WO2018098641A1 - 一种网络安全防护方法及设备 - Google Patents

一种网络安全防护方法及设备 Download PDF

Info

Publication number
WO2018098641A1
WO2018098641A1 PCT/CN2016/107756 CN2016107756W WO2018098641A1 WO 2018098641 A1 WO2018098641 A1 WO 2018098641A1 CN 2016107756 W CN2016107756 W CN 2016107756W WO 2018098641 A1 WO2018098641 A1 WO 2018098641A1
Authority
WO
WIPO (PCT)
Prior art keywords
rff
terminal
base station
information
acquisition
Prior art date
Application number
PCT/CN2016/107756
Other languages
English (en)
French (fr)
Inventor
洪泓
王爱成
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201680090081.6A priority Critical patent/CN109845215A/zh
Priority to PCT/CN2016/107756 priority patent/WO2018098641A1/zh
Publication of WO2018098641A1 publication Critical patent/WO2018098641A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the embodiments of the present invention relate to the field of communications technologies, and in particular, to a network security protection method and device.
  • the existing network-to-terminal authentication process is: an Evolved Packet Core (EPC) initiates an authentication request to a user equipment (User Equipment, UE), and the terminal performs an authentication request according to the request.
  • the parameters in and the parameters saved in the SIM card are calculated as a response number (RES) value and returned to the EPC.
  • the EPC checks whether the value of the response (XRES) calculated by the parameter in the existing SIM card and the parameter in the authentication request is consistent with the RES value reported by the terminal. If they are consistent, the authentication succeeds.
  • the authentication of the terminal by the network is based on the SIM card.
  • the terminal corresponding to the original SIM card is the target terminal
  • the terminal corresponding to the copied SIM card is the pseudo terminal. Since the pseudo terminal is the same as the SIM card information of the target terminal, the pseudo terminal can be authenticated to obtain a legal identity that is completely consistent with the target terminal, and the financial operation such as transfer can be implemented after the pseudo terminal accesses the network.
  • the embodiment of the invention provides a network security protection method and device, so as to avoid the harm caused by the illegal operation of the pseudo terminal after the SIM card is copied.
  • the first aspect provides a network security protection method, including: the core network device sends an initial collection indication of the radio frequency fingerprint RFF to the base station, where the initial collection of the RFF indicates the identification information of the mobile terminal, and then receives the initial acquisition by the base station according to the RFF. And indicating an RFF of the terminal that is feedback, and storing a correspondence between the identifier module of the terminal and the RFF of the terminal.
  • the RFF of the first network access terminal is obtained by the above method. And then, when the core network device initiates the authentication of the terminal, sending an RFF acquisition indication to the base station, where the RFF acquisition indication carries the identifier information of the terminal, and then receiving the feedback from the base station according to the RFF acquisition indication.
  • the RFF collects information, and determines whether the RFF authentication of the terminal is successful according to the RFF acquisition information, that is, compares the saved RFF with the newly collected RFF, determines whether the RFF authentication of the terminal is successful, and prevents the SIM card from being copied.
  • the pseudo terminal successfully accesses the network and implements the harm caused by illegal operations to the user.
  • the method provided by the embodiment of the present invention adds a new method for extracting, analyzing, and authenticating the terminal radio frequency fingerprint in the terminal authentication process. . Since the authentication of the physical layer feature of the terminal is added, the real terminal and the pseudo terminal can be distinguished, so that the shortcomings of the current solution can be solved, and the security protection capability of the network side to the terminal is significantly improved.
  • the identifier module is a subscriber identity module SIM or a global subscriber identity module USIM. Therefore, the method provided by the embodiment of the present invention is not limited to the type of the identification module, and may be a possible identification module in the future.
  • the RFF acquisition indication further carries an RFF of the terminal corresponding to the identifier module; at this time, the core network device receives the RFF acquisition information fed back by the base station, and collects according to the RFF.
  • Determining whether the RFF authentication of the terminal is successful includes: receiving, by the core network device, RFF acquisition information that is sent by the base station according to the RFF acquisition indication, where the RFF collection information carries RFF comparison information, and the RFF comparison The information is generated by the base station according to the RFF collected by the base station and the RFF carried by the RFF acquisition indication, that is, the base station completes the insured The RFF is compared with the newly acquired RFF, and the comparison result is fed back to the core network device. If the RFF comparison information indicates that the RFF collected by the base station is consistent with the RFF carried by the RFF collection indication, the core network device determines that the RFF authentication of the terminal is successful, otherwise, determines the RFF authentication of the terminal. failure.
  • the core network device receives the RFF acquisition information that is sent by the base station according to the RFF acquisition indication, and determines whether the RFF authentication of the terminal is successful according to the RFF collection information, including: The core network device receives the RFF acquisition information fed back by the base station, where the RFF collection information carries the RFF collected by the base station, and the RFF collected by the base station is corresponding to the identifier information of the terminal carried by the RFF collection indication. The RFF of the terminal is determined by the core network device to determine whether the RFF collected by the base station is consistent with the RFF of the terminal corresponding to the stored identity module. If the RFF authentication is consistent, the RFF authentication of the terminal is successful. The RFF authentication of the terminal failed. Therefore, the method provided by the embodiment of the present invention provides multiple implementations of comparing the saved RFF with the newly acquired RFF.
  • the method further includes: when the core network device determines that the RFF authentication of the terminal fails, the user identity of the terminal is activated; and the core network device determines a user identity result of the terminal.
  • the RFF and update the RFF corresponding relationship between the identification module of the terminal and the terminal. Therefore, when the RFF authentication fails, the user identification process may be performed when the RFF authentication fails.
  • the identification is passed, the RFF of the terminal corresponding to the current identity module is re-acquired.
  • the core network device determines that the RFF authentication of the terminal fails, it indicates that the terminal is not entering the network for the first time. In this case, the user may use the original identity module, or the newly added identity module, or the illegally copied identity module is installed in other terminals. Up, so there may be scenes where the pseudo terminal will be illegally operated.
  • the user identification result of the terminal If the user identification result of the terminal is recognized, it indicates that the original identity module or the newly added identity module is installed on another terminal, and the identity module that is not illegally copied is installed in other On the terminal. Therefore, since the identity module is installed on another terminal, that is, the identity module is not on the original terminal and is installed on the new terminal, the binding relationship between the original terminal and the identity module needs to be removed, and the RFF authentication cannot be passed. The correspondence between the identity module and the RFF of the terminal is established to establish a binding relationship between the identity module and the new terminal.
  • the identification module that is illegally copied is installed on another terminal, and the RFF authentication fails. At this time, the core network device refuses to provide subsequent services for the terminal, and the identification module is avoided. The harm caused by the illegal operation of the terminal after being illegally copied improves the security protection capability of the network side to the terminal.
  • a second aspect a network security protection method, comprising: receiving, by a base station, an initial RFF indication sent by the core network device, where the initial collection of the RFF indicates identification information of the mobile terminal; and the base station is configured according to the identification information of the terminal.
  • the core network device Collecting the identifier information corresponding to the RFF of the terminal, and feeding back the collected RFF to the core network device, so that the core network device saves the correspondence between the identifier module of the terminal and the RFF of the terminal;
  • Receiving an RFF acquisition indication sent by the core network device where the RFF acquisition indication carries the identifier information of the terminal;
  • the base station collects the RFF of the terminal corresponding to the identifier information according to the identifier information of the terminal;
  • the RFF generates RFF acquisition information and feeds back to the core network device, so that the core network device determines whether the RFF authentication of the terminal is successful according to the RFF collection information.
  • the base station performs an initial RFF acquisition indication sent by the core network device, so that the core network device saves the RFF mapping relationship between the identifier module of the terminal and the terminal, and the base station subsequently performs an RFF acquisition indication, so that the core network device determines the current time. Whether the collected RFF is consistent with the existing RFF and performs RFF authentication on the terminal.
  • the RFF acquisition indication further carries an RFF of the terminal corresponding to the identifier module; the base station generates RFF acquisition information according to the collected RFF, including: the base station according to the collected RFF and the The RFF acquisition indicates that the carried RFF generates RFF comparison information as RFF acquisition information.
  • the identifier module is a subscriber identity module SIM or a global subscriber identity module USIM.
  • the base station generates an RFF acquisition signal according to the collected RFF.
  • the information includes: the base station collects the collected RFF as an RFF. Therefore, the base station can feed back the RFF acquisition information to the core network device in multiple manners.
  • a network security protection device comprising: a transceiver and a processor coupled to the transceiver; the processor, configured to: send, by using the transceiver, an initial collection indication of an RF fingerprint RFF to a base station, where The RFF initial collection indicates the identification information of the mobile terminal; the RFF of the terminal that is fed back by the base station according to the initial RFF acquisition indication is received by the transceiver, and the identifier module of the terminal and the RFF of the terminal are saved.
  • the transceiver sends an RFF acquisition indication to the base station, where the RFF acquisition indication carries the identification information of the terminal; and receives the indication according to the RFF by receiving the base station.
  • the feedback RFF collects information, and determines whether the RFF authentication of the terminal is successful according to the RFF collection information.
  • the identifier module is a subscriber identity module SIM or a global subscriber identity module USIM.
  • the RFF acquisition indication further carries an RFF of the terminal corresponding to the identifier module
  • the processor is configured to: receive, by using the transceiver, RFF acquisition information fed back by the base station, And determining, according to the RFF acquisition information, whether the RFF authentication of the terminal is successful, and receiving, by the transceiver, RFF acquisition information that is sent by the base station according to the RFF acquisition indication, where the RFF collection information carries RFF comparison information,
  • the RFF comparison information is generated by the base station according to the RFF collected by the base station and the RFF carried by the RFF acquisition indication; if the RFF comparison information indicates the RFF collected by the base station and the RFF collection If the RFF is consistent, the RFF authentication of the terminal is successful. Otherwise, the RFF authentication of the terminal fails.
  • the processor is configured to: receive, by using the transceiver, RFF acquisition information that is sent by the base station according to the RFF acquisition indication, and determine the terminal according to the RFF collection information.
  • RFF acquisition information fed back by the base station is received by the transceiver, where the RFF acquisition information carries the RFF collected by the base station, and the RFF collected by the base station is carried by the RFF acquisition indication.
  • the RFF of the terminal corresponding to the identifier information of the terminal determining the RFF collected by the base station and the terminal corresponding to the stored identifier module If the RFFs are consistent, if the RFF authentication is successful, the RFF authentication of the terminal is determined to be unsuccessful.
  • the processor is further configured to: when determining that the RFF authentication of the terminal fails, start a user identity identification of the terminal; and determine that the user identity recognition result of the terminal is a recognition time And transmitting, by the base station, an RFF initial acquisition indication, where the RFF initial collection indication carries the identifier information of the terminal, and receiving, by the transceiver, the RFF of the terminal that is sent back by the base station according to the initial RFF acquisition indication, and Updating an RFF corresponding relationship between the identifier module of the terminal and the terminal.
  • a network security protection device comprising: a transceiver and a processor coupled to the transceiver; the processor, configured to: receive, by the transceiver, an RFF initial collection sent by the core network device Instructing, the initial collection of the RFF indicates the identification information of the mobile terminal; collecting the RFF of the terminal corresponding to the identification information according to the identification information of the terminal, and feeding back the collected RFF to the core network device, so that the The core network device stores the corresponding relationship between the identifier module of the terminal and the RFF of the terminal; the transceiver receives the RFF acquisition indication sent by the core network device, and the RFF collection indication carries the identifier information of the terminal; The identifier information of the terminal is collected, the RFF of the terminal corresponding to the identifier information is collected, and the RFF acquisition information is generated and fed back to the core network device according to the collected RFF, so that the core network device determines the terminal according to the RFF collection information. Whether the RFF certification is successful
  • the RFF acquisition indication further carries an RFF of the terminal corresponding to the identification module
  • the processor is specifically configured to: when generating the RFF acquisition information according to the collected RFF, according to the collected RFF and The RFF acquisition indicates that the carried RFF generates RFF comparison information as RFF acquisition information.
  • the identifier module is a subscriber identity module SIM or a global subscriber identity module USIM.
  • the processor is specifically configured to: generate RFF acquisition information according to the collected RFF, and collect the collected RFF as the RFF acquisition information.
  • FIG. 1 is a schematic diagram of an attacker using an artificial terminal to perform an illegal operation according to the background art of the present invention
  • FIG. 2 is a schematic diagram of a network-to-terminal authentication process in the background art of the present invention.
  • FIG. 3 is a flowchart of an overview of a network security protection method according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a correspondence between a core network and a RFF of a terminal RFF storage identifier module in a core network according to an embodiment of the present invention
  • FIG. 5(a) is a schematic diagram of an RFF authentication process of a core network to a terminal according to an embodiment of the present invention
  • FIG. 5(b) is a second schematic diagram of an RFF authentication process of a core network to a terminal according to an embodiment of the present invention
  • FIG. 7 is a schematic structural diagram of a network security protection device according to an embodiment of the present invention.
  • FIG. 8 is a second schematic structural diagram of a network security protection device according to an embodiment of the present invention.
  • the radio frequency fingerprint (RFF) mentioned in the embodiment of the present invention refers to different types and the same models extracted by the receiver according to the inherent tolerances of the analog devices such as circuit traces, RF power amplifiers, and antennas in the radio frequency circuit of the wireless terminal. Different types of wireless terminals correspond to the unique and unique radio frequency characteristics of the emitted electromagnetic waves.
  • the existing RF fingerprint extraction algorithms are mostly divided into (frequency hopping) algorithm for extracting transient response characteristics, algorithm for extracting steady-state response features, and distortion algorithm based on constellation trajectory map.
  • an embodiment of the present invention provides a network security protection method, where the method includes:
  • Step 300 When the core network device determines the correspondence between the identifier module of the unsaved terminal and the radio frequency fingerprint RFF of the terminal, the initial collection instruction of the radio frequency fingerprint RFF is sent to the base station, and the initial collection of the RFF indicates the identification information of the mobile terminal.
  • Step 310 The base station collects the RFF of the terminal corresponding to the identifier information according to the identifier information of the terminal.
  • Step 320 The base station feeds back the RFF of the terminal to the core network device according to the initial RFF acquisition indication.
  • Step 330 The core network device saves the correspondence between the identifier module of the terminal and the RFF of the terminal.
  • step 330 when the core network device determines that the RFF corresponding to the identity module of the terminal is not stored, it indicates that the terminal is the first time to enter the network, that is, the identity module of the terminal has not been used.
  • the core network device needs to send an initial RFF acquisition indication to the base station, and the initial collection of the RFF indicates the identification information of the mobile terminal.
  • the base station collects the RFF of the terminal corresponding to the identifier according to the identifier information of the terminal, and feeds back the collected RFF to the core network device.
  • the core network device receives the RFF of the terminal that is fed back by the base station according to the RFF initial acquisition indication, and saves the correspondence between the identity module of the terminal and the RFF of the terminal, that is, when the terminal is the first time to access the network, the RFF of the terminal where the current identity module is located needs to be collected by the base station. Establishing a binding relationship between the identity module and the terminal that installs the identity module.
  • the identity module is a SIM or a global subscriber identity module (USIM).
  • SIM subscriber identity module
  • USIM global subscriber identity module
  • the cell identifier and the terminal identifier may be used as the identifier information of the terminal.
  • other information that uniquely identifies the terminal may be selected as the identifier information of the terminal, which is not specifically limited herein.
  • Step 340 The core network device initiates authentication for the terminal.
  • the RFF authentication process of the core network device to the terminal may be performed simultaneously with the authentication process of the terminal by the core network device, or after the core network device successfully authenticates the terminal.
  • Step 350 The core network device sends an RFF collection indication to the base station, and the RFF collection indicates the identification information of the mobile terminal.
  • the core network device has stored the correspondence between the identifier module of the terminal and the RFF of the terminal, indicating that the terminal is not the first network access, that is, the identifier module of the terminal has been used, and the RFF of the corresponding module of the identifier module has been collected by the base station, and
  • the mapping between the identity module of the terminal and the RFF is stored in the core network device. Since the RFF of each terminal is unique, the identity module has a binding relationship with the terminal that installs the identity module, and the core network device utilizes the binding relationship. , again through the base station The RFF of the terminal is set to determine whether the original binding relationship is satisfied, and whether the current terminal is a pseudo terminal is analyzed.
  • Step 360 The base station collects the RFF of the terminal corresponding to the identifier information according to the identifier information of the terminal.
  • the terminal sends an uplink signal to the base station, and the base station can obtain the RFF by using the radio frequency fingerprint extraction algorithm based on the uplink signal.
  • Step 370 The base station generates feedback of the RFF acquisition information according to the collected RFF to the core network device.
  • the base station may generate RFF acquisition information by using, but not limited to, the following two methods:
  • the base station when the RFF acquisition indication further carries the RFF of the terminal corresponding to the identifier module, the base station generates RFF comparison information as the RFF acquisition information according to the RFF carried by the collected RFF and the RFF acquisition indication.
  • the second way the base station collects the RFF directly as an RFF.
  • Step 380 The core network device receives the RFF acquisition information fed back by the base station according to the RFF acquisition indication, and determines whether the RFF authentication of the terminal is successful according to the RFF collection information.
  • step 380 when the core network device performs step 370, the following two methods may be used:
  • the first mode is: when the RFF acquisition indication further carries the RFF of the terminal corresponding to the identity module, the core network device receives the RFF acquisition information fed back by the base station according to the RFF acquisition indication, and the RFF acquisition information carries the RFF comparison information, where the RFF comparison information is based on the base station.
  • the RFF collected by the base station and the RFF collected by the RFF are generated.
  • the core network device determines that the RFF authentication of the terminal is successful. Otherwise, the RFF authentication of the terminal is determined to be unsuccessful.
  • the core network device receives the RFF information collected by the base station, and the RFF collection information carries the RFF collected by the base station.
  • the RFF collected by the base station is the RFF of the terminal corresponding to the RFF acquisition indication carrying the identification information.
  • the core network device determines whether the RFF collected by the base station is consistent with the RFF of the stored identity module. If the RFF is consistent, the RFF authentication of the terminal is successful. Otherwise, the RFF authentication of the terminal fails.
  • step 340 when the core network device determines that the RFF authentication of the terminal fails, the user identity of the terminal is started.
  • the user identification process for the terminal may be an existing process, for example, performing user identification on the current terminal user according to the previous reservation information of the terminal user, where the reservation information may be an answer to a preset question. For example, the name of the primary school, the most favorite fruit, etc. This application does not specifically limit the user identification process.
  • the core network device determines that the user identity identification result of the terminal is an initial RFF acquisition indication sent to the base station when the identification is passed, and the initial collection of the RFF indicates the identification information of the mobile terminal.
  • the base station collects the RFF of the terminal corresponding to the identifier according to the identifier information of the terminal, and feeds back the collected RFF to the core network device.
  • the core network device receives the RFF of the terminal that the base station feeds back according to the initial RFF acquisition indication, and updates the correspondence between the identity module of the terminal and the RFF of the terminal. This is consistent with the process shown in Figure 4.
  • the core network device determines that the RFF authentication of the terminal fails, it indicates that the terminal is not entering the network for the first time. In this case, the user may use the original identity module, or the newly added identity module, or the illegally copied identity module is installed in other terminals. Up, so there may be scenes where the pseudo terminal will be illegally operated.
  • the user identification result of the terminal is the identification pass, it indicates that the original identity module or the newly added identity module is installed on another terminal, and the identity module that is not illegally copied is installed on other terminals. Therefore, since the identity module is installed on another terminal, that is, the identity module is not on the original terminal and is installed on the new terminal, the binding relationship between the original terminal and the identity module needs to be removed, and the RFF authentication cannot be passed. The correspondence between the identity module and the RFF of the terminal is established to establish a binding relationship between the identity module and the new terminal.
  • the identification module that is illegally copied is installed on another terminal, and the RFF authentication fails. At this time, the core network device refuses to provide subsequent services for the terminal, and the identification module is avoided. The harm caused by the illegal operation of the terminal after being illegally copied improves the security protection capability of the network side to the terminal.
  • S601 The EPC initiates an authentication process for the UE.
  • S602 The EPC determines whether the UE is the first network access.
  • the EPC determines whether the UE is the first network access by whether the RFF of the UE corresponding to the SIM of the UE is stored. If S603 is performed, otherwise, S608 is performed.
  • the EPC sends an RFF acquisition indication to the eNB.
  • the identifier of the UE and the identifier of the cell where the UE is located are included in the identifier of the UE.
  • the eNB collects the RFF according to the RFF acquisition indication sent by the EPC, and generates RFF acquisition information to feed back to the EPC.
  • the eNB collects the identifier information corresponding to the RFF of the UE according to the RFF collection indication sent by the EPC, and feeds the collected RFF as the RFF collection information to the EPC.
  • the EPC determines, according to the RFF collection information, whether the RFF authentication for the UE is successful.
  • S606 The EPC continues the authentication process for the UE. After the authentication succeeds, the UE is provided with the service, and the process ends.
  • S607 The EPC initiates a user identification process for the UE. It is judged whether the user identification result is the recognition pass, and if S608 is executed, otherwise S611 is executed.
  • the EPC sends a reservation question to the UE and receives an answer for the reservation question replied by the UE.
  • the EPC determines the identity of the user.
  • the recognition result is the identification pass, and when the existing answer to the reservation question is inconsistent with the answer to the reservation question replied by the UE, the EPC determines that the user identification result is the identification failure.
  • the EPC sends an RFF initial acquisition indication to the eNB.
  • the initial acquisition indication of the RFF carries the identification information of the UE.
  • the eNB collects the RFF according to the initial RFF acquisition indication, and reports the RFF to the EPC.
  • the EPC receives the RFF fed back by the eNB, and stores a correspondence between the SIM and the RFF collected by the eNB, and the process ends.
  • the EPC determines that the RFF authentication of the UE fails, and refuses to provide a follow-up service for the UE. The process ends.
  • an embodiment of the present invention provides a network security protection device, for example, a core network device, including: a transceiver 701 and a processor 702 coupled to the transceiver;
  • the processor 702 is configured to: send, by using the transceiver, a radio frequency fingerprint RFF initial collection indication to the base station, where the RFF initial collection indicates identification information of the mobile terminal; and receiving, by the transceiver, the base station according to the RFF initial Collecting an RFF of the terminal indicating the feedback, and storing a correspondence between the identifier module of the terminal and an RFF of the terminal; and when the terminal initiates authentication, sending, by the transceiver, an RFF acquisition indication to the base station
  • the RFF acquisition indication carries the identification information of the terminal; and receives the RFF acquisition information fed back by the base station according to the RFF acquisition indication, and determines whether the RFF authentication of the terminal is successful according to the RFF collection information.
  • the identifier module is a subscriber identity module SIM or a global subscriber identity module USIM.
  • the RFF acquisition indication further carries an RFF of the terminal corresponding to the identifier module
  • the processor 702 is configured to: receive, by the transceiver, RFF acquisition information fed back by the base station, and determine, according to the RFF acquisition information, whether the RFF authentication of the terminal is successful, and receive, by using the transceiver
  • the RFF acquisition information is sent by the base station according to the RFF acquisition indication, and the RFF acquisition information carries RFF comparison information, where the RFF comparison information is carried by the base station according to the RFF collected by the base station and the RFF acquisition indication.
  • the RFF is generated; if the RFF comparison information indicates that the RFF collected by the base station is consistent with the RFF carried by the RFF acquisition indication, determining that the RFF authentication of the terminal is successful, otherwise, determining the RFF authentication of the terminal failure.
  • the processor 702 is configured to: receive, by using the transceiver, RFF acquisition information that is sent by the base station according to the RFF acquisition indication, and determine, according to the RFF acquisition information, When the RFF authentication of the terminal is successful, the RFF collection information fed back by the base station is received by the transceiver, where the RFF acquisition information carries the RFF collected by the base station, and the RFF collected by the base station is the RFF acquisition indication.
  • the RFF of the terminal corresponding to the identifier information of the terminal that is carried; the terminal that corresponds to the stored identifier module and the RFF collected by the base station If the RFFs are consistent, if the RFF authentication is successful, the RFF authentication of the terminal is determined to be unsuccessful.
  • the processor 702 is further configured to: when determining that the RFF authentication of the terminal fails, start user identification of the terminal; and determine that the user identity of the terminal is recognized by the terminal. Sending an RFF initial acquisition indication to the base station, where the RFF initial acquisition indication carries the identifier information of the terminal, and the transceiver receives the RFF of the terminal that is fed back by the base station according to the initial RFF acquisition indication. And updating an RFF corresponding relationship between the identifier module of the terminal and the terminal.
  • an embodiment of the present invention provides a network security protection device, such as a base station, including: a transceiver 801 and a processor 802 coupled to the transceiver;
  • the processor 802 is configured to: receive, by using the transceiver, an initial RFF acquisition indication sent by the core network device, where the initial collection of the RFF indicates identification information of the mobile terminal; and collecting, according to the identification information of the terminal, the The identifier information corresponds to the RFF of the terminal, and the collected RFF is fed back to the core network device, so that the core network device saves the corresponding relationship between the identifier module of the terminal and the RFF of the terminal; Receiving an RFF acquisition indication sent by the core network device, where the RFF acquisition indication carries the identification information of the terminal; collecting, according to the identification information of the terminal, the RFF of the terminal corresponding to the identification information; and generating the RFF collection information according to the collected RFF. Feedback to the core network device, so that the core network device determines whether the RFF authentication of the terminal is successful according to the RFF collection information.
  • the RFF collection indication further carries an RFF of the terminal corresponding to the identification module
  • the processor 802 is specifically configured to: when the RFF acquisition information is generated according to the collected RFF, generate RFF comparison information according to the collected RFF and the RFF carried by the RFF acquisition indication as the RFF acquisition information.
  • the identifier module is a subscriber identity module SIM or a global subscriber identity module USIM.
  • the processor 802 is specifically configured to: according to the collected The RFF generates RFF acquisition information, and collects the collected RFF as RFF.
  • the method provided by the embodiment of the present invention adds a radio fingerprint to the terminal in the terminal authentication process. Extraction and analytical certification. Since the authentication of the physical layer feature of the terminal is added, the real terminal and the pseudo terminal can be distinguished, so that the shortcomings of the current solution can be solved, and the security protection capability of the network side to the terminal is significantly improved.
  • FIG. 1 These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)

Abstract

一种网络安全防护方法及设备，用以避免SIM卡被复制后，伪终端的非法操作带来的危害。该方法包括核心网设备确定未保存终端的标识模块与终端的射频指纹RFF的对应关系时，向基站发送RFF初始采集指示，RFF初始采集指示携带终端的标识信息；核心网设备接收基站根据RFF初始采集指示反馈的终端的RFF，保存终端的标识模块与终端的RFF的对应关系；在核心网设备对终端发起鉴权时，核心网设备向基站发送RFF采集指示，RFF采集指示携带终端的标识信息；核心网设备接收基站根据RFF采集指示反馈的RFF采集信息，并根据RFF采集信息判断终端的RFF认证是否成功。

Description

一种网络安全防护方法及设备 技术领域
本发明实施例涉及通信技术领域，尤其涉及一种网络安全防护方法及设备。
背景技术
随着移动支付领域以及网络技术的发展，对终端的身份识别有了更高的安全性需求。现有终端身份识别技术依赖用户识别模块(Subscriber Identity Module，SIM)卡以及机身序列等数字化方式，而随着物理攻击以及旁路攻击等技术能力的提升，这些终端身份识别技术变得不够可靠。攻击者可能通过操作伪终端，实施金融盗窃或危害公共安全的操作，如图1所示，目前的长期演进(Long Term Evolution，LTE)网络无法识别具有相同SIM卡的终端和伪终端。
具体的，参阅图2所示，现有的网络对终端的鉴权过程为：核心网设备(Evolved Packet Core，EPC)向用户设备(User Equipment，UE)发起鉴权请求，终端根据鉴权请求中的参数和自身SIM卡中保存的参数计算一个响应数(RES)值并返回给EPC。EPC检查本地根据已存的SIM卡中的参数和鉴权请求中的参数计算的响应数(XRES)值是否与终端上报的RES值一致，若一致则鉴权成功。
由此可知，网络对终端的鉴权是基于SIM卡的，当SIM卡被复制后插入另一个终端时，令原SIM卡对应的终端为目标终端，复制后的SIM卡对应的终端为伪终端，该伪终端由于与目标终端的SIM卡信息相同，因此可以鉴权通过，获得同目标终端完全一致的合法身份，在伪终端接入网络后可实施转账等金融操作。
因此，现有的网络对终端的鉴权过程无法抵御SIM卡被复制后，伪终端的非法操作带来危害。
发明内容
本发明实施例提供一种网络安全防护方法及设备，用以避免SIM卡被复制后，伪终端的非法操作带来的危害。
第一方面，提供一种网络安全防护方法，包括：核心网设备向基站发送射频指纹RFF初始采集指示，所述RFF初始采集指示携带终端的标识信息，然后接收所述基站根据所述RFF初始采集指示反馈的所述终端的RFF，并保存所述终端的标识模块与所述终端的RFF的对应关系。通过上述方法获得首次入网终端的RFF。之后在所述核心网设备对所述终端发起鉴权时，向所述基站发送RFF采集指示，所述RFF采集指示携带所述终端的标识信息，然后接收所述基站根据所述RFF采集指示反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功，即利用已保存的RFF与新采集的RFF进行比较，判断终端的RFF认证是否成功，避免SIM卡被复制后，伪终端成功接入网络，实施非法操作给用户带来的危害。相较于现有技术中由于网络只识别SIM是否合法，并不感知终端的物理层特征，采用本发明实施例提供的方法在终端认证过程中，新增了对终端射频指纹的提取和分析认证。由于增加了终端物理层特征的认证，可将真终端和伪终端区分出来，因此可解决目前方案的不足，显著提高了网络侧对终端的安全防护能力。
在一种可能的实现方式中，所述标识模块为用户识别模块SIM或全球用户识别模块USIM。因此，本发明实施例提供的方法不限于识别模块的类型，也可是未来可能的识别模块。
在一种可能的实现方式中，所述RFF采集指示还携带所述标识模块对应的终端的RFF；此时，所述核心网设备接收所述基站反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功，包括：所述核心网设备接收所述基站根据所述RFF采集指示反馈的RFF采集信息，所述RFF采集信息携带RFF比对信息，所述RFF比对信息是所述基站根据所述基站采集到的RFF与所述RFF采集指示携带的RFF生成的，即由基站完成已保 存RFF与新采集RFF的比对，并将比对结果反馈给核心网设备。若所述RFF比对信息指示所述基站采集到的RFF与所述RFF采集指示携带的RFF一致，则所述核心网设备判断所述终端的RFF认证成功，否则，判断所述终端的RFF认证失败。
在一种可能的实现方式中，所述核心网设备接收所述基站根据所述RFF采集指示反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功，包括：所述核心网设备接收所述基站反馈的RFF采集信息，所述RFF采集信息携带所述基站采集到的RFF，所述基站采集到的RFF为所述RFF采集指示携带的所述终端的标识信息对应的终端的RFF；所述核心网设备判断所述基站采集到的RFF与存储的所述标识模块对应的终端的RFF是否一致，若一致，则判断所述终端的RFF认证成功，否则，判断所述终端的RFF认证失败。因此，本发明实施例提供的方法提供了已保存RFF与新采集RFF的进行比对的多种实现方式。
在一种可能的实现方式中，还包括：所述核心网设备判断所述终端的RFF认证失败时，启动所述终端的用户身份识别；所述核心网设备确定所述终端的用户身份识别结果为识别通过时，向所述基站发送RFF初始采集指示，所述RFF初始采集指示携带所述终端的标识信息；所述核心网设备接收所述基站根据所述RFF初始采集指示反馈的所述终端的RFF，并更新所述终端的标识模块与所述终端的RFF对应关系。因此，采用本发明实施例提供的方法当RFF认证失败时，考虑到可能是用户更换手机，此时执行用户身份识别流程，当识别通过时，重新采集当前标识模块对应终端的RFF。
应理解的是，核心网设备判断终端的RFF认证失败时，表明终端不是首次入网，此时可能是用户采用原标识模块、或者新补办的标识模块、或者非法复制的标识模块安装在了其他终端上，因此可能出现伪终端将要进行非法操作的场景。
若终端的用户身份识别结果为识别通过，则表明是原标识模块或者新补办的标识模块安装在了其他终端上，不是非法复制的标识模块安装在了其他 终端上。因此，由于标识模块安装在了其他终端上，即标识模块不在原终端上，安装在了新终端上，所以原终端与标识模块绑定关系需要解除，RFF认证无法通过，此时需要更新终端的标识模块与终端的RFF的对应关系，以建立标识模块与新终端绑定关系。
若终端的用户身份识别结果为识别不通过，则表明是非法复制的标识模块安装在了其他终端上，RFF认证无法通过，此时，核心网设备拒绝为该终端提供后续服务，避免了标识模块被非法复制后终端的非法操作带来的危害，提高了网络侧对终端的安全防护能力。
第二方面、一种网络安全防护方法，包括：基站接收所述核心网设备发送的RFF初始采集指示，所述RFF初始采集指示携带终端的标识信息；所述基站根据所述终端的标识信息，采集所述标识信息对应终端的RFF，并将采集到的RFF反馈至所述核心网设备，以使所述核心网设备保存所述终端的标识模块与所述终端的RFF的对应关系；；基站接收核心网设备发送的RFF采集指示，所述RFF采集指示携带所述终端的标识信息；所述基站根据所述终端的标识信息，采集所述标识信息对应终端的RFF；所述基站根据采集到的RFF生成RFF采集信息反馈至所述核心网设备，以使所述核心网设备根据所述RFF采集信息判断所述终端的RFF认证是否成功。因此，基站执行核心网设备发送的RFF初始采集指示，以使核心网设备保存所述终端的标识模块与所述终端的RFF对应关系，基站后续执行RFF采集指示，以使核心网设备判断本次采集的RFF与已存的RFF是否一致，对终端进行RFF认证。
在一种可能的实现方式中，所述RFF采集指示还携带标识模块对应的终端的RFF；所述基站根据采集到的RFF生成RFF采集信息，包括：所述基站根据采集到的RFF与所述RFF采集指示携带的RFF生成RFF比对信息作为RFF采集信息。
在一种可能的实现方式中，所述标识模块为用户识别模块SIM或全球用户识别模块USIM。
在一种可能的实现方式中，所述基站根据采集到的RFF生成RFF采集信 息，包括：所述基站将采集到的RFF作为RFF采集信息。因此，基站可以采用多种方式向核心网设备反馈RFF采集信息。
第三方面、一种网络安全防护设备，包括：收发器和与所述收发器耦合的处理器；所述处理器，用于：通过所述收发器向基站发送射频指纹RFF初始采集指示，所述RFF初始采集指示携带终端的标识信息；通过所述收发器接收所述基站根据所述RFF初始采集指示反馈的所述终端的RFF，并保存所述终端的标识模块与所述终端的RFF的对应关系；在对所述终端发起鉴权时，通过所述收发器向所述基站发送RFF采集指示，所述RFF采集指示携带所述终端的标识信息；通过接收所述基站根据所述RFF采集指示反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功。
在一种可能的实现方式中，所述标识模块为用户识别模块SIM或全球用户识别模块USIM。
在一种可能的实现方式中，所述RFF采集指示还携带所述标识模块对应的终端的RFF；所述处理器，具体用于：通过所述收发器接收所述基站反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功时，通过所述收发器接收所述基站根据所述RFF采集指示反馈的RFF采集信息，所述RFF采集信息携带RFF比对信息，所述RFF比对信息是所述基站根据所述基站采集到的RFF与所述RFF采集指示携带的RFF生成的；若所述RFF比对信息指示所述基站采集到的RFF与所述RFF采集指示携带的RFF一致，则判断所述终端的RFF认证成功，否则，判断所述终端的RFF认证失败。
在一种可能的实现方式中，所述处理器，具体用于：通过所述收发器接收所述基站根据所述RFF采集指示反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功时，通过所述收发器接收所述基站反馈的RFF采集信息，所述RFF采集信息携带所述基站采集到的RFF，所述基站采集到的RFF为所述RFF采集指示携带的所述终端的标识信息对应的终端的RFF；判断所述基站采集到的RFF与存储的所述标识模块对应的终端 的RFF是否一致，若一致，则判断所述终端的RFF认证成功，否则，判断所述终端的RFF认证失败。
在一种可能的实现方式中，所述处理器，还用于：判断所述终端的RFF认证失败时，启动所述终端的用户身份识别；确定所述终端的用户身份识别结果为识别通过时，向所述基站发送RFF初始采集指示，所述RFF初始采集指示携带所述终端的标识信息；通过所述收发器接收所述基站根据所述RFF初始采集指示反馈的所述终端的RFF，并更新所述终端的标识模块与所述终端的RFF对应关系。
第四方面、一种网络安全防护设备，包括：收发器和与所述收发器耦合的处理器；所述处理器，用于：通过所述收发器接收所述核心网设备发送的RFF初始采集指示，所述RFF初始采集指示携带终端的标识信息；根据所述终端的标识信息，采集所述标识信息对应终端的RFF，并将采集到的RFF反馈至所述核心网设备，以使所述核心网设备保存所述终端的标识模块与所述终端的RFF的对应关系；通过所述收发器接收核心网设备发送的RFF采集指示，所述RFF采集指示携带所述终端的标识信息；根据所述终端的标识信息，采集所述标识信息对应终端的RFF；根据采集到的RFF生成RFF采集信息反馈至所述核心网设备，以使所述核心网设备根据所述RFF采集信息判断所述终端的RFF认证是否成功。
在一种可能的实现方式中，所述RFF采集指示还携带标识模块对应的终端的RFF；所述处理器，具体用于：根据采集到的RFF生成RFF采集信息时，根据采集到的RFF与所述RFF采集指示携带的RFF生成RFF比对信息作为RFF采集信息。
在一种可能的实现方式中，所述标识模块为用户识别模块SIM或全球用户识别模块USIM。
在一种可能的实现方式中，所述处理器，具体用于：根据采集到的RFF生成RFF采集信息，将采集到的RFF作为RFF采集信息。
附图说明
图1为本发明背景技术中攻击者利用伪终端实施非法操作的示意图；
图2为本发明背景技术中网络对终端的鉴权过程示意图；
图3为本发明实施例中网络安全防护方法的概述流程图；
图4为本发明实施例中核心网通过基站采集终端RFF存储标识模块与RFF对应关系的示意图；
图5(a)为本发明实施例中核心网对终端的RFF认证过程示意图之一；
图5(b)为本发明实施例中核心网对终端的RFF认证过程示意图之二；
图6为本发明实施例中RFF认证过程的具体流程；
图7为本发明实施例中网络安全防护设备的结构示意图之一；
图8为本发明实施例中网络安全防护设备的结构示意图之二。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。
本发明实施例中提到的射频指纹(Radio Frequency Fingerprint，RFF)是指根据无线终端射频电路中电路走线、射频功放、天线等模拟器件存在固有容差，由接收机提取的不同型号以及同一型号不同无线终端分别对应的发射电磁波的独特且唯一的射频特征。
其中，现有的射频指纹提取算法较多，可大致分为提取瞬态响应特征的(频率跳变)算法，提取稳态响应特征的算法以及基于星座轨迹图畸变算法等。
参阅图3所示，本发明实施例提供一种网络安全防护方法，该方法包括：
步骤300：核心网设备确定未保存终端的标识模块与所述终端的射频指纹RFF的对应关系时，向基站发送射频指纹RFF初始采集指示，RFF初始采集指示携带终端的标识信息。
步骤310：基站根据终端的标识信息，采集标识信息对应终端的RFF。
步骤320：基站根据RFF初始采集指示向核心网设备反馈终端的RFF。
步骤330：核心网设备保存终端的标识模块与终端的RFF的对应关系。
具体的，针对上述步骤300～步骤330，核心网设备确定未存储终端的标识模块对应的RFF时，表明终端是首次入网，即终端的标识模块未被使用过，此时，参阅图4所示，核心网设备需要向基站发送RFF初始采集指示，RFF初始采集指示携带终端的标识信息。基站根据终端的标识信息，采集标识信息对应终端的RFF，并将采集到的RFF反馈至核心网设备。核心网设备接收基站根据RFF初始采集指示反馈的终端的RFF，并保存保存终端的标识模块与终端的RFF的对应关系，即当终端为首次入网时，需要通过基站采集当前标识模块所在终端的RFF，建立该标识模块与安装该标识模块终端的绑定关系。
可选地，标识模块为SIM或全球用户识别模块全球用户识别模块(Universal Subscriber Identity Module，USIM)。
可选地，可以将小区标识加终端标识作为终端的标识信息，此外，还可选择唯一标识终端的其他信息作为终端的标识信息，这里不做具体限定。
步骤340：核心网设备对终端发起鉴权。
应理解的是，核心网设备对终端的RFF认证过程，可以与核心网设备对终端的鉴权过程同时进行，或在核心网设备对终端鉴权成功后开始执行。
核心网设备对终端的鉴权过程与现有技术一致，此处不再赘述。
步骤350：核心网设备向基站发送RFF采集指示，RFF采集指示携带终端的标识信息。
具体的，核心网设备已存储终端的标识模块与终端的RFF的对应关系，表明终端不是首次入网，即终端的标识模块已经使用过，该标识模块对应终端的RFF已经由基站采集过，并将终端的标识模块与RFF的对应关系存储在核心网设备中，由于每个终端的RFF是惟一的，因此该标识模块与安装该标识模块终端具有绑定关系，核心网设备利用这种绑定关系，通过基站再次采 集终端的RFF，以确定是否满足原绑定关系，分析出当前终端是否为伪终端。
步骤360：基站根据终端的标识信息，采集标识信息对应终端的RFF。
具体的，终端在与基站进行通信的过程中，会发送上行信号至基站，基站可基于该上行信号，通过射频指纹提取算法获得RFF。
步骤370：基站根据采集到的RFF生成RFF采集信息反馈至核心网设备。
参阅图5(a)和图5(b)所示，在执行步骤370时，基站可以采用但不限于以下两种方式生成RFF采集信息：
第一种方式：RFF采集指示还携带标识模块对应的终端的RFF时，基站根据采集到的RFF与RFF采集指示携带的RFF生成RFF比对信息作为RFF采集信息。
第二种方式：基站将采集到的RFF直接作为RFF采集信息。
步骤380：核心网设备接收基站根据RFF采集指示反馈的RFF采集信息，并根据RFF采集信息判断终端的RFF认证是否成功。
参阅图5(a)和图5(b)所示，对应步骤380，在核心网设备执行步骤370时，可以采用但不限于以下两种方式：
第一种方式：RFF采集指示还携带标识模块对应的终端的RFF时，核心网设备接收基站根据RFF采集指示反馈的RFF采集信息，RFF采集信息携带RFF比对信息，RFF比对信息是基站根据基站采集到的RFF与RFF采集指示携带的RFF生成的。
若RFF比对信息指示基站采集到的RFF与RFF采集指示携带的RFF一致，则核心网设备判断终端的RFF认证成功，否则，判断终端的RFF认证失败。
第二种方式：核心网设备接收基站反馈的RFF采集信息，RFF采集信息携带基站采集到的RFF，其中，基站采集到的RFF为RFF采集指示携带标识信息对应的终端的RFF。
核心网设备判断基站采集到的RFF与存储的标识模块对应的RFF是否一致，若一致，则判断终端的RFF认证成功，否则，判断终端的RFF认证失败。
此外，在执行完步骤340后，核心网设备判断终端的RFF认证失败时，启动终端的用户身份识别。
应理解的是，针对终端的用户身份识别过程可以为现有过程，例如，根据终端用户之前预留信息对当前终端用户进行用户身份识别，这里的预留信息可以为针对预设问题的答案，例如，小学的名称，最喜欢吃的水果等。本申请对用户身份识别过程不做具体限定。
核心网设备确定终端的用户身份识别结果为识别通过时，向基站发送RFF初始采集指示，RFF初始采集指示携带终端的标识信息。基站根据终端的标识信息，采集标识信息对应终端的RFF，并将采集到的RFF反馈至核心网设备。核心网设备接收基站根据RFF初始采集指示反馈的终端的RFF，并更新终端的标识模块与终端的RFF的对应关系。这里与如图4所示的过程一致。
应理解的是，核心网设备判断终端的RFF认证失败时，表明终端不是首次入网，此时可能是用户采用原标识模块、或者新补办的标识模块、或者非法复制的标识模块安装在了其他终端上，因此可能出现伪终端将要进行非法操作的场景。
若终端的用户身份识别结果为识别通过，则表明是原标识模块或者新补办的标识模块安装在了其他终端上，不是非法复制的标识模块安装在了其他终端上。因此，由于标识模块安装在了其他终端上，即标识模块不在原终端上，安装在了新终端上，所以原终端与标识模块绑定关系需要解除，RFF认证无法通过，此时需要更新终端的标识模块与终端的RFF的对应关系，以建立标识模块与新终端绑定关系。
若终端的用户身份识别结果为识别不通过，则表明是非法复制的标识模块安装在了其他终端上，RFF认证无法通过，此时，核心网设备拒绝为该终端提供后续服务，避免了标识模块被非法复制后终端的非法操作带来的危害，提高了网络侧对终端的安全防护能力。
参阅图6所示，RFF认证过程的具体流程为：
S601：EPC启动对UE的鉴权过程。
S602：EPC判断UE是否为首次入网。
EPC通过是否存储有UE的SIM对应的UE的RFF判断UE是否为首次入网，若是执行S603，否则，执行S608。
S603：EPC向eNB发送RFF采集指示。
该RFF采集指示中携带UE的标识信息，该标识信息中包括UE的标识和UE所在小区的标识。
S604：eNB根据EPC发送的RFF采集指示采集RFF，生成RFF采集信息反馈至EPC。
具体的，eNB根据EPC发送的RFF采集指示采集标识信息对应UE的RFF，并将采集到的RFF作为RFF采集信息反馈至EPC。
S605：EPC根据RFF采集信息判断针对UE的RFF认证是否成功。
若是，执行S606，否则执行S607。
S606：EPC继续进行针对UE的鉴权过程，在鉴权成功后，为UE提供服务，流程结束。
S607：EPC启动针对UE的用户身份识别过程。判断用户身份识别结果是否为识别通过，若是执行S608，否则执行S611。
例如，EPC向UE发送预留问题，并接收UE回复的针对预留问题的答案，当已存的针对预留问题的答案与UE回复的针对预留问题的答案一致时，则EPC确定用户身份识别结果为识别通过，当已存的针对预留问题的答案与UE回复的针对预留问题的答案不一致时，则EPC确定用户身份识别结果为识别不通过。
S608：EPC向eNB发送RFF初始采集指示。
该RFF初始采集指示中携带UE的标识信息。
S609:eNB根据RFF初始采集指示采集RFF，并上报至EPC。
S610:EPC接收eNB反馈的RFF，并存储该SIM与eNB采集到的RFF的对应关系，流程结束。
S611：EPC确定该UE的RFF认证不通过，拒绝为该UE提供后续服务， 流程结束。
参阅图7所示，本发明实施例提供一种网络安全防护设备，例如，核心网设备，包括：收发器701和与所述收发器耦合的处理器702；
所述处理器702，用于：通过所述收发器向基站发送射频指纹RFF初始采集指示，所述RFF初始采集指示携带终端的标识信息；通过所述收发器接收所述基站根据所述RFF初始采集指示反馈的所述终端的RFF，并保存所述终端的标识模块与所述终端的RFF的对应关系；在对所述终端发起鉴权时，通过所述收发器向所述基站发送RFF采集指示，所述RFF采集指示携带所述终端的标识信息；通过接收所述基站根据所述RFF采集指示反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功。
在一种可能的实现方式中，所述标识模块为用户识别模块SIM或全球用户识别模块USIM。
在一种可能的实现方式中，所述RFF采集指示还携带所述标识模块对应的终端的RFF；
所述处理器702，具体用于：通过所述收发器接收所述基站反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功时，通过所述收发器接收所述基站根据所述RFF采集指示反馈的RFF采集信息，所述RFF采集信息携带RFF比对信息，所述RFF比对信息是所述基站根据所述基站采集到的RFF与所述RFF采集指示携带的RFF生成的；若所述RFF比对信息指示所述基站采集到的RFF与所述RFF采集指示携带的RFF一致，则判断所述终端的RFF认证成功，否则，判断所述终端的RFF认证失败。
在一种可能的实现方式中，所述处理器702，具体用于：通过所述收发器接收所述基站根据所述RFF采集指示反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功时，通过所述收发器接收所述基站反馈的RFF采集信息，所述RFF采集信息携带所述基站采集到的RFF，所述基站采集到的RFF为所述RFF采集指示携带的所述终端的标识信息对应的终端的RFF；判断所述基站采集到的RFF与存储的所述标识模块对应的终端 的RFF是否一致，若一致，则判断所述终端的RFF认证成功，否则，判断所述终端的RFF认证失败。
在一种可能的实现方式中，所述处理器702，还用于：判断所述终端的RFF认证失败时，启动所述终端的用户身份识别；确定所述终端的用户身份识别结果为识别通过时，向所述基站发送RFF初始采集指示，所述RFF初始采集指示携带所述终端的标识信息；通过所述收发器接收所述基站根据所述RFF初始采集指示反馈的所述终端的RFF，并更新所述终端的标识模块与所述终端的RFF对应关系。
参阅图8所示，本发明实施例提供一种网络安全防护设备，例如基站，包括：收发器801和与所述收发器耦合的处理器802；
所述处理器802，用于：通过所述收发器接收所述核心网设备发送的RFF初始采集指示，所述RFF初始采集指示携带终端的标识信息；根据所述终端的标识信息，采集所述标识信息对应终端的RFF，并将采集到的RFF反馈至所述核心网设备，以使所述核心网设备保存所述终端的标识模块与所述终端的RFF的对应关系；通过所述收发器接收核心网设备发送的RFF采集指示，所述RFF采集指示携带所述终端的标识信息；根据所述终端的标识信息，采集所述标识信息对应终端的RFF；根据采集到的RFF生成RFF采集信息反馈至所述核心网设备，以使所述核心网设备根据所述RFF采集信息判断所述终端的RFF认证是否成功。
在一种可能的实现方式中，所述RFF采集指示还携带标识模块对应的终端的RFF；
所述处理器802，具体用于：根据采集到的RFF生成RFF采集信息时，根据采集到的RFF与所述RFF采集指示携带的RFF生成RFF比对信息作为RFF采集信息。
在一种可能的实现方式中，所述标识模块为用户识别模块SIM或全球用户识别模块USIM。
在一种可能的实现方式中，所述处理器802，具体用于：根据采集到的 RFF生成RFF采集信息，将采集到的RFF作为RFF采集信息。
综上所述，相较于现有技术中由于网络只识别SIM是否合法，并不感知终端的物理层特征，采用本发明实施例提供的方法在终端认证过程中，新增了对终端射频指纹的提取和分析认证。由于增加了终端物理层特征的认证，可将真终端和伪终端区分出来，因此可解决目前方案的不足，显著提高了网络侧对终端的安全防护能力。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分步骤是可以通过程序来指令处理器完成，所述的程序可以存储于计算机可读存储介质中，所述存储介质是非短暂性(英文：non-transitory)介质，例如随机存取存储器，只读存储器，快闪存储器，硬盘，固态硬盘，磁带(英文：magnetic tape)，软盘(英文：floppy disk)，光盘(英文：optical disc)及其任意组合。
本发明是参照本发明实施例的方法和设备各自的流程图和方框图来描述的。应理解可由计算机程序指令实现流程图和方框图中的每一流程和方框、以及流程图和方框图中的流程和方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和方框图一个方框或多个方框中指定的功能的装置。
以上所述，仅为本发明较佳的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到的变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应该以权利要求的保护范围为准。

Claims (18)

  1. 一种网络安全防护方法，其特征在于，包括：
    核心网设备确定未保存终端的标识模块与所述终端的射频指纹RFF的对应关系时，向基站发送RFF初始采集指示，所述RFF初始采集指示携带所述终端的标识信息；
    所述核心网设备接收所述基站根据所述RFF初始采集指示反馈的所述终端的RFF，保存所述终端的标识模块与所述终端的RFF的对应关系；
    在所述核心网设备对所述终端发起鉴权时，所述核心网设备向所述基站发送RFF采集指示，所述RFF采集指示携带所述终端的标识信息；
    所述核心网设备接收所述基站根据所述RFF采集指示反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功。
  2. 如权利要求1所述的方法，其特征在于，所述标识模块为用户识别模块SIM或全球用户识别模块USIM。
  3. 如权利要求1或2所述的方法，其特征在于，所述RFF采集指示还携带所述标识模块对应的终端的RFF；
    所述核心网设备接收所述基站反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功，包括：
    所述核心网设备接收所述基站根据所述RFF采集指示反馈的RFF采集信息，所述RFF采集信息携带RFF比对信息，所述RFF比对信息是所述基站根据所述基站采集到的RFF与所述RFF采集指示携带的RFF生成的；
    若所述RFF比对信息指示所述基站采集到的RFF与所述RFF采集指示携带的RFF一致，则所述核心网设备判断所述终端的RFF认证成功，否则，判断所述终端的RFF认证失败。
  4. 如权利要求1或2所述的方法，其特征在于，所述核心网设备接收所述基站根据所述RFF采集指示反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功，包括：
    所述核心网设备接收所述基站反馈的RFF采集信息，所述RFF采集信息携带所述基站采集到的RFF，所述基站采集到的RFF为所述RFF采集指示携带的所述终端的标识信息对应的终端的RFF；
    所述核心网设备判断所述基站采集到的RFF与存储的所述标识模块对应的终端的RFF是否一致，若一致，则判断所述终端的RFF认证成功，否则，判断所述终端的RFF认证失败。
  5. 如权利要求3或4所述的方法，其特征在于，还包括：
    所述核心网设备判断所述终端的RFF认证失败时，启动所述终端的用户身份识别；
    所述核心网设备确定所述终端的用户身份识别结果为识别通过时，向所述基站发送RFF初始采集指示，所述RFF初始采集指示携带所述终端的标识信息；
    所述核心网设备接收所述基站根据所述RFF初始采集指示反馈的所述终端的RFF，并更新所述终端的标识模块与所述终端的RFF对应关系。
  6. 一种网络安全防护方法，其特征在于，包括：
    基站接收所述核心网设备发送的RFF初始采集指示，所述RFF初始采集指示携带终端的标识信息；
    所述基站根据所述终端的标识信息，采集所述标识信息对应终端的RFF，并将采集到的RFF反馈至所述核心网设备，以使所述核心网设备保存所述终端的标识模块与所述终端的RFF的对应关系；
    基站接收核心网设备发送的RFF采集指示，所述RFF采集指示携带所述终端的标识信息；
    所述基站根据所述终端的标识信息，采集所述标识信息对应终端的RFF；
    所述基站根据采集到的RFF生成RFF采集信息反馈至所述核心网设备，以使所述核心网设备根据所述RFF采集信息判断所述终端的RFF认证是否成功。
  7. 如权利要求6所述的方法，其特征在于，所述RFF采集指示还携带标 识模块对应的终端的RFF；
    所述基站根据采集到的RFF生成RFF采集信息，包括：
    所述基站根据采集到的RFF与所述RFF采集指示携带的RFF生成RFF比对信息作为RFF采集信息。
  8. 如权利要求7所述的方法，其特征在于，所述标识模块为用户识别模块SIM或全球用户识别模块USIM。
  9. 如权利要求6所述的方法，其特征在于，所述基站根据采集到的RFF生成RFF采集信息，包括：
    所述基站将采集到的RFF作为RFF采集信息。
  10. 一种网络安全防护设备，其特征在于，包括：收发器和与所述收发器耦合的处理器；
    所述处理器，用于：
    通过所述收发器向基站发送射频指纹RFF初始采集指示，所述RFF初始采集指示携带终端的标识信息；
    通过所述收发器接收所述基站根据所述RFF初始采集指示反馈的所述终端的RFF，并保存所述终端的标识模块与所述终端的RFF的对应关系；
    在对所述终端发起鉴权时，通过所述收发器向所述基站发送RFF采集指示，所述RFF采集指示携带所述终端的标识信息；
    通过接收所述基站根据所述RFF采集指示反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功。
  11. 如权利要求10所述的设备，其特征在于，所述标识模块为用户识别模块SIM或全球用户识别模块USIM。
  12. 如权利要求10或11所述的设备，其特征在于，所述RFF采集指示还携带所述标识模块对应的终端的RFF；
    所述处理器，具体用于：
    通过所述收发器接收所述基站反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功时，通过所述收发器接收所述基站 根据所述RFF采集指示反馈的RFF采集信息，所述RFF采集信息携带RFF比对信息，所述RFF比对信息是所述基站根据所述基站采集到的RFF与所述RFF采集指示携带的RFF生成的；
    若所述RFF比对信息指示所述基站采集到的RFF与所述RFF采集指示携带的RFF一致，则判断所述终端的RFF认证成功，否则，判断所述终端的RFF认证失败。
  13. 如权利要求10或11所述的设备，其特征在于，所述处理器，具体用于：
    通过所述收发器接收所述基站根据所述RFF采集指示反馈的RFF采集信息，并根据所述RFF采集信息判断所述终端的RFF认证是否成功时，通过所述收发器接收所述基站反馈的RFF采集信息，所述RFF采集信息携带所述基站采集到的RFF，所述基站采集到的RFF为所述RFF采集指示携带的所述终端的标识信息对应的终端的RFF；
    判断所述基站采集到的RFF与存储的所述标识模块对应的终端的RFF是否一致，若一致，则判断所述终端的RFF认证成功，否则，判断所述终端的RFF认证失败。
  14. 如权利要求12或13所述的设备，其特征在于，所述处理器，还用于：
    判断所述终端的RFF认证失败时，启动所述终端的用户身份识别；
    确定所述终端的用户身份识别结果为识别通过时，向所述基站发送RFF初始采集指示，所述RFF初始采集指示携带所述终端的标识信息；
    通过所述收发器接收所述基站根据所述RFF初始采集指示反馈的所述终端的RFF，并更新所述终端的标识模块与所述终端的RFF对应关系。
  15. 一种网络安全防护设备，其特征在于，包括：收发器和与所述收发器耦合的处理器；
    所述处理器，用于：
    通过所述收发器接收所述核心网设备发送的RFF初始采集指示，所述 RFF初始采集指示携带终端的标识信息；
    根据所述终端的标识信息，采集所述标识信息对应终端的RFF，并将采集到的RFF反馈至所述核心网设备，以使所述核心网设备保存所述终端的标识模块与所述终端的RFF的对应关系；
    通过所述收发器接收核心网设备发送的RFF采集指示，所述RFF采集指示携带所述终端的标识信息；
    根据所述终端的标识信息，采集所述标识信息对应终端的RFF；
    根据采集到的RFF生成RFF采集信息反馈至所述核心网设备，以使所述核心网设备根据所述RFF采集信息判断所述终端的RFF认证是否成功。
  16. 如权利要求15所述的设备，其特征在于，所述RFF采集指示还携带标识模块对应的终端的RFF；
    所述处理器，具体用于：
    根据采集到的RFF生成RFF采集信息时，根据采集到的RFF与所述RFF采集指示携带的RFF生成RFF比对信息作为RFF采集信息。
  17. 如权利要求16所述的设备，其特征在于，所述标识模块为用户识别模块SIM或全球用户识别模块USIM。
  18. 如权利要求15所述的设备，其特征在于，所述处理器，具体用于：
    根据采集到的RFF生成RFF采集信息，将采集到的RFF作为RFF采集信息。
PCT/CN2016/107756 2016-11-29 2016-11-29 一种网络安全防护方法及设备 WO2018098641A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201680090081.6A CN109845215A (zh) 2016-11-29 2016-11-29 一种网络安全防护方法及设备
PCT/CN2016/107756 WO2018098641A1 (zh) 2016-11-29 2016-11-29 一种网络安全防护方法及设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/107756 WO2018098641A1 (zh) 2016-11-29 2016-11-29 一种网络安全防护方法及设备

Publications (1)

Publication Number Publication Date
WO2018098641A1 true WO2018098641A1 (zh) 2018-06-07

Family

ID=62241028

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/107756 WO2018098641A1 (zh) 2016-11-29 2016-11-29 一种网络安全防护方法及设备

Country Status (2)

Country Link
CN (1) CN109845215A (zh)
WO (1) WO2018098641A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112383958B (zh) * 2020-11-11 2022-07-19 武汉虹信科技发展有限责任公司 用于无线定位的主机、单兵、系统及无线定位方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102056293A (zh) * 2010-12-10 2011-05-11 北京星网锐捷网络技术有限公司 射频指纹定位方法、系统、无线控制器及定位服务器
CN103945428A (zh) * 2013-01-21 2014-07-23 华为技术有限公司 射频指纹库更新方法、装置及系统
CN105162778A (zh) * 2015-08-19 2015-12-16 电子科技大学 基于射频指纹的跨层认证方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101174873B (zh) * 2006-10-30 2011-08-10 华为技术有限公司 中继站设备及其实现的通信转发方法
WO2014071632A1 (zh) * 2012-11-12 2014-05-15 东莞宇龙通信科技有限公司 虚拟用户识别卡的实现方法、系统及通信终端
CN104935575A (zh) * 2015-04-29 2015-09-23 努比亚技术有限公司 一种登录方法、鉴权方法及设备
CN105631472B (zh) * 2015-12-24 2019-06-11 东南大学 一种基于星座轨迹图的无线设备身份识别方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102056293A (zh) * 2010-12-10 2011-05-11 北京星网锐捷网络技术有限公司 射频指纹定位方法、系统、无线控制器及定位服务器
CN103945428A (zh) * 2013-01-21 2014-07-23 华为技术有限公司 射频指纹库更新方法、装置及系统
CN105162778A (zh) * 2015-08-19 2015-12-16 电子科技大学 基于射频指纹的跨层认证方法

Also Published As

Publication number Publication date
CN109845215A (zh) 2019-06-04

Similar Documents

Publication Publication Date Title
US10244074B2 (en) Method and apparatus for receiving profile by terminal in mobile communication system
CN106028331B (zh) 一种识别伪基站的方法及设备
CA2736172C (en) Secure negotiation of authentication capabilities
US10038998B2 (en) Profile deletion codes in subscription management systems
US11778458B2 (en) Network access authentication method and device
US9948641B2 (en) Method and devices for providing a subscription profile on a mobile terminal
CN104601324A (zh) 一种针对应用的验证方法、终端和系统
KR20160143333A (ko) 이중 채널을 이용한 이중 인증 방법
WO2017161875A1 (zh) 识别伪基站的方法及装置
CN111148094A (zh) 5g用户终端的注册方法、用户终端设备及介质
CN106657034B (zh) 一种业务鉴权的方法及鉴权能力开放服务器
WO2018098641A1 (zh) 一种网络安全防护方法及设备
CN109151827B (zh) 基于射频指纹的WiFi定位欺骗检测方法及装置
CN111148213A (zh) 5g用户终端的注册方法、用户终端设备及介质
CN108123918A (zh) 一种账户认证登录方法及装置
WO2016065572A1 (zh) 终端、服务器、用户识别的系统及方法
US11751059B1 (en) Subscriber identification module (SIM) application authentication
CN112637846B (zh) 一种热点连接方法及装置
CN111770488B (zh) Ehplmn更新方法、相关设备及存储介质
CN105207987A (zh) 基于蓝牙手机终端的指纹识别系统
JP2021140482A (ja) 電子情報記憶媒体、情報書き込み方法、及びプログラム
CN114731563A (zh) 无线通信中注册的安全处理
US20230010440A1 (en) System and Method for Performing Identity Management
US20240107316A1 (en) Method for imei verification and unauthorized device detection using control plane message and the system thereof
CN115589571B (zh) 设备找回方法、用户设备、地面卫星设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16923035

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16923035

Country of ref document: EP

Kind code of ref document: A1