WO2018045842A1 - 入网认证处理方法及装置 - Google Patents

入网认证处理方法及装置 Download PDF

Info

Publication number
WO2018045842A1
WO2018045842A1 PCT/CN2017/094402 CN2017094402W WO2018045842A1 WO 2018045842 A1 WO2018045842 A1 WO 2018045842A1 CN 2017094402 W CN2017094402 W CN 2017094402W WO 2018045842 A1 WO2018045842 A1 WO 2018045842A1
Authority
WO
WIPO (PCT)
Prior art keywords
user equipment
authentication
network
imsi
home network
Prior art date
Application number
PCT/CN2017/094402
Other languages
English (en)
French (fr)
Inventor
游世林
刘红军
蔡继燕
宗在峰
彭锦
林兆骥
张云银
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US16/332,682 priority Critical patent/US11368841B2/en
Priority to EP17848015.8A priority patent/EP3512230A4/en
Priority to EP20197709.7A priority patent/EP3826339A1/en
Publication of WO2018045842A1 publication Critical patent/WO2018045842A1/zh
Priority to US17/826,914 priority patent/US11778458B2/en
Priority to US18/375,885 priority patent/US12096207B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/72—Subscriber identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/75—Temporary identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/654—International mobile subscriber identity [IMSI] numbers

Definitions

  • the embodiments of the present invention relate to the field of communications, and in particular, to a network authentication processing method and apparatus.
  • the future mobile network will provide access services for more and more IoT terminals.
  • Internet of Things access brings new challenges and opportunities to mobile networks. Different types of Internet of Things have different needs for the network. Some require the network to provide high real-time and high-reliability services, such as telemedicine, while others require regular small data transmission services, such as remote meter reading systems.
  • mobile networks may need to be properly optimized to meet business needs. More and more Internet of Things puts more and more different optimization requirements on mobile networks. Some of the optimization requirements may be contradictory. Therefore, a converged core network is increasingly unable to meet various Internet of Things. demand.
  • FIG. 1 is a schematic diagram of the future 5G network access in the related technology.
  • the user equipment completes initial registration in the service network 1
  • the service network 1 obtains an authentication authentication vector and user subscription data from the home network of the user equipment
  • the service network 1 completes mutual authentication with the user equipment, and then the user
  • the device can attach to the service network 2 and then perform related data services.
  • the service network 1 and the service network 2 include an access network and a core network
  • the home network includes a user data center/authentication authentication center.
  • the schematic diagram of the International Mobile Subscriber Identification Number (IMSI) process wherein the IMSI is stored in the SIM card and can be used to distinguish the effective information of the mobile user, and the total length thereof is not more than 15 bits, and the numbers of 0 to 9 are also used.
  • the IMSI includes a Mobile Country Code (MCC) indicating the mobile subscriber's country code, which is 3 digits.
  • MCC Mobile Country Code
  • the MCC of China is 460.
  • the Mobile Network Code (MNC) is the mobile network number. It consists of two or three digits. China Mobile's MNC is 00 for identifying the mobile communication network to which the mobile subscriber belongs; and Mobile Subscriber Identification Number (MSIN) is used to identify a certain mobile.
  • MCC Mobile Country Code
  • MNC Mobile Network Code
  • step S201 the user equipment partially encrypts the IMSI by using the public key Kimsi.
  • Step S202 the user equipment sends an initial attach request message to the service network 1, the message carries an encrypted IMSI;
  • Step S203 the service network 1 searches for the home network of the user equipment according to the MCC and the MNC in the encrypted IMSI, and sends an authentication authentication request message to the home network, where the message carries the encrypted IMSI;
  • Step S204 the home network decrypts the encrypted IMSI using the private key paired with the public key, obtains the decrypted IMSI, and finds the user corresponding to the encrypted IMSI;
  • Step S205 The home network sends an authentication authentication request response message to the service network 1, where the message carries a user security context, that is, a security vector group;
  • Step S206 The home network uses a key K1 that is known to the user equipment to generate a user equipment alias name corresponding to the user equipment, where the user equipment name identifier is used to replace the IMSI or the encrypted IMSI, so that the service network 1 can be used according to the user in subsequent processing.
  • the device name identifies the home network corresponding to the user equipment;
  • Step S207 the service network 1 sends a user authentication authentication request message to the user equipment, where
  • the message carries the authentication token AUTN and the random number RAND, and the user equipment verifies the validity of the network through the authentication token, and uses the RND to calculate the expected response value XRES;
  • Step S208 the user equipment sends back a user authentication authentication request response message to the service network 1, the carrying the expected response value XRES, and the service network 1 compares the expected response value in the security context with the received expected response value. If they are equal, the authenticated user equipment is legal;
  • step S209 the user equipment uses K1 to generate a user equipment alias name, where the user equipment alias name is used to replace the IMSI or the encrypted IMSI, so that the service network 1 can find the home network corresponding to the user equipment according to the user equipment alias name in the subsequent processing;
  • Step S210 the service network 1 sends a location update request message to the home network, the message carries an encrypted IMSI;
  • Step S211 the home network sends a location update request response message to the service network 1, where the message carries the user subscription data and the user equipment alias name identifier;
  • step S212 the service network 1 allocates a temporary identifier to the user equipment, and the temporary identifier includes the service network network identifier, the service network device identifier, and the temporary code allocated to the user equipment, and sends an attach success response message to the user equipment, where the message carries the temporary Identification
  • Step S213 When the user equipment synchronizes with the user equipment alias name in the home network, the user equipment alias name is used to communicate with the service network 1 or the service network 2, otherwise the user equipment needs to use the encrypted IMSI and the service network 1 or the service network. 2 for communication.
  • the network access process of the related art does not describe how the user equipment alias name in the user equipment is asynchronous with the user equipment alias name in the home network.
  • the embodiment of the invention provides a method and a device for processing the network access authentication, so as to solve at least the problem that the network access process in the related art does not describe how the user device alias name in the user equipment is asynchronous with the user device alias name in the home network.
  • a network authentication method including: receiving an authentication authentication request message sent by a first service network, where the authentication authentication request message is carried The user equipment alias name generated by the user equipment is determined; whether the local user equipment name identifier is asynchronous with the user equipment alias name generated by the user equipment; if the judgment result is yes, the encrypted international mobile subscriber identity IMSI is obtained for the user equipment. Perform network access authentication processing.
  • the obtaining the network authentication process for the user equipment by the cryptographic IMSI includes: sending a first authentication authentication failure message to the first service network, where the first authentication authentication failure message Carrying the user equipment aliasing identifier asynchronous reason value, the user equipment aliasing identifier asynchronous reason value is used to notify the user equipment to re-initiate the carrying the encrypted IMSI to the first serving network according to the user equipment aliasing name asynchronous reason value. And attaching the encrypted IMSI according to the attach request, and performing network access authentication processing on the user equipment.
  • the obtaining the network authentication process by the encrypted IMSI to the user equipment includes: sending a second authentication failure message to the first service network; and receiving the first service network according to the The second authentication authentication failure message resends the authentication authentication request message carrying the encrypted IMSI; the encrypted authentication IMSI is obtained according to the authentication authentication request message, and the user equipment is subjected to network access authentication processing.
  • the obtaining the network authentication process by the encrypted IMSI to the user equipment comprises: sending a request message for requesting to obtain an encrypted IMSI to the first service network; and acquiring according to the response message of the request message. Encrypting the IMSI; decrypting the encrypted IMSI, and feeding back an authentication authentication response message to the first serving network, where the authentication authentication response message carries a user security context, and the user security context is to the user equipment Perform network access authentication processing.
  • the method before receiving the authentication authentication request message sent by the first serving network, the method further includes: receiving an encrypted IMSI sent by the second serving network; determining that the user equipment corresponding to the encrypted IMSI is legal And generating a pseudonym index number corresponding to the user device alias name to be used; sending the alias name index number to the second service network, to notify the user equipment to generate the user equipment alias name according to the alias name index number.
  • a network authentication processing method includes: sending an authentication authentication request message to the home network, where the authentication authentication request message carries the user equipment alias name generated by the user equipment; and determining, according to the feedback of the home network, the user equipment alias name in the home network
  • the user equipment alias name generated by the user equipment is asynchronous; the encrypted international mobile subscriber identity IMSI is obtained, and the encrypted IMSI is sent to the home network, so that the home network performs network access authentication processing on the user equipment.
  • the encrypted IMSI is obtained, and the encrypted IMSI is sent to the home network, so that the home network performs network access authentication processing on the user equipment, including: receiving, by the home network, the first An authentication authentication failure message, wherein the first authentication authentication failure message carries a user equipment name identifier asynchronous cause value; and the user equipment sends an asynchronous reason value attachment failure message carrying the user equipment alias name identifier, and notifies the The user equipment re-initiates an attach request carrying the encrypted IMSI to the first serving network according to the user equipment alias name asynchronous cause value; acquiring the encrypted IMSI according to the attach request, and sending the encrypted IMSI to the The home network, so that the home network performs network access authentication processing on the user equipment.
  • the encrypted IMSI is obtained, and the encrypted IMSI is sent to the home network, so that the home network performs network access authentication processing on the user equipment, including: receiving, by the home network, a second The authentication authentication failure message is sent to the user equipment according to the second authentication authentication failure message; the encrypted IMSI is obtained according to the response of the user equipment, and the bearer is sent to the home network again.
  • the authentication authentication request message of the IMSI is encrypted, so that the home network performs network access authentication processing on the user equipment.
  • the encrypted IMSI is obtained, and the encrypted IMSI is sent to the home network, so that the home network performs the network access authentication process on the user equipment, including: receiving, by the home network, Requesting to obtain a request message for encrypting the IMSI; sending a user equipment identity request message to the user equipment according to the request message; acquiring an encrypted IMSI according to the response of the user equipment, and sending an encrypted IMSI to the home network, so that the attribution The network performs network access authentication processing on the user equipment.
  • the method before the sending the authentication request message to the home network, the method further includes: receiving an attach request sent by the user equipment, where the attach request carries a temporary identifier;
  • the second service network obtains the user security context; if the user security context fails to be obtained, sending a request message for acquiring the encrypted IMSI or the user device alias name to the user equipment; acquiring the encrypted IMSI according to the message or
  • the user equipment name identifier is used to perform network access authentication processing on the user equipment.
  • an access authentication processing apparatus including: a first receiving module, configured to receive an authentication authentication request message sent by a first serving network, where the authentication authentication request message is carried The user equipment alias name generated by the user equipment is determined.
  • the determining module is configured to determine whether the local user equipment name identifier is asynchronous with the user equipment alias name generated by the user equipment.
  • the first obtaining module is configured to obtain the judgment result of yes.
  • the encrypted international mobile subscriber identity IMSI performs network access authentication processing on the user equipment.
  • the first acquiring module is further configured to send a first authentication authentication failure message to the first serving network, where the first authentication authentication failure message carries a user equipment alias name identifier.
  • the asynchronous cause value, the user equipment name identifier asynchronous cause value is used to notify the user equipment to re-initiate an attach request carrying the encrypted IMSI to the first serving network according to the user equipment alias name asynchronous cause value;
  • the attach request acquires the encrypted IMSI, and performs network access authentication processing on the user equipment.
  • the first acquiring module is configured to send a second authentication authentication failure message to the first serving network, and receive the first serving network to re-recover according to the second authentication authentication failure message. Sending an authentication authentication request message carrying the encrypted IMSI; and acquiring the encrypted IMSI according to the authentication authentication request message, performing network access authentication processing on the user equipment.
  • the first acquiring module is configured to send, to the first serving network, a request message for requesting to obtain an encrypted IMSI; acquire the encrypted IMSI according to the response message of the request message; and decrypt Encrypting the IMSI, feeding back an authentication authentication response message to the first serving network, where the authentication authentication response message carries a user security context,
  • the user security context performs network access authentication processing on the user equipment.
  • the method further includes: a second receiving module, configured to receive the encrypted IMSI sent by the second serving network; and a generating module, configured to: after determining that the user equipment corresponding to the encrypted IMSI is legal, generate a to be used And the first sending module is configured to send the aliasing index number to the second service network, so as to notify the user equipment to generate the user equipment attribute name according to the alias name index.
  • a network authentication processing apparatus including: a second sending module, configured to send an authentication authentication request message to a home network, where the authentication authentication request message carries And the determining module is configured to determine, according to the feedback of the home network, that the user equipment alias name in the home network is asynchronous with the user equipment alias name generated by the user equipment; and the second obtaining module is configured to Obtaining an encrypted international mobile subscriber identity (IMSI), and transmitting the encrypted IMSI to the home network, so that the home network performs network access authentication processing on the user equipment.
  • IMSI international mobile subscriber identity
  • the second obtaining module is further configured to receive the first authentication authentication failure message sent by the home network, where the first authentication authentication failure message carries the asynchronous cause value of the user equipment alias identifier Sending, to the user equipment, an asynchronous reason value attachment failure message carrying the user equipment alias name, informing the user equipment to re-initiate carrying the encrypted IMSI to the first serving network according to the asynchronous reason value of the user equipment alias name identifier And obtaining the encrypted IMSI according to the attach request, and sending the encrypted IMSI to the home network, so that the home network performs network access authentication processing on the user equipment.
  • the second obtaining module is further configured to receive a second authentication authentication failure message sent by the home network, and send the user equipment identifier to the user equipment according to the second authentication authentication failure message.
  • the request message is obtained, and the encrypted IMSI is obtained according to the response of the user equipment, and the authentication authentication request message carrying the encrypted IMSI is sent to the home network, so that the home network performs the network access authentication process on the user equipment.
  • the second obtaining module is further configured to receive a request message sent by the home network for requesting to obtain an encrypted IMSI; and according to the request message, to the user
  • the device sends a user equipment identification request message; and obtains an encrypted IMSI according to the response of the user equipment, and sends an encrypted IMSI to the home network, so that the home network performs network access authentication processing on the user equipment.
  • the method further includes: a third receiving module, configured to receive an attach request sent by the user equipment, where the attach request carries a temporary identifier; and the third obtaining module is configured to be according to the temporary identifier Acquiring a user security context from the second service network; the third sending module is configured to send a request message for acquiring the encrypted IMSI or the user device alias name to the user equipment if the user security context fails to be obtained; And a fourth obtaining module, configured to acquire the encrypted IMSI or the user device alias name according to the message, and perform network access authentication processing on the user equipment.
  • a third receiving module configured to receive an attach request sent by the user equipment, where the attach request carries a temporary identifier
  • the third obtaining module is configured to be according to the temporary identifier Acquiring a user security context from the second service network
  • the third sending module is configured to send a request message for acquiring the encrypted IMSI or the user device alias name to the user equipment if the user security context fails to
  • a storage medium is further provided.
  • the storage medium is configured to store a program code for performing the following steps: receiving an authentication authentication request message sent by the first service network, where the authentication authentication request message carries a user equipment alias name generated by the user equipment; Whether the user equipment alias name and the user equipment alias name generated by the user equipment are asynchronous; if the judgment result is yes, the encrypted international mobile subscriber identity IMSI is obtained to perform network access authentication processing on the user equipment.
  • the storage medium is further configured to store program code for performing the following steps: acquiring the encrypted IMSI to perform network access authentication processing on the user equipment, comprising: sending a first authentication to the first serving network An authentication failure message, where the first authentication authentication failure message carries a user equipment name identifier asynchronous cause value, and the user equipment alias name identifier asynchronous cause value is used to notify the user equipment to identify an asynchronous reason according to the user equipment alias name.
  • the value re-initiates the attach request carrying the encrypted IMSI to the first serving network; the encrypted IMSI is obtained according to the attach request, and the user equipment is subjected to the network access authentication process.
  • the storage medium is further configured to store program code for performing the following steps: obtaining the encrypted IMSI to perform network access authentication processing on the user equipment, comprising: sending a second authentication to the first service network An authentication failure message; receiving, by the first serving network, resending the authentication authentication carrying the encrypted IMSI according to the second authentication authentication failure message And obtaining the encrypted IMSI according to the authentication authentication request message, and performing network access authentication processing on the user equipment.
  • the storage medium is further configured to store program code for performing the following steps: acquiring the encrypted IMSI to perform network access authentication processing on the user equipment, comprising: sending, to the first service network, a request for obtaining Encrypting the request message of the IMSI; acquiring the encrypted IMSI according to the response message of the request message; decrypting the encrypted IMSI, and feeding back an authentication authentication response message to the first serving network, where the authentication authentication response message carries There is a user security context, and the user security context performs network access authentication processing on the user equipment.
  • the storage medium is further configured to store program code for performing the following steps: before receiving the authentication authentication request message sent by the first service network, further comprising: receiving the encryption sent by the second service network After determining that the user equipment corresponding to the encrypted IMSI is legal, generating a pseudonym index number corresponding to the user equipment alias name to be used; sending the alias name index number to the second service network, to notify the user equipment according to the The alias name index generates a user device alias name.
  • a storage medium is further provided.
  • the storage medium is configured to store program code for performing the following steps: sending an authentication authentication request message to the home network, where the authentication authentication request message carries a user equipment alias name generated by the user equipment; according to the home network And determining that the user equipment alias name in the home network is asynchronous with the user equipment alias name generated by the user equipment; acquiring an encrypted international mobile subscriber identity IMSI, and sending the encrypted IMSI to the home network, so that the home network Performing network access authentication processing on the user equipment.
  • the storage medium is further configured to store program code for performing the following steps: acquiring the encrypted IMSI, and transmitting the encrypted IMSI to the home network, so that the home network is connected to the user equipment
  • the performing the network authentication process includes: receiving a first authentication authentication failure message sent by the home network, where the first authentication authentication failure message carries a user equipment name identifier asynchronous cause value; and sending the carried message to the user equipment
  • the user equipment alias name identifies an asynchronous cause value attachment failure message, and notifies the user equipment according to the user equipment
  • the aliasing cause asynchronous cause value re-initiates an attach request carrying the encrypted IMSI to the first serving network; acquiring the encrypted IMSI according to the attach request, and sending the encrypted IMSI to the home network, so that the home network Performing network access authentication processing on the user equipment.
  • the storage medium is further configured to store program code for performing the following steps: acquiring the encrypted IMSI, and transmitting the encrypted IMSI to the home network, so that the home network is connected to the user equipment
  • the performing the network access authentication process includes: receiving a second authentication authentication failure message sent by the home network; sending a user equipment identity request message to the user equipment according to the second authentication authentication failure message; And in response to obtaining the encrypted IMSI, the authentication authentication request message carrying the encrypted IMSI is sent to the home network, so that the home network performs network access authentication processing on the user equipment.
  • the storage medium is further configured to store program code for performing the following steps: acquiring the encrypted IMSI, and transmitting the encrypted IMSI to the home network, so that the home network is connected to the user equipment
  • Performing the network access authentication process includes: receiving a request message sent by the home network for requesting to obtain an encrypted IMSI; sending, according to the request message, a user equipment identity request message to the user equipment; and obtaining an encryption according to the response of the user equipment
  • the IMSI sends an encrypted IMSI to the home network, so that the home network performs network access authentication processing on the user equipment.
  • the storage medium is further configured to store the program code for performing the following steps: before sending the authentication authentication request message to the home network, the method further includes: receiving an attach request sent by the user equipment, where The attachment request carries a temporary identifier; the user security context is obtained from the second service network according to the temporary identifier; and if the user security context fails to be obtained, the user equipment is configured to obtain an encrypted IMSI or a user device pseudonym.
  • the identified request message is obtained by performing the network access authentication process on the user equipment by acquiring the encrypted IMSI or the user equipment alias name according to the message.
  • the embodiment of the present invention receives an authentication authentication request message sent by the first service network, where the authentication authentication request message carries the user equipment alias name generated by the user equipment, and determines the local user equipment alias name identifier and the user equipment generated by the user equipment. Whether the alias name is asynchronous; If the result of the disconnection is yes, the encrypted international mobile subscriber identity IMSI is obtained to perform network access authentication processing on the user equipment.
  • the local user device aliasing identifier is asynchronous with the user device aliasing identifier generated by the user equipment
  • the encrypted international mobile subscriber identity (IMSI) is obtained to perform network access authentication processing on the user equipment. Therefore, the network access process of the related technology is not described in the user equipment. What to do if the user device alias name is asynchronous with the user device alias name in the home network.
  • FIG. 2 is a schematic diagram of a process for protecting a user privacy international mobile subscriber identity IMSI in a user equipment access service network 1 in the related art
  • FIG. 3 is a block diagram showing the hardware structure of a computer terminal of a network authentication processing method according to an embodiment of the present invention
  • FIG. 4 is a flowchart 1 of a method for processing an incoming network authentication according to an embodiment of the present invention
  • FIG. 5 is a second flowchart of a network authentication processing method according to an embodiment of the present invention.
  • FIG. 6 is a schematic flowchart of a service network acquisition context failure process according to an embodiment of the present invention.
  • FIG. 7 is a schematic flowchart 1 of a process for asynchronous processing of a home network discovery user device identification name according to an embodiment of the present invention
  • FIG. 8 is a second schematic diagram of a process for asynchronous processing of a home network discovery user device name identifier according to an embodiment of the present invention.
  • FIG. 9 is a third schematic diagram of a process for asynchronous processing of a home network discovery user device identification name according to an embodiment of the present invention.
  • FIG. 10 is a structural block diagram 1 of a network access authentication processing apparatus according to an embodiment of the present invention.
  • FIG. 11 is a block diagram 1 of a preferred structure of an incoming network authentication processing apparatus according to an embodiment of the present invention.
  • FIG. 12 is a second structural block diagram of a network access authentication processing apparatus according to an embodiment of the present invention.
  • FIG. 13 is a second structural block diagram of a network authentication processing apparatus according to an embodiment of the present invention.
  • FIG. 3 is a hardware block diagram of a computer terminal of a network authentication processing method according to an embodiment of the present invention.
  • computer terminal 30 may include one or more (only one shown) processor 302 (processor 302 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA)
  • processor 302 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA)
  • a memory 304 for storing data
  • a transmission device 306 for communication functions.
  • computer terminal 30 may also include more or fewer components than shown in FIG. 3, or have a different configuration than that shown in FIG.
  • the memory 304 can be used to store software programs and modules of the application software, such as the program instructions/modules corresponding to the network authentication processing method in the embodiment of the present invention, and the processor 302 executes each of the software programs and modules stored in the memory 304.
  • a functional application and data processing, that is, the above method is implemented.
  • Memory 304 can include high speed random access memory and can also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 304 can further include relative to processor 302 Remotely located memories that can be connected to computer terminal 30 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • Transmission device 306 is for receiving or transmitting data via a network.
  • the network specific examples described above may include a wireless network provided by a communication provider of the computer terminal 30.
  • transmission device 306 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet.
  • NIC Network Interface Controller
  • the transmission device 306 can be a Radio Frequency (RF) module for communicating with the Internet wirelessly.
  • RF Radio Frequency
  • FIG. 4 is a flowchart 1 of a network authentication processing method according to an embodiment of the present invention. As shown in FIG. 4, the process includes the following steps:
  • Step S402 receiving an authentication authentication request message sent by the first service network, where the authentication authentication request message carries the user equipment alias name generated by the user equipment;
  • Step S404 determining whether the local user device alias name and the user equipment alias name generated by the user equipment are asynchronous
  • Step S406 If the determination result is yes, the encrypted international mobile subscriber identity IMSI is obtained to perform network access authentication processing on the user equipment.
  • the encrypted international mobile subscriber identity is used to perform network access authentication processing on the user equipment. Therefore, the network access process of the related technology can be solved.
  • IMSI international mobile subscriber identity
  • the obtaining the encrypted IMSI to perform the network access authentication process on the user equipment includes: sending the first authentication authentication failure message to the first service network, where the first authentication authentication failure message carries the asynchronous reason of the user equipment alias identifier Value, the user device name identifier asynchronous reason value is used to notify the user equipment to re-send to the first service according to the user device alias name asynchronous reason value.
  • the network initiates an attach request carrying the encrypted IMSI; obtains the encrypted IMSI according to the attach request, and performs network access authentication processing on the user equipment.
  • a user device alias name is generated in the re-attachment process to ensure that the local user device alias name is synchronized with the user device alias name generated by the user device, so that a more secure user device alias name can be generated.
  • the obtaining the encrypted IMSI to perform the network access authentication process on the user equipment includes: sending a second authentication authentication failure message to the first serving network; and receiving the first service network to resend according to the second authentication authentication failure message. Encrypting the authentication authentication request message of the IMSI; acquiring the encrypted IMSI according to the authentication authentication request message, and performing network access authentication processing on the user equipment.
  • the user equipment aliasing identifier is generated by the re-receiving of the authentication authentication request message carrying the encrypted IMSI to ensure that the local user equipment aliasing identifier is synchronized with the user equipment aliasing identifier generated by the user equipment, and the initial step of the attaching process is not necessary. At the beginning, you can save time when generating user device aliases.
  • the obtaining the encrypted IMSI to perform the network access authentication process on the user equipment includes: sending a request message for requesting to obtain the encrypted IMSI to the first service network; acquiring the encrypted IMSI according to the response message of the request message; decrypting the encrypted IMSI, The first service network feeds back an authentication authentication response message, where the authentication authentication response message carries a user security context, and the user security context performs network access authentication processing on the user equipment.
  • the user equipment alias name identifier can be generated to ensure that the local user equipment alias name identifier is synchronized with the user equipment alias name generated by the user equipment, by re-acquiring the authentication authentication request message carrying the encrypted IMSI. Generate user device aliases faster and more directly.
  • the method before receiving the authentication authentication request message sent by the first serving network, the method further includes: receiving the encrypted IMSI sent by the second serving network; determining that the user equipment corresponding to the encrypted IMSI is legal, and generating the user to be used.
  • a pseudonym index number corresponding to the device name identifier sending a pseudonym index number to the second service network, to notify the user equipment to generate the user device alias name according to the alias name index number.
  • the user device can generate the user device alias name according to the alias name index, and the user equipment alias name is not decrypted by decrypting the encrypted IMSI after mutually authenticating with the service network, thereby reducing the alias of the user device.
  • the burden of belonging to the network is small.
  • FIG. 5 is a second flowchart of a network authentication processing method according to an embodiment of the present invention. As shown in FIG. 5, the process includes the following steps:
  • Step S502 sending an authentication authentication request message to the home network, where the authentication authentication request message carries the user equipment alias name generated by the user equipment;
  • Step S504 determining, according to the feedback of the home network, that the user equipment alias name in the home network is asynchronous with the user equipment alias name generated by the user equipment;
  • Step S506 Acquire an encrypted international mobile subscriber identity (IMSI), and send the encrypted IMSI to the home network, so that the home network performs network access authentication processing on the user equipment.
  • IMSI international mobile subscriber identity
  • the encrypted international mobile subscriber identity IMSI is obtained, and the encrypted IMSI is sent to the home network, so that the home network accesses the user equipment.
  • the authentication process can solve the problem that the network access process of the related technology does not describe how the user equipment alias name in the user equipment is asynchronous with the user equipment alias name in the home network.
  • the encrypted IMSI is obtained, and the encrypted IMSI is sent to the home network, so that the home network performs the network access authentication process on the user equipment, including: receiving the first authentication authentication failure message sent by the home network, where the first authentication is performed.
  • the authentication failure message carries the asynchronous cause value of the user equipment alias name; the user equipment sends an asynchronous reason value attachment failure message carrying the user equipment alias name, and notifies the user equipment to re-initiate the carrier to the first service network according to the asynchronous reason value of the user equipment alias name.
  • Encrypt the IMSI attach request obtain the encrypted IMSI according to the attach request, and send the encrypted IMSI to the home network, so that the home network performs the network access authentication process on the user equipment.
  • a user device alias name is generated in the re-attachment process to ensure that the local user device alias name is synchronized with the user device alias name generated by the user device, so that a more secure user device alias name can be generated.
  • the encrypted IMSI is obtained, and the encrypted IMSI is sent to the home network, so that the home network performs the network access authentication process on the user equipment, including: receiving the second authentication authentication failure message sent by the home network; Failed message, sending user to user device
  • the device identifies the request message, and obtains the encrypted IMSI according to the response of the user equipment, and sends an authentication authentication request message carrying the encrypted IMSI to the home network, so that the home network performs the network access authentication process on the user equipment.
  • the user equipment aliasing identifier is generated by the re-receiving of the authentication authentication request message carrying the encrypted IMSI to ensure that the local user equipment aliasing identifier is synchronized with the user equipment aliasing identifier generated by the user equipment, and the initial step of the attaching process is not necessary.
  • the encrypted IMSI is obtained, and the encrypted IMSI is sent to the home network, so that the home network performs the network access authentication process on the user equipment, including: receiving a request message sent by the home network for requesting to obtain the encrypted IMSI; Sending a user equipment identity request message to the user equipment; obtaining an encrypted IMSI according to the response of the user equipment, and sending an encrypted IMSI to the home network, so that the home network performs network access authentication processing on the user equipment.
  • the user equipment alias name identifier can be generated to ensure that the local user equipment alias name identifier is synchronized with the user equipment alias name generated by the user equipment, by re-acquiring the authentication authentication request message carrying the encrypted IMSI. Generate user device aliases faster and more directly.
  • the method before the sending the authentication request message to the home network, the method further includes: receiving an attach request sent by the user equipment, where the attach request carries the temporary identifier; and acquiring the user security from the second service network according to the temporary identifier.
  • Context in the case that the user security context fails to be obtained, the request message for obtaining the encrypted IMSI or the user device alias name is sent to the user equipment; the encrypted IMSI or the user equipment alias name is obtained according to the message, and the user equipment is authenticated by the network. .
  • the second service network is used as the service network 1
  • the first service network is the service network 2 as an example for detailed description.
  • FIG. 6 is a schematic flowchart of a service network acquisition context failure process according to an embodiment of the present invention.
  • the core idea is: after the home network decrypts and encrypts the IMSI, it transmits the security context to the service network and decrypts the IMSI.
  • the home network After the service network and the user equipment implement the two-way authentication, the home network generates the user equipment alias name group, and determines the user equipment alias name used. Alias index number, and The service network sends the user subscription data and the user device alias name, and the alias name index number, and the service network sends the temporary identifier and the alias name to the user equipment, and the user equipment generates the user equipment alias name according to the alias name index.
  • the user equipment initiates an attach request to the service network by using the temporary identifier, and the service network fails to obtain the user context according to the other service network, and the service network initiates the acquisition of the user equipment identifier request to the user equipment, where the request type is an encrypted IMSI or a user equipment alias name, and the service network
  • the attach process is completed using the encrypted IMSI or user device alias. As shown in FIG. 6, the process includes the following steps:
  • Step S602 The user equipment partially encrypts the IMSI by using the public key Kimsi.
  • Step S604 the user equipment sends an initial attach request message to the service network 1, the message carries an encrypted IMSI;
  • Step S606 the service network 1 searches for the home network of the user equipment according to the MCC and the MNC in the encrypted IMSI, and sends an authentication authentication request message to the home network, where the message carries the encrypted IMSI;
  • Step S608 the home network decrypts the encrypted IMSI using the private key paired with the public key, obtains the decrypted IMSI, and finds the user corresponding to the encrypted IMSI;
  • Step S610 the home network sends back an authentication authentication request response message to the service network 1, the message carries a user security context, that is, a security vector group, and the message also carries the decrypted IMSI;
  • Step S612 the service network 1 sends a user authentication authentication request message to the user equipment, where the message carries the authentication token AUTN and the random number RAND, and the user equipment verifies the validity of the network by using the authentication token, and calculates the expected response by using the RND.
  • Step S614 the user equipment sends back a user authentication authentication request response message to the service network 1, the carrying the expected response value XRES, and the service network 1 compares the expected response value in the security context with the received expected response value. If they are equal, the authenticated user equipment is legal;
  • Step S616 the service network 1 sends a location update request message to the home network, where the Carry IMSI;
  • Step S618 The home network generates a user equipment alias name group corresponding to the user equipment by using a key K1 shared by the user equipment, where the user equipment name identifier includes the MCC and the MNC of the user equipment, the user data center identifier, and the home network generates a Corresponding pseudonym index number, determining a corresponding user equipment alias name;
  • Step S620 The home network sends a location update request response message to the service network 1, where the message carries the user subscription data, the user equipment alias name and the alias name index, or the user data center identifier.
  • Step S622 the service network 1 allocates a temporary identifier to the user equipment, and the temporary identifier includes the service network network identifier, the service network device identifier, and the temporary code allocated to the user equipment, and sends an attach success response message to the user equipment, where the message carries the temporary
  • the identifier further carries a pseudonym index number or a user data center identifier;
  • Step S624 The user equipment determines a corresponding user equipment alias name according to the alias name index, where the user equipment alias name identifier includes the MCC and the MNC of the user equipment, and the user data center identifier.
  • Step S626 the user equipment sends an attach request message to the service network 2, where the message carries a temporary identifier.
  • Step S628 the service network 2, according to the temporary identifier query, finds that there is no user context locally, and initiates a user context request message to the service network 1 according to the service network network identifier and the service network device identifier in the temporary identifier, where the message carries a temporary identifier, or If the corresponding service network cannot be found according to the temporary identifier, or the corresponding service network 1 communication link is abnormal, then the process proceeds to step S632;
  • Step S630 the service network 1 cannot find the corresponding user context according to the temporary identifier, and sends back a user context failure response message to the service network 2;
  • Step S632 the service network 2 sends an identifier request message to the user equipment, and the identifier request type is one of an encrypted IMSI or a user equipment alias name.
  • Step S634 the user equipment selects a corresponding encrypted IMSI according to the identifier request type or The user equipment alias name is sent back to the service network 2 to send an identifier request response message, where the message carries an encrypted IMSI or a user equipment alias name identifier;
  • step S636 the service network 2 searches for the home network of the user equipment according to the MCC and the MNC identified in the encrypted IMSI or the user equipment name, and sends an authentication authentication request message to the home network, where the message carries the encrypted IMSI or the user equipment alias name.
  • Step S638 if the message carries the encrypted IMSI, the home network decrypts the encrypted IMSI using the private key paired with the public key, obtains the decrypted IMSI, and finds the user corresponding to the encrypted IMSI; the home network sends back an authentication authentication request response to the service network 2.
  • the message carries the user security context, that is, the security vector group, and the message also carries the decrypted IMSI. If the user equipment alias name carried in the message is used, the user data center is found according to the user data center in the user device alias name. Finding a corresponding user in the user data center, and sending an authentication authentication request response message to the service network 2, where the message carries a user security context, that is, a security vector group;
  • Step S640 the service network 1 sends a user authentication authentication request message to the user equipment, where the message carries the authentication token AUTN and the random number RAND, and the user equipment verifies the validity of the network by using the authentication token, and calculates the expected response by using the RND.
  • Step S642 the user equipment sends back a user authentication authentication request response message to the service network 1, the carrying the expected response value XRES, and the service network 1 compares the expected response value in the security context with the received expected response value. If they are equal, the authenticated user equipment is legal;
  • Step S644 the service network 2 sends a location update request message to the home network, where the message carries an IMSI or a user equipment alias name identifier;
  • step S646 the home network generates a user equipment alias name group corresponding to the new user equipment by using a key K1 shared by the user equipment, where the user equipment alias name identifier includes the MCC and the MNC of the user equipment, and the user data center identifier, the home network. Generating a corresponding newization name index number to determine a corresponding new user equipment name identifier;
  • Step S648 the home network sends a location update request response message to the service network 2, where the message carries the user subscription data, the new user equipment alias name and the newization name index number, or the user data center identifier;
  • Step S650 the service network 2 allocates a new temporary identifier to the user equipment, where the new temporary identifier includes a service network network identifier, a service network device identifier, and a new temporary code allocated to the user equipment, and sends an attach success response message to the user equipment,
  • the message carries a new temporary identifier, and the message also carries a new name index number or a user data center identifier;
  • Step S652 The user equipment uses the key K1 to generate a new user equipment alias name group corresponding to the user equipment, where the user equipment alias name identifier includes the MCC and the MNC of the user equipment, and the user data center identifier, and the user equipment determines the corresponding according to the newization name index number.
  • New user device alias name The user equipment uses the key K1 to generate a new user equipment alias name group corresponding to the user equipment, where the user equipment alias name identifier includes the MCC and the MNC of the user equipment, and the user data center identifier, and the user equipment determines the corresponding according to the newization name index number.
  • New user device alias name includes the MCC and the MNC of the user equipment, and the user data center identifier
  • FIG. 7 is a schematic flowchart 1 of a process for asynchronously processing a user equipment alias name in a home network according to an embodiment of the present invention.
  • the core idea is that after the home network receives the service network authentication request message, it discovers the user equipment alias name in the user equipment. Asynchronously, the authentication authentication failure message is sent back to the service network, where the message carries the asynchronous cause value of the user device name, and the service network sends an attachment failure message to the user equipment, where the message carries the asynchronous cause value of the user device alias name, and the user equipment is based on the user.
  • the device alias identifier asynchronous cause value uses the encrypted IMSI to initiate a reattach request to the service network. As shown in FIG. 7, the process includes the following steps:
  • Step S702 completing initial registration in the service network 1 according to step S602-step S624, or completing registration once in other networks, the user equipment has a temporary identifier and a user equipment alias name;
  • Step S704 the user equipment sends an attach request message to the service network 2, where the message carries a temporary identifier.
  • Step S706 the service network 2, according to the temporary identifier query, finds that there is no user context locally, and initiates a user context request message to the service network 1 according to the service network network identifier and the service network device identifier in the temporary identifier, where the message carries the temporary identifier;
  • Step S708 the service network 1 searches for the corresponding user context according to the temporary identifier, and sends back a user context response message to the service network 2, where the message carries the user context;
  • Step S710 The serving network 2 searches for the home network of the user equipment according to the MCC and the MNC identified by the user equipment name in the user context, and sends an authentication authentication request message to the home network.
  • the message carries a user equipment alias name identifier
  • Step S712 The home network fails to query the user according to the user equipment alias name.
  • Step S714 the home network sends an authentication authentication failure message to the service network 2, where the message carries the user equipment alias name query failure reason value;
  • step S716 the service network 2 sends an attach failure response message to the user equipment, where the message carries the user equipment alias name query failure reason value;
  • Step S720 the attaching process similar to the initial registration in the service network 2 is completed according to steps S604-S624.
  • FIG. 8 is a second schematic diagram of a process for asynchronously processing a user equipment alias name in a home network according to an embodiment of the present invention.
  • the core idea is that after the home network receives the service network authentication request message, it discovers the user equipment alias name in the user equipment. Asynchronously, the authentication authentication failure message is sent back to the service network, where the message carries the user equipment name identifier asynchronous cause value, and the service network initiates the user equipment identity request message to the user equipment, the request identifier type is the encrypted IMSI, and the service network uses the encrypted IMSI. Initiate a re-authentication authentication process and complete the subsequent attach process. As shown in FIG. 8, the process includes the following steps:
  • Step S802 completing initial registration in the service network 1 according to step S602-step S624, or completing registration once in other networks, the user equipment has a temporary identifier and a user equipment alias name;
  • Step S804 The user equipment sends an attach request message to the service network 2, where the message carries a temporary identifier.
  • Step S806 the service network 2, according to the temporary identifier query, finds that there is no user context locally, and initiates a user context request message to the service network 1 according to the service network network identifier and the service network device identifier in the temporary identifier, where the message carries the temporary identifier;
  • Step S808 the service network 1 finds the corresponding user context according to the temporary identifier, and applies to the service.
  • the service network 2 sends back a user context response message, where the message carries a user context;
  • step S810 the service network 2 searches for the home network of the user equipment according to the MCC and the MNC identified by the user equipment name in the user context, and sends an authentication authentication request message to the home network, where the message carries the user equipment alias name identifier;
  • Step S812 The home network fails to query the user according to the user equipment alias name.
  • step S814 the home network sends an authentication authentication failure message to the service network 2, where the message carries the user equipment alias name query failure reason value;
  • Step S818, the user equipment selects the corresponding encrypted IMSI according to the identifier request type, and sends an identifier request response message to the service network 2, where the message carries the encrypted IMSI;
  • Step S820 the service network 2 searches for the home network of the user equipment according to the MCC and the MNC identified in the encrypted IMSI or the user equipment alias name, and sends an authentication authentication request message to the home network, where the message carries the encrypted IMSI;
  • Step S822 The home network decrypts the encrypted IMSI by using the private key paired public key, obtains the decrypted IMSI, and finds the user corresponding to the encrypted IMSI; the home network sends an authentication authentication request response message to the service network 2, where the message carries the user security context. , that is, the security vector group, the message also carries the decrypted IMSI;
  • Step S824 the service network 1 sends a user authentication authentication request message to the user equipment, where the message carries the authentication token AUTN and the random number RAND, and the user equipment verifies the validity of the network by using the authentication token, and calculates the expected response by using the RND.
  • Step S826 the user equipment sends back a user authentication authentication request response message to the service network 1, the carrying the expected response value XRES, and the service network 1 compares the expected response value in the security context with the received expected response value. If they are equal, the authenticated user equipment is legal;
  • Step S830 The home network generates a user equipment alias name group corresponding to the new user equipment by using a key K1 shared by the user equipment, where the user equipment name identifier includes the MCC and the MNC of the user equipment, and the user data center identifier, the home network. Generating a corresponding newization name index number to determine a corresponding new user equipment name identifier;
  • Step S832 the home network sends a location update request response message to the service network 2, where the message carries the user subscription data, the new user equipment alias name and the newization name index number, or the user data center identifier;
  • Step S834 the service network 2 allocates a new temporary identifier to the user equipment, where the new temporary identifier includes a service network network identifier, a service network device identifier, and a new temporary code allocated to the user equipment, and sends an attach success response message to the user equipment,
  • the message carries a new temporary identifier, and the message also carries a new name index number or a user data center identifier;
  • Step S836 The user equipment uses the key K1 to generate a new user equipment alias name group corresponding to the user equipment, where the user equipment alias name identifier includes the MCC and the MNC of the user equipment, and the user data center identifier, and the user equipment determines the corresponding according to the newization name index number.
  • New user device alias name The user equipment uses the key K1 to generate a new user equipment alias name group corresponding to the user equipment, where the user equipment alias name identifier includes the MCC and the MNC of the user equipment, and the user data center identifier, and the user equipment determines the corresponding according to the newization name index number.
  • New user device alias name includes the MCC and the MNC of the user equipment, and the user data center identifier
  • FIG. 9 is a schematic flowchart 3 of a process for asynchronously processing a user equipment alias name in a home network according to an embodiment of the present invention.
  • the core idea is: after receiving a service network authentication request message, the home network discovers a user equipment alias name in the user equipment. Asynchronously, the device obtains the encrypted IMSI request message from the service network, and the service network sends a user equipment identity request message to the user equipment, where the request identifier type is the encrypted IMSI, and after the home network obtains the encrypted IMSI, the IMSI is decrypted, and the subsequent attach procedure is completed.
  • the process includes the following steps:
  • Step S902 completing initial registration in the service network 1 according to step S602-step S624, or completing registration once in other networks, the user equipment has a temporary identifier and a user equipment alias name;
  • Step S904 the user equipment sends an attach request message to the service network 2, where the message carries a temporary identifier
  • Step S906 the service network 2 finds that there is no user context locally according to the temporary identifier query. And acquiring a user context request message, which carries a temporary identifier, to the service network 1 according to the service network identifier and the service network device identifier in the temporary identifier;
  • Step S908 the service network 1 searches for the corresponding user context according to the temporary identifier, and sends back a user context response message to the service network 2, where the message carries the user context;
  • step S910 the service network 2 searches for the home network of the user equipment according to the MCC and the MNC identified by the user equipment name in the user context, and sends an authentication authentication request message to the home network, where the message carries the user equipment alias name identifier;
  • Step S912 The home network fails to query the user according to the user equipment alias name.
  • Step S914 the home network sends a user encrypted IMSI request message to the service network 2;
  • Step S916 the service network 2 initiates an identification request message to the user equipment, and the identifier request type is an encrypted IMSI;
  • Step S918 the user equipment selects the corresponding encrypted IMSI according to the identifier request type, and sends an identifier request response message to the service network 2, where the message carries the encrypted IMSI;
  • Step S920 the service network 2 sends back a user encrypted IMSI response message to the home network, the message carrying the encrypted IMSI;
  • Step S922 The home network decrypts the encrypted IMSI by using the public key paired with the public key, obtains the decrypted IMSI, and finds the user corresponding to the encrypted IMSI; the home network sends an authentication authentication request response message to the service network 2, where the message carries the user security context. , that is, the security vector group, the message also carries the decrypted IMSI;
  • Step S924 the service network 1 sends a user authentication authentication request message to the user equipment, where the message carries the authentication token AUTN and the random number RAND, and the user equipment verifies the validity of the network by using the authentication token, and calculates the expected response by using the RND.
  • Step S926 the user equipment sends back a user authentication authentication request response message to the service network 1, the carrying the expected response value XRES, and the service network 1 compares the expected response value in the security context with the received expected response value. If they are equal, the authenticated user equipment is legal;
  • Step S930 The home network generates a user equipment alias name group corresponding to the new user equipment by using a key K1 shared by the user equipment, where the user equipment alias name identifier includes the MCC and the MNC of the user equipment, and the user data center identifier, the home network. Generating a corresponding newization name index number to determine a corresponding new user equipment name identifier;
  • Step S932 the home network sends a location update request response message to the service network 2, where the message carries the user subscription data, the new user equipment alias name and the newization name index number, or the user data center identifier;
  • Step S934 the service network 2 allocates a new temporary identifier to the user equipment, where the new temporary identifier includes a service network network identifier, a service network device identifier, and a new temporary code allocated for the user equipment, and sends an attach success response message to the user equipment,
  • the message carries a new temporary identifier, and the message also carries a new name index number or a user data center identifier;
  • Step S936 The user equipment uses the key K1 to generate a new user equipment alias name group corresponding to the user equipment, where the user equipment alias name identifier includes the MCC and the MNC of the user equipment, and the user data center identifier, and the user equipment determines the corresponding according to the newization name index number.
  • New user device alias name includes the MCC and the MNC of the user equipment, and the user data center identifier.
  • the foregoing embodiment diagnoses the user device alias name asynchronously through the service network and the home network, and uses the response processing to solve the problem that the home network and the service network user device name identifier are asynchronous.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium (such as ROM/RAM, magnetic).
  • the disc, the optical disc includes a number of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.
  • an in-network authentication processing device is also provided, which is used to implement the foregoing embodiments and preferred embodiments, and has not been described again.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 10 is a structural block diagram 1 of a network access authentication processing apparatus according to an embodiment of the present invention. As shown in FIG. 10, the apparatus includes:
  • the first receiving module 102 is configured to receive an authentication authentication request message sent by the first service network, where the authentication authentication request message carries the user equipment alias name generated by the user equipment;
  • the determining module 104 is connected to the first receiving module 102, and is configured to determine whether the local user device name identifier is asynchronous with the user device alias name generated by the user equipment.
  • the first obtaining module 106 is connected to the foregoing determining module 104, and is configured to obtain an encrypted international mobile subscriber identity (IMSI) to perform network access authentication processing on the user equipment if the determination result is yes.
  • IMSI international mobile subscriber identity
  • the first acquiring module is further configured to send a first authentication authentication failure message to the first service network, where the first authentication authentication failure message carries the asynchronous cause value of the user equipment alias name, and the user equipment
  • the aliasing cause reason value is used to notify the user equipment to re-initiate the attach request carrying the encrypted IMSI to the first serving network according to the user equipment name identifier asynchronous reason value; and obtain the encrypted IMSI according to the attach request, and perform network access authentication processing on the user equipment.
  • the first obtaining module is configured to send a second authentication authentication failure message to the first serving network; and the receiving first service network resends the authentication carrying the encrypted IMSI according to the second authentication authentication failure message. And obtaining an encrypted IMSI according to the authentication authentication request message, and performing network access authentication processing on the user equipment.
  • the first acquiring module is configured to send a request message for requesting to obtain the encrypted IMSI to the first serving network, and obtain the encrypted IMSI according to the response message of the request message; And decrypting the encrypted IMSI, and feeding back the authentication authentication response message to the first service network, where the authentication authentication response message carries the user security context, and the user security context performs network access authentication processing on the user equipment.
  • FIG. 11 is a block diagram of a preferred structure of a network access authentication processing apparatus according to an embodiment of the present invention. As shown in FIG. 11, the apparatus includes, in addition to all the modules shown in FIG.
  • the second receiving module 112 is configured to receive the encrypted IMSI sent by the second serving network
  • the generating module 114 is connected to the second receiving module 112, and is configured to: after determining that the user equipment corresponding to the encrypted IMSI is legal, generate a pseudonym index number corresponding to the user equipment alias name to be used;
  • the first sending module 116 is connected to the generating module 114, and configured to send a pseudonym index number to the second serving network, so as to notify the user equipment to generate the user equipment alias name according to the alias name index.
  • FIG. 12 is a second structural block diagram of a network access authentication processing apparatus according to an embodiment of the present invention. As shown in FIG. 12, the apparatus includes:
  • the second sending module 122 is configured to send an authentication authentication request message to the home network, where the authentication authentication request message carries the user equipment alias name generated by the user equipment;
  • the determining module 124 is connected to the second sending module 122, and is configured to determine, according to the feedback of the home network, that the user equipment alias name in the home network is asynchronous with the user equipment alias name generated by the user equipment;
  • the second obtaining module 126 is connected to the determining module 124, configured to obtain an encrypted international mobile subscriber identity (IMSI), and send the encrypted IMSI to the home network, so that the home network performs network access authentication processing on the user equipment.
  • IMSI international mobile subscriber identity
  • the second obtaining module is further configured to receive the first authentication authentication failure message sent by the home network, where the first authentication authentication failure message carries the asynchronous cause value of the user equipment alias name; to the user equipment Sending a message carrying the device device name identifier asynchronous cause value attachment failure, notifying the user equipment to re-send the attach request carrying the encrypted IMSI to the first service network according to the asynchronous cause value of the user device alias name; and obtaining the encryption according to the attach request
  • the IMSI sends the encrypted IMSI to the home network, so that the home network performs network access authentication processing on the user equipment.
  • the second acquiring module is further configured to receive a second authentication authentication failure message sent by the home network, and send a user equipment identity request message to the user equipment according to the second authentication authentication failure message;
  • the response of the device obtains the encrypted IMSI, and sends an authentication authentication request message carrying the encrypted IMSI to the home network, so that the home network performs the network access authentication process on the user equipment.
  • the second obtaining module is further configured to: receive a request message sent by the home network for requesting to obtain the encrypted IMSI; send a user equipment identity request message to the user equipment according to the request message; and respond according to the user equipment
  • the encrypted IMSI is obtained, and the encrypted IMSI is sent to the home network, so that the home network performs the network access authentication process on the user equipment.
  • FIG. 13 is a block diagram of a preferred structure of the network access authentication processing apparatus according to an embodiment of the present invention. As shown in FIG. 13, the apparatus includes, in addition to all the modules shown in FIG.
  • the third receiving module 132 is configured to receive an attach request sent by the user equipment, where the attach request carries the temporary identifier
  • the third obtaining module 134 is connected to the third receiving module 132, and is configured to acquire a user security context from the second service network according to the temporary identifier.
  • the third sending module 136 is connected to the third obtaining module 134, and is configured to send a request message for acquiring the encrypted IMSI or the user device alias name to the user equipment if the user security context fails to be obtained;
  • the fourth obtaining module 138 is connected to the third sending module 136, and is configured to obtain an encrypted IMSI or a user equipment alias name according to the message, and perform network access authentication processing on the user equipment.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination.
  • the forms are located in different processors.
  • Embodiments of the present invention also provide a storage medium.
  • the above storage medium may be configured to store program code for performing the following steps:
  • the authentication authentication request message sent by the first service network is received, where the authentication authentication request message carries the user equipment alias name generated by the user equipment.
  • the encrypted international mobile subscriber identity (IMSI) is obtained to perform network access authentication processing on the user equipment.
  • the storage medium is further configured to store program code for performing the following steps: obtaining the encrypted IMSI to perform network access authentication processing on the user equipment includes:
  • the first authentication authentication failure message is sent to the first service network, where the first authentication authentication failure message carries the user equipment name identifier asynchronous cause value, and the user equipment alias name identifier asynchronous cause value is used to notify the user equipment according to the user equipment.
  • the alias name asynchronous reason value re-initiates an attach request carrying the encrypted IMSI to the first serving network;
  • S2 Acquire an encrypted IMSI according to the attach request, and perform network access authentication processing on the user equipment.
  • the storage medium is further configured to store program code for performing the following steps: obtaining the encrypted IMSI to perform network access authentication processing on the user equipment includes:
  • the receiving first service network resends an authentication authentication request message carrying the encrypted IMSI according to the second authentication authentication failure message.
  • S3 Acquire an encrypted IMSI according to the authentication authentication request message, and perform network access authentication processing on the user equipment.
  • the storage medium is further configured to store program code for performing the following steps: obtaining the encrypted IMSI to perform network access authentication processing on the user equipment includes:
  • the storage medium is further configured to store program code for performing the following steps: before receiving the authentication authentication request message sent by the first service network, the method further includes:
  • Embodiments of the present invention also provide a storage medium.
  • the above storage medium may be configured to store program code for performing the following steps:
  • S1 Send an authentication authentication request message to the home network, where the authentication authentication request message carries the user equipment alias name generated by the user equipment;
  • IMSI international mobile subscriber identity
  • the storage medium is further configured to store the program code for performing the following steps: acquiring the encrypted IMSI, and transmitting the encrypted IMSI to the home network, so that the home network performs the network access authentication process on the user equipment, including:
  • the first authentication authentication failure message sent by the home network is received, where the first authentication authentication failure message carries an asynchronous cause value of the user equipment alias name.
  • S3 Acquire an encrypted IMSI according to the attach request, and send the encrypted IMSI to the home network, so that the home network performs network access authentication processing on the user equipment.
  • the storage medium is further configured to store the program code for performing the following steps: acquiring the encrypted IMSI, and transmitting the encrypted IMSI to the home network, so that the home network performs the network access authentication process on the user equipment, including:
  • S3 Acquire an encrypted IMSI according to the response of the user equipment, and send an authentication authentication request message carrying the encrypted IMSI to the home network, so that the home network performs network access authentication processing on the user equipment.
  • the storage medium is further configured to store the program code for performing the following steps: acquiring the encrypted IMSI, and transmitting the encrypted IMSI to the home network, so that the home network performs the network access authentication process on the user equipment, including:
  • S3 Acquire an encrypted IMSI according to the response of the user equipment, and send an encrypted IMSI to the home network, so that the home network performs network access authentication processing on the user equipment.
  • the storage medium is further configured to store program code for performing the following steps: before sending the authentication authentication request message to the home network, the method further includes:
  • S4 Obtain an encrypted IMSI or a user equipment alias name according to the message, and perform network access authentication processing on the user equipment.
  • the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • a mobile hard disk e.g., a hard disk
  • magnetic memory e.g., a hard disk
  • the processor performs: receiving, according to the stored program code in the storage medium, an authentication authentication request message sent by the first service network, where the authentication authentication request message carries the user generated by the user equipment.
  • the device name identifier is used to determine whether the local user device name identifier is asynchronous with the user device alias name generated by the user equipment. If the judgment result is negative, the encrypted international mobile subscriber identity IMSI is obtained to perform network access authentication processing on the user equipment.
  • the processor performs, according to the stored program code in the storage medium, the obtaining the encrypted IMSI to perform the network access authentication process on the user equipment, including: sending the first authentication authentication failure message to the first service network, where The first authentication authentication failure message carries the user equipment name identifier asynchronous cause value, and the user equipment alias name identifier asynchronous cause value is used to notify the user equipment to re-initiate the carrying the encrypted IMSI to the first serving network according to the user equipment alias name asynchronous reason value. Attachment request; obtain an encrypted IMSI according to the attach request, and perform network access authentication processing on the user equipment.
  • the processor performs, according to the stored program code in the storage medium: obtaining the encrypted IMSI, performing network access authentication processing on the user equipment, including: sending a second authentication authentication failure message to the first serving network; The first service network resends the authentication authentication request message carrying the encrypted IMSI according to the second authentication authentication failure message; obtains the encrypted IMSI according to the authentication authentication request message, and performs network access authentication processing on the user equipment.
  • the processor performs, according to the stored program code in the storage medium: obtaining the encrypted IMSI, performing the network access authentication process on the user equipment, by: sending a request message for requesting to obtain the encrypted IMSI to the first service network. Acquiring the encrypted IMSI according to the response message of the request message; decrypting the encrypted IMSI, and feeding back the authentication authentication response message to the first service network, wherein the authentication authentication response message carries the user security context, and the user security context performs network access authentication on the user equipment.
  • the processor is configured to: according to the stored program code in the storage medium, before receiving the authentication authentication request message sent by the first service network, further comprising: receiving the encrypted IMSI sent by the second service network. After determining that the user equipment corresponding to the encrypted IMSI is legal, generating a pseudonym index number corresponding to the user equipment alias name to be used; and sending the alias name index number to the second service network, to notify the user equipment to generate the user equipment alias name according to the alias name index.
  • the processor performs: sending, according to the stored program code in the storage medium, an authentication authentication request message to the home network, where the authentication authentication request message carries the user equipment alias name generated by the user equipment. Determining, according to the feedback of the home network, that the user equipment alias name in the home network is asynchronous with the user equipment alias name generated by the user equipment; acquiring the encrypted international mobile subscriber identity IMSI, and transmitting the encrypted IMSI to the home network, so that the home network is connected to the user The device performs network access authentication.
  • the processor performs: acquiring the encrypted IMSI according to the stored program code in the storage medium, and sending the encrypted IMSI to the home network, so that the home network performs the network access authentication process on the user equipment, including: receiving the home network.
  • the user equipment name identifier asynchronous reason value re-initiates the attach request carrying the encrypted IMSI to the first serving network; the encrypted IMSI is obtained according to the attach request, and the encrypted IMSI is sent to the home network, so that the home network performs the network access authentication process on the user equipment.
  • the processor performs: acquiring the encrypted IMSI according to the stored program code in the storage medium, and sending the encrypted IMSI to the home network, so that the home network performs the network access authentication process on the user equipment, including: receiving the home network. Sending a second authentication authentication failure message; sending a user equipment identity request message to the user equipment according to the second authentication authentication failure message; acquiring the encrypted IMSI according to the response of the user equipment, and resending the authentication carrying the encrypted IMSI to the home network The authentication request message is sent so that the home network performs the network access authentication process on the user equipment.
  • the processor performs, according to the stored program code in the storage medium, acquiring the encrypted IMSI, and transmitting the encrypted IMSI to the home network, so that the home network is connected to the user.
  • the device performing the network access authentication process includes: receiving a request message sent by the home network for requesting to obtain the encrypted IMSI; sending a user equipment identity request message to the user equipment according to the request message; acquiring the encrypted IMSI according to the response of the user equipment, and sending the encryption to the home network IMSI, so that the home network performs network access authentication on the user equipment.
  • the processor performs, according to the stored program code in the storage medium, before sending the authentication authentication request message to the home network, the method further includes: receiving an attach request sent by the user equipment, where the attach request Carrying a temporary identifier; obtaining a user security context from the second service network according to the temporary identifier; and sending a request message for obtaining the encrypted IMSI or the user device alias name to the user equipment if the user security context fails to be obtained; and obtaining the encryption according to the message
  • the IMSI or the user equipment alias name identifies the user equipment for network access authentication.
  • modules or steps of the embodiments of the present invention can be implemented by a general computing device, which can be concentrated on a single computing device or distributed in multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from The steps shown or described are performed sequentially, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated into a single integrated circuit module. Thus, embodiments of the invention are not limited to any specific combination of hardware and software.
  • the encrypted international mobile subscriber identity IMSI is obtained to perform network access authentication processing on the user equipment.
  • the problem of how to deal with the user equipment alias name in the user equipment and the user equipment alias name in the home network is not described in the network access process of the related technology.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明实施例提供了一种入网认证处理方法及装置，该方法包括：接收第一服务网络发送的鉴权认证请求消息，其中，鉴权认证请求消息携带有用户设备生成的用户设备化名标识；判断本地用户设备化名标识与用户设备生成的用户设备化名标识是否异步；在判断结果为是的情况下，获取加密国际移动用户识别码IMSI对用户设备进行入网认证处理。通过本发明实施例，可以解决相关技术的入网流程中没有说明用户设备中用户设备化名标识与归属网络中的用户设备化名标识异步时如何处理的问题。

Description

入网认证处理方法及装置 技术领域
本发明实施例涉及通信领域，具体而言，涉及一种入网认证处理方法及装置。
背景技术
移动通信在二十多年时间里得到了飞速发展，给人们的生活方式、工作方式以及社会政治、经济等各方面都带来了巨大的影响。人类社会进入高效的信息化时代，各个方面业务应用需求呈现爆发式增长，给未来无线移动带宽系统在频率、技术以及运营等各方面都带来了巨大的挑战。
未来的移动网络除了为人人通信提供服务外，还将为越来越多的物联网终端提供接入服务。物联网接入给移动网络带来了新的挑战和机遇。不同类型的物联网对网络的需求千差万别，有的要求网络提供高实时高可靠服务，如远程医疗，有的则要求提供有规律的小数据量传输服务，如远程抄表系统。针对不同的业务需求，移动网络可能需要适当优化才能满足业务需求。越来越多的物联网对移动网络提出了越来越多不同的优化需求，其中，有些优化需求还可能相互矛盾，因此，一张融合的核心网越来越无法满足各种不同的物联网需求。
随着网络不断升级改造，5G技术的出现，针对网络的隐私性保护要求越来越高，图1是相关技术中未来5G网络接入的示意图。如图1所示，用户设备在服务网络1完成初始注册，服务网络1从用户设备的归属网络获取鉴权认证向量和用户签约数据，服务网络1完成与用户设备之间的相互认证，然后用户设备可以在服务网络2进行附着，然后进行相关的数据业务。其中服务网络1和服务网络2包括接入网和核心网，归属网络包括用户数据中心/鉴权认证中心。
图2是相关技术中用户设备接入服务网络1保护用户隐私国际移动用 户识别码(International Mobile Subscriber Identification Number，简称IMSI)流程示意图，其中，IMSI储存在SIM卡中，可用于区别移动用户的有效信息，其总长度不超过15位，同样使用0～9的数字。IMSI包括指示移动用户所属国家代号移动信号国家码(Mobile Country Code，简称为MCC)，占3位数字，中国的MCC规定为460；移动网络编码(Mobile Network Code，简称为MNC)是移动网号码，由两位或者三位数字组成，中国移动的MNC为00，用于识别移动用户所归属的移动通信网；以及移动用户识别码(Mobile Subscriber Identification Number，简称为MSIN)用以识别某一移动通信网中的移动用户。步骤具体说明如下：
步骤S201，用户设备使用公钥Kimsi对IMSI进行部分加密，保密方式为，保持原有的MCC和MNC不变，只针对MSIN进行加密。即加密IMSI＝MCC+MNC+加密函数(MSIN，Kimsi)，其中所述的公钥为归属网络的公钥Kimsi；
步骤S202，用户设备向服务网络1发送初始的附着请求消息，所述消息携加密IMSI；
步骤S203，服务网络1根据加密IMSI中的MCC和MNC查找到用户设备的归属网络，向归属网络发送鉴权认证请求消息，所述消息携带加密IMSI；
步骤S204，归属网络使用公钥配对的私钥解密加密IMSI，获得解密的IMSI，查找到加密IMSI对应的用户；
步骤S205，归属网络向服务网络1回送鉴权认证请求响应消息，所述消息携带用户安全上下文，即安全向量组；
步骤S206，归属网络使用一个和用户设备共知的密钥K1产生用户设备对应的用户设备化名标识，该用户设备化名标识用于替代IMSI或者加密IMSI，使得服务网络1可以在后续处理中根据用户设备化名标识查找到用户设备对应的归属网络；
步骤S207，服务网络1向用户设备发送用户鉴权认证请求消息，所 述消息携带认证令牌AUTN和随机数RAND，用户设备通过认证令牌验证网络的合法性，并使用RND计算出期望的响应值XRES；
步骤S208，用户设备向服务网络1回送用户鉴权认证请求响应消息，所述携带期望的响应值XRES，服务网络1将安全上下文中的期望的响应值和收到的期望的响应值比对，如果相等，认证用户设备合法；
步骤S209，用户设备使用K1产生用户设备化名标识，该用户设备化名标识用于替代IMSI或者加密IMSI，使得服务网络1可以在后续处理中根据用户设备化名标识查找到用户设备对应的归属网络；
步骤S210，服务网络1向归属网络发送位置更新请求消息，所述消息携带加密IMSI；
步骤S211，归属网络向服务网络1回送位置更新请求响应消息，所述消息携带用户签约数据和用户设备化名标识；
步骤S212，服务网络1为用户设备分配一个临时标识，临时标识包含服务网络网络标识，服务网络设备标识，以及为用户设备分配的临时编码，向用户设备回送附着成功响应消息，所述消息携带临时标识；
步骤S213，当用户设备与归属网络中用户设备化名标识同步，则使用用户设备化名标识与服务网路1或者服务网络2进行通讯，否则需要用户设备需要使用加密IMSI与服务网路1或者服务网络2进行通讯。
但是，相关技术的入网流程中没有说明用户设备中用户设备化名标识与归属网络中的用户设备化名标识异步时如何处理。
发明内容
本发明实施例提供了一种入网认证处理方法及装置，以至少解决相关技术的入网流程中没有说明用户设备中用户设备化名标识与归属网络中的用户设备化名标识异步时如何处理的问题。
根据本发明的一个实施例，提供了一种入网认证方法，包括：接收第一服务网络发送的鉴权认证请求消息，其中，所述鉴权认证请求消息携带 有用户设备生成的用户设备化名标识；判断本地用户设备化名标识与用户设备生成的用户设备化名标识是否异步；在判断结果为是的情况下，获取加密国际移动用户识别码IMSI对所述用户设备进行入网认证处理。
在本发明实施例中，获取所述加密IMSI对所述用户设备进行入网认证处理包括：向所述第一服务网络发送第一鉴权认证失败消息，其中，所述第一鉴权认证失败消息携带有用户设备化名标识异步原因值，所述用户设备化名标识异步原因值用于通知所述用户设备根据所述用户设备化名标识异步原因值重新向所述第一服务网络发起携带有加密IMSI的附着请求；根据所述附着请求获取所述加密IMSI，对所述用户设备进行入网认证处理。
在本发明实施例中，获取所述加密IMSI对所述用户设备进行入网认证处理包括：向所述第一服务网络发送第二鉴权认证失败消息；接收所述第一服务网络根据所述第二鉴权认证失败消息重新发送携带有所述加密IMSI的鉴权认证请求消息；根据所述鉴权认证请求消息获取所述加密IMSI，对所述用户设备进行入网认证处理。
在本发明实施例中，获取所述加密IMSI对所述用户设备进行入网认证处理包括：向所述第一服务网络发送用于请求获取加密IMSI的请求消息；根据所述请求消息的响应消息获取所述加密IMSI；解密所述加密IMSI，向所述第一服务网络反馈鉴权认证响应消息，其中，所述鉴权认证响应消息携带有用户安全上下文，所述用户安全上下文对所述用户设备进行入网认证处理。
在本发明实施例中，在接收所述第一服务网络发送的鉴权认证请求消息之前，还包括：接收第二服务网络发送的加密IMSI；确定所述加密IMSI对应的所述用户设备合法后，生成将要使用的用户设备化名标识对应的化名索引号；向第二服务网络发送所述化名索引号，以便通知所述用户设备根据所述化名索引号生成用户设备化名标识。
根据本发明实施例的另一个实施例，提供了一种入网认证处理方法， 包括：向归属网络发送鉴权认证请求消息，其中，所述鉴权认证请求消息携带有用户设备生成的用户设备化名标识；根据所述归属网络的反馈，确定所述归属网络中用户设备化名标识与用户设备生成的用户设备化名标识异步；获取加密国际移动用户识别码IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理。
在本发明实施例中，获取所述加密IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理包括：接收所述归属网络发送的第一鉴权认证失败消息，其中，所述第一鉴权认证失败消息携带有用户设备化名标识异步原因值；向所述用户设备发送携带有所述用户设备化名标识异步原因值附着失败消息，通知所述用户设备根据所述用户设备化名标识异步原因值重新向所述第一服务网络发起携带有加密IMSI的附着请求；根据所述附着请求获取所述加密IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理。
在本发明实施例中，获取所述加密IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理包括：接收所述归属网络发送的第二鉴权认证失败消息；根据所述第二鉴权认证失败消息，向所述用户设备发送用户设备标识请求消息；根据所述用户设备的响应获取加密IMSI，重新向所述归属网络发送携带有所述加密IMSI的鉴权认证请求消息，以便所述归属网络对所述用户设备进行入网认证处理。
在本发明实施例中，获取所述加密IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理包括：接收所述归属网络发送的用于请求获取加密IMSI的请求消息；根据所述请求消息，向所述用户设备发送用户设备标识请求消息；根据所述用户设备的响应获取加密IMSI，向所述归属网络发送加密IMSI，以便所述归属网络对所述用户设备进行入网认证处理。
在本发明实施例中，在向归属网络发送鉴权认证请求消息之前，还包括：接收所述用户设备发送的附着请求，其中，所述附着请求携带有临时标识；根据所述临时标识从第二服务网络获取用户安全上下文；在获取所述用户安全上下文失败的情况下，向所述用户设备发送用于获取加密IMSI或者用户设备化名标识的请求消息；根据所述消息获取所述加密IMSI或者所述用户设备化名标识，对所述用户设备进行入网认证处理。
根据本发明的又一个实施例，提供了一种入网认证处理装置，包括：第一接收模块，设置为接收第一服务网络发送的鉴权认证请求消息，其中，所述鉴权认证请求消息携带有用户设备生成的用户设备化名标识；判断模块，设置为判断本地用户设备化名标识与用户设备生成的用户设备化名标识是否异步；第一获取模块，设置为在判断结果为是的情况下，获取加密国际移动用户识别码IMSI对所述用户设备进行入网认证处理。
在本发明实施例中，所述第一获取模块，还设置为向所述第一服务网络发送第一鉴权认证失败消息，其中，所述第一鉴权认证失败消息携带有用户设备化名标识异步原因值，所述用户设备化名标识异步原因值用于通知所述用户设备根据所述用户设备化名标识异步原因值重新向所述第一服务网络发起携带有加密IMSI的附着请求；以及根据所述附着请求获取所述加密IMSI，对所述用户设备进行入网认证处理。
在本发明实施例中，所述第一获取模块，设置为向所述第一服务网络发送第二鉴权认证失败消息；接收所述第一服务网络根据所述第二鉴权认证失败消息重新发送携带有所述加密IMSI的鉴权认证请求消息；以及根据所述鉴权认证请求消息获取所述加密IMSI，对所述用户设备进行入网认证处理。
在本发明实施例中，所述第一获取模块，设置为向所述第一服务网络发送用于请求获取加密IMSI的请求消息；根据所述请求消息的响应消息获取所述加密IMSI；以及解密所述加密IMSI，向所述第一服务网络反馈鉴权认证响应消息，其中，所述鉴权认证响应消息携带有用户安全上下文， 所述用户安全上下文对所述用户设备进行入网认证处理。
在本发明实施例中，还包括：第二接收模块，设置为接收第二服务网络发送的加密IMSI；生成模块，设置为确定所述加密IMSI对应的所述用户设备合法后，生成将要使用的用户设备化名标识对应的化名索引号；第一发送模块，设置为向第二服务网络发送所述化名索引号，以便通知所述用户设备根据所述化名索引号生成用户设备化名标识。
根据本发明实施例的又一个实施例，提供了一种入网认证处理装置，包括：第二发送模块，设置为向归属网络发送鉴权认证请求消息，其中，所述鉴权认证请求消息携带有用户设备生成的用户设备化名标识；确定模块，设置为根据所述归属网络的反馈，确定所述归属网络中用户设备化名标识与用户设备生成的用户设备化名标识异步；第二获取模块，设置为获取加密国际移动用户识别码IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理。
在本发明实施例中，第二获取模块，还设置为接收所述归属网络发送的第一鉴权认证失败消息，其中，所述第一鉴权认证失败消息携带有用户设备化名标识异步原因值；向所述用户设备发送携带有所述用户设备化名标识异步原因值附着失败消息，通知所述用户设备根据所述用户设备化名标识异步原因值重新向所述第一服务网络发起携带有加密IMSI的附着请求；以及根据所述附着请求获取所述加密IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理。
在本发明实施例中，第二获取模块，还设置为接收所述归属网络发送的第二鉴权认证失败消息；根据所述第二鉴权认证失败消息，向所述用户设备发送用户设备标识请求消息；以及根据所述用户设备的响应获取加密IMSI，重新向所述归属网络发送携带有所述加密IMSI的鉴权认证请求消息，以便所述归属网络对所述用户设备进行入网认证处理。
在本发明实施例中，第二获取模块，还设置为接收所述归属网络发送的用于请求获取加密IMSI的请求消息；根据所述请求消息，向所述用户 设备发送用户设备标识请求消息；以及根据所述用户设备的响应获取加密IMSI，向所述归属网络发送加密IMSI，以便所述归属网络对所述用户设备进行入网认证处理。
在本发明实施例中，还包括：第三接收模块，设置为接收所述用户设备发送的附着请求，其中，所述附着请求携带有临时标识；第三获取模块，设置为根据所述临时标识从第二服务网络获取用户安全上下文；第三发送模块，设置为在获取所述用户安全上下文失败的情况下，向所述用户设备发送用于获取加密IMSI或者用户设备化名标识的请求消息；第四获取模块，设置为根据所述消息获取所述加密IMSI或者所述用户设备化名标识，对所述用户设备进行入网认证处理。
根据本发明实施例的又一个实施例，还提供了一种存储介质。该存储介质设置为存储用于执行以下步骤的程序代码：接收第一服务网络发送的鉴权认证请求消息，其中，所述鉴权认证请求消息携带有用户设备生成的用户设备化名标识；判断本地用户设备化名标识与用户设备生成的用户设备化名标识是否异步；在判断结果为是的情况下，获取加密国际移动用户识别码IMSI对所述用户设备进行入网认证处理。
在本发明实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：获取所述加密IMSI对所述用户设备进行入网认证处理包括：向所述第一服务网络发送第一鉴权认证失败消息，其中，所述第一鉴权认证失败消息携带有用户设备化名标识异步原因值，所述用户设备化名标识异步原因值用于通知所述用户设备根据所述用户设备化名标识异步原因值重新向所述第一服务网络发起携带有加密IMSI的附着请求；根据所述附着请求获取所述加密IMSI，对所述用户设备进行入网认证处理。
在本发明实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：获取所述加密IMSI对所述用户设备进行入网认证处理包括：向所述第一服务网络发送第二鉴权认证失败消息；接收所述第一服务网络根据所述第二鉴权认证失败消息重新发送携带有所述加密IMSI的鉴权认证请 求消息；根据所述鉴权认证请求消息获取所述加密IMSI，对所述用户设备进行入网认证处理。
在本发明实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：获取所述加密IMSI对所述用户设备进行入网认证处理包括：向所述第一服务网络发送用于请求获取加密IMSI的请求消息；根据所述请求消息的响应消息获取所述加密IMSI；解密所述加密IMSI，向所述第一服务网络反馈鉴权认证响应消息，其中，所述鉴权认证响应消息携带有用户安全上下文，所述用户安全上下文对所述用户设备进行入网认证处理。
在本发明实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：在接收所述第一服务网络发送的鉴权认证请求消息之前，还包括：接收第二服务网络发送的加密IMSI；确定所述加密IMSI对应的所述用户设备合法后，生成将要使用的用户设备化名标识对应的化名索引号；向第二服务网络发送所述化名索引号，以便通知所述用户设备根据所述化名索引号生成用户设备化名标识。
根据本发明实施例的又一个实施例，还提供了一种存储介质。该存储介质设置为存储用于执行以下步骤的程序代码：向归属网络发送鉴权认证请求消息，其中，所述鉴权认证请求消息携带有用户设备生成的用户设备化名标识；根据所述归属网络的反馈，确定所述归属网络中用户设备化名标识与用户设备生成的用户设备化名标识异步；获取加密国际移动用户识别码IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理。
在本发明实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：获取所述加密IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理包括：接收所述归属网络发送的第一鉴权认证失败消息，其中，所述第一鉴权认证失败消息携带有用户设备化名标识异步原因值；向所述用户设备发送携带有所述用户设备化名标识异步原因值附着失败消息，通知所述用户设备根据所述用户设备 化名标识异步原因值重新向所述第一服务网络发起携带有加密IMSI的附着请求；根据所述附着请求获取所述加密IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理。
在本发明实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：获取所述加密IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理包括：接收所述归属网络发送的第二鉴权认证失败消息；根据所述第二鉴权认证失败消息，向所述用户设备发送用户设备标识请求消息；根据所述用户设备的响应获取加密IMSI，重新向所述归属网络发送携带有所述加密IMSI的鉴权认证请求消息，以便所述归属网络对所述用户设备进行入网认证处理。
在本发明实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：获取所述加密IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理包括：接收所述归属网络发送的用于请求获取加密IMSI的请求消息；根据所述请求消息，向所述用户设备发送用户设备标识请求消息；根据所述用户设备的响应获取加密IMSI，向所述归属网络发送加密IMSI，以便所述归属网络对所述用户设备进行入网认证处理。
在本发明实施例中，存储介质还设置为存储用于执行以下步骤的程序代码：在向归属网络发送鉴权认证请求消息之前，还包括：接收所述用户设备发送的附着请求，其中，所述附着请求携带有临时标识；根据所述临时标识从第二服务网络获取用户安全上下文；在获取所述用户安全上下文失败的情况下，向所述用户设备发送用于获取加密IMSI或者用户设备化名标识的请求消息；根据所述消息获取所述加密IMSI或者所述用户设备化名标识，对所述用户设备进行入网认证处理。
通过本发明实施例，接收第一服务网络发送的鉴权认证请求消息，其中，鉴权认证请求消息携带有用户设备生成的用户设备化名标识；判断本地用户设备化名标识与用户设备生成的用户设备化名标识是否异步；在判 断结果为是的情况下，获取加密国际移动用户识别码IMSI对用户设备进行入网认证处理。由于在本地用户设备化名标识与用户设备生成的用户设备化名标识异步时，获取加密国际移动用户识别码IMSI对用户设备进行入网认证处理，因此，可以解决相关技术的入网流程中没有说明用户设备中用户设备化名标识与归属网络中的用户设备化名标识异步时如何处理的问题。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是相关技术中未来5G网络接入的示意图；
图2是相关技术中用户设备接入服务网络1保护用户隐私国际移动用户识别码IMSI流程示意图；
图3是本发明实施例的一种入网认证处理方法的计算机终端的硬件结构框图；
图4是根据本发明实施例的入网认证处理方法的流程图一；
图5是根据本发明实施例的入网认证处理方法的流程图二；
图6是根据本发明实施例的服务网络获取上下文失败处理的流程示意图；
图7是根据本发明实施例的归属网络发现用户设备化名标识异步处理的流程示意图一；
图8是根据本发明实施例的归属网络发现用户设备化名标识异步处理的流程示意图二；
图9是根据本发明实施例的归属网络发现用户设备化名标识异步处理的流程示意图三；
图10是根据本发明实施例的入网认证处理装置的结构框图一；
图11是根据本发明实施例的入网认证处理装置的优选结构框图一；
图12是根据本发明实施例的入网认证处理装置的结构框图二；
图13是根据本发明实施例的入网认证处理装置的优选结构框图二。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明实施例。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
实施例1
本申请实施例1所提供的方法实施例可以在计算机终端或者类似的运算装置中执行。以运行在计算机终端上为例，图3是本发明实施例的一种入网认证处理方法的计算机终端的硬件结构框图。如图3所示，计算机终端30可以包括一个或多个(图中仅示出一个)处理器302(处理器302可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)、用于存储数据的存储器304、以及用于通信功能的传输装置306。本领域普通技术人员可以理解，图3所示的结构仅为示意，其并不对上述电子装置的结构造成限定。例如，计算机终端30还可包括比图3中所示更多或者更少的组件，或者具有与图3所示不同的配置。
存储器304可用于存储应用软件的软件程序以及模块，如本发明实施例中的入网认证处理方法对应的程序指令/模块，处理器302通过运行存储在存储器304内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的方法。存储器304可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器304可进一步包括相对于处理器302 远程设置的存储器，这些远程存储器可以通过网络连接至计算机终端30。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置306用于经由一个网络接收或者发送数据。上述的网络具体实例可包括计算机终端30的通信供应商提供的无线网络。在一个实例中，传输装置306包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置306可以为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网进行通讯。
在本实施例中提供了一种运行于上述计算机终端的入网认证处理方法，图4是根据本发明实施例的入网认证处理方法的流程图一，如图4所示，该流程包括如下步骤：
步骤S402，接收第一服务网络发送的鉴权认证请求消息，其中，鉴权认证请求消息携带有用户设备生成的用户设备化名标识；
步骤S404，判断本地用户设备化名标识与用户设备生成的用户设备化名标识是否异步；
步骤S406，在判断结果为是的情况下，获取加密国际移动用户识别码IMSI对用户设备进行入网认证处理。
通过上述步骤，由于在本地用户设备化名标识与用户设备生成的用户设备化名标识异步时，获取加密国际移动用户识别码IMSI对用户设备进行入网认证处理，因此，可以解决相关技术的入网流程中没有说明用户设备中用户设备化名标识与归属网络中的用户设备化名标识异步时如何处理的问题。
在本发明实施例中，获取加密IMSI对用户设备进行入网认证处理包括：向第一服务网络发送第一鉴权认证失败消息，其中，第一鉴权认证失败消息携带有用户设备化名标识异步原因值，用户设备化名标识异步原因值用于通知用户设备根据用户设备化名标识异步原因值重新向第一服务 网络发起携带有加密IMSI的附着请求；根据附着请求获取加密IMSI，对用户设备进行入网认证处理。通过上述步骤，由于在重新进行附着流程，来生成用户设备化名标识以保证本地用户设备化名标识与用户设备生成的用户设备化名标识同步，可以生成更安全的用户设备化名标识。
在本发明实施例中，获取加密IMSI对用户设备进行入网认证处理包括：向第一服务网络发送第二鉴权认证失败消息；接收第一服务网络根据第二鉴权认证失败消息重新发送携带有加密IMSI的鉴权认证请求消息；根据鉴权认证请求消息获取加密IMSI，对用户设备进行入网认证处理。通过上述步骤，由于仅重新接收携带有加密IMSI的鉴权认证请求消息，来生成用户设备化名标识以保证本地用户设备化名标识与用户设备生成的用户设备化名标识同步，无需从附着流程初始步骤重新开始，可以节省生成用户设备化名标识的时间。
在本发明实施例中，获取加密IMSI对用户设备进行入网认证处理包括：向第一服务网络发送用于请求获取加密IMSI的请求消息；根据请求消息的响应消息获取加密IMSI；解密加密IMSI，向第一服务网络反馈鉴权认证响应消息，其中，鉴权认证响应消息携带有用户安全上下文，用户安全上下文对用户设备进行入网认证处理。通过上述步骤，由于直接获取加密IMSI，无需重新接收携带有加密IMSI的鉴权认证请求消息，即可生成用户设备化名标识以保证本地用户设备化名标识与用户设备生成的用户设备化名标识同步，可以更快捷、更直接的生成用户设备化名标识。
在本发明实施例中，在接收第一服务网络发送的鉴权认证请求消息之前，还包括：接收第二服务网络发送的加密IMSI；确定加密IMSI对应的用户设备合法后，生成将要使用的用户设备化名标识对应的化名索引号；向第二服务网络发送化名索引号，以便通知用户设备根据化名索引号生成用户设备化名标识。由于生成了将要使用的用户设备化名标识对应的化名索引号，使得用户设备可以根据化名索引号生成用户设备化名标识，无需通过与服务网络互相认证后再次解密加密IMSI来生成用户设备化名标识，减小了归属网络的负担。
在本实施例中提供了一种运行于上述计算机终端的入网认证处理方法，图5是根据本发明实施例的入网认证处理方法的流程图二，如图5所示，该流程包括如下步骤：
步骤S502，向归属网络发送鉴权认证请求消息，其中，鉴权认证请求消息携带有用户设备生成的用户设备化名标识；
步骤S504，根据归属网络的反馈，确定归属网络中用户设备化名标识与用户设备生成的用户设备化名标识异步；
步骤S506，获取加密国际移动用户识别码IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理。
通过上述步骤，由于在归属网络中用户设备化名标识与用户设备生成的用户设备化名标识异步时，获取加密国际移动用户识别码IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理，因此，可以解决相关技术的入网流程中没有说明用户设备中用户设备化名标识与归属网络中的用户设备化名标识异步时如何处理的问题。
在本发明实施例中，获取加密IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理包括：接收归属网络发送的第一鉴权认证失败消息，其中，第一鉴权认证失败消息携带有用户设备化名标识异步原因值；向用户设备发送携带有用户设备化名标识异步原因值附着失败消息，通知用户设备根据用户设备化名标识异步原因值重新向第一服务网络发起携带有加密IMSI的附着请求；根据附着请求获取加密IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理。通过上述步骤，由于在重新进行附着流程，来生成用户设备化名标识以保证本地用户设备化名标识与用户设备生成的用户设备化名标识同步，可以生成更安全的用户设备化名标识。
在本发明实施例中，获取加密IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理包括：接收归属网络发送的第二鉴权认证失败消息；根据第二鉴权认证失败消息，向用户设备发送用户 设备标识请求消息；根据用户设备的响应获取加密IMSI，重新向归属网络发送携带有加密IMSI的鉴权认证请求消息，以便归属网络对用户设备进行入网认证处理。通过上述步骤，由于仅重新接收携带有加密IMSI的鉴权认证请求消息，来生成用户设备化名标识以保证本地用户设备化名标识与用户设备生成的用户设备化名标识同步，无需从附着流程初始步骤重新开始，可以节省生成用户设备化名标识的时间。
在本发明实施例中，获取加密IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理包括：接收归属网络发送的用于请求获取加密IMSI的请求消息；根据请求消息，向用户设备发送用户设备标识请求消息；根据用户设备的响应获取加密IMSI，向归属网络发送加密IMSI，以便归属网络对用户设备进行入网认证处理。通过上述步骤，由于直接获取加密IMSI，无需重新接收携带有加密IMSI的鉴权认证请求消息，即可生成用户设备化名标识以保证本地用户设备化名标识与用户设备生成的用户设备化名标识同步，可以更快捷、更直接的生成用户设备化名标识。
在本发明实施例中，在向归属网络发送鉴权认证请求消息之前，还包括：接收用户设备发送的附着请求，其中，附着请求携带有临时标识；根据临时标识从第二服务网络获取用户安全上下文；在获取用户安全上下文失败的情况下，向用户设备发送用于获取加密IMSI或者用户设备化名标识的请求消息；根据消息获取加密IMSI或者用户设备化名标识，对所述用户设备进行入网认证处理。
为了方便理解上述实施例，以第二服务网络为服务网络1，第一服务网络为服务网络2为例进行详细说明。
图6是根据本发明实施例的服务网络获取上下文失败处理的流程示意图。其核心思想为：归属网络解密加密IMSI后，向服务网络传送安全上下文和解密IMSI，服务网络与用户设备实现双向认证后，归属网络产生用户设备化名标识组，并确定使用的用户设备化名标识的化名索引号，并 用服务网络发送用户签约数据和用户设备化名标识，以及化名索引号，服务网络向用户设备发送临时标识和化名索引号，用户设备根据化名索引号产生用户设备化名标识。用户设备使用临时标识向服务网络发起附着请求，服务网络根据其他服务网络获取用户上下文失败，服务网络向用户设备发起获取用户设备标识请求，所述请求类型为加密IMSI或者用户设备化名标识，服务网络使用加密IMSI或者用户设备化名标识完成附着流程。如图6所示，该流程包括如下步骤：
步骤S602，用户设备使用公钥Kimsi对IMSI进行部分加密，保密方式为，保持原有的MCC和MNC不变，只针对MSIN进行加密。即加密IMSI＝MCC+MNC+加密函数(MSIN，Kimsi)，其中所述的公钥为归属网络的公钥Kimsi；
步骤S604，用户设备向服务网络1发送初始的附着请求消息，所述消息携加密IMSI；
步骤S606，服务网络1根据加密IMSI中的MCC和MNC查找到用户设备的归属网络，向归属网络发送鉴权认证请求消息，所述消息携带加密IMSI；
步骤S608，归属网络使用公钥配对的私钥解密加密IMSI，获得解密的IMSI，查找到加密IMSI对应的用户；
步骤S610，归属网络向服务网络1回送鉴权认证请求响应消息，所述消息携带用户安全上下文，即安全向量组，所述消息还携带解密的IMSI；
步骤S612，服务网络1向用户设备发送用户鉴权认证请求消息，所述消息携带认证令牌AUTN和随机数RAND，用户设备通过认证令牌验证网络的合法性，并使用RND计算出期望的响应值XRES；
步骤S614，用户设备向服务网络1回送用户鉴权认证请求响应消息，所述携带期望的响应值XRES，服务网络1将安全上下文中的期望的响应值和收到的期望的响应值比对，如果相等，认证用户设备合法；
步骤S616，服务网络1向归属网络发送位置更新请求消息，所述消 息携带IMSI；
步骤S618，归属网络使用一个和用户设备共知的密钥K1产生用户设备对应的用户设备化名标识组，所述用户设备化名标识包括用户设备的MCC和MNC，用户数据中心标识，归属网络产生一个对应的化名索引号，确定对应的用户设备化名标识；
步骤S620，归属网络向服务网络1回送位置更新请求响应消息，所述消息携带用户签约数据、用户设备化名标识和化名索引号，或者用户数据中心标识；
步骤S622，服务网络1为用户设备分配一个临时标识，临时标识包含服务网络网络标识，服务网络设备标识，以及为用户设备分配的临时编码，向用户设备回送附着成功响应消息，所述消息携带临时标识，所述消息还携带化名索引号，或者用户数据中心标识；
步骤S624，用户设备根据化名索引号确定对应的用户设备化名标识，所述用户设备化名标识包括用户设备的MCC和MNC，和用户数据中心标识；
步骤S626，用户设备向服务网络2发送附着请求消息，所述消息携临时标识；
步骤S628，服务网络2根据临时标识查询，发现本地无用户上下文，根据临时标识中的服务网络网络标识和服务网络设备标识向服务网络1发起获取用户上下文请求消息，所述消息携带临时标识，或者根据临时标识无法找到对应的服务网络，或者对应的服务网络1通讯链路异常，则跳转到步骤S632；
步骤S630，服务网络1根据临时标识不能发现对应用户上下文，向服务网络2回送获取用户上下文失败响应消息；
步骤S632，服务网络2向用户设备发起标识请求消息，标识请求类型为加密IMSI或者用户设备化名标识其中之一；
步骤S634，用户设备根据标识请求类型，选择对应的加密IMSI或者 用户设备化名标识，向服务网络2回送标识请求响应消息，所述消息携带加密IMSI或者用户设备化名标识；
步骤S636，服务网络2根据加密IMSI中或者用户设备化名标识的MCC和MNC查找到用户设备的归属网络，向归属网络发送鉴权认证请求消息，所述消息携带加密IMSI或者用户设备化名标识；
步骤S638，如果上述消息携带的是加密IMSI，归属网络使用公钥配对的私钥解密加密IMSI，获得解密的IMSI，查找到加密IMSI对应的用户；归属网络向服务网络2回送鉴权认证请求响应消息，所述消息携带用户安全上下文，即安全向量组，所述消息还携带解密的IMSI，如果上述消息携带的用户设备化名标识，根据用户设备化名标识中的用户数据中心，找到用户数据中心，在用户数据中心中找到对应的用户，向服务网络2回送鉴权认证请求响应消息，所述消息携带用户安全上下文，即安全向量组；
步骤S640，服务网络1向用户设备发送用户鉴权认证请求消息，所述消息携带认证令牌AUTN和随机数RAND，用户设备通过认证令牌验证网络的合法性，并使用RND计算出期望的响应值XRES；
步骤S642，用户设备向服务网络1回送用户鉴权认证请求响应消息，所述携带期望的响应值XRES，服务网络1将安全上下文中的期望的响应值和收到的期望的响应值比对，如果相等，认证用户设备合法；
步骤S644，服务网络2向归属网络发送位置更新请求消息，所述消息携带IMSI或者用户设备化名标识；
步骤S646，归属网络使用一个和用户设备共知的密钥K1产生新用户设备对应的用户设备化名标识组，所述用户设备化名标识包括用户设备的MCC和MNC，和用户数据中心标识，归属网络产生一个对应的新化名索引号，确定对应的新用户设备化名标识；
步骤S648，归属网络向服务网络2回送位置更新请求响应消息，所述消息携带用户签约数据、新用户设备化名标识和新化名索引号，或者用户数据中心标识；
步骤S650，服务网络2为用户设备分配一个新临时标识，新临时标识包含服务网络网络标识，服务网络设备标识，以及为用户设备分配的新临时编码，向用户设备回送附着成功响应消息，所述消息携带新临时标识，所述消息还携带新化名索引号，或者用户数据中心标识；
步骤S652，用户设备使用密钥K1产生用户设备对应的新用户设备化名标识组，所述用户设备化名标识包括用户设备的MCC和MNC，和用户数据中心标识，用户设备根据新化名索引号确定对应的新用户设备化名标识。
图7是根据本发明实施例的归属网络发现用户设备化名标识异步处理的流程示意图一，其核心思想为：归属网络接收到服务网络鉴权请求消息后，发现与用户设备中的用户设备化名标识异步，向服务网络回送鉴权认证失败消息，所述消息携带用户设备化名标识异步原因值，服务网络向用户设备回送附着失败消息，所述消息携带用户设备化名标识异步原因值，用户设备根据用户设备化名标识异步原因值使用加密IMSI向服务网络发起重新附着请求。如图7所示，该流程包括如下步骤：
步骤S702，按照步骤S602-步骤S624完成在服务网络1中的初始注册，或者在其他网络完成一次注册，用户设备具有临时标识和用户设备化名标识；
步骤S704，用户设备向服务网络2发送附着请求消息，所述消息携临时标识；
步骤S706，服务网络2根据临时标识查询，发现本地无用户上下文，根据临时标识中的服务网络网络标识和服务网络设备标识向服务网络1发起获取用户上下文请求消息，所述消息携带临时标识；
步骤S708，服务网络1根据临时标识查找到对应用户上下文，向服务网络2回送获取用户上下文响应消息，所述消息携带用户上下文；
步骤S710，服务网络2根据用户上下文中的用户设备化名标识的MCC和MNC查找到用户设备的归属网络，向归属网络发送鉴权认证请求消息， 所述消息携带用户设备化名标识；
步骤S712，归属网络根据用户设备化名标识查询用户失败；
步骤S714，归属网络向服务网络2回送鉴权认证失败消息，所述消息携带用户设备化名标识查询失败原因值；
步骤S716，服务网络2向用户设备回送附着失败响应消息，所述消息携带用户设备化名标识查询失败原因值；
步骤S718，用户设备根据失败原因值，向服务网络2发起附着请求消息，所述消息携带加密IMSI；
步骤S720，按照步骤S604-S624完成在服务网络2类似初始注册的附着流程。
图8是根据本发明实施例的归属网络发现用户设备化名标识异步处理的流程示意图二，其核心思想为：归属网络接收到服务网络鉴权请求消息后，发现与用户设备中的用户设备化名标识异步，向服务网络回送鉴权认证失败消息，所述消息携带用户设备化名标识异步原因值，服务网络向用户设备发起用户设备标识请求消息，所述请求标识类型为加密IMSI，服务网络使用加密IMSI发起重新鉴权认证过程，并完成后续的附着流程。如图8所示，该流程包括如下步骤：
步骤S802，按照步骤S602-步骤S624完成在服务网络1中的初始注册，或者在其他网络完成一次注册，用户设备具有临时标识和用户设备化名标识；
步骤S804，用户设备向服务网络2发送附着请求消息，所述消息携临时标识；
步骤S806，服务网络2根据临时标识查询，发现本地无用户上下文，根据临时标识中的服务网络网络标识和服务网络设备标识向服务网络1发起获取用户上下文请求消息，所述消息携带临时标识；
步骤S808，服务网络1根据临时标识查找到对应用户上下文，向服 务网络2回送获取用户上下文响应消息，所述消息携带用户上下文；
步骤S810，服务网络2根据用户上下文中的用户设备化名标识的MCC和MNC查找到用户设备的归属网络，向归属网络发送鉴权认证请求消息，所述消息携带用户设备化名标识；
步骤S812，归属网络根据用户设备化名标识查询用户失败；
步骤S814，归属网络向服务网络2回送鉴权认证失败消息，所述消息携带用户设备化名标识查询失败原因值；
步骤S816，服务网络2向用户设备发起标识请求消息，标识请求类型为加密IMSI；
步骤S818，用户设备根据标识请求类型，选择对应的加密IMSI，向服务网络2回送标识请求响应消息，所述消息携带加密IMSI；
步骤S820，服务网络2根据加密IMSI中或者用户设备化名标识的MCC和MNC查找到用户设备的归属网络，向归属网络发送鉴权认证请求消息，所述消息携带加密IMSI；
步骤S822，归属网络使用公钥配对的私钥解密加密IMSI，获得解密的IMSI，查找到加密IMSI对应的用户；归属网络向服务网络2回送鉴权认证请求响应消息，所述消息携带用户安全上下文，即安全向量组，所述消息还携带解密的IMSI；
步骤S824，服务网络1向用户设备发送用户鉴权认证请求消息，所述消息携带认证令牌AUTN和随机数RAND，用户设备通过认证令牌验证网络的合法性，并使用RND计算出期望的响应值XRES；
步骤S826，用户设备向服务网络1回送用户鉴权认证请求响应消息，所述携带期望的响应值XRES，服务网络1将安全上下文中的期望的响应值和收到的期望的响应值比对，如果相等，认证用户设备合法；
步骤S828，服务网络2向归属网络发送位置更新请求消息，所述消息携带IMSI；
步骤S830，归属网络使用一个和用户设备共知的密钥K1产生新用户设备对应的用户设备化名标识组，所述用户设备化名标识包括用户设备的MCC和MNC，和用户数据中心标识，归属网络产生一个对应的新化名索引号，确定对应的新用户设备化名标识；
步骤S832，归属网络向服务网络2回送位置更新请求响应消息，所述消息携带用户签约数据、新用户设备化名标识和新化名索引号，或者用户数据中心标识；
步骤S834，服务网络2为用户设备分配一个新临时标识，新临时标识包含服务网络网络标识，服务网络设备标识，以及为用户设备分配的新临时编码，向用户设备回送附着成功响应消息，所述消息携带新临时标识，所述消息还携带新化名索引号，或者用户数据中心标识；
步骤S836，用户设备使用密钥K1产生用户设备对应的新用户设备化名标识组，所述用户设备化名标识包括用户设备的MCC和MNC，和用户数据中心标识，用户设备根据新化名索引号确定对应的新用户设备化名标识。
图9是根据本发明实施例的归属网络发现用户设备化名标识异步处理的流程示意图三，其核心思想为：归属网络接收到服务网络鉴权请求消息后，发现与用户设备中的用户设备化名标识异步，向服务网络发送获取加密IMSI请求消息，服务网络向用户设备发起用户设备标识请求消息，所述请求标识类型为加密IMSI，归属网络获取到加密IMSI后，解密IMSI，并完成后续的附着流程。如图9所示，该流程包括如下步骤：
步骤S902，按照步骤S602-步骤S624完成在服务网络1中的初始注册，或者在其他网络完成一次注册，用户设备具有临时标识和用户设备化名标识；
步骤S904，用户设备向服务网络2发送附着请求消息，所述消息携临时标识；
步骤S906，服务网络2根据临时标识查询，发现本地无用户上下文， 根据临时标识中的服务网络网络标识和服务网络设备标识向服务网络1发起获取用户上下文请求消息，所述消息携带临时标识；
步骤S908，服务网络1根据临时标识查找到对应用户上下文，向服务网络2回送获取用户上下文响应消息，所述消息携带用户上下文；
步骤S910，服务网络2根据用户上下文中的用户设备化名标识的MCC和MNC查找到用户设备的归属网络，向归属网络发送鉴权认证请求消息，所述消息携带用户设备化名标识；
步骤S912，归属网络根据用户设备化名标识查询用户失败；
步骤S914，归属网络向服务网络2发送获取用户加密IMSI请求消息；
步骤S916，服务网络2向用户设备发起标识请求消息，标识请求类型为加密IMSI；
步骤S918，用户设备根据标识请求类型，选择对应的加密IMSI，向服务网络2回送标识请求响应消息，所述消息携带加密IMSI；
步骤S920，服务网络2向归属网络回送获取用户加密IMSI响应消息，所述消息携带加密IMSI；
步骤S922，归属网络使用公钥配对的私钥解密加密IMSI，获得解密的IMSI，查找到加密IMSI对应的用户；归属网络向服务网络2回送鉴权认证请求响应消息，所述消息携带用户安全上下文，即安全向量组，所述消息还携带解密的IMSI；
步骤S924，服务网络1向用户设备发送用户鉴权认证请求消息，所述消息携带认证令牌AUTN和随机数RAND，用户设备通过认证令牌验证网络的合法性，并使用RND计算出期望的响应值XRES；
步骤S926，用户设备向服务网络1回送用户鉴权认证请求响应消息，所述携带期望的响应值XRES，服务网络1将安全上下文中的期望的响应值和收到的期望的响应值比对，如果相等，认证用户设备合法；
步骤S928，服务网络2向归属网络发送位置更新请求消息，所述消 息携带IMSI；
步骤S930，归属网络使用一个和用户设备共知的密钥K1产生新用户设备对应的用户设备化名标识组，所述用户设备化名标识包括用户设备的MCC和MNC，和用户数据中心标识，归属网络产生一个对应的新化名索引号，确定对应的新用户设备化名标识；
步骤S932，归属网络向服务网络2回送位置更新请求响应消息，所述消息携带用户签约数据、新用户设备化名标识和新化名索引号，或者用户数据中心标识；
步骤S934，服务网络2为用户设备分配一个新临时标识，新临时标识包含服务网络网络标识，服务网络设备标识，以及为用户设备分配的新临时编码，向用户设备回送附着成功响应消息，所述消息携带新临时标识，所述消息还携带新化名索引号，或者用户数据中心标识；
步骤S936，用户设备使用密钥K1产生用户设备对应的新用户设备化名标识组，所述用户设备化名标识包括用户设备的MCC和MNC，和用户数据中心标识，用户设备根据新化名索引号确定对应的新用户设备化名标识。
可见，上述实施例通过服务网络和归属网络诊断用户设备化名标识异步，采用响应的处理，解决归属网络和服务网络用户设备化名标识异步的问题。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明实施例的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
实施例2
在本实施例中还提供了一种入网认证处理装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图10是根据本发明实施例的入网认证处理装置的结构框图一，如图10所示，该装置包括：
第一接收模块102，设置为接收第一服务网络发送的鉴权认证请求消息，其中，鉴权认证请求消息携带有用户设备生成的用户设备化名标识；
判断模块104，连接至上述第一接收模块102，设置为判断本地用户设备化名标识与用户设备生成的用户设备化名标识是否异步；
第一获取模块106，连接至上述判断模块104，设置为在判断结果为是的情况下，获取加密国际移动用户识别码IMSI对用户设备进行入网认证处理。
在本发明实施例中，第一获取模块，还设置为向第一服务网络发送第一鉴权认证失败消息，其中，第一鉴权认证失败消息携带有用户设备化名标识异步原因值，用户设备化名标识异步原因值用于通知用户设备根据用户设备化名标识异步原因值重新向第一服务网络发起携带有加密IMSI的附着请求；以及根据附着请求获取加密IMSI，对用户设备进行入网认证处理。
在本发明实施例中，第一获取模块，设置为向第一服务网络发送第二鉴权认证失败消息；接收第一服务网络根据第二鉴权认证失败消息重新发送携带有加密IMSI的鉴权认证请求消息；以及根据鉴权认证请求消息获取加密IMSI，对用户设备进行入网认证处理。
在本发明实施例中，第一获取模块，设置为向第一服务网络发送用于请求获取加密IMSI的请求消息；根据请求消息的响应消息获取加密IMSI； 以及解密加密IMSI，向第一服务网络反馈鉴权认证响应消息，其中，鉴权认证响应消息携带有用户安全上下文，用户安全上下文对用户设备进行入网认证处理。
图11是根据本发明实施例的入网认证处理装置的优选结构框图一，如图11所示，该装置除包括图10所示的所有模块外，还包括：
第二接收模块112，设置为接收第二服务网络发送的加密IMSI；
生成模块114，连接至上述第二接收模块112，设置为确定加密IMSI对应的用户设备合法后，生成将要使用的用户设备化名标识对应的化名索引号；
第一发送模块116，连接至上述生成模块114，设置为向第二服务网络发送化名索引号，以便通知用户设备根据化名索引号生成用户设备化名标识。
图12是根据本发明实施例的入网认证处理装置的结构框图二，如图12所示，该装置包括：
第二发送模块122，设置为向归属网络发送鉴权认证请求消息，其中，鉴权认证请求消息携带有用户设备生成的用户设备化名标识；
确定模块124，连接至上述第二发送模块122，设置为根据归属网络的反馈，确定所述归属网络中用户设备化名标识与用户设备生成的用户设备化名标识异步；
第二获取模块126，连接至上述确定模块124，设置为获取加密国际移动用户识别码IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理。
在本发明实施例中，第二获取模块，还设置为接收归属网络发送的第一鉴权认证失败消息，其中，第一鉴权认证失败消息携带有用户设备化名标识异步原因值；向用户设备发送携带有用户设备化名标识异步原因值附着失败消息，通知用户设备根据用户设备化名标识异步原因值重新向第一服务网络发起携带有加密IMSI的附着请求；以及根据附着请求获取加密 IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理。
在本发明实施例中，第二获取模块，还设置为接收归属网络发送的第二鉴权认证失败消息；根据第二鉴权认证失败消息，向用户设备发送用户设备标识请求消息；以及根据用户设备的响应获取加密IMSI，重新向归属网络发送携带有加密IMSI的鉴权认证请求消息，以便归属网络对用户设备进行入网认证处理。
在本发明实施例中，第二获取模块，还设置为接收归属网络发送的用于请求获取加密IMSI的请求消息；根据请求消息，向用户设备发送用户设备标识请求消息；以及根据用户设备的响应获取加密IMSI，向归属网络发送加密IMSI，以便归属网络对用户设备进行入网认证处理。
图13是根据本发明实施例的入网认证处理装置的优选结构框图二，如图13所示，该装置除包括图12所示的所有模块外，还包括：
第三接收模块132，设置为接收用户设备发送的附着请求，其中，附着请求携带有临时标识；
第三获取模块134，连接至上述第三接收模块132，设置为根据临时标识从第二服务网络获取用户安全上下文；
第三发送模块136，连接至上述第三获取模块134，设置为在获取用户安全上下文失败的情况下，向用户设备发送用于获取加密IMSI或者用户设备化名标识的请求消息；
第四获取模块138，连接至上述第三发送模块136，设置为根据消息获取加密IMSI或者用户设备化名标识，对所述用户设备进行入网认证处理。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
实施例3
本发明的实施例还提供了一种存储介质。在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S1，接收第一服务网络发送的鉴权认证请求消息，其中，鉴权认证请求消息携带有用户设备生成的用户设备化名标识；
S2，判断本地用户设备化名标识与用户设备生成的用户设备化名标识是否异步；
S3，在判断结果为是的情况下，获取加密国际移动用户识别码IMSI对用户设备进行入网认证处理。
在本发明实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：获取加密IMSI对用户设备进行入网认证处理包括：
S1，向第一服务网络发送第一鉴权认证失败消息，其中，第一鉴权认证失败消息携带有用户设备化名标识异步原因值，用户设备化名标识异步原因值用于通知用户设备根据用户设备化名标识异步原因值重新向第一服务网络发起携带有加密IMSI的附着请求；
S2，根据附着请求获取加密IMSI，对用户设备进行入网认证处理。
在本发明实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：获取加密IMSI对用户设备进行入网认证处理包括：
S1，向第一服务网络发送第二鉴权认证失败消息；
S2，接收第一服务网络根据第二鉴权认证失败消息重新发送携带有加密IMSI的鉴权认证请求消息；
S3，根据鉴权认证请求消息获取加密IMSI，对用户设备进行入网认证处理。
在本发明实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：获取加密IMSI对用户设备进行入网认证处理包括：
S1，向第一服务网络发送用于请求获取加密IMSI的请求消息；
S2，根据请求消息的响应消息获取加密IMSI；
S3，解密加密IMSI，向第一服务网络反馈鉴权认证响应消息，其中，鉴权认证响应消息携带有用户安全上下文，用户安全上下文对用户设备进行入网认证处理。
在本发明实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：在接收第一服务网络发送的鉴权认证请求消息之前，还包括：
S1，接收第二服务网络发送的加密IMSI；
S2，确定加密IMSI对应的用户设备合法后，生成将要使用的用户设备化名标识对应的化名索引号；
S3，向第二服务网络发送化名索引号，以便通知用户设备根据化名索引号生成用户设备化名标识。
本发明的实施例还提供了一种存储介质。在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S1，向归属网络发送鉴权认证请求消息，其中，鉴权认证请求消息携带有用户设备生成的用户设备化名标识；
S2，根据归属网络的反馈，确定所述归属网络中用户设备化名标识与用户设备生成的用户设备化名标识异步；
S3，获取加密国际移动用户识别码IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理。
在本发明实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：获取加密IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理包括：
S1，接收归属网络发送的第一鉴权认证失败消息，其中，第一鉴权认证失败消息携带有用户设备化名标识异步原因值；
S2，向用户设备发送携带有用户设备化名标识异步原因值附着失败消息，通知用户设备根据用户设备化名标识异步原因值重新向第一服务网络发起携带有加密IMSI的附着请求；
S3，根据附着请求获取加密IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理。
在本发明实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：获取加密IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理包括：
S1，接收归属网络发送的第二鉴权认证失败消息；
S2，根据第二鉴权认证失败消息，向用户设备发送用户设备标识请求消息；
S3，根据用户设备的响应获取加密IMSI，重新向归属网络发送携带有加密IMSI的鉴权认证请求消息，以便归属网络对用户设备进行入网认证处理。
在本发明实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：获取加密IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理包括：
S1，接收归属网络发送的用于请求获取加密IMSI的请求消息；
S2，根据请求消息，向用户设备发送用户设备标识请求消息；
S3，根据用户设备的响应获取加密IMSI，向归属网络发送加密IMSI，以便归属网络对用户设备进行入网认证处理。
在本发明实施例中，存储介质还被设置为存储用于执行以下步骤的程序代码：在向归属网络发送鉴权认证请求消息之前，还包括：
S1，接收用户设备发送的附着请求，其中，附着请求携带有临时标识；
S2，根据临时标识从第二服务网络获取用户安全上下文；
S3，在获取用户安全上下文失败的情况下，向用户设备发送用于获取加密IMSI或者用户设备化名标识的请求消息；
S4，根据消息获取加密IMSI或者用户设备化名标识，对所述用户设备进行入网认证处理。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：接收第一服务网络发送的鉴权认证请求消息，其中，鉴权认证请求消息携带有用户设备生成的用户设备化名标识；判断本地用户设备化名标识与用户设备生成的用户设备化名标识是否异步；在判断结果为否的情况下，获取加密国际移动用户识别码IMSI对用户设备进行入网认证处理。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：获取加密IMSI对用户设备进行入网认证处理包括：向第一服务网络发送第一鉴权认证失败消息，其中，第一鉴权认证失败消息携带有用户设备化名标识异步原因值，用户设备化名标识异步原因值用于通知用户设备根据用户设备化名标识异步原因值重新向第一服务网络发起携带有加密IMSI的附着请求；根据附着请求获取加密IMSI，对用户设备进行入网认证处理。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：获取加密IMSI对用户设备进行入网认证处理包括：向第一服务网络发送第二鉴权认证失败消息；接收第一服务网络根据第二鉴权认证失败消息重新发送携带有加密IMSI的鉴权认证请求消息；根据鉴权认证请求消息获取加密IMSI，对用户设备进行入网认证处理。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：获取加密IMSI对用户设备进行入网认证处理包括：向第一服务网络发送用于请求获取加密IMSI的请求消息；根据请求消息的响应消息获取加密IMSI；解密加密IMSI，向第一服务网络反馈鉴权认证响应消息，其中，鉴权认证响应消息携带有用户安全上下文，用户安全上下文对用户设备进行入网认证处理。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：在接收第一服务网络发送的鉴权认证请求消息之前，还包括：接收第二服务网络发送的加密IMSI；确定加密IMSI对应的用户设备合法后，生成将要使用的用户设备化名标识对应的化名索引号；向第二服务网络发送化名索引号，以便通知用户设备根据化名索引号生成用户设备化名标识。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：向归属网络发送鉴权认证请求消息，其中，鉴权认证请求消息携带有用户设备生成的用户设备化名标识；根据归属网络的反馈，确定所述归属网络中用户设备化名标识与用户设备生成的用户设备化名标识异步；获取加密国际移动用户识别码IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：获取加密IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理包括：接收归属网络发送的第一鉴权认证失败消息，其中，第一鉴权认证失败消息携带有用户设备化名标识异步原因值；向用户设备发送携带有用户设备化名标识异步原因值附着失败消息，通知用户设备根据用户设备化名标识异步原因值重新向第一服务网络发起携带有加密IMSI的附着请求；根据附着请求获取加密IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：获取加密IMSI，将加密IMSI发送给归属网络，以便归属网络对用户设备进行入网认证处理包括：接收归属网络发送的第二鉴权认证失败消息；根据第二鉴权认证失败消息，向用户设备发送用户设备标识请求消息；根据用户设备的响应获取加密IMSI，重新向归属网络发送携带有加密IMSI的鉴权认证请求消息，以便归属网络对用户设备进行入网认证处理。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：获取加密IMSI，将加密IMSI发送给归属网络，以便归属网络对用户 设备进行入网认证处理包括：接收归属网络发送的用于请求获取加密IMSI的请求消息；根据请求消息，向用户设备发送用户设备标识请求消息；根据用户设备的响应获取加密IMSI，向归属网络发送加密IMSI，以便归属网络对用户设备进行入网认证处理。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行：在向归属网络发送鉴权认证请求消息之前，还包括：接收用户设备发送的附着请求，其中，附着请求携带有临时标识；根据临时标识从第二服务网络获取用户安全上下文；在获取用户安全上下文失败的情况下，向用户设备发送用于获取加密IMSI或者用户设备化名标识的请求消息；根据消息获取加密IMSI或者用户设备化名标识，对所述用户设备进行入网认证处理。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本发明实施例的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明实施例不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明实施例，对于本领域的技术人员来说，本发明实施例可以有各种更改和变化。凡在本发明实施例的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明实施例的保护范围之内。
工业实用性
在本发明实施例提供的入网认证处理方法中，由于在本地用户设备化名标识与用户设备生成的用户设备化名标识异步时，获取加密国际移动用户识别码IMSI对用户设备进行入网认证处理，因此，可以解决相关技术的入网流程中没有说明用户设备中用户设备化名标识与归属网络中的用户设备化名标识异步时如何处理的问题。

Claims (21)

  1. 一种入网认证处理方法，包括：
    接收第一服务网络发送的鉴权认证请求消息，其中，所述鉴权认证请求消息携带有用户设备生成的用户设备化名标识；
    判断本地用户设备化名标识与用户设备生成的用户设备化名标识是否异步；
    在判断结果为是的情况下，获取加密国际移动用户识别码IMSI对所述用户设备进行入网认证处理。
  2. 根据权利要求1所述的方法，其中，获取所述加密IMSI对所述用户设备进行入网认证处理包括：
    向所述第一服务网络发送第一鉴权认证失败消息，其中，所述第一鉴权认证失败消息携带有用户设备化名标识异步原因值，所述用户设备化名标识异步原因值用于通知所述用户设备根据所述用户设备化名标识异步原因值重新向所述第一服务网络发起携带有加密IMSI的附着请求；
    根据所述附着请求获取所述加密IMSI，对所述用户设备进行入网认证处理。
  3. 根据权利要求1所述的方法，其中，获取所述加密IMSI对所述用户设备进行入网认证处理包括：
    向所述第一服务网络发送第二鉴权认证失败消息；
    接收所述第一服务网络根据所述第二鉴权认证失败消息重新发送携带有所述加密IMSI的鉴权认证请求消息；
    根据所述鉴权认证请求消息获取所述加密IMSI，对所述用户设备进行入网认证处理。
  4. 根据权利要求1所述的方法，其中，获取所述加密IMSI对所述用户设备进行入网认证处理包括：
    向所述第一服务网络发送用于请求获取加密IMSI的请求消息；
    根据所述请求消息的响应消息获取所述加密IMSI；
    解密所述加密IMSI，向所述第一服务网络反馈鉴权认证响应消息，其中，所述鉴权认证响应消息携带有用户安全上下文，所述用户安全上下文对所述用户设备进行入网认证处理。
  5. 根据权利要求1至4中任一项所述的方法，其中，在接收所述第一服务网络发送的鉴权认证请求消息之前，还包括：
    接收第二服务网络发送的加密IMSI；
    确定所述加密IMSI对应的所述用户设备合法后，生成将要使用的用户设备化名标识对应的化名索引号；向第二服务网络发送所述化名索引号，以便通知所述用户设备根据所述化名索引号生成用户设备化名标识。
  6. 一种入网认证处理方法，包括：
    向归属网络发送鉴权认证请求消息，其中，所述鉴权认证请求消息携带有用户设备生成的用户设备化名标识；
    根据所述归属网络的反馈，确定所述归属网络中用户设备化名标识与用户设备生成的用户设备化名标识异步；
    获取加密国际移动用户识别码IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理。
  7. 根据权利要求6所述的方法，其中，获取所述加密IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用 户设备进行入网认证处理包括：
    接收所述归属网络发送的第一鉴权认证失败消息，其中，所述第一鉴权认证失败消息携带有用户设备化名标识异步原因值；
    向所述用户设备发送携带有所述用户设备化名标识异步原因值附着失败消息，通知所述用户设备根据所述用户设备化名标识异步原因值重新向第一服务网络发起携带有加密IMSI的附着请求；
    根据所述附着请求获取所述加密IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理。
  8. 根据权利要求6所述的方法，其中，获取所述加密IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理包括：
    接收所述归属网络发送的第二鉴权认证失败消息；
    根据所述第二鉴权认证失败消息，向所述用户设备发送用户设备标识请求消息；
    根据所述用户设备的响应获取加密IMSI，重新向所述归属网络发送携带有所述加密IMSI的鉴权认证请求消息，以便所述归属网络对所述用户设备进行入网认证处理。
  9. 根据权利要求6所述的方法，其中，获取所述加密IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理包括：
    接收所述归属网络发送的用于请求获取加密IMSI的请求消息；
    根据所述请求消息，向所述用户设备发送用户设备标识请求消息；
    根据所述用户设备的响应获取加密IMSI，向所述归属网络发送加密IMSI，以便所述归属网络对所述用户设备进行入网认证处理。
  10. 根据权利要求6至9中任一项所述的方法，其中，在向归属网络发送鉴权认证请求消息之前，还包括：
    接收所述用户设备发送的附着请求，其中，所述附着请求携带有临时标识；
    根据所述临时标识从第二服务网络获取用户安全上下文；
    在获取所述用户安全上下文失败的情况下，向所述用户设备发送用于获取加密IMSI或者用户设备化名标识的请求消息；
    根据所述消息获取所述加密IMSI或者所述用户设备化名标识，对所述用户设备进行入网认证处理。
  11. 一种入网认证处理装置，包括：
    第一接收模块，设置为接收第一服务网络发送的鉴权认证请求消息，其中，所述鉴权认证请求消息携带有用户设备生成的用户设备化名标识；
    判断模块，设置为判断本地用户设备化名标识与用户设备生成的用户设备化名标识是否异步；
    第一获取模块，设置为在判断结果为是的情况下，获取加密国际移动用户识别码IMSI对所述用户设备进行入网认证处理。
  12. 根据权利要求11所述的装置，其中，所述第一获取模块，还设置为向所述第一服务网络发送第一鉴权认证失败消息，其中，所述第一鉴权认证失败消息携带有用户设备化名标识异步原因值，所述用户设备化名标识异步原因值用于通知所述用户设备根据所述用户设备化名标识异步原因值重新向所述第一服务网络发起携带有加密 IMSI的附着请求；以及根据所述附着请求获取所述加密IMSI，对所述用户设备进行入网认证处理。
  13. 根据权利要求11所述的装置，其中，所述第一获取模块，设置为向所述第一服务网络发送第二鉴权认证失败消息；接收所述第一服务网络根据所述第二鉴权认证失败消息重新发送携带有所述加密IMSI的鉴权认证请求消息；以及根据所述鉴权认证请求消息获取所述加密IMSI，对所述用户设备进行入网认证处理。
  14. 根据权利要求11所述的装置，其中，所述第一获取模块，设置为向所述第一服务网络发送用于请求获取加密IMSI的请求消息；根据所述请求消息的响应消息获取所述加密IMSI；以及解密所述加密IMSI，向所述第一服务网络反馈鉴权认证响应消息，其中，所述鉴权认证响应消息携带有用户安全上下文，所述用户安全上下文对所述用户设备进行入网认证处理。
  15. 根据权利要求11至14中任一项所述的装置，其中，还包括：
    第二接收模块，设置为接收第二服务网络发送的加密IMSI；
    生成模块，设置为确定所述加密IMSI对应的所述用户设备合法后，生成将要使用的用户设备化名标识对应的化名索引号；
    第一发送模块，设置为向第二服务网络发送所述化名索引号，以便通知所述用户设备根据所述化名索引号生成用户设备化名标识。
  16. 一种入网认证处理装置，包括：
    第二发送模块，设置为向归属网络发送鉴权认证请求消息，其中，所述鉴权认证请求消息携带有用户设备生成的用户设备化名标识；
    确定模块，设置为根据所述归属网络的反馈，确定所述归属网络中用户设备化名标识与用户设备生成的用户设备化名标识异步；
    第二获取模块，设置为获取加密国际移动用户识别码IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理。
  17. 根据权利要求16所述的装置，其中，第二获取模块，还设置为接收所述归属网络发送的第一鉴权认证失败消息，其中，所述第一鉴权认证失败消息携带有用户设备化名标识异步原因值；向所述用户设备发送携带有所述用户设备化名标识异步原因值附着失败消息，通知所述用户设备根据所述用户设备化名标识异步原因值重新向第一服务网络发起携带有加密IMSI的附着请求；以及根据所述附着请求获取所述加密IMSI，将所述加密IMSI发送给所述归属网络，以便所述归属网络对所述用户设备进行入网认证处理。
  18. 根据权利要求16所述的装置，其中，第二获取模块，还设置为接收所述归属网络发送的第二鉴权认证失败消息；根据所述第二鉴权认证失败消息，向所述用户设备发送用户设备标识请求消息；以及根据所述用户设备的响应获取加密IMSI，重新向所述归属网络发送携带有所述加密IMSI的鉴权认证请求消息，以便所述归属网络对所述用户设备进行入网认证处理。
  19. 根据权利要求16所述的装置，其中，第二获取模块，还设置为接收所述归属网络发送的用于请求获取加密IMSI的请求消息；根据所述请求消息，向所述用户设备发送用户设备标识请求消息；以及根据所述用户设备的响应获取加密IMSI，向所述归属网络发送加密IMSI，以便所述归属网络对所述用户设备进行入网认证处理。
  20. 根据权利要求16至19中任一项所述的装置，其中，还包括：
    第三接收模块，设置为接收所述用户设备发送的附着请求，其中，所述附着请求携带有临时标识；
    第三获取模块，设置为根据所述临时标识从第二服务网络获取用户安全上下文；
    第三发送模块，设置为在获取所述用户安全上下文失败的情况下，向所述用户设备发送用于获取加密IMSI或者用户设备化名标识的请求消息；
    第四获取模块，设置为根据所述消息获取所述加密IMSI或者所述用户设备化名标识，对所述用户设备进行入网认证处理。
  21. 一种存储介质，所述存储介质包括存储的程序，其中，所述程序运行时执行权利要求1至10中任一项所述的方法。
PCT/CN2017/094402 2016-09-12 2017-07-25 入网认证处理方法及装置 WO2018045842A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
US16/332,682 US11368841B2 (en) 2016-09-12 2017-07-25 Network access authentication method and device
EP17848015.8A EP3512230A4 (en) 2016-09-12 2017-07-25 NETWORK ACCESS-AUTHENTICATION METHOD AND DEVICE
EP20197709.7A EP3826339A1 (en) 2016-09-12 2017-07-25 Network access authentication method and device
US17/826,914 US11778458B2 (en) 2016-09-12 2022-05-27 Network access authentication method and device
US18/375,885 US12096207B2 (en) 2016-09-12 2023-10-02 Network access authentication method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610821578.2 2016-09-12
CN201610821578.2A CN107820244B (zh) 2016-09-12 2016-09-12 入网认证方法及装置

Related Child Applications (2)

Application Number Title Priority Date Filing Date
US16/332,682 A-371-Of-International US11368841B2 (en) 2016-09-12 2017-07-25 Network access authentication method and device
US17/826,914 Continuation US11778458B2 (en) 2016-09-12 2022-05-27 Network access authentication method and device

Publications (1)

Publication Number Publication Date
WO2018045842A1 true WO2018045842A1 (zh) 2018-03-15

Family

ID=61562680

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/094402 WO2018045842A1 (zh) 2016-09-12 2017-07-25 入网认证处理方法及装置

Country Status (4)

Country Link
US (3) US11368841B2 (zh)
EP (2) EP3512230A4 (zh)
CN (2) CN107820244B (zh)
WO (1) WO2018045842A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20230353379A1 (en) * 2016-03-10 2023-11-02 Futurewei Technologies, Inc. Authentication Mechanism for 5G Technologies

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115038078A (zh) * 2017-07-25 2022-09-09 瑞典爱立信有限公司 用于获得supi的认证服务器、ue及其方法和介质
CN110418335A (zh) * 2018-04-28 2019-11-05 中国移动通信有限公司研究院 一种信息处理方法、网络设备及终端
EP3777021B1 (en) * 2018-05-11 2024-06-26 Apple Inc. Subscriber identity privacy protection against fake base stations
EP3909275A1 (en) * 2019-01-11 2021-11-17 NEC Corporation A method and a device for enabling key re-usage in a communication network
CN111465007B (zh) * 2019-01-18 2022-10-11 华为技术有限公司 一种认证方法、装置和系统
CN111465011B (zh) * 2019-01-18 2021-07-16 华为技术有限公司 跨网络接入方法、装置、存储介质及通信系统
EP3935548A4 (en) * 2019-03-08 2022-12-21 Anagog Ltd. DATA COLLECTION PRESERVING CONFIDENTIALITY
CN112134831B (zh) * 2019-06-25 2023-02-21 中兴通讯股份有限公司 接入请求的发送、处理方法及装置
CN114980076A (zh) * 2021-02-20 2022-08-30 华为技术有限公司 保护身份标识隐私的方法与通信装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101400054A (zh) * 2007-09-28 2009-04-01 华为技术有限公司 保护用户终端的隐私的方法、系统和设备
CN101720086A (zh) * 2009-12-23 2010-06-02 成都三零瑞通移动通信有限公司 一种移动通信用户身份保护方法
CN101771992B (zh) * 2009-01-04 2012-06-27 中国移动通信集团公司 国际移动用户标识符imsi机密性保护的方法、设备及系统
US8245039B2 (en) * 2008-07-18 2012-08-14 Bridgewater Systems Corp. Extensible authentication protocol authentication and key agreement (EAP-AKA) optimization

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1265676C (zh) * 2004-04-02 2006-07-19 华为技术有限公司 一种实现漫游用户使用拜访网络内业务的方法
CN100455115C (zh) * 2005-12-28 2009-01-21 华为技术有限公司 服务gprs支持节点间重定位后路由区更新方法及系统
CN101179561B (zh) * 2006-11-06 2012-02-15 华为技术有限公司 用户设备附着网络的方法及其系统
EP1991014B1 (en) * 2007-05-11 2012-11-28 Nokia Siemens Networks S.p.A. Method to attach a mobile station to a second generation packet network shared between different operators
CN101360323B (zh) * 2007-08-03 2014-12-31 华为技术有限公司 一种网络获取临时标识的方法与系统
CN101552959B (zh) * 2008-04-02 2011-01-05 大唐移动通信设备有限公司 一种附着过程中的数据获取方法、设备及系统
CN101730171B (zh) * 2009-05-27 2013-01-16 中兴通讯股份有限公司 一种切换控制方法及系统
US8495720B2 (en) * 2010-05-06 2013-07-23 Verizon Patent And Licensing Inc. Method and system for providing multifactor authentication
US8667574B2 (en) 2010-05-10 2014-03-04 Canon Kabushiki Kaisha Assigning a network address for a virtual device to virtually extend the functionality of a network device
US8601602B1 (en) * 2010-08-31 2013-12-03 Google Inc. Enhanced multi-factor authentication
CN102131188B (zh) 2010-09-01 2013-12-04 华为技术有限公司 用户身份信息传输的方法、用户设备、网络侧设备及系统
CN102421083B (zh) * 2010-09-27 2018-01-05 中兴通讯股份有限公司 一种双模双待终端的通信方法和相应的通信系统
CN102857897A (zh) * 2011-07-01 2013-01-02 华为终端有限公司 管理mtc设备的方法、装置及系统
US20130039287A1 (en) * 2011-08-12 2013-02-14 Venkata Ratnakar Rao Rayavarapu Simplified ue + enb messaging
CN102355743B (zh) * 2011-09-23 2015-07-22 电信科学技术研究院 一种ue上下文信息的管理方法和设备
CN109041089B (zh) * 2012-08-08 2021-12-31 华为技术有限公司 信息处理方法和装置
CN102917332B (zh) * 2012-10-11 2015-06-03 大唐移动通信设备有限公司 一种实现移动设备附着的方法及装置
KR101666330B1 (ko) * 2012-10-15 2016-10-13 노키아 테크놀로지스 오와이 서비스 요청에 대한 사용자 장비에서의 서비스 거절의 수신 후의 네트워크로의 재접속
WO2014065492A1 (ko) * 2012-10-25 2014-05-01 엘지전자 주식회사 Mtc 모니터링 방법 및 네트워크 노드
US10237729B2 (en) * 2015-03-05 2019-03-19 Qualcomm Incorporated Identity privacy in wireless networks
US10931644B2 (en) * 2015-06-23 2021-02-23 Telefonaktiebolaget Lm Ericsson (Publ) Methods, network nodes, mobile entity, computer programs and computer program products for protecting privacy of a mobile entity

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101400054A (zh) * 2007-09-28 2009-04-01 华为技术有限公司 保护用户终端的隐私的方法、系统和设备
US8245039B2 (en) * 2008-07-18 2012-08-14 Bridgewater Systems Corp. Extensible authentication protocol authentication and key agreement (EAP-AKA) optimization
CN101771992B (zh) * 2009-01-04 2012-06-27 中国移动通信集团公司 国际移动用户标识符imsi机密性保护的方法、设备及系统
CN101720086A (zh) * 2009-12-23 2010-06-02 成都三零瑞通移动通信有限公司 一种移动通信用户身份保护方法

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20230353379A1 (en) * 2016-03-10 2023-11-02 Futurewei Technologies, Inc. Authentication Mechanism for 5G Technologies

Also Published As

Publication number Publication date
EP3512230A4 (en) 2019-09-18
US20220295269A1 (en) 2022-09-15
CN107820244A (zh) 2018-03-20
EP3512230A1 (en) 2019-07-17
US11778458B2 (en) 2023-10-03
CN113923659B (zh) 2024-02-23
EP3826339A1 (en) 2021-05-26
US11368841B2 (en) 2022-06-21
CN107820244B (zh) 2021-10-26
CN113923659A (zh) 2022-01-11
US20210289353A1 (en) 2021-09-16
US12096207B2 (en) 2024-09-17
US20240031800A1 (en) 2024-01-25

Similar Documents

Publication Publication Date Title
WO2018045842A1 (zh) 入网认证处理方法及装置
US11829774B2 (en) Machine-to-machine bootstrapping
US10298398B2 (en) Peer discovery, connection, and data transfer
US11178125B2 (en) Wireless network connection method, wireless access point, server, and system
US8559633B2 (en) Method and device for generating local interface key
EP3668042B1 (en) Registration method and apparatus based on service-oriented architecture
CN108886685B (zh) 一种终端匹配方法、装置
KR102094216B1 (ko) 이동 통신 시스템 환경에서 프락시미티 기반 서비스 단말 간 발견 및 통신을 지원하기 위한 보안 방안 및 시스템
US10979903B2 (en) Key generation and distribution method based on identity-based cryptography
CN112636901B (zh) 身份识别方法、装置、存储介质和电子设备
US20230199492A1 (en) Verified position information
WO2019066720A1 (zh) 秘钥管理方法和装置
US11330428B2 (en) Privacy key in a wireless communication system
WO2014194818A1 (zh) 一种用于发现设备的用户的方法和用户设备
CN114143781B (zh) 入网认证处理方法及装置
JP6407838B2 (ja) 認証方法及び認証システム
US20230336535A1 (en) Method, device, and system for authentication and authorization with edge data network
CN110169128B (zh) 一种通信方法、装置和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17848015

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017848015

Country of ref document: EP

Effective date: 20190412