WO2019001509A1

WO2019001509A1 - Network authentication method and system

Info

Publication number: WO2019001509A1
Application number: PCT/CN2018/093319
Authority: WO
Inventors: 李�赫; 诸华林; 靳维生
Original assignee: 华为技术有限公司
Priority date: 2017-06-28
Filing date: 2018-06-28
Publication date: 2019-01-03
Also published as: CN109151816B; CN109151816A

Abstract

The present application relates to the technical field of communications. Disclosed are a network authentication method and system. The method comprises: when receiving a first attachment request, an MME of an LTE-U network adds a network identifier of the LTE-U network into the first attachment request, so as to generate a second attachment request and send the second attachment request to an MME of an LTE network; the MME of the LTE network sends, according to the second attachment request, an authentication data request carrying the network identifier of the LTE-U network and a network identifier of the LTE network, to an HSS; the HSS generates an authentication vector according to the authentication data request, and sends authentication vector to the MME of the LTE network; and The MME of the LTE network interacts with a UE and the MME of the LTE-U network according to the authentication vector, so as to implement network authentication. That is, by means of the method provided in the present application, a UE can implement network authentication with an operator network and an LTE-U network one time when the UE can access the operator network and the LTE-U network.

Description

Network authentication method and system

This application claims the priority of the Chinese Patent Application submitted to the State Intellectual Property Office of the People's Republic of China on June 28, 2017, the application number is 201710510229.3, and the application name is "a network authentication method and system", the entire contents of which are incorporated by reference. Combined in this application.

Technical field

The present application relates to the field of communications technologies, and in particular, to a network authentication method and system.

Background technique

A Long Term Evolution-Unlicensed (LTE-U) network based on a long-term evolution refers to a network composed of network devices deployed by a third party in addition to network devices deployed by operators and users. For example, a hospital deploys network devices such as an LTE-U base station (Evolved Node B, eNB), an LTE-U Mobility Management Entity (MME), and an LTE-U gateway (Gateway, GW). These network devices constitute an LTE-U network, and user equipment (User Equipment, UE) in the hospital can communicate by accessing the LTE-U network. In order to ensure that the UE can access the LTE-U network and also use the network service provided by the operator network, such as a Long Term Evolution (LTE) network, the network device of the LTE-U network can be connected with the network device of the carrier network. The UE is required to authenticate with the LTE-U network and the carrier network when the UE that is not currently connected to the carrier network accesses the LTE-U network.

In the related art, when the UE first accesses the LTE network, the UE first performs mutual authentication with the MME of the LTE network. If the UE determines that the LTE network is authentic and the MME determines that the UE is authentic, the two-way authentication succeeds. After the two-way authentication succeeds, the MME generates a non-access stratum (NAS) key and performs algorithm negotiation with the UE according to the NAS key. The Evolved Node B (eNodeB) generates an Access Stratum (AS) key and performs algorithm negotiation with the UE according to the AS key. If the algorithm negotiation between the eNodeB and the UE is successful, the authentication between the UE and the LTE network is completed, and the UE can successfully access the LTE network.

It can be seen from the foregoing description that the related art only provides a method for directly authenticating a network device in a carrier network when the UE accesses the carrier network, and does not provide that when the LTE-U network exists, the UE accesses the carrier network and A method of network authentication when an LTE-U network is used.

Summary of the invention

The embodiment of the present invention provides a network authentication method and system, which can solve the problem that the method for the UE to access the LTE network and the LTE-U network for network authentication is not provided in the related art.

In a first aspect, a network authentication method is provided, the method comprising:

When the mobility management entity MME of the unlicensed LTE-U network based on the long-term evolution receives the first attach request from the user equipment UE, the network identifier of the LTE-U network is added in the first attach request to generate a second attach request, and sending the second attach request to an MME of a long term evolution LTE network;

When the MME of the LTE network receives the second attach request, send an authentication data request to the home subscriber server HSS based on the second attach request, where the authentication data request carries the LTE-U a network identifier of the network and a network identifier of the LTE network;

And when the HSS receives the authentication data request, generating an authentication vector based on the network identifier of the LTE-U network and the network identifier of the LTE network, and sending the authentication to the MME of the LTE network. a weight vector, the authentication vector including parameters for authenticating the UE, the LTE-U network, and the LTE network;

When the MME of the LTE network receives the authentication vector, interact with the UE and the MME of the LTE-U network based on the authentication vector to implement network authentication.

Optionally, the authentication vector includes a first basic key, a desired reply information, a first random number, and an authentication token AUTN, where the first basic key is a key corresponding to the LTE-U network;

The interaction between the UE and the MME of the LTE-U network based on the authentication vector to implement network authentication, including:

The MME of the LTE network stores the expected reply information, and sends the first random number, the AUTN, the network identifier of the LTE-U network, and the first MME to the UE through the MME of the LTE-U network. As a result of the encryption, the first encryption result is generated by the MME of the LTE-U network based on the first base key;

And when the UE receives the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result, the LTE is based on the first random number and the AUTN The network performs verification, and performs verification on the LTE-U network based on the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result;

And generating, when the UE determines to pass the LTE network and the LTE-U network, the reply information, and generating, according to the first random number, the AUTN, and the network identifier of the LTE-U network. Second encryption result;

The UE sends the second encryption result to the MME of the LTE-U network, and sends the reply information to the MME of the LTE network;

When the MME of the LTE-U network receives the second encryption result, the UE is authenticated based on the second encryption result, and when the MME of the LTE network receives the reply information, based on the The expected reply information and the reply information verify the UE.

Optionally, the MME of the LTE network sends the first random number, the AUTN, and the first encryption result to the UE by using an MME of the LTE-U network, including:

The MME of the LTE network stores the expected reply information, and sends the first base key, the first random number, and the AUTN to an MME of the LTE-U network;

When the MME of the LTE-U network receives the first base key, the first random number, and the AUTN, storing the first base key, based on the first base key Generating a first encryption result, and transmitting the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result to the UE.

Optionally, the generating the first encryption result based on the first basic key includes:

The MME of the LTE-U network generates a second random number, and encrypts the second random number by using the first basic key to obtain the first encryption result;

Correspondingly, the sending, by the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result to the UE, includes:

The MME of the LTE-U network sends the first random number, the AUTN, the network identifier of the LTE-U network, the first encryption result, and the second random number to the UE.

Optionally, the AUTN includes a message authentication code MAC;

The UE performs verification on the LTE network based on the first random number and the AUTN, including:

Generating, by the UE, a desired message authentication code XMAC based on the first random number and other parameters in the AUTN except the MAC;

If the XMAC and the MAC are the same, the UE determines to pass the verification of the LTE network.

Optionally, the UE performs verification on the LTE-U network based on the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result, including:

Generating, by the UE, a second basic key according to the network identifier of the LTE-U network, the first random number, and the AUTN;

The UE encrypts the second random number by using the second basic key to obtain a third encryption result;

If the first encryption result is equal to the third encryption result, the UE determines that the verification of the LTE-U network passes.

Optionally, the generating, according to the first random number, the AUTN, and the network identifier of the LTE-U network, a second encryption result, including:

The UE generates a third random number, and performs overall encryption on the second random number and the third random number by using the second basic key to obtain a second encryption result;

Correspondingly, the sending, by the UE, the second encryption result to the MME of the LTE-U network includes:

Transmitting, by the UE, the second encryption result and the third random number to an MME of the LTE-U network;

Correspondingly, the MME of the LTE-U network performs verification on the UE based on the second encryption result, including:

The MME of the LTE-U network performs overall encryption on the second random number and the third random number by using the stored first basic key to obtain a fourth encryption result;

If the second encryption result and the fourth encryption result are equal, the MME of the LTE-U network determines that the verification of the UE passes.

Optionally, the MME of the LTE network sends the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result to the UE by using the MME of the LTE-U network. include:

The MME of the LTE network stores the expected reply information, and sends the first base key, the expected reply information, the first random number, and the AUTN to the LTE-U network. MME;

And when the MME of the LTE-U network receives the first base key, the expected reply information, the first random number, and the AUTN, the first base key and the expected reply The information is stored, the first encryption result is generated based on the first basic key, and the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result are sent to the Said UE.

Optionally, the AUTN includes a MAC;

The generating the first encryption result based on the first basic key includes:

The MME of the LTE-U network encrypts the MAC by using the first basic key to obtain the first encryption result.

The UE encrypts the MAC by using the second basic key to obtain a fifth encryption result;

If the first encryption result is equal to the fifth encryption result, the UE determines that the verification of the LTE-U network passes.

The UE encrypts the reply information by using the second basic key to obtain a second encryption result;

The MME of the LTE-U network encrypts the reply information by using the stored first basic key to obtain a sixth encryption result;

If the expected reply information stored by the MME of the LTE-U network is the same as the reply information, and the sixth encryption result is equal to the second encryption result, the MME of the LTE-U network determines the pair The verification of the UE is passed.

Optionally, the second attach request carries a security algorithm of the UE, where the authentication vector includes a third base key, expected reply information, a first random number, an authentication token AUTN, and the third basis The key is a key corresponding to the LTE network;

The performing, by using the authentication vector, the UE and the MME of the LTE-U to perform network authentication, including:

The MME of the LTE network interacts with the UE according to the third basic key, the expected reply information, the first random number, and the AUTN, to implement verification of the LTE network by the UE. And verifying, by the MME of the LTE network, the UE;

When the MME of the LTE network determines that the verification of the UE passes, generates a second random number, and generates a first base key based on the network identifier of the LTE-U network and the third base key;

The MME of the LTE network generates a non-access stratum NAS key based on the security algorithm of the UE, and encrypts the second random number by using the NAS key to obtain a seventh encryption result;

The MME of the LTE network, the first base key, the third base key, the NAS key, a network identifier of the LTE-U network, the second random number, and the seventh Sending the encryption result to the MME of the LTE-U network;

The MME of the LTE-U network encrypts the second random number by using the first basic key to obtain an eighth encryption result, and the third basic key, the NAS key, and the The network identifier, the seventh encryption result, and the eighth encryption result of the LTE-U network are sent to the UE;

The UE generates a second basic key based on the third basic key and the network identifier of the LTE-U network, and decrypts the eighth encryption result by using the second basic key to obtain the first Decrypting the result, decrypting the seventh encryption result by using the NAS key, to obtain a second decryption result;

If the first decryption result and the second decryption result are the same, the UE determines that the verification of the LTE-U network passes.

In a second aspect, a network authentication system is provided, the network authentication system having a function of implementing the behavior of the network authentication method in the first aspect. The network authentication system includes the UE, the MME of the LTE-U network, the MME of the LTE network, and the HSS, and the MME of the LTE-U network, the MME of the LTE network, and the HSS are used to implement the network provided by the foregoing first aspect. Authentication method.

A third aspect provides a network device, where the network device includes a processor and a memory, where the memory is used to store a program for supporting a network device to perform the network authentication method provided by the above first aspect, and storing The data involved in implementing the network authentication method provided by the above first aspect. The processor is configured to execute a program stored in the memory. The operating device of the storage device may further include a communication bus for establishing a connection between the processor and the memory.

In a fourth aspect, a computer readable storage medium is provided, the instructions being stored in the computer readable storage medium, when executed on a computer, causing the computer to perform the network authentication method of the first aspect described above.

In a fifth aspect, a computer program product comprising instructions for causing a computer to perform the network authentication method of the first aspect described above when executed on a computer is provided.

The technical effects obtained by the second aspect, the third aspect, the fourth aspect, and the fifth aspect are similar to those obtained by the corresponding technical means in the first aspect, and are not described herein again.

The technical solution provided by the present application has the beneficial effects that, in the embodiment of the present invention, when the UE accesses the LTE-U network, the UE may not send the first attachment request to the LTE. When the MME of the LTE-U network receives the first attach request, the MME of the LTE-U network may join the network identifier of the LTE-U network in the first attach request, thereby generating a second attach request, and The second attach request is sent to the MME of the LTE network, and the MME of the LTE network generates an authentication data request based on the second attach request to request an authentication vector from the HSS, and when the HSS receives the authentication data request, based on the authentication data The request generates an authentication vector, and sends the authentication vector to the MME of the LTE network. After that, the MME of the LTE network can interact with the UE and the MME of the LTE-U network according to the received authentication vector to implement the network authentication. right. That is, with the network authentication method provided by the embodiment of the present invention, the UE can perform authentication with the operator network and the LTE-U network at one time when accessing the operator network and the LTE-U network, thereby The UE can smoothly access the carrier network and the LTE-U network at the same time, which brings convenience to the user.

DRAWINGS

1 is a system architecture diagram of a network authentication method according to an embodiment of the present invention;

2 is a schematic structural diagram of a network device according to an embodiment of the present invention;

3 is a flowchart of a network authentication method according to an embodiment of the present invention;

4 is a flowchart of a method for performing network authentication by using an MME of an LTE network, an MME of an LTE-U network, and a UE according to an embodiment of the present invention;

FIG. 5 is a flowchart of still another method for performing network authentication by using an MME of an LTE network, an MME of an LTE-U network, and a UE according to an embodiment of the present invention;

FIG. 6 is a flowchart of another method for performing network authentication by using an MME of an LTE network, an MME of an LTE-U network, and a UE according to an embodiment of the present invention.

Detailed ways

In order to make the objects, technical solutions and advantages of the present application more clear, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

Before the detailed description of the embodiments of the present invention, the application scenarios of the embodiments of the present invention are introduced. Currently, organizations such as enterprises, hospitals, and government agencies can deploy their own network devices and use unauthorized spectrum in a certain area in order to facilitate communication between internal employees or to push specific information and services to users of the service. Communicate through deployed network devices, where the unlicensed spectrum can be the same spectrum as the WIreless-Fidelity (WIFI) spectrum. These networks consisting of network devices deployed by third parties and communicating using unlicensed spectrum are LTE-U networks. The third party deploying the LTE-U network can provide specific services to users accessing the LTE-U network by controlling the deployed network device. For example, a hospital deploys LTE-U eNB, LTE-U MME, LTE-U GW and other network devices within the scope of the hospital, thereby forming an LTE-U network through which the hospital can The user provides medical services, and the user accessing the LTE-U network can conveniently and quickly find information such as the doctor information, the number of queues, and the location of the department through the LTE-U network.

It should be noted that the third party can not only provide specific services to the user through the deployed LTE-U network, but also connect the network devices in the LTE-U network with the network devices in the carrier network. The user accessing the LTE-U network can simultaneously use the network service provided by the carrier network. On this premise, when a UE that is not currently connected to the carrier network accesses the LTE-U network, the UE needs to authenticate with the LTE-U network and the carrier network. The network authentication method and system provided by the present application can be used in the scenario where the UE that is not currently connected to the carrier network authenticates with the operator network and the LTE-U network when accessing the LTE-U network.

After the application scenario of the embodiment of the present invention is introduced, the system architecture involved in the embodiment of the present invention is described next.

FIG. 1 is a system architecture diagram of a network authentication method according to an embodiment of the present invention. As shown in FIG. 1, the system includes a UE 101, an eNB 102 of an LTE-U network, an MME 103 of an LTE-U network, an MME 104 of an LTE network, and an HSS 105. The UE 101 is connected to the eNB 102 of the LTE-U network, the MME 103 of the LTE-U network is connected to the MME 104 of the LTE network, and the MME 104 of the LTE network is connected to the HSS 105.

The UE 101 may be a user equipment such as a smart phone or a tablet. When performing network authentication, the UE 101 initiates an attach request to the eNB 102 of the LTE-U network, and the eNB 102 of the LTE-U network forwards the attach request sent by the UE 101 to the MME 103 of the LTE-U network, and the MME of the LTE-U network. The MME 104 of the LTE network interacts with the UE according to the attach request sent by the UE to implement authentication between the UE 101, the MME 103 of the LTE-U network, and the MME 104 of the LTE network. In this process, the MME 104 of the LTE network may request an authentication vector from the HSS according to the attach request sent by the UE 101, the network identifier of the LTE-U network, and the network identifier of the LTE network, and the HSS 105 generates an authentication according to the received information. The vector is returned to the MME 104 of the LTE network such that the MME 103 of the LTE-U network and the MME 104 of the LTE network authenticate with the UE 101 based on the authentication vector.

FIG. 2 is a schematic structural diagram of a network device according to an embodiment of the present invention. The network device may be the UE, eNB, MME or HSS in FIG. Referring to FIG. 2, the network device includes at least one processor 201, a communication bus 202, a memory 203, and at least one communication interface 204.

The processor 201 can be a general purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more for controlling the execution of the program of the present application. integrated circuit.

Communication bus 202 can include a path for communicating information between the components described above.

The memory 203 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM), or other information that can store information and instructions. Type of dynamic storage device, or Electro Scientific Erasable Programmable Read-Only Memory (EEPROM), Compact Disc Read-Only Memory (CD-ROM) or other optical disc storage, optical disc Storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being Any other medium accessed by the computer, but is not limited thereto. Memory 203 may be present independently and coupled to processor 201 via communication bus 202. The memory 203 can also be integrated with the processor 201.

The communication interface 204 uses devices such as any transceiver for communicating with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), and the like.

In a particular implementation, as an embodiment, processor 201 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG.

In a particular implementation, as an embodiment, the network device can include multiple processors, such as processor 201 and processor 205 shown in FIG. Each of these processors can be a single-CPU processor or a multi-core processor. A processor herein may refer to one or more devices, circuits, and/or processing cores for processing data, such as computer program instructions.

In a specific implementation, as an embodiment, the network device may further include an output device 206 and an input device 207. Output device 206 is in communication with processor 201 and can display information in a variety of ways. For example, the output device 206 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. Wait. Input device 207 is in communication with processor 201 and can receive user input in a variety of ways. For example, input device 207 can be a mouse, keyboard, touch screen device, or sensing device, and the like.

The network device described above may be a general purpose computer device or a special purpose computer device. In a specific implementation, the network device may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet, a wireless terminal device, a communication device, or an embedded device. The embodiment of the invention does not limit the type of the network device.

The memory 203 is used to store program code for executing the solution of the present application, and is controlled by the processor 201 for execution. The processor 201 is configured to execute the program code 208 stored in the memory 203. One or more software modules may be included in program code 208. The network device shown in FIG. 1 can implement network authentication through the processor 201 and one or more of the program codes 208 in the memory 203.

After the application scenario and system architecture involved in the embodiments of the present invention are explained, the specific implementation process of the embodiment of the present invention is described in detail below.

FIG. 3 is a flowchart of a network authentication method according to an embodiment of the present invention. As shown in FIG. 3, the method includes the following steps:

Step 301: The UE sends the first attach request to the MME of the LTE-U network.

For the UE that is not connected to the carrier network, when the UE accesses the LTE-U network, the UE may send a first attach request (Attach Request) to the eNB of the LTE-U network, and receive the eNB of the LTE-U network. Upon the first attach request, the eNB of the LTE-U network forwards the first attach request to the MME of the LTE-U network.

It should be noted that the first attach request is a NAS message, and the eNB of the LTE-U network cannot parse the first attach request. Moreover, the first attach request may carry an International Mobile Subscriber Identification Number (IMSI) of the UE and a security algorithm of the UE. The IMSI of the UE may be used to uniquely identify the UE, and the IMSI of the UE may determine the mobile network to which the UE currently belongs. In addition, the security algorithm of the UE refers to an encryption algorithm and an integrity protection algorithm supported by the UE.

Step 302: When the MME of the LTE-U network receives the first attach request from the UE, add the network identifier of the LTE-U network in the first attach request to generate a second attach request.

When the MME of the LTE-U network receives the first attach request, the MME may add its own network identifier to the first attach request, thereby generating a second attach request. After the second attach request is generated, the MME of the LTE-U network may determine the MME of the LTE network corresponding to the UE according to the IMSI of the UE carried in the first attach request.

Step 303: The MME of the LTE-U network sends a second attach request to the MME of the LTE network.

After determining the MME of the LTE network corresponding to the UE, the MME of the LTE-U network may send the generated second attach request to the MME of the determined LTE network.

Step 304: When the MME of the LTE network receives the second attach request, send an authentication data request to the HSS based on the second attach request.

When the MME of the LTE network receives the second attach request, it can be seen from the foregoing description that the second attach request carries the IMSI of the UE, the security capability, and the network identifier of the LTE-U network. At this time, the MME of the LTE network may The network identifier of the LTE network is added to the second attach request, thereby generating an authentication data request, and sending the authentication data request to the HSS.

Step 305: When the HSS receives the authentication data request, generate an authentication vector based on the network identifier of the LTE-U network and the network identifier of the LTE network.

When receiving the authentication data request, the HSS may determine, according to the IMSI carried in the authentication data request, a long-term key corresponding to the IMSI of the UE from the stored plurality of long-term keys, and the long-term key may also be called For the mobile phone authentication code (Key identifier, Ki). Afterwards, the HSS may generate a third basic key corresponding to the LTE network according to the determined long-term key and the network identifier of the LTE network, and generate a corresponding LTE-U network by using the long-term key and the network identifier of the LTE-U network. A base key. In addition, after Ki, the HSS may also generate a first random number and a sequence number, and generate an Authentication Token (AUTN) and an expected reply message according to the first random number and the sequence number. The AUTN includes a sequence number, a message authentication code (MAC), an Authentication Management Field (AMF), and the like.

It should be noted that the authentication vector may include the first basic key, the third basic key, the first random number, the expected reply information, and the AUTN, or may not include the first basic key, and only includes the third basic key. Key, first random number, expected reply information, and AUTN. Alternatively, the authentication vector may not include the third base key, but includes the first base key, the first random number, the expected reply information, and the AUTN. When the authentication vector does not include the first base key or the third base key, the HSS may not necessarily generate the first base key or the third base key in the above process.

Step 306: The HSS sends an authentication vector to the MME of the LTE network.

Step 307: When the MME of the LTE network receives the authentication vector, interact with the UE and the MME of the LTE-U network based on the authentication vector to implement network authentication.

When the MME of the LTE network receives the authentication vector, it can interact with the UE and the MME of the LTE-U network according to the authentication vector, thereby completing the verification of the UE by the LTE network, the verification of the UE by the LTE-U network, and the UE. Verification of LTE networks and LTE-U networks.

It should be noted that, in the embodiment of the present invention, the UE may perform verification on the LTE-U network and the LTE network at the same time, or may mutually authenticate with the LTE network before performing mutual authentication with the LTE-U network. In addition, when the UE performs verification on the LTE-U network and the LTE network at the same time, the UE may also verify the LTE-U network by using different parameters in the authentication vector. A specific implementation process of performing network authentication based on the authentication vector interacting with the UE and the MME of the LTE-U network will be described in detail through subsequent embodiments.

In the embodiment of the present invention, for a UE that is not connected to the carrier network, when the UE accesses the LTE-U network, the first attach request may be sent to the MME of the LTE-U network, and the MME of the LTE-U network. Upon receiving the first attach request, the network identifier of the LTE-U network may be added to the first attach request, thereby generating a second attach request, and sending the second attach request to the MME of the LTE network, where the LTE network The MME generates an authentication data request according to the second attach request to request an authentication vector from the HSS, and when the HSS receives the authentication data request, generates an authentication vector based on the authentication data request, and sends the authentication vector After the MME of the LTE network, the MME of the LTE network can interact with the UE and the MME of the LTE-U network according to the received authentication vector to implement network authentication. That is, with the network authentication method provided by the embodiment of the present invention, the UE can perform authentication with the operator network and the LTE-U network at one time when accessing the operator network and the LTE-U network, thereby The UE can smoothly access the carrier network and the LTE-U network at the same time, which brings convenience to the user.

Based on the foregoing description, the UE may perform verification on the LTE-U network and the LTE network at the same time, or may perform mutual authentication with the LTE-U network after verifying the mutual authentication with the LTE network. In addition, when the UE performs verification on the LTE-U network and the LTE network at the same time, the UE may also verify the LTE-U network by using different parameters in the authentication vector. In the following, the MME of the LTE network interacts with the UE and the MME of the LTE-U network based on the authentication vector, and the three implementation manners of the network authentication are respectively explained.

FIG. 4 is a flowchart of a first method for network authentication based on an authentication vector according to an embodiment of the present invention. As shown in FIG. 4, the method includes the following steps:

Step 401: The MME of the LTE network stores the expected reply information in the authentication vector.

Based on the description in the foregoing embodiment, the authentication vector may include a first base key, a first random number, expected reply information, and an AUTN. When the MME of the LTE network receives the authentication vector, the authentication vector may be included in the authentication vector. The expected reply information is stored, and the UE is verified afterwards. The first base key, the first random number, and the AUTN in the authentication vector may be forwarded to the MME of the LTE-U network.

Step 402: The MME of the LTE network sends the first base key, the first random number, and the AUTN to the MME of the LTE-U network.

Step 403: When the MME of the LTE-U network receives the first basic key, the first random number, and the AUTN, storing the first basic key, generating a second random number, and based on the first basic key and the first The second random number generates a first encryption result.

When receiving the first basic key, the first random number, and the AUTN sent by the LTE network, the MME of the LTE-U network may store the first basic key for subsequent verification by the UE. At the same time, the MME of the LTE-U network may further generate a first encryption result based on the first basic key, where the first encryption result is used by the UE to verify the LTE-U network.

The MME of the LTE-U network may generate a second random number by using a random number generator and use the first base key to the second random number when receiving the first base key, the first random number, and the AUTN. Encryption is performed to obtain a first encryption result.

Step 404: The MME of the LTE-U network sends the first random number, the AUTN, the network identifier of the LTE-U network, the first encryption result, and the second random number to the UE.

After the MME of the LTE-U network generates the first encryption result, the first random number, the AUTN, the network identifier of the LTE-U network, the first encryption result, and the second random number used to generate the first encryption result may be sent to The eNB of the LTE-U network forwards the first random number, the AUTN, the network identifier of the LTE-U network, the first encryption result, and the second random number to the UE by the eNB of the LTE-U network.

Step 405: When the UE receives the first random number, the AUTN, the network identifier of the LTE-U network, the first encryption result, and the second random number, the network identifier based on the first random number, the AUTN, and the LTE-U network, The LTE network and the LTE-U network are verified by an encryption result and a second random number.

When the UE receives the first random number, the AUTN, and the first encryption result, the UE may perform verification on the LTE network according to the first random number and the AUTN, and perform LTE-U network according to the first random number, the AUTN, and the first encryption result. verification.

When the UE performs verification on the LTE network, the UE may generate a desired message authentication code XMAC based on the first random number and other parameters in the AUTN except the MAC; if the XMAC and the MAC are the same, the UE determines to pass the verification of the LTE network.

The UE may calculate an Expected Message Authentication Code (XMAC) according to the stored Ki, the first random number, the sequence number in the AUTN, and the AMF. Based on the description of step 305 in the foregoing embodiment, the MAC is included in the AUTN, and the MAC is calculated by the HSS according to the determined Ki, the first random number, the sequence number in the AUTN, and the AMF. After the UE generates the XMAC, If the XMAC and the MAC are the same, it indicates that the Ki determined by the HSS is consistent with the Ki stored in the UE. The Ki determined by the HSS is determined according to the IMSI of the UE, that is, the Ki determined by the HSS is actually the Ki stored by the UE on the LTE network side. Therefore, when the XMAC and the MAC are the same, the UE can determine the current LTE. The network is real, that is, the UE passes the verification of the LTE network.

When the UE performs the verification on the LTE-U network, the UE may generate a second basic key according to the network identifier, the first random number, and the AUTN of the LTE-U network; the UE encrypts the second random number by using the second basic key, A third encryption result is obtained; if the first encryption result is equal to the third encryption result, the UE determines that the verification of the LTE-U network passes.

The UE may generate a second basic key according to the network identifier, the first random number, and the AUTN of the Ki, the LTE-U network, and the AUTN, when the UE performs the verification on the LTE-U network. Thereafter, the second random number is encrypted by the second base key to obtain a third encryption result. Since the first basic key is a key corresponding to the LTE-U network, the first encryption result is obtained by encrypting the second random number by using the first basic key, and therefore, if the third encryption result and the first encryption result The same, the second basic key and the first basic key are the same, that is, the UE can determine the verification of the LTE-U network. On the other hand, if the third encryption result is different from the first encryption result, it indicates that the second basic key is different from the first basic key. At this time, the UE's verification of the LTE-U network will fail.

Step 406: When the UE determines to pass the verification of both the LTE network and the LTE-U network, generate reply information and a third random number, and generate the network identifier, the first random number, the AUTN, and the third random number based on the LTE-U network. The second encryption result.

After the UE determines that the verification of the LTE network is passed, the reply information may be generated by using the stored Ki and the received first random number, and the reply information is used for verifying the UE by the subsequent LTE network.

After the UE determines that the verification of the LTE-U network is passed, the third random number may be generated, after which the UE may receive the second base key according to the network identifier, the first random number, and the AUTN generated by the LTE-U network. The second random number obtained and the generated third random number are integrally encrypted to obtain a second encryption result.

Step 407: The UE sends the second encryption result, the third random number, and the reply information to the MME of the LTE-U network.

After the UE generates the reply information and the second encryption result, the second encryption result, the third random number, and the reply information may be sent to the eNB of the LTE-U network, and the second encryption result is obtained by the eNB of the LTE-U network, The third random number and reply information are forwarded to the MME of the LTE-U network.

Step 408: When the MME of the LTE-U network receives the second encryption result and the third random number, the UE is verified based on the second encryption result.

Based on the description in the foregoing step 403, the MME is stored in the MME of the LTE-U network, and the second random number is generated by the MME of the LTE-U network and stored in the MME of the LTE-U network. Therefore, after the MME of the LTE-U network receives the second encryption result and the third random number, the stored second random number and the received third random number may be performed by using the stored first basic key. Encryption as a whole, resulting in a fourth encryption result. If the fourth encryption result and the second encryption result are the same, it is indicated that the second basic key generated by the UE is the same as the first basic key stored in the MME of the LTE-U network, that is, the LTE-U network. The MME may determine the verification of the UE. On the other hand, if the fourth encryption result is different from the second encryption result, the first basic key and the second basic key are different. At this time, the verification of the UE by the LTE-U network fails.

Step 409: When the MME of the LTE-U network receives the reply information, the MME sends the reply information to the MME of the LTE network.

Based on the description in step 407, the UE sends the second encryption result, the third random number, and the reply information to the MME of the LTE-U network, where the MME of the LTE-U network can utilize the second encryption result and the third random number. The UE is authenticated in the manner of the step 408, and the MME of the LTE-U network can forward the reply information directly to the received reply information, because the reply information is used for the LTE network to authenticate the UE. MME of the LTE network.

Step 410: When the MME of the LTE network receives the reply information, verify the UE based on the reply information.

Based on the description in step 401, the MME of the LTE network stores the expected reply information, which is generated by the HSS according to the determined Ki and the first random number. Therefore, when the MME of the LTE network receives the reply information, if the reply information and the expected reply information are the same, the MME of the LTE network may determine that the Ki for generating the desired reply information and the Ki for generating the reply information are The same is true, that is, the Ki stored on the LTE network side and the Ki stored by the UE are consistent. In this case, the MME of the LTE network can determine that the current UE is authentic and effective, that is, the LTE network. The MME may determine the verification of the UE.

In the embodiment of the present invention, after the MME of the LTE network receives the authentication vector, the MME of the LTE network and the MME of the LTE-U network may send the first random number, the AUTN, and the first encryption result to the UE, when the UE receives After the first random number, the AUTN, and the first encryption result, the LTE-U network and the LTE network may be simultaneously verified according to the first random number, the AUTN, and the first encryption result, and then the MME and the LTE network of the LTE-U network. The MME then verifies the UE according to the reply information from the UE and the second encryption result. That is, with the network authentication method provided by the embodiment of the present invention, the UE can simultaneously perform authentication with the operator network and the LTE-U network when accessing the carrier network and the LTE-U network, thereby enabling The UE can access the carrier network and the LTE-U network at the same time, which brings convenience to the user.

The method for verifying the LTE-U network and the LTE network by using the second random number generated by the UE according to the LTE-U network and other parameters is described in the foregoing embodiment. Next, another UE is simultaneously introduced to the LTE-U network and A method of verifying an LTE network.

FIG. 5 is a flowchart of a second method for network authentication based on an authentication vector according to an embodiment of the present invention. As shown in FIG. 5, the method includes the following steps:

Step 501: The MME of the LTE network stores the expected reply information in the authentication vector.

Based on the description of step 305 in the foregoing embodiment, the authentication vector includes the first base key, the first random number, the expected reply information, and the AUTN. When the MME of the LTE network receives the authentication vector, the expected reply information may be performed. Store for subsequent verification of the UE.

Step 502: The MME of the LTE network sends the first base key, the expected reply information, the first random number, and the AUTN to the MME of the LTE-U network.

After the MME of the LTE network stores the expected reply information, in addition to transmitting the first base key, the first random number, and the AUTN remaining in the authentication vector to the MME of the LTE-U network, the expected reply information needs to be sent. MME of the LTE-U network.

Step 503: When the MME of the LTE-U network receives the first basic key, the expected reply information, the first random number, and the AUTN, the first basic key and the expected reply information are stored, and are generated based on the first basic key. The first encryption result.

When the MME of the LTE-U network receives the first base key, the expected reply information, the first random number, and the AUTN, the first base key and the expected reply information may be stored for subsequent verification of the UE. At the same time, the MME of the LTE-U network may generate a first encryption result based on the first base key.

It should be noted that, in the description of step 305 in the foregoing embodiment, the MAC is included in the AUTN. When the MME of the LTE-U network receives the first basic key, the expected reply information, the first random number, and the AUTN, The MAC in the AUTN is encrypted by the first base key to obtain a first encryption result.

Step 504: The MME of the LTE-U network sends the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result to the UE.

After generating the first encryption result, the MME of the LTE-U network may send the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result to the eNB of the LTE-U network, and by the LTE- The eNB of the U network forwards the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result to the UE.

Step 505: When the UE receives the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result, the network identifier based on the first random number, the AUTN, the LTE-U network, and the first encryption result are used for LTE. The network and the LTE-U network are verified.

When the UE receives the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result, the UE may perform verification on the LTE network according to the first random number and the AUTN, according to the first random number, AUTN, and LTE- The network identifier of the U network and the first encryption result verify the LTE-U network.

For the specific implementation manner of the UE to verify the LTE network, refer to the method for the UE to verify the LTE network in the step 405, which is not described in the embodiment of the present invention.

When the UE performs the verification on the LTE-U network, the UE may generate a second basic key according to the network identifier, the first random number, and the AUTN of the LTE-U network; and encrypt the MAC by using the second basic key to obtain the fifth encryption. As a result; if the first encryption result is equal to the fifth encryption result, the UE determines that the verification of the LTE-U network passes.

The UE may generate a second basic key according to the network identifier of the Ki, the LTE-U network, the first random number, and the AUTN, and then pass the second basic key. The key encrypts the MAC included in the AUTN to obtain a fifth encryption result. Since the first basic key is a key corresponding to the LTE-U network, the first encryption result is obtained by encrypting the MAC by the first basic key, and the fifth encryption result is obtained by encrypting the MAC by the second basic key. . Therefore, if the first encryption result and the fifth encryption result are the same, it indicates that the first basic key and the second basic key are the same, that is, the UE can determine that the verification of the LTE-U network passes. On the other hand, if the fifth encryption result is different from the first encryption result, it indicates that the second basic key is different from the first basic key. At this time, the UE's verification of the LTE-U network will fail.

Step 506: When the UE determines to pass the verification of both the LTE network and the LTE-U network, generate reply information, and generate a second encryption result based on the network identifier, the first random number, and the AUTN of the LTE-U network.

When the UE determines that the verification of the LTE network is passed, the reply information may be generated by the Ki stored by itself and the received first random number.

After the UE determines that the verification of the LTE-U network passes, and generates the reply information, the UE may respond to the reply according to the network identifier of the LTE-U network, the first random number, and the second basic key generated by the AUTN in step 505. The information is encrypted to obtain a second encrypted result.

Step 507: The UE sends the second encryption result and the reply information to the MME of the LTE-U network.

After the UE generates the reply information and the second encryption result, the reply information and the second encryption result may be sent to the eNB of the LTE-U network, and the eNB of the LTE-U network forwards the reply information and the second encryption result to the eNB. MME of the LTE-U network.

Step 508: When the MME of the LTE-U network receives the reply information and the second encryption result, the UE is verified based on the reply information and the second encryption result.

Based on the description in step 503, the MME of the LTE-U network stores a first base key and expected reply information, wherein the expected reply information is generated by the HSS according to the stored Ki and the first random number. After receiving the reply information and the second decryption result, the MME of the LTE-U network may first compare the reply information with the expected reply information, and then the MME of the LTE-U network may use the first basic key pair stored by itself. The reply message is encrypted to obtain a sixth encrypted result. Since the reply information is generated by the UE according to the Ki and the first random number stored by the UE, if the reply information and the expected reply information are the same, and the sixth encryption result is the same as the second encryption result, the UE generates The second base key is consistent with the first base key stored by the MME of the LTE-U network. At this time, the MME of the LTE-U network can confirm that the current UE is authentic and effective, that is, LTE- The MME of the U network may determine the verification of the UE. On the other hand, if the sixth encryption result is different from the second encryption result, it indicates that the first basic key and the second basic key are different. At this time, the verification of the UE by the LTE-U network fails.

Step 509: The MME of the LTE-U network sends the reply information to the MME of the LTE network.

The MME of the LTE-U network may send the reply information to the MME of the LTE network when receiving the reply information. Of course, the MME may also send the reply information to the MME of the LTE network after completing the verification of the UE.

Step 510: When the MME of the LTE network receives the reply information, verify the UE based on the reply information.

When the MME of the LTE network receives the reply information, the specific implementation manner of verifying the UE based on the reply information may refer to the implementation manner in the step 410, which is not repeatedly described in the embodiment of the present invention.

In the embodiment of the present invention, after the MME of the LTE network receives the authentication vector, the MME of the LTE network and the MME of the LTE-U network may send the first random number, the AUTN, and the first encryption result to the UE, where the first The result of the encryption is obtained by the MME of the LTE-U network encrypting the MAC in the AUTN. After receiving the first random number, the AUTN and the first encryption result, the UE may simultaneously obtain the first random number, the AUTN, and the first The LTE-U network and the LTE network are verified by an encryption result, and then the MME of the LTE-U network and the MME of the LTE network authenticate the UE according to the reply information from the UE and the second encryption result, wherein the second encryption The result is that the UE encrypts the reply message. That is, in the network authentication method provided by the embodiment of the present invention, the LTE-U network and the UE do not need to generate a random number any more, and only need to encrypt the parameters in the authentication vector to complete mutual authentication, which simplifies the operation. . With the network authentication method provided by the embodiment of the present invention, the UE can simultaneously perform authentication with the operator network and the LTE-U network when accessing the operator network and the LTE-U network, so that the UE can simultaneously connect. Entering the carrier network and the LTE-U network brings convenience to users.

The foregoing describes the two authentication methods for the UE to simultaneously verify the LTE-U network and the LTE network, and then the MME of the LTE-U network and the MME of the LTE network verify the UE, and then combine 6 is a network authentication method for the UE to mutually authenticate with the LTE network and then verify the LTE-U network.

FIG. 6 is a flowchart of a third method for performing network authentication based on an authentication vector according to an embodiment of the present invention. In this method, an MME of an LTE network first performs a first random based on a third basic key and expected reply information. The number and the AUTN interact with the UE through the method in steps 601-60 to complete mutual authentication with the UE. Thereafter, as shown in FIG. 6, the method includes the following steps:

Step 601: The MME of the LTE network stores the third basic key and the expected reply information in the authentication vector.

Based on the description of step 305 in the foregoing embodiment, the authentication vector may include a third base key, expected reply information, a first random number, and an AUTN. When the third base key, the expected reply information, the first random number, and the AUTN are included in the authentication vector, the MME of the LTE network may receive the third basic key in the authentication vector when receiving the authentication vector. The expected reply information is stored for subsequent verification of the UE.

Step 602: The MME of the LTE network sends the first random number and the AUTN to the UE.

After the MME of the LTE network stores the third base key and the expected reply information, the MME of the LTE network may send the first random number and the AUTN in the authentication vector to the MME of the LTE-U network, and the LTE-U network After receiving the first random number and the AUTN, the MME may send the first random number and the AUTN to the eNB of the LTE-U network, and the eNB of the LTE-U network receives the first random number and the AUTN, and then The first random number and the AUTN are forwarded to the UE.

Step 603: When the UE receives the first random number and the AUTN, perform verification on the LTE network based on the first random number and the AUTN.

For a specific implementation of the step, reference may be made to the implementation manner of the UE performing the verification of the LTE network based on the first random number and the AUTN in the step 405, which is not repeatedly described in the embodiment of the present invention.

Step 604: Generate reply information when the UE determines that the verification of the LTE network passes.

For a specific implementation of the step, reference may be made to the description in the step 406 when the UE determines that the LTE network is authenticated, and the related information is not described herein.

Step 605: The UE sends the reply information to the MME of the LTE network.

After the UE generates the reply information, the reply information may be sent to the MME of the LTE network via the eNB and the MME of the LTE-U network.

Step 606: When the MME of the LTE network receives the reply information, verify the UE based on the reply information.

For a specific implementation of this step, reference may be made to the description of the MME of the LTE network in step 410 for verifying the UE based on the reply information, which is not described in detail in the embodiment of the present invention.

Step 607: When the MME of the LTE network determines that the verification of the UE passes, generate a second random number, and generate a first basic key based on the network identifier of the LTE-U network and the third basic key, and the UE-based security algorithm The NAS key is generated, and the second random number is encrypted by the NAS key to obtain a seventh encryption result.

Based on the description in step 302, the MME of the LTE-U network adds the network identifier of the LTE-U network to the first attach request, thereby generating a second attach request, and sending the second attach request to the LTE network. The MME, therefore, when the MME of the LTE network determines that the verification of the UE is passed, the first base key may be generated based on the network identity of the LTE-U network and the third base key. At the same time, the MME of the LTE network can generate a second random number using a random number generator.

It should be noted that, since the second attach request further includes the security algorithm of the UE, after the MME of the LTE network generates the second random number and the first basic key, the NAS key may be generated according to the security algorithm of the UE. . Thereafter, the MME of the LTE network may encrypt the second random number by using the NAS key to obtain a seventh encryption result.

Step 608: The MME of the LTE network sends the first basic key, the third basic key, the NAS key, the network identifier of the LTE-U network, the second random number, and the seventh encryption result to the MME of the LTE-U network.

Step 609: When the MME of the LTE-U network receives the first basic key, the third basic key, the NAS key, the network identifier of the LTE-U network, the second random number, and the seventh encryption result, the first The base key encrypts the second random number to obtain an eighth encryption result.

Step 610: The MME of the LTE-U network sends the third basic key, the NAS key, the network identifier of the LTE-U network, the seventh encryption result, and the eighth encryption result to the UE.

The MME of the LTE-U network sends the third base key, the NAS key, the network identifier of the LTE-U network, the seventh encryption result, and the eighth encryption result to the eNB of the LTE-U network, and then the LTE-U network The eNB forwards to the UE.

Step 611: When the UE receives the third basic key, the NAS key, the network identifier of the LTE-U network, the seventh encryption result, and the eighth encryption result, the network identifier based on the third basic key and the LTE-U network Generating a second base key, and decrypting the eighth encryption result by using the second base key to obtain a first decryption result, and decrypting the seventh encryption result by using the NAS key to obtain a second decryption result.

Since the first basic key is generated by the MME of the LTE network according to the third basic key and the network identifier of the LTE-U network, in order to verify the authenticity of the LTE-U network, when the UE receives the third basic key and When the network identifier of the LTE-U network is used, the second basic key may be generated according to the third basic key and the network identifier of the LTE-U network, so as to verify whether the second basic key and the first basic key are the same. To verify the LTE-U network.

It should be noted that, in order to prevent the MME of the LTE-U network from being tampered with during the process of transmitting information to the UE, the MME of the LTE-U network does not directly send the first basic key to the UE, but passes the step 609. The method encrypts the second random number by using the first basic key to obtain an eighth encryption result, and sends the eighth encryption result to the UE. After receiving the eighth encryption result, the UE may decrypt the eighth encryption result by using the second basic key to obtain a first decryption result, and decrypt the seventh encryption result by using the NAS key to obtain a second decryption result. .

Step 612: The UE verifies the LTE-U network based on the first decryption result and the second decryption result.

The eighth encryption result is obtained by the MME of the LTE-U network encrypting the second random number by using the first basic key, and the seventh encryption result is that the MME of the LTE network encrypts the second random number by using the NAS key. Therefore, after the UE decrypts the eighth encryption result by using the second base key, after decrypting the seventh encryption result by the NAS key, if the first encryption result and the second encryption result are equal, the UE generates the second The base key and the first base key are the same, that is, the UE can determine that the LTE-U network is authentic, and at this time, the UE can determine the verification of the LTE-U network.

In the embodiment of the present invention, after the MME of the LTE network receives the authentication vector, the MME of the LTE network may first perform the UE and the UE based on the third basic key, the first random number, the expected reply information, and the AUTN in the authentication vector. Interacting to complete mutual authentication with the UE, after which the MME of the LTE network may generate a first base key, a second random number to obtain a NAS key, and the first base key, the second random number, and the NAS key. After being sent to the MME of the LTE-U network, the MME and the UE of the LTE-U network can perform network authentication by using the first base key, the second random number, and the NAS key. That is, with the network authentication method provided by the embodiment of the present invention, the UE can simultaneously perform authentication with the operator network and the LTE-U network when accessing the carrier network and the LTE-U network, thereby enabling The UE can access the carrier network and the LTE-U network at the same time, which brings convenience to the user.

After the network authentication method provided by the embodiment of the present invention is introduced, the network authentication system provided by the embodiment of the present invention is introduced.

An embodiment of the present invention provides a network authentication system, where the network authentication system includes a UE, an MME of an LTE-U network, an MME of an LTE network, and an HSS.

The MME of the LTE-U network is used to perform steps 302 and 303 in the foregoing embodiment;

The MME of the LTE network is used to perform step 304 in the foregoing embodiment;

The HSS is used to perform steps 305 and 306 in the above embodiment;

The MME of the LTE network is used to perform step 307 in the above embodiment.

Optionally, the authentication vector includes a first basic key, expected reply information, a first random number, and an authentication token AUTN, where the first basic key is a key corresponding to the LTE-U network;

The MME of the LTE network is specifically configured to store the expected reply information, and send the network identifier of the first random number, the AUTN, the LTE-U network, and the first encryption result to the UE through the MME of the LTE-U network, and the first encryption result is performed by the LTE- The MME of the U network is generated based on the first base key;

The UE is configured to: when receiving the network identifier of the first random number, the AUTN, the LTE-U network, and the first encryption result, verify the LTE network based on the first random number and the AUTN, and based on the first random number, the AUTN, and the LTE - The network identifier of the U network and the first encryption result verify the LTE-U network;

The UE is further configured to: when determining that both the LTE network and the LTE-U network pass the verification, generate reply information, and generate a second encryption result based on the network identifiers of the first random number, the AUTN, and the LTE-U network;

The UE is further configured to send the second encryption result to the MME of the LTE-U network, and send the reply information to the MME of the LTE network;

The MME of the LTE-U network is configured to perform verification on the UE based on the second encryption result when receiving the second encryption result, and verify the UE based on the expected reply information and the reply information when the MME of the LTE network receives the reply information.

Optionally, the MME of the LTE network is specifically configured to:

The expected reply information is stored, and the first base key, the first random number, and the AUTN are sent to the MME of the LTE-U network;

The MME of the LTE-U network is further configured to: when receiving the first basic key, the first random number, and the AUTN, store the first basic key, generate a first encryption result based on the first basic key, and A network identifier of the random number, the AUTN, the LTE-U network, and the first encryption result are sent to the UE.

Optionally, the MME of the LTE-U network is specifically configured to:

Generating a second random number, and encrypting the second random number by using the first basic key to obtain a first encryption result;

Transmitting the first random number, the AUTN, the network identifier of the LTE-U network, the first encryption result, and the second random number to the UE.

Optionally, the AUTN includes a message authentication code MAC;

The UE is specifically used to:

Generating a desired message authentication code XMAC based on the first random number and other parameters in the AUTN other than the MAC;

If the XMAC and the MAC are the same, it is determined that the verification of the LTE network is passed.

Optionally, the UE is specifically configured to:

Generating a second base key according to the network identifier of the LTE-U network, the first random number, and the AUTN;

Encrypting the second random number by using the second basic key to obtain a third encryption result;

If the first encryption result is equal to the third encryption result, it is determined that the verification of the LTE-U network is passed.

Optionally, the UE is specifically configured to:

Generating a third random number, and performing overall encryption on the second random number and the third random number by using the second basic key to obtain a second encryption result;

Transmitting the second encryption result and the third random number to the MME of the LTE-U network;

Correspondingly, the MME of the LTE-U network is specifically used for:

And encrypting the second random number and the third random number by using the stored first basic key to obtain a fourth encryption result;

If the second encryption result and the fourth encryption result are equal, it is determined that the verification of the UE is passed.

Optionally, the MME of the LTE network is specifically configured to:

The expected reply information is stored, and the first base key, the expected reply information, the first random number, and the AUTN are sent to the MME of the LTE-U network;

The MME of the LTE-U network is configured to store the first basic key and the expected reply information when receiving the first basic key, the expected reply information, the first random number, and the AUTN, based on the first basic key generation. And encrypting the result, and sending the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result to the UE.

Optionally, the AUTN includes a MAC;

The MME of the LTE-U network is specifically used to:

The MAC is encrypted by the first base key to obtain a first encryption result.

Optionally, the UE is specifically configured to:

Encrypting the MAC by using the second basic key to obtain a fifth encryption result;

If the first encryption result is equal to the fifth encryption result, it is determined that the verification of the LTE-U network is passed.

Optionally, the UE is specifically configured to:

Encrypting the reply information by using the second basic key to obtain a second encryption result;

Correspondingly, the MME of the LTE-U network is specifically used for:

Encrypting the reply information by using the stored first basic key to obtain a sixth encryption result;

If the expected reply information stored by the MME of the LTE-U network is the same as the reply information, and the sixth encryption result is equal to the second encryption result, it is determined that the verification of the UE is passed.

Optionally, the second attach request carries the security algorithm of the UE, where the authentication vector includes a third basic key, expected reply information, a first random number, an authentication token AUTN, and the third basic key is a secret corresponding to the LTE network. key;

The MME of the LTE network is specifically configured to perform interaction between the UE and the UE based on the third basic key, the expected reply information, the first random number, and the AUTN, to implement the UE to verify the LTE network, and the MME of the LTE network authenticates the UE;

The MME of the LTE network is further configured to: when determining that the verification of the UE passes, generate a second random number, and generate a first base key based on the network identifier of the LTE-U network and the third basic key;

The MME of the LTE network is further configured to generate a non-access stratum NAS key based on the UE security algorithm, and encrypt the second random number by using the NAS key to obtain a seventh encryption result;

The MME of the LTE network is further configured to send the first base key, the third base key, the NAS key, the network identifier of the LTE-U network, the second random number, and the seventh encryption result to the MME of the LTE-U network;

The MME of the LTE-U network is specifically configured to encrypt the second random number by using the first basic key to obtain an eighth encryption result, and the third basic key, the NAS key, the network identifier of the LTE-U network, and the third The seventh encryption result and the eighth encryption result are sent to the UE;

The UE is specifically configured to generate a second basic key based on the network identifier of the third basic key and the LTE-U network, and decrypt the eighth encryption result by using the second basic key to obtain a first decryption result, and obtain the first decryption result. Decrypting the seventh encryption result to obtain a second decryption result;

The UE is further configured to determine that the verification of the LTE-U network passes if the first decrypted result and the second decrypted result are the same.

In the embodiment of the present invention, for a UE that is not connected to the operator network, when the UE accesses the LTE-U network, the first attach request may be sent to the MME of the LTE-U network, when LTE When receiving the first attach request, the MME of the -U network may join the network identifier of the LTE-U network in the first attach request, thereby generating a second attach request, and sending the second attach request to the LTE network. The MME, the MME of the LTE network generates an authentication data request based on the second attach request, to request an authentication vector from the HSS, and when the HSS receives the authentication data request, generates an authentication vector based on the authentication data request, and The authentication vector is sent to the MME of the LTE network, and then the MME of the LTE network can interact with the UE and the MME of the LTE-U network according to the received authentication vector to implement network authentication. That is, with the network authentication method provided by the embodiment of the present invention, the UE can perform authentication with the operator network and the LTE-U network at one time when accessing the operator network and the LTE-U network, thereby The UE can smoothly access the carrier network and the LTE-U network at the same time, which brings convenience to the user.

It should be noted that, in the network authentication system provided by the foregoing embodiment, only the division of the foregoing functional modules is illustrated in the network authentication. In actual applications, the function allocation may be completed by different functional modules as needed. The internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the network authentication system and the network authentication method are provided in the same embodiment. For details, refer to the method embodiment, and details are not described herein.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented in software, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present invention are generated in whole or in part. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.). The computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a digital versatile disc (DVD)), or a semiconductor medium (for example, a solid state disk (SSD)). )Wait.

A person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium. The storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

The above description of the embodiments of the present application is not intended to limit the application, and any modifications, equivalents, improvements, etc. made within the spirit and principles of the present application are included in the scope of the present application. Inside.

Claims

A network authentication method, the method comprising:

When the mobility management entity MME of the unlicensed LTE-U network based on the long-term evolution receives the first attach request from the user equipment UE, the network identifier of the LTE-U network is added in the first attach request to generate a second attach request, and sending the second attach request to an MME of a long term evolution LTE network;

When the MME of the LTE network receives the second attach request, send an authentication data request to the home subscriber server HSS based on the second attach request, where the authentication data request carries the LTE-U a network identifier of the network and a network identifier of the LTE network;

And when the HSS receives the authentication data request, generating an authentication vector based on the network identifier of the LTE-U network and the network identifier of the LTE network, and sending the authentication to the MME of the LTE network. a weight vector, the authentication vector including parameters for authenticating the UE, the LTE-U network, and the LTE network;

When the MME of the LTE network receives the authentication vector, interact with the UE and the MME of the LTE-U network based on the authentication vector to implement network authentication.
The method of claim 1, wherein the authentication vector comprises a first base key, expected reply information, a first random number, and an authentication token AUTN, the first base key being the LTE a key corresponding to the -U network;

The interaction between the UE and the MME of the LTE-U network based on the authentication vector to implement network authentication, including:

The MME of the LTE network stores the expected reply information, and sends the first random number, the AUTN, the network identifier of the LTE-U network, and the first MME to the UE through the MME of the LTE-U network. As a result of the encryption, the first encryption result is generated by the MME of the LTE-U network based on the first base key;

And when the UE receives the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result, the LTE is based on the first random number and the AUTN The network performs verification, and performs verification on the LTE-U network based on the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result;

And generating, when the UE determines to pass the LTE network and the LTE-U network, the reply information, and generating, according to the first random number, the AUTN, and the network identifier of the LTE-U network. Second encryption result;

The UE sends the second encryption result to the MME of the LTE-U network, and sends the reply information to the MME of the LTE network;

When the MME of the LTE-U network receives the second encryption result, the UE is authenticated based on the second encryption result, and when the MME of the LTE network receives the reply information, based on the The expected reply information and the reply information verify the UE.
The method according to claim 2, wherein the MME of the LTE network sends the first random number, the AUTN and the first encryption result to the UE by using an MME of the LTE-U network, including :

The MME of the LTE network stores the expected reply information, and sends the first base key, the first random number, and the AUTN to an MME of the LTE-U network;

When the MME of the LTE-U network receives the first base key, the first random number, and the AUTN, storing the first base key, based on the first base key Generating a first encryption result, and transmitting the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result to the UE.
The method of claim 3, wherein the generating the first encryption result based on the first base key comprises:

The MME of the LTE-U network generates a second random number, and encrypts the second random number by using the first basic key to obtain the first encryption result;

Correspondingly, the sending, by the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result to the UE, includes:

The MME of the LTE-U network sends the first random number, the AUTN, the network identifier of the LTE-U network, the first encryption result, and the second random number to the UE.
The method according to claim 3 or 4, wherein the AUTN comprises a message authentication code MAC;

The UE performs verification on the LTE network based on the first random number and the AUTN, including:

Generating, by the UE, a desired message authentication code XMAC based on the first random number and other parameters in the AUTN except the MAC;

If the XMAC and the MAC are the same, the UE determines to pass the verification of the LTE network.
The method according to claim 4, wherein the UE performs the LTE-U based on the first random number, the AUTN, a network identifier of the LTE-U network, and the first encryption result. The network is verified, including:

Generating, by the UE, a second basic key according to the network identifier of the LTE-U network, the first random number, and the AUTN;

The UE encrypts the second random number by using the second basic key to obtain a third encryption result;

If the first encryption result is equal to the third encryption result, the UE determines that the verification of the LTE-U network passes.
The method according to claim 6, wherein the generating the second encryption result based on the first random number, the AUTN, and the network identifier of the LTE-U network includes:

The UE generates a third random number, and performs overall encryption on the second random number and the third random number by using the second basic key to obtain a second encryption result;

Correspondingly, the sending, by the UE, the second encryption result to the MME of the LTE-U network includes:

Transmitting, by the UE, the second encryption result and the third random number to an MME of the LTE-U network;

Correspondingly, the MME of the LTE-U network performs verification on the UE based on the second encryption result, including:

The MME of the LTE-U network performs overall encryption on the second random number and the third random number by using the stored first basic key to obtain a fourth encryption result;

If the second encryption result and the fourth encryption result are equal, the MME of the LTE-U network determines that the verification of the UE passes.
The method according to claim 2, wherein the MME of the LTE network sends the first random number, the AUTN, and the LTE-U network to the UE through an MME of the LTE-U network. Network identification and first encryption results, including:

The MME of the LTE network stores the expected reply information, and sends the first base key, the expected reply information, the first random number, and the AUTN to the LTE-U network. MME;

And when the MME of the LTE-U network receives the first base key, the expected reply information, the first random number, and the AUTN, the first base key and the expected reply The information is stored, the first encryption result is generated based on the first basic key, and the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result are sent to the Said UE.
The method of claim 8 wherein said AUTN comprises a MAC;

The generating the first encryption result based on the first basic key includes:

The MME of the LTE-U network encrypts the MAC by using the first basic key to obtain the first encryption result.
The method according to claim 9, wherein the UE performs the LTE-U based on the first random number, the AUTN, a network identifier of the LTE-U network, and the first encryption result. The network is verified, including:

Generating, by the UE, a second basic key according to the network identifier of the LTE-U network, the first random number, and the AUTN;

The UE encrypts the MAC by using the second basic key to obtain a fifth encryption result;

If the first encryption result is equal to the fifth encryption result, the UE determines that the verification of the LTE-U network passes.
The method according to claim 10, wherein the generating the second encryption result based on the first random number, the AUTN, and the network identifier of the LTE-U network comprises:

The UE encrypts the reply information by using the second basic key to obtain a second encryption result;

Correspondingly, the MME of the LTE-U network performs verification on the UE based on the second encryption result, including:

The MME of the LTE-U network encrypts the reply information by using the stored first basic key to obtain a sixth encryption result;

If the expected reply information stored by the MME of the LTE-U network is the same as the reply information, and the sixth encryption result is equal to the second encryption result, the MME of the LTE-U network determines the pair The verification of the UE is passed.
The method according to claim 1, wherein the second attach request carries a security algorithm of the UE, and the authentication vector includes a third base key, expected reply information, a first random number, and a The right identifier is AUTN, and the third basic key is a key corresponding to the LTE network;

The interaction between the UE and the MME of the LTE-U network based on the authentication vector to implement network authentication, including:

The MME of the LTE network interacts with the UE according to the third basic key, the expected reply information, the first random number, and the AUTN, to implement verification of the LTE network by the UE. And verifying, by the MME of the LTE network, the UE;

When the MME of the LTE network determines that the verification of the UE passes, generates a second random number, and generates a first base key based on the network identifier of the LTE-U network and the third base key;

The MME of the LTE network generates a non-access stratum NAS key based on the security algorithm of the UE, and encrypts the second random number by using the NAS key to obtain a seventh encryption result;

The MME of the LTE network, the first base key, the third base key, the NAS key, a network identifier of the LTE-U network, the second random number, and the seventh Sending the encryption result to the MME of the LTE-U network;

The MME of the LTE-U network encrypts the second random number by using the first basic key to obtain an eighth encryption result, and the third basic key, the NAS key, and the The network identifier, the seventh encryption result, and the eighth encryption result of the LTE-U network are sent to the UE;

The UE generates a second basic key based on the third basic key and the network identifier of the LTE-U network, and decrypts the eighth encryption result by using the second basic key to obtain the first Decrypting the result, decrypting the seventh encryption result by using the NAS key, to obtain a second decryption result;

If the first decryption result and the second decryption result are the same, the UE determines that the verification of the LTE-U network passes.
A network authentication system, characterized in that the system comprises:

The mobility management entity MME of the unlicensed LTE-U network is configured to add the network identifier of the LTE-U network in the first attach request when receiving the first attach request from the user equipment UE Generating a second attach request and transmitting the second attach request to an MME of a Long Term Evolution (LTE) network;

The MME of the LTE network is configured to: when the receiving the second attach request, send an authentication data request to the home subscription subscriber server HSS based on the second attach request, where the authentication data request is carried a network identifier of the LTE-U network and a network identifier of the LTE network;

The HSS is configured to generate an authentication vector based on the network identifier of the LTE-U network and the network identifier of the LTE network when the authentication data request is received, and send the authentication vector to the MME of the LTE network. The authentication vector, where the authentication vector includes parameters for authenticating the UE, the LTE-U network, and the LTE network;

The MME of the LTE network is configured to interact with the UE and the MME of the LTE-U network based on the authentication vector to implement network authentication when receiving the authentication vector.
The system according to claim 13, wherein said authentication vector comprises a first base key, expected reply information, a first random number, and an authentication token AUTN, said first base key being said LTE a key corresponding to the -U network;

The MME of the LTE network is specifically configured to store the expected reply information, and send the first random number, the AUTN, and the network of the LTE-U network to the UE by using an MME of the LTE-U network. Identifying and the first encryption result, the first encryption result is generated by the MME of the LTE-U network based on the first base key;

The UE is configured to: when receiving the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result, based on the first random number and the AUTN pair The LTE network performs verification, and performs verification on the LTE-U network based on the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result;

The UE is further configured to: when it is determined that both the LTE network and the LTE-U network are verified to pass, generate reply information, and based on the first random number, the AUTN, and the network of the LTE-U network The identifier generates a second encryption result;

The UE is further configured to send the second encryption result to an MME of the LTE-U network, and send the reply information to an MME of an LTE network;

The MME of the LTE-U network is configured to perform verification on the UE based on the second encryption result when receiving the second encryption result, when the MME of the LTE network receives the reply information, The UE is authenticated based on the expected reply information and the reply information.
The system of claim 14, wherein the MME of the LTE network is specifically configured to:

And storing the expected reply information, and sending the first base key, the first random number, and the AUTN to an MME of the LTE-U network;

The MME of the LTE-U network is further configured to store the first base key when receiving the first base key, the first random number, and the AUTN, based on the first The base key generates a first encryption result, and sends the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result to the UE.
The system of claim 15, wherein the MME of the LTE-U network is specifically configured to:

Generating a second random number, and encrypting the second random number by using the first basic key to obtain the first encryption result;

Transmitting the first random number, the AUTN, the network identifier of the LTE-U network, the first encryption result, and the second random number to the UE.
The system according to claim 15 or 16, wherein the AUTN comprises a message authentication code MAC;

The UE is specifically configured to:

Generating a desired message authentication code XMAC based on the first random number and other parameters in the AUTN other than the MAC;

If the XMAC and the MAC are the same, the verification of the LTE network is passed.
The system of claim 16 wherein said UE is specifically configured to:

Generating a second base key according to the network identifier of the LTE-U network, the first random number, and the AUTN;

Encrypting the second random number by using the second basic key to obtain a third encryption result;

If the first encryption result is equal to the third encryption result, it is determined that the verification of the LTE-U network passes.
The system of claim 18, wherein the UE is specifically configured to:

Generating a third random number, and performing overall encryption on the second random number and the third random number by using the second basic key to obtain a second encryption result;

Transmitting the second encryption result and the third random number to an MME of the LTE-U network;

Correspondingly, the MME of the LTE-U network is specifically configured to:

And encrypting the second random number and the third random number by using the stored first basic key to obtain a fourth encryption result;

If the second encryption result and the fourth encryption result are equal, it is determined that the verification of the UE is passed.
The system of claim 14, wherein the MME of the LTE network is specifically configured to:

And storing the expected reply information, and sending the first basic key, the expected reply information, the first random number, and the AUTN to an MME of the LTE-U network;

The MME of the LTE-U network is configured to: when the first base key, the expected reply information, the first random number, and the AUTN are received, the first base key and the Desiring that the reply information is stored, generating a first encryption result based on the first base key, and transmitting the first random number, the AUTN, the network identifier of the LTE-U network, and the first encryption result To the UE.
The system of claim 20 wherein said AUTN comprises a MAC;

The MME of the LTE-U network is specifically configured to:

And encrypting the MAC by using the first basic key to obtain the first encryption result.
The system of claim 21, wherein the UE is specifically configured to:

Generating a second base key according to the network identifier of the LTE-U network, the first random number, and the AUTN;

Encrypting the MAC by using the second basic key to obtain a fifth encryption result;

If the first encryption result is equal to the fifth encryption result, it is determined that the verification of the LTE-U network passes.
The system of claim 22, wherein the UE is specifically configured to:

Encrypting the reply information by using the second basic key to obtain a second encryption result;

Correspondingly, the MME of the LTE-U network is specifically configured to:

Encrypting the reply information by using the stored first basic key to obtain a sixth encryption result;

If the expected reply information stored by the MME of the LTE-U network is the same as the reply information, and the sixth encryption result is equal to the second encryption result, it is determined that the verification of the UE is passed.
The system according to claim 13, wherein the second attach request carries a security algorithm of the UE, and the authentication vector includes a third base key, expected reply information, a first random number, and a reference. The right identifier is AUTN, and the third basic key is a key corresponding to the LTE network;

The MME of the LTE network is specifically configured to perform interaction with the UE based on the third basic key, the expected reply information, the first random number, and the AUTN, to implement the UE to the Verification of the LTE network, and verification of the UE by the MME of the LTE network;

The MME of the LTE network is further configured to: when determining that the verification of the UE passes, generate a second random number, and generate a first basis based on the network identifier of the LTE-U network and the third basic key Key

The MME of the LTE network is further configured to generate a non-access stratum NAS key based on the security algorithm of the UE, and encrypt the second random number by using the NAS key to obtain a seventh encryption result;

The MME of the LTE network is further configured to use the first base key, the third base key, the NAS key, a network identifier of the LTE-U network, the second random number, and Transmitting the seventh encryption result to the MME of the LTE-U network;

The MME of the LTE-U network is specifically configured to encrypt the second random number by using the first basic key to obtain an eighth encryption result, and the third basic key and the NAS key. The network identifier of the LTE-U network, the seventh encryption result, and the eighth encryption result are sent to the UE;

The UE is specifically configured to generate a second basic key based on the third basic key and the network identifier of the LTE-U network, and decrypt the eighth encryption result by using the second basic key, Obtaining a first decryption result, and decrypting the seventh encryption result by using the NAS key to obtain a second decryption result;

The UE is further configured to determine that the verification of the LTE-U network passes if the first decryption result and the second decryption result are the same.