WO2018126791A1

WO2018126791A1 - Authentication method and device, and computer storage medium

Info

Publication number: WO2018126791A1
Application number: PCT/CN2017/110751
Authority: WO
Inventors: 谢振华
Original assignee: 中兴通讯股份有限公司
Priority date: 2017-01-03
Filing date: 2017-11-13
Publication date: 2018-07-12
Also published as: CN108271154A; CN108271154B

Abstract

The present application discloses an authentication method, device and computer storage medium. The method comprises: a first network functional entity receiving a handover preparation message transmitted by a second network functional entity, the handover preparation message carrying authentication data therein; the first network functional entity transmitting a handover notification message to the second network functional entity, the handover notification message carrying authentication parameters therein, the authentication parameters being generated on the basis of the authentication data; the first network functional entity receiving a handover completion message from a terminal, the handover completion message carrying authentication information therein, the authentication information being generated on the basis of the authentication parameters; and the first network functional entity verifying the authentication information on the basis of the authentication data.

Description

Authentication method and device, computer storage medium

Cross-reference to related applications

The present application is filed on the basis of a Chinese patent application filed on Jan. 3, 2017, the entire disclosure of which is hereby incorporated by reference.

Technical field

The present application relates to the field of communications, and in particular, to an authentication method and apparatus for performing handover, and a computer storage medium.

Background technique

The 3rd Generation Partnership Project (3GPP) proposes a mobile network authentication scheme. As shown in Figure 1, the process of the authentication scheme includes the following steps:

Step 101: The core network element (such as the mobility management entity MME) sends an authentication data request to the home network element (such as the home subscription service HSS), for example, sends an Authentication Data Request message, where the message carries the identifier of the user to be authenticated, such as international mobile. The station identifies the IMSI and carries the public key PubK of the core network element;

Step 102: A home network element (such as an HSS) obtains an authentication vector of one or a group of users. The authentication vector is composed of the following four parts: a random number RAND, a network authentication parameter AUTN, an expected response XRES, and a key Knp; The network element generates an encryption key Ks and uses it to encrypt Knp in the authentication vector to prevent Knp from being leaked out during transmission, and then uses PubK to encrypt Ks to obtain E _PubK (Ks) for the receiver to decrypt the authentication vector. Key and prevent it from being leaked out during transmission;

Step 103: The home network element (such as the HSS) sends an authentication data response to the core network element (such as the MME), for example, sends an Authentication Data Response message, and the message carries the processed authentication vector and the Ks encrypted by PubK—E _PubK (Ks);

Step 104: The core network element (such as MME) decrypts E _PubK (Ks) with its own private key corresponding to the public key PubK, obtains Ks, and uses Ks to decrypt the encrypted encrypted Ks in the received authentication vector. key;

Step 105: The core network element (such as the MME) sends a user authentication request to the terminal UE, for example, sends a User Authentication Request message, and carries part of the received information in an authentication vector to form an authentication parameter, such as RAND and AUTN;

Step 106: The terminal UE verifies the network based on the AUTN. The terminal UE calculates the response value RES based on the RAND, and sends a user authentication response to the core network element (such as the MME), for example, sends a User Authentication Response message, and the message carries the authentication information, that is, the RES. The core network element compares the RES with the XRES in the authentication vector, and if RES=XRES, the network authenticates the user.

In the above process, the AUTN is used for the terminal UE to authenticate the network, and the RAND is used for the user of the network authentication terminal UE.

In the prior art, the authentication process is not introduced in the handover process, so that the authentication operation can be performed after the handover, and the signaling efficiency is reduced.

Application content

To solve the above technical problem, the embodiment of the present application provides an authentication method and device, and a computer storage medium.

An embodiment of the present application provides an authentication method, where the method includes:

Receiving, by the first network function entity, a handover preparation message sent by the second network function entity, where the handover preparation message carries the authentication data;

The first network function entity sends a handover notification message to the second network function entity, where the handover notification message carries an authentication parameter, and the authentication parameter is generated based on the authentication data;

The first network function entity receives a handover complete message from the terminal, where the handover complete message carries authentication information, and the authentication information is generated based on the authentication parameter;

The first network function entity verifies the authentication information based on the authentication data.

In the above solution, the first network function entity verifies the authentication information based on the authentication data, including:

The first network function entity compares the authentication information based on information in the authentication data;

If the information in the authentication data is the same as the authentication information, the verification is successful; if the information in the authentication data is different from the authentication information, the verification fails.

In the foregoing solution, where the second network function entity is a source base station system, the method further includes:

And after the first network function entity successfully verifies the authentication information based on the authentication data, sending a path switch message to the core network element, where the path switch message carries information about the target base station system.

In the above solution, the second network function entity sends a handover preparation message to the first network function entity, where the handover preparation message carries the authentication data;

And receiving, by the second network function entity, a handover notification message that carries the authentication parameter, where the first network function entity sends a handover execution message carrying the authentication parameter, where the authentication parameter is generated based on the authentication data. .

In the above solution, the authentication data includes one or more authentication sub-data; the authentication parameter is generated based on the authentication data, and includes:

One or more authentication sub-data are selected from the authentication data as the authentication parameter.

The embodiment of the present application further provides an authentication device, where the device includes:

a handover preparation unit, configured to send a handover preparation message to the network, where the handover preparation message carries the authentication data;

The authentication data unit is configured to receive a handover preparation message, where the handover preparation message carries the authentication data, and sends a handover notification message to the network, where the handover notification message carries an authentication parameter, and the authentication parameter is generated based on the authentication data. And for receiving a handover complete message from the terminal, where the handover complete message carries authentication information, and the authentication information is generated based on the authentication parameter;

The switching execution unit is configured to receive a handover notification message, where the handover notification message carries an authentication parameter, and sends a handover execution message carrying the authentication parameter to the terminal;

a verification unit configured to verify the authentication information based on the authentication data.

In the above solution, the verification unit is further configured to: compare the authentication information based on information in the authentication data; if the information in the authentication data is the same as the authentication information, the verification succeeds; If the information in the authentication data is different from the authentication information, the verification fails.

An embodiment of the present application provides an authentication apparatus, where the apparatus includes:

a receiving unit, configured to receive a handover preparation message sent by the second network function entity, where the handover preparation message carries the authentication data, and is configured to receive a handover complete message from the terminal, where the handover complete message carries the authentication information, where The authentication information is generated based on the authentication parameter;

a sending unit, configured to send a handover notification message to the second network function entity, where the handover notification message carries an authentication parameter, and the authentication parameter is generated based on the authentication data;

In the above solution, in a case where the second network function entity is a source base station system, the sending unit is further configured to: send a path switch message to the core network element, where the path switch message carries the target base station system Information.

a sending unit, configured to send a handover preparation message to the first network function entity, where the handover preparation message carries the authentication data, and is configured to send, to the terminal, a handover execution message carrying the authentication parameter, where the authentication parameter is based on the authentication Data generation

The receiving unit is configured to receive a handover notification message that carries the authentication parameter sent by the first network function entity.

In the above solution, the authentication data includes one or more authentication sub-data; the device further includes: a selecting unit configured to select one or more authentication sub-data from the authentication data as the authentication parameter.

The embodiment of the present application further provides a computer storage medium storing a computer program configured to execute the above authentication method.

In the technical solution of the embodiment of the present application, the first network function entity receives the handover preparation message sent by the second network function entity, where the handover preparation message carries the authentication data, and the first network function entity sends the second network function The entity sends a handover notification message, where the handover notification message carries an authentication parameter, and the authentication parameter is generated based on the authentication data; the first network function entity receives a handover complete message from the terminal, where the handover complete message carries the authentication Information, the authentication information is generated based on the authentication parameter; the first network function entity verifies the authentication information based on the authentication data. The technical solution of the embodiment of the present application combines the authentication process with the handover process to provide a new base station system, so that the base station system can initiate and execute the authentication process during the handover process, thereby improving signaling efficiency.

DRAWINGS

The drawings generally illustrate the various embodiments discussed herein by way of example and not limitation.

1 is a schematic flow chart of an existing mobile network authentication method;

2 is a schematic flowchart 1 of an authentication method according to an embodiment of the present application;

3 is a schematic flowchart 2 of an authentication method according to an embodiment of the present application;

4 is a schematic flowchart of an authentication method based on a core network handover according to an embodiment of the present application;

FIG. 5 is a schematic flowchart of an authentication method according to an access network handover according to an embodiment of the present application;

6 is a first schematic structural diagram of an authentication device according to an embodiment of the present application;

FIG. 7 is a second schematic structural diagram of an authentication apparatus according to an embodiment of the present application;

FIG. 8 is a third schematic structural diagram of an authentication apparatus according to an embodiment of the present application.

detailed description

The embodiments of the present application are described in detail with reference to the accompanying drawings.

2 is a schematic flowchart 1 of an authentication method according to an embodiment of the present application. As shown in FIG. 2, the process includes:

Step 201: The first network function entity receives a handover preparation message sent by the second network function entity, where the handover preparation message carries the authentication data.

In this embodiment, the first network function entity is a target base station system, and the second network function entity is a source base station system or a core network element.

Step 202: The first network function entity sends a handover notification message to the second network function entity, where the handover notification message carries an authentication parameter, and the authentication parameter is generated based on the authentication data.

Step 203: The first network function entity receives a handover complete message from the terminal, where the handover complete message carries authentication information, and the authentication information is generated based on the authentication parameter.

Step 204: The first network function entity verifies the authentication information based on the authentication data.

In this embodiment, the first network function entity verifies the authentication information based on the authentication data, and includes:

In the embodiment of the present application, in a case where the second network function entity is a source base station system, the method further includes:

FIG. 3 is a second schematic flowchart of an authentication method according to an embodiment of the present disclosure. As shown in FIG. 3, the process includes:

Step 301: The second network function entity sends a handover preparation message to the first network function entity, where the handover preparation message carries the authentication data.

In this embodiment, the second network function entity is a source base station system, and the first network function entity is a target base station system or a core network element.

Step 302: The second network function entity sends a handover execution message carrying the authentication parameter to the terminal when receiving the handover notification message that carries the authentication parameter sent by the first network function entity, where the authentication parameter is based on the Authentication data generation.

Here, the authentication data includes one or more authentication sub-data; the authentication parameter is generated based on the authentication data, and includes:

The technical solutions of the embodiments of the present application are further described in detail below with reference to specific application scenarios.

Embodiment 1 (The first network function entity is the target base station system, and the second network function entity is the core network element)

FIG. 4 is a schematic flowchart of an authentication method based on a core network switching according to an embodiment of the present application. As shown in FIG. 4, the process includes:

Step 401: The terminal UE accesses the mobile network, and the authentication data sending network element initiates the authentication process to the terminal UE by using the source base station system, or performs the handover process in the embodiment or the embodiment in FIG. 5, and the source base station system caches These certification data;

Step 402: The source base station system determines to initiate a handover process, and sends a handover requirement to the core network element (such as the mobility management function MMF, or the MME), for example, sends a Handover Required message, and carries the cached authentication data.

Step 403: The core network element sends a handover request to the target base station system, for example, sends a Handover Request message, and carries the received authentication data.

Step 404: The target base station system sends a handover response to the core network element, for example, sending a Handover Response message, carrying an authentication parameter, and the authentication parameter is from the cached authentication data, such as RAND and AUTN;

Step 405: The core network element sends a handover command to the source base station system, for example, sends a Handover Command message, and carries the received authentication parameter.

Step 406: The source base station system sends a handover command to the terminal UE, for example, sends a Handover Command message, and carries the received authentication parameter.

Step 407: The terminal UE authenticates the network through the authentication parameter, and calculates the authentication information, such as the RES, and accesses the target base station system, and sends a handover confirmation to the target base station system, for example, sends a Handover Confirmed message, and carries the authentication information.

Step 408: The target base station system receives the authentication information, and verifies the terminal UE, for example, calculates XRES by RAND, and compares whether XRES is equal to RES.

Embodiment 2 (The first network function entity is the target base station system, and the second network function entity is the source base station system)

FIG. 5 is a schematic flowchart of an authentication method based on an access network switching according to an embodiment of the present application. As shown in FIG. 5, the process includes:

Step 501: The terminal UE accesses the mobile network, and the authentication data is sent by the network element through the source base station system. Initiating an authentication process for the terminal UE, or performing a handover procedure in the embodiment or the embodiment in FIG. 4, the source base station system buffering the authentication data;

Step 502: The source base station system determines to initiate a handover process, and sends a handover request to the target base station system, for example, sends a Handover Request message, and carries the cached authentication data.

Step 503: The target base station system sends a handover response to the source base station system, for example, sending a Handover Response message, carrying an authentication parameter, and the authentication parameter is from the cached authentication data, such as RAND and AUTN;

Step 504: The source base station system sends a connection reconfiguration to the terminal UE, for example, sends an RRC Connection Reconfiguration message, and carries the received authentication parameter.

Step 505: The terminal UE authenticates the network through the authentication parameter, and calculates authentication information, such as RES, and accesses the target base station system, and sends a connection reconfiguration complete to the target base station system, for example, sending an RRC Connection Reconfiguration Complete message, carrying the authentication information;

Step 506: The target base station system receives the authentication information, and verifies the terminal UE, for example, calculates XRES by RAND, and compares whether XRES is equal to RES;

Step 507: The target base station system sends a path switch to the core network element, for example, sends a Path Switch message.

FIG. 6 is a first schematic structural diagram of an authentication apparatus according to an embodiment of the present application. As shown in FIG. 6, the apparatus includes:

The receiving unit 61 is configured to receive a handover preparation message sent by the second network function entity, where the handover preparation message carries the authentication data, and is configured to receive a handover complete message from the terminal, where the handover complete message carries the authentication information, where The authentication information is generated based on the authentication parameter;

The sending unit 62 is configured to send a handover notification message to the second network function entity, where the handover notification message carries an authentication parameter, and the authentication parameter is generated based on the authentication data;

The verification unit 63 is configured to verify the authentication information based on the authentication data.

In the embodiment of the present application, the authentication device is configured in a first network function entity, where the first The network function entity is a target base station system, and the second network function entity is a source base station system or a core network element.

In the embodiment of the present application, the checking unit 63 is further configured to: compare the authentication information based on information in the authentication data; if the information in the authentication data is the same as the authentication information, verify Successful; if the information in the authentication data is different from the authentication information, the verification fails.

In the embodiment of the present application, when the second network function entity is the source base station system, the sending unit 62 is further configured to: send a path switch message to the core network element, where the path switch message carries the Information of the target base station system.

It will be understood by those skilled in the art that the implementation functions of the units in the authentication apparatus shown in FIG. 6 can be understood by referring to the related description of the foregoing authentication method. The functions of the units in the authentication apparatus shown in FIG. 6 can be realized by a program running on the processor, or can be realized by a specific logic circuit.

In practical applications, the functions implemented by each unit in the authentication device may be implemented by a central processing unit (CPU) or a microprocessor (MPU, Micro Processor Unit) or a digital device located in the authentication device. Implemented by a signal processor (DSP, Digital Signal Processor) or a Field Programmable Gate Array (FPGA).

FIG. 7 is a second schematic structural diagram of an authentication apparatus according to an embodiment of the present application. As shown in FIG. 7, the apparatus includes:

The sending unit 71 is configured to send a handover preparation message to the first network function entity, where the handover preparation message carries the authentication data, and is configured to send a handover execution message carrying the authentication parameter to the terminal, where the authentication parameter is based on the Authentication data generation;

The receiving unit 72 is configured to receive a handover notification message that carries the authentication parameter sent by the first network function entity;

Here, the authentication data includes one or more authentication sub-data; the apparatus further includes: a selecting unit configured to select one or more authentication sub-data from the authentication data as the authentication parameter.

In the embodiment of the present application, the authentication device is configured in a second network function entity, where the second network function entity is a source base station system, and the first network function entity is a target base station system or a core network element.

Those skilled in the art should understand that the implementation functions of the units in the authentication apparatus shown in FIG. 7 can be understood by referring to the related description of the foregoing authentication method. The functions of the respective units in the authentication apparatus shown in FIG. 7 can be realized by a program running on the processor, or can be realized by a specific logic circuit.

In practical applications, the functions implemented by each unit in the authentication device may be implemented by a CPU, an MPU, or a DSP, or an FPGA or the like located in the authentication device.

FIG. 8 is a third schematic structural diagram of an authentication apparatus according to an embodiment of the present application. As shown in FIG. 8, the apparatus includes:

The handover preparation unit 81 is configured to send a handover preparation message to the network, where the handover preparation message carries the authentication data.

The authentication data unit 82 is configured to receive a handover preparation message, where the handover preparation message carries the authentication data, and sends a handover notification message to the network, where the handover notification message carries an authentication parameter, and the authentication parameter is generated based on the authentication data. And receiving, by the terminal, a handover complete message, where the handover complete message carries authentication information, where the authentication information is generated based on the authentication parameter;

The switching execution unit 83 is configured to receive a handover notification message, where the handover notification message carries an authentication parameter, and sends a handover execution message carrying the authentication parameter to the terminal;

The verification unit 84 is configured to verify the authentication information based on the authentication data.

In the embodiment of the present application, the authentication device is disposed in a base station system.

In the embodiment of the present application, the checking unit 84 is further configured to: compare the authentication information based on information in the authentication data; and if the information in the authentication data is the same as the authentication information, verify Successful; if the information in the authentication data is different from the authentication information, the verification fails.

It will be understood by those skilled in the art that the implementation functions of the units in the authentication apparatus shown in FIG. 8 can be understood by referring to the related description of the foregoing authentication method. The functions of the respective units in the authentication apparatus shown in FIG. 8 can be realized by a program running on the processor, or can be realized by a specific logic circuit.

Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, system, or computer program product. Accordingly, the application can take the form of a hardware embodiment, a software embodiment, or an embodiment in combination with software and hardware. Moreover, the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the computer is readable and stored The instructions in the reservoir produce an article of manufacture comprising an instruction device that implements the functions specified in one or more blocks of the flow or in a flow or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Correspondingly, an embodiment of the present invention further provides a computer storage medium, wherein a computer program is configured, and the computer program is configured to execute the authentication method of the embodiment of the present invention.

The above is only the preferred embodiment of the present application and is not intended to limit the scope of the present application.

Industrial applicability

In the technical solution of the embodiment of the present application, the first network function entity receives the handover preparation message sent by the second network function entity, where the handover preparation message carries the authentication data, and the first network function entity sends the second network function entity to the second network function entity. Sending a handover notification message, where the handover notification message carries an authentication parameter, and the authentication parameter is generated based on the authentication data; the first network function entity receives a handover complete message from the terminal, where the handover complete message carries the authentication information And the authentication information is generated based on the authentication parameter; the first network function entity checks the authentication information based on the authentication data. The technical solution of the embodiment of the present application combines the authentication process with the handover process to provide a new base station system, so that the base station system can initiate and execute the authentication process during the handover process, thereby improving signaling efficiency.

Claims

An authentication method, the method comprising:

Receiving, by the first network function entity, a handover preparation message sent by the second network function entity, where the handover preparation message carries the authentication data;

The first network function entity sends a handover notification message to the second network function entity, where the handover notification message carries an authentication parameter, and the authentication parameter is generated based on the authentication data;

The first network function entity receives a handover complete message from the terminal, where the handover complete message carries authentication information, and the authentication information is generated based on the authentication parameter;

The first network function entity verifies the authentication information based on the authentication data.
The authentication method according to claim 1, wherein the first network function entity verifies the authentication information based on the authentication data, including:

The first network function entity compares the authentication information based on information in the authentication data;

If the information in the authentication data is the same as the authentication information, the verification is successful; if the information in the authentication data is different from the authentication information, the verification fails.
The authentication method according to claim 1 or 2, wherein, in the case that the second network function entity is a source base station system, the method further includes:

And after the first network function entity successfully verifies the authentication information based on the authentication data, sending a path switch message to the core network element, where the path switch message carries information about the target base station system.
An authentication method, the method comprising:

The second network function entity sends a handover preparation message to the first network function entity, where the handover preparation message carries the authentication data;

Receiving, by the second network function entity, the portable identity sent by the first network function entity And transmitting, by the terminal, a handover execution message carrying the authentication parameter, where the authentication parameter is generated based on the authentication data.
The authentication method according to claim 4, wherein the authentication data includes one or more authentication sub-data; the authentication parameter is generated based on the authentication data, and includes:

One or more authentication sub-data are selected from the authentication data as the authentication parameter.
An authentication device, the device comprising:

a handover preparation unit, configured to send a handover preparation message to the network, where the handover preparation message carries the authentication data;

The authentication data unit is configured to receive a handover preparation message, where the handover preparation message carries the authentication data, and sends a handover notification message to the network, where the handover notification message carries an authentication parameter, and the authentication parameter is generated based on the authentication data. And for receiving a handover complete message from the terminal, where the handover complete message carries authentication information, and the authentication information is generated based on the authentication parameter;

The switching execution unit is configured to receive a handover notification message, where the handover notification message carries an authentication parameter, and sends a handover execution message carrying the authentication parameter to the terminal;

a verification unit configured to verify the authentication information based on the authentication data.
The authentication apparatus according to claim 6, wherein the verification unit is further configured to: compare the authentication information based on information in the authentication data; and if the information in the authentication data and the authentication information If the information is the same, the verification is successful; if the information in the authentication data is different from the authentication information, the verification fails.
An authentication device, the device comprising:

a receiving unit, configured to receive a handover preparation message sent by the second network function entity, where the handover preparation message carries the authentication data, and is configured to receive a handover complete message from the terminal, where the handover complete message carries the authentication information, where The authentication information is based on the authentication parameter Number generation

a sending unit, configured to send a handover notification message to the second network function entity, where the handover notification message carries an authentication parameter, and the authentication parameter is generated based on the authentication data;

a verification unit configured to verify the authentication information based on the authentication data.
The authentication apparatus according to claim 8, wherein the verification unit is further configured to: compare the authentication information based on information in the authentication data; and if information in the authentication data and the authentication information If the information is the same, the verification is successful; if the information in the authentication data is different from the authentication information, the verification fails.
The authentication device according to claim 8 or 9, wherein, in the case that the second network function entity is a source base station system, the sending unit is further configured to: send a path switch message to the core network element, The path switch message carries information of the target base station system.
An authentication device, the device comprising:

a sending unit, configured to send a handover preparation message to the first network function entity, where the handover preparation message carries the authentication data, and is configured to send, to the terminal, a handover execution message carrying the authentication parameter, where the authentication parameter is based on the authentication Data generation

The receiving unit is configured to receive a handover notification message that carries the authentication parameter sent by the first network function entity.
The authentication device according to claim 11, wherein said authentication data includes one or more authentication sub-data; said device further comprising: a selecting unit configured to select one or more authenticators from said authentication data Data as the authentication parameter.
A computer storage medium having stored therein computer executable instructions configured to perform the authentication method of any of claims 1-3, or any one of claims 4-5 The authentication method described.