户设备也设置PMSI为PMSI_next_new。如果认证失败，归属网络向用户设备和服务网络发送ACKTN再认证失败，服务网络和归属网络将认为用户设备为非法用户，将拒绝用户设备再次发送的附着请求，用户设备认为归属网络非法，不在发起附着请求消息。
在本发明实施例中，在接收用户设备发送的确认消息之前，还包括：接收用户设备发送的附着请求，其中，附着请求携带第一PMSI，第一PMSI包括用户数据中心标识；通过用户数据中心标识对应的用户数据中心生成加密第一PMSI；将加密第一PMSI发送给用户设备，其中，加密第一PMSI用于生成第一签名令牌。通过上述步骤，可以根据用户数据中心标识找到对应的用户数据中，可以解决归属网络存在多个用户数据中心时，在PMSI标识附着时，不能找到对应的用户数据中心的问题。
在本发明实施例中，在接收用户设备发送的确认消息之前，还包括：通过使用散列函数散列国际移动用户识别码IMSI的方式，获取PMSI。通过上述步骤，避免归属网络发生故障时PMSI丢失，使得归属网络可以正常工作的。
在本发明实施例中，接收用户设备发送的确认消息包括：接收服务网络发送的位置更新请求，其中，所述位置更新请求携带有所述用户设备转发给所述服务网络的所述第一签名令牌。例如，用户设备从用户认证消息 中得到PMSI_next，对PMSI_next进行签名运算得到签名令牌ACKTN，向服务网络回送用户认证响应消息，消息携带签名令牌ACKTN，服务网络向归属网络发送位置更新请求，消息携带签名认证令牌ACKTN，归属网络认证ACKTN合法，确认PMSI_next的合法性，通过服务网络向用户设备完成附着请求消息，用户设备确定PMSI_next的合法性，使用PMSI_next替换原来的PMSI。通过上述步骤，使得在无法接收到携带第一签名令牌的确认消息时，仍然能接收到第一签名令牌，保证用户设备和归属网络的PMSI不同步。
为了方便理解上述实施例，下面进行详细说明。
图5是根据本发明实施例的保护用户隐私国际移动用户识别码流程示意图和签名认证失败处理流程示意图，如图5所示，该流程包括如下步骤：
步骤S502，用户设备和归属网络保存着：IMSI和原始的PMSI，其中原始PMSI＝MCC|MNC|1-2位用户数据中心标识(至少含有1位字母)|8-10位用户标识(字母和数字)，其中8-10位用户标识＝截取函数(散列函数(IMSI，Kpmsi)，截取长度)，其中截取长度为8-10；
步骤S504，用户设备向服务网络1发送初始的附着请求消息，所述消息携PMSI；
步骤S506，服务网络根据PMSI的MCC和MNC查询到对应的归属网络，以及根据用户数据中心标识查询到对应归属网络的用户数据中心，以及跟向归属网络用户数据中心发送鉴权认证请求消息，所述消息携带PMSI；
步骤S508，归属网络用户数据中心根据PMSI找到对应的IMSI，生成对应的安全向量，然后生成下次附着的PMSI_next，其中PMSI_next＝MCC|MNC|用户数据中心标识|截取函数(散列函数(Kpmsi，PMSI)，n)，其中Kpmsi为散列密钥，n为截取长度，由于PMSI_next可能和已有其他用户设备的PMSI相同，因此增加索引号为散列次数，索引号从0开始计数，设置：PMSI_pre＝PMSI，PMSI＝PMSI_next，pending标 识＝1，其中pending标识＝1时表示目前PMSI无效，PMSI_pre有效；
步骤S510，归属网络数据中心向服务网络发送鉴权认证响应消息，所述消息携带安全向量，加密的PMSI_next，其中加密PMSI_next＝加密函数(PMSI_next|索引号，K1)，其中K1归属网络加密PMSI_next的加密密钥K1，K1＝密钥生成函数(Kpmsi，RAND)，其中RAND为鉴权向量中的随机数；
步骤S512，服务网络向用户设备发送用户认证请求消息，所述消息携带鉴权向量中认证令牌AUTN，用于用户设备认证网络的合法性，所述消息还携带随机数RAND以及加密的PMSI_next；
步骤S514，用户设备通过AUTN认证网络成功后，使用归属网络同样的方法获取K1，解密加密的PMSI_next，并使用K2签名计算PMSI_next，签名令牌ACKTN＝签名函数(PMSI_next|索引号，K2)，其中K2＝密钥生成函数(Kpmsi，签名认证K)，其中签名认证K也分别保存在用户设备中和归属网络中，用户设备向服务网络发送用户认证成功响应消息，所述消息携带ACKTN和XRES；
步骤S516，服务网络将收到的XRES与安全向量中XRES进行比较，如果相等，认证用户设备成功，向归属网络位置更新请求消息，所述消息携带ACKTN；
步骤S518，归属网络使用用户设备同样计算方式，验证ACKTN签名令牌的合法性，设置：PMSI_pre＝PMSI，PMSI＝PMSI_next，pending标识＝0，其中pending标识＝0表明PMSI合法；
步骤S520，归属网络向服务网络回送位置更新响应消息，所述消息携带用户签约数据和PMSI_next；
步骤S522，服务网络保存用户签约数据和PMSI_next，向用户设备回送附着响应成功消息；
步骤S524，用户设备设置：PMSI_pre＝PMSI，PMSI＝PMSI_next，如果用户设备下次需要使用PMSI注册，则使用PMSI进行注册。
以上为用户设备使用PMSI成功附着的流程，以下为归属网络签名认证ACKTN失败的流程；
步骤S518a，归属网络认证ACKTN失败；
步骤S520a，归属网络向服务网络回送位置更新失败响应消息，所述消息携带ACKTN认证失败原因值；
步骤S522a，服务网络向用户设备回送附着失败响应消息，所述消息携带ACKTN认证失败原因值；
步骤S524a，用户设备根据ACKTN认证失败原因值，获取原始PMSI，或者重新计算原始PMSI，原始PMSI＝MCC|MNC|用户数据中心标识|8-10位用户标识|截取函数(散列函数(IMSI，Kpmsi)，截取长度)，向服务网络发起附着消息，所述消息携带原始PMSI，原始标记；
步骤S526a，服务网络根据原始PMSI的MCC和MNC查询到对应的归属网络，以及根据用户数据中心标识查询到对应归属网络的用户数据中心，以及跟向归属网络用户数据中心发送鉴权认证请求消息，所述消息携带原始PMSI，原始标记；
步骤S528a，归属网络用户数据中心根据原始标记和原始PMSI找到对应的IMSI，生成对应的安全向量，重新计算附着的PMSI_next，其中PMSI_next＝MCC|MNC|用户数据中心标识|截取函数(散列函数(Kpmsi，原始PMSI)，n)，其中Kpmsi为散列密钥，n为截取长度，由于PMSI_next可能和已有其他用户设备的PMSI相同，因此增加索引号为散列次数，索引号从0开始计数，设置：PMSI_pre＝原始PMSI，PMSI＝PMSI_next，pending标识＝1，其中pending标识＝1时表示目前PMSI无效，PMSI_pre有效；
步骤S530a，按照步骤S505-步骤S512完成重新附着流程，其中步骤312中的PMSI_pre＝原始PMSI，其他均为相同的描述。
图6是根据本发明实施例的保护用户隐私国际移动用户识别码签名认证失败处理流程示意图，如图6所示，该流程包括如下步骤：
步骤S602，按照步骤S502-步骤S516进行附着流程；
步骤S604，归属网络签名认证ACKTN失败；
步骤S606，产生新的PMSI_next_new＝MCC|MNC|用户数据中心标识|截取函数(散列函数(Kpmsi，PMSI_next)，n)，设置PMSI＝PMSI_next_new，pending标识＝1，其中pending标识＝1时表示目前PMSI无效，PMSI_pre有效；
步骤S608，归属网络向服务网络发送PMSI再认证请求消息，所述消息携带加密的PMSI_next_new，其中加密PMSI_next_new＝加密函数(PMSI_next_new|索引号，K1)，其中K1归属网络加密PMSI_next_new的加密密钥K1，K1＝密钥生成函数(Kpmsi，RAND)，其中RAND为鉴权向量中的随机数；
步骤S610，服务网络向用户设备发送PMSI用户再认证请求，所述消息携带加密PMSI_next_new；
步骤S612，用户设备使用归属网络同样的方法获取K1，解密加密的PMSI_next_new，并使用K2签名计算PMSI_next_new，签名令牌ACKTN_new＝签名函数(PMSI_next_new|索引号，K2)，其中K2＝密钥生成函数(Kpmsi，签名认证K)，其中签名认证K也分别保存在用户设备中和归属网络中，用户设备向服务网络发送PMSI用户再认证响应消息，所述消息携带ACKTN_new；
步骤S614，服务网络向归属网络回送PMSI再认证请求响应消息，所述消息携带ACKTN_new；
步骤S616，归属网络使用用户设备同样计算方式，验证ACKTN签名令牌的合法；
步骤S618，归属网络设置：PMSI＝PMSI_next_new，pending标识＝0，其中pending标识＝0表明PMSI合法；
步骤S620，归属网络向服务网络回送位置更新响应消息，所述消息携带用户签约数据和PMSI_next_new；
步骤S622，服务网络保存用户签约数据和PMSI_next_new，向用户设 备回送附着响应成功消息；
步骤S624，用户设备设置：PMSI_pre＝PMSI，PMSI＝PMSI_next_new，如果用户设备下次需要使用PMSI注册，则使用PMSI进行注册。
以上为ACKTN_new签名认证合法的情况，以下为归属网络签名认证ACKTN_new失败的流程；
步骤S616a，归属网络认证ACKTN_new失败；
步骤S618a，归属网络向服务网络回送位置更新失败响应消息，所述消息携带ACKTN再认证失败原因值；
步骤S620a，服务网络向用户设备回送附着失败响应消息，所述消息携带ACKTN再认证失败原因值，用户设备确定归属网络为非法网络，不再进行重新注册，服务网络和归属网络认定用户设备为非法用户，拒绝非紧急的所有业务请求。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明实施例的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
实施例2
在本实施例中还提供了一种入网认证处理装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图7是根据本发明实施例的入网认证处理装置的结构框图，如图7所 示，该装置包括：
第一接收模块72，设置为接收用户设备发送的确认消息，其中，确认消息携带有用户设备根据第一初始增强隐私移动标识PMSI生成的第一签名令牌；
验证模块74，连接至上述第一接收模块72，设置为验证第一签名令牌是否合法；
第一获取模块76，连接至上述验证模块74，设置为在验证结果为否的情况下，获取PMSI对用户设备进行入网认证处理。
在本发明实施例中，第一获取模块，还设置为向用户设备发送第一签名令牌认证失败消息，通知用户设备重新发起附着请求；以及根据附着请求重新获取第一PMSI，对用户设备进行入网认证处理。
在本发明实施例中，第一获取模块，还设置为根据第一PSMI生成第二PSMI，并向用户设备发送第二PSMI；根据用户设备的反馈，获取用户设备根据第二PSMI生成的第二签名令牌；以及通过验证第二签名令牌的合法性，重新对用户设备进行入网认证处理。
在本发明实施例中，第一获取模块，还设置为验证第二签名令牌是否合法；在验证结果为否的情况下，向用户设备和服务网络发送第二签名令牌认证失败消息，通知用户设备不合法；以及在验证结果为是的情况下，使用第二PMSI替换第一PMSI对用户设备进行附着处理。
图8是根据本发明实施例的入网认证处理装置的优选结构框图，如图8所示，该装置除包括图7所示的所有模块外，还包括：
第二接收模块82，设置为接收用户设备发送的附着请求，其中，附着请求携带第一PMSI，第一PMSI包括用户数据中心标识；
生成模块84，连接至上述第二接收模块82，设置为通过用户数据中心标识对应的用户数据中心生成加密第一PMSI；
发送模块86，连接至上述生成模块84，设置为将加密第一PMSI发 送给用户设备，其中，加密第一PMSI用于生成第一签名令牌。
图9是根据本发明实施例的入网认证处理装置的优选结构框图，如图9所示，该装置除包括图7和图8所示的所有模块外，还包括：
第二获取模块92，设置为通过使用散列函数散列国际移动用户识别码IMSI的方式，获取PMSI。
在本发明实施例中，第一接收模块，还设置为接收服务网络发送的位置更新请求，其中，所述位置更新请求携带有所述用户设备转发给所述服务网络的所述第一签名令牌。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
实施例3
本发明的实施例还提供了一种存储介质。在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S1，接收用户设备发送的确认消息，其中，确认消息携带有用户设备根据第一初始增强隐私移动标识PMSI生成的第一签名令牌；
S2，验证第一签名令牌是否合法；
S3，在验证结果为否的情况下，获取PMSI对用户设备进行入网认证处理。
在本发明实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：获取PMSI对用户设备进行入网认证处理包括：
S1，向用户设备发送第一签名令牌认证失败消息，通知用户设备重新发起附着请求；
S2，根据附着请求重新获取第一PMSI，对用户设备进行入网认证处理。
在本发明实施例中，存储介质还被设置为存储用于执行以下步骤的程 序代码：获取PMSI对用户设备进行入网认证处理包括：
S1，根据第一PSMI生成第二PSMI，并向用户设备发送第二PSMI；
S2，根据用户设备的反馈，获取用户设备根据第二PSMI生成的第二签名令牌；
S3，通过验证第二签名令牌的合法性，重新对用户设备进行入网认证处理。
在本发明实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：通过验证第二签名令牌的合法性，重新对用户设备进行入网认证处理包括：
S1，验证第二签名令牌是否合法；
S2，在验证结果为否的情况下，向用户设备和服务网络发送第二签名令牌认证失败消息，通知用户设备不合法；
S3，在验证结果为是的情况下，使用第二PMSI替换第一PMSI对用户设备进行附着处理。
在本发明实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：在接收用户设备发送的确认消息之前，还包括：
S1，接收用户设备发送的附着请求，其中，附着请求携带第一PMSI，第一PMSI包括用户数据中心标识；
S2，通过用户数据中心标识对应的用户数据中心生成加密第一PMSI；
S3，将加密第一PMSI发送给用户设备，其中，加密第一PMSI用于生成第一签名令牌。
在本发明实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：在接收用户设备发送的确认消息之前，还包括：
S1，通过使用散列函数散列国际移动用户识别码IMSI的方式，获取PMSI。
在本发明实施例中，存储介质还被设置为存储用于执行以下步骤的程 序代码：接收用户设备发送的确认消息包括：
S1，接收服务网络发送的位置更新请求，其中，所述位置更新请求携带有所述用户设备转发给所述服务网络的所述第一签名令牌。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：接收用户设备发送的确认消息，其中，确认消息携带有用户设备根据第一初始增强隐私移动标识PMSI生成的第一签名令牌；验证第一签名令牌是否合法；在验证结果为否的情况下，获取PMSI对用户设备进行入网认证处理。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：获取PMSI对用户设备进行入网认证处理包括：向用户设备发送第一签名令牌认证失败消息，通知用户设备重新发起附着请求；根据附着请求重新获取第一PMSI，对用户设备进行入网认证处理。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：获取PMSI对用户设备进行入网认证处理包括：根据第一PSMI生成第二PSMI，并向用户设备发送第二PSMI；根据用户设备的反馈，获取用户设备根据第二PSMI生成的第二签名令牌；通过验证第二签名令牌的合法性，重新对用户设备进行入网认证处理。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：通过验证第二签名令牌的合法性，重新对用户设备进行入网认证处理包括：验证第二签名令牌是否合法；在验证结果为否的情况下，向用户设备和服务网络发送第二签名令牌认证失败消息，通知用户设备不合法；在验证结果为是的情况下，使用第二PMSI替换第一PMSI对用户设备进行附着处理。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：在接收用户设备发送的确认消息之前，还包括：接收用户设备发送的附着请求，其中，附着请求携带第一PMSI，第一PMSI包括用户数据中心标识；通过用户数据中心标识对应的用户数据中心生成加密第一PMSI；将加密第一PMSI发送给用户设备，其中，加密第一PMSI用于生成第一签名令牌。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：在接收用户设备发送的确认消息之前，还包括：通过使用散列函数散列国际移动用户识别码IMSI的方式，获取PMSI。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：接收用户设备发送的确认消息包括：接收服务网络发送的位置更新请求，其中，位置更新请求携带有用户设备转发给服务网络的第一签名令牌。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本发明实施例的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，在本发明实施例中，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明实施例不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明实施例，对于本领域的技术人员来说，本发明实施例可以有各种更改和变化。凡在本发明实施例的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明实施例的保护范围之内。
工业实用性
在本发明实施例提供的入网认证处理方法过程中，由于在验证第一签名令牌不合法的情况下，也即，签名认证失败的情况下，获取PMSI对用户设备进行入网认证处理，因此，可以解决相关技术的入网流程中没有说明签名认证失败时归属网络如何处理的问题。

Claims (15)

  1. 一种入网认证处理方法，包括：
    接收用户设备发送的确认消息，其中，所述确认消息携带有所述用户设备根据第一初始增强隐私移动标识PMSI生成的第一签名令牌；
    验证所述第一签名令牌是否合法；
    在验证结果为否的情况下，获取PMSI对所述用户设备进行入网认证处理。
  2. 根据权利要求1所述的方法，其中，获取所述PMSI对所述用户设备进行入网认证处理包括：
    向所述用户设备发送第一签名令牌认证失败消息，通知所述用户设备重新发起附着请求；
    根据所述附着请求重新获取所述第一PMSI，对所述用户设备进行入网认证处理。
  3. 根据权利要求1所述的方法，其中，获取所述PMSI对所述用户设备进行入网认证处理包括：
    根据所述第一PSMI生成第二PSMI，并向所述用户设备发送所述第二PSMI；
    根据所述用户设备的反馈，获取所述用户设备根据所述第二PSMI生成的第二签名令牌；
    通过验证所述第二签名令牌的合法性，重新对所述用户设备进行入网认证处理。
  4. 根据权利要求3所述的方法，其中，通过验证所述第二签名令牌的合法性，重新对所述用户设备进行入网认证处理包括：
    验证所述第二签名令牌是否合法；
    在验证结果为否的情况下，向所述用户设备和服务网络发送第二签名令牌认证失败消息，通知所述用户设备不合法；
    在验证结果为是的情况下，使用所述第二PMSI替换所述第一PMSI对所述用户设备进行附着处理。
  5. 根据权利要求1所述的方法，其中，在接收所述用户设备发送的所述确认消息之前，还包括：
    接收所述用户设备发送的附着请求，其中，所述附着请求携带第一PMSI，所述第一PMSI包括用户数据中心标识；
    通过所述用户数据中心标识对应的用户数据中心生成加密第一PMSI；
    将所述加密第一PMSI发送给所述用户设备，其中，所述加密第一PMSI用于生成所述第一签名令牌。
  6. 根据权利要求1所述的方法，其中，在接收用户设备发送的确认消息之前，还包括：
    通过使用散列函数散列国际移动用户识别码IMSI的方式，获取所述PMSI。
  7. 根据权利要求1至6中任一项所述的方法，其中，接收用户设备发送的确认消息包括：
    接收服务网络发送的位置更新请求，其中，所述位置更新请求携带有所述用户设备转发给所述服务网络的所述第一签名令牌。
  8. 一种入网认证处理装置，包括：
    第一接收模块，设置为接收用户设备发送的确认消息，其中，所述确认消息携带有所述用户设备根据第一初始增强隐私移动标识PMSI生成的第一签名令牌；
    验证模块，设置为验证所述第一签名令牌是否合法；
    第一获取模块，设置为在验证结果为否的情况下，获取PMSI对所述用户设备进行入网认证处理。
  9. 根据权利要求8所述的装置，其中，所述第一获取模块，还设置为向所述用户设备发送第一签名令牌认证失败消息，通知所述用户设备重新发起附着请求；以及根据所述附着请求重新获取所述第一PMSI，对所述用户设备进行入网认证处理。
  10. 根据权利要求8所述的装置，其中，所述第一获取模块，还设置为根据所述第一PSMI生成第二PSMI，并向所述用户设备发送所述第二PSMI；根据所述用户设备的反馈，获取所述用户设备根据所述第二PSMI生成的第二签名令牌；以及通过验证所述第二签名令牌的合法性，重新对所述用户设备进行入网认证处理。
  11. 根据权利要求10所述的装置，其中，所述第一获取模块，还设置为验证所述第二签名令牌是否合法；在验证结果为否的情况下，向所述用户设备和服务网络发送第二签名令牌认证失败消息，通知所述用户设备不合法；以及在验证结果为是的情况下，使用所述第二PMSI替换所述第一PMSI对所述用户设备进行附着处理。
  12. 根据权利要求8所述的装置，其中，还包括：
    第二接收模块，设置为接收所述用户设备发送的附着请求，其中，所述附着请求携带第一PMSI，所述第一PMSI包括用户数据中心标识；
    生成模块，设置为通过所述用户数据中心标识对应的用户数据中心生成加密第一PMSI；
    发送模块，设置为将所述加密第一PMSI发送给所述用户设备，其中，所述加密第一PMSI用于生成所述第一签名令牌。
  13. 根据权利要求8所述的装置，其中，还包括：
    第二获取模块，设置为通过使用散列函数散列国际移动用户识别码IMSI的方式，获取所述PMSI。
  14. 根据权利要求8至13中任一项所述的装置，其中，第一接收模块，还设置为接收服务网络发送的位置更新请求，其中，所述位置更新请求携带有所述用户设备转发给所述服务网络的所述第一签名令牌。
  15. 一种存储介质，所述存储介质包括存储的程序，其中，所述程序运行时执行权利要求1至7中任一项所述的方法
PCT/CN2017/094400 2016-09-12 2017-07-25 入网认证处理方法及装置 WO2018045841A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP17848014.1A EP3512229B1 (en) 2016-09-12 2017-07-25 Network access authentication processing method and device
EP20199611.3A EP3793233A1 (en) 2016-09-12 2017-07-25 Network access authentication processing method and device
US16/332,681 US20230048689A1 (en) 2016-09-12 2017-07-25 Network access authentication processing method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610821823.XA CN107820245B (zh) 2016-09-12 2016-09-12 注册方法
CN201610821823.X 2016-09-12

Publications (1)

Publication Number Publication Date
WO2018045841A1 true WO2018045841A1 (zh) 2018-03-15

Family

ID=61561715

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/094400 WO2018045841A1 (zh) 2016-09-12 2017-07-25 入网认证处理方法及装置

Country Status (4)

Country Link
US (1) US20230048689A1 (zh)
EP (2) EP3512229B1 (zh)
CN (2) CN114143781A (zh)
WO (1) WO2018045841A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101145906A (zh) * 2006-09-13 2008-03-19 北京邦天科技有限公司 对单向网络中的接收终端进行合法性认证的方法及系统
CN103944733A (zh) * 2014-04-25 2014-07-23 天地融科技股份有限公司 数据安全交互方法
CN105050081A (zh) * 2015-08-19 2015-11-11 腾讯科技（深圳）有限公司 网络接入设备接入无线网络接入点的方法、装置和系统
US20160262015A1 (en) * 2015-03-05 2016-09-08 Qualcomm Incorporated Identity privacy in wireless networks

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1620971A2 (en) * 2003-04-29 2006-02-01 Azaire Networks Inc. Method and system for providing sim-based roaming over existing wlan public access infrastructure
CN102821382B (zh) * 2008-06-18 2015-09-23 上海华为技术有限公司 一种用于接入的装置
US8693642B2 (en) * 2009-04-16 2014-04-08 Alcatel Lucent Emergency call handling in accordance with authentication procedure in communication network
US8514756B1 (en) * 2010-10-15 2013-08-20 Juniper Networks, Inc. Collectively addressing wireless devices
US9491620B2 (en) * 2012-02-10 2016-11-08 Qualcomm Incorporated Enabling secure access to a discovered location server for a mobile device
EP3509387B1 (en) * 2012-03-08 2021-07-28 Samsung Electronics Co., Ltd. Method for controlling services in wireless communication system
US8995989B2 (en) * 2012-05-22 2015-03-31 Mediatek Inc. UE enhancement for service recovery in mobile communications network
CN102917332B (zh) * 2012-10-11 2015-06-03 大唐移动通信设备有限公司 一种实现移动设备附着的方法及装置
US20140153722A1 (en) * 2012-12-03 2014-06-05 Semyon Mizikovsky Restricting use of mobile subscriptions to authorized mobile devices
US9642077B2 (en) * 2013-10-23 2017-05-02 Cisco Technology, Inc. Node selection in virtual evolved packet core
EP3175640A1 (en) * 2014-07-28 2017-06-07 Telefonaktiebolaget LM Ericsson (publ) Authentication in a radio access network
US20170070880A1 (en) * 2014-08-01 2017-03-09 Lg Electronics Inc. Method of performing an initial access by protecting privacy on a network and user equipment therefor
WO2016086355A1 (zh) * 2014-12-02 2016-06-09 华为技术有限公司 一种无线通信网络中的鉴权方法、相关装置及系统
WO2016162502A1 (en) * 2015-04-08 2016-10-13 Telefonaktiebolaget Lm Ericsson (Publ) Method, apparatus, and system for providing encryption or integrity protection in a wireless network
US10069822B2 (en) * 2016-02-23 2018-09-04 Verizon Patent And Licensing Inc. Authenticated network time for mobile device smart cards
CN109691156B (zh) * 2016-07-14 2023-04-28 瑞典爱立信有限公司 基站、移动性管理实体及其操作方法
WO2018016713A2 (ko) * 2016-07-18 2018-01-25 엘지전자(주) 무선 통신 시스템에서의 단말의 접속 식별자 보안 방법 및 이를 위한 장치
US9838991B1 (en) * 2016-08-15 2017-12-05 At&T Intellectual Property I, L.P. Method and apparatus for managing mobile subscriber identification information according to registration requests

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101145906A (zh) * 2006-09-13 2008-03-19 北京邦天科技有限公司 对单向网络中的接收终端进行合法性认证的方法及系统
CN103944733A (zh) * 2014-04-25 2014-07-23 天地融科技股份有限公司 数据安全交互方法
US20160262015A1 (en) * 2015-03-05 2016-09-08 Qualcomm Incorporated Identity privacy in wireless networks
CN105050081A (zh) * 2015-08-19 2015-11-11 腾讯科技（深圳）有限公司 网络接入设备接入无线网络接入点的方法、装置和系统

Also Published As

Publication number Publication date
EP3512229A4 (en) 2019-08-14
US20230048689A1 (en) 2023-02-16
EP3793233A1 (en) 2021-03-17
CN107820245B (zh) 2021-10-15
CN107820245A (zh) 2018-03-20
CN114143781A (zh) 2022-03-04
EP3512229A1 (en) 2019-07-17
EP3512229B1 (en) 2021-07-14

Similar Documents

Publication Publication Date Title
US11405780B2 (en) Method for performing verification by using shared key, method for performing verification by using public key and private key, and apparatus
US11825303B2 (en) Method for performing verification by using shared key, method for performing verification by using public key and private key, and apparatus
US10638321B2 (en) Wireless network connection method and apparatus, and storage medium
US11778458B2 (en) Network access authentication method and device
US10298398B2 (en) Peer discovery, connection, and data transfer
TW201706900A (zh) 終端的認證處理、認證方法及裝置、系統
WO2015029945A1 (ja) 加入者プロファイル転送方法、加入者プロファイル転送システム及びユーザ装置
US20170300678A1 (en) Method and apparatus for using a biometric template to control access to a user credential for a shared wireless communication device
AU2020200523B2 (en) Methods and arrangements for authenticating a communication device
CN104145465A (zh) 机器类型通信中基于群组的自举
JP2018517367A (ja) サービスプロバイダ証明書管理
US20140115673A1 (en) Authentication process
KR20160143333A (ko) 이중 채널을 이용한 이중 인증 방법
CN110999215A (zh) 安全设备访问令牌
CN111107550A (zh) 5g终端设备双通道接入注册方法、设备及存储介质
WO2018045841A1 (zh) 入网认证处理方法及装置
TWI641271B (zh) 一種存取認證方法、ｕｅ和存取設備
WO2019024937A1 (zh) 密钥协商方法、装置及系统
JP2020017032A (ja) 認証用装置とサービス用装置とを含むコアネットワークシステムのユーザ認証方法
WO2018171486A1 (zh) 移动终端位置更新的方法及装置
WO2013113185A1 (zh) 业务签约信息处理方法及装置
KR20150135715A (ko) 이동통신 시스템에서 사용자의 프라이버시를 보호하는 장치 및 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17848014

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017848014

Country of ref document: EP

Effective date: 20190412