WO2020147856A1 - 认证处理方法、装置、存储介质及电子装置 - Google Patents

认证处理方法、装置、存储介质及电子装置 Download PDF

Info

Publication number
WO2020147856A1
WO2020147856A1 PCT/CN2020/072950 CN2020072950W WO2020147856A1 WO 2020147856 A1 WO2020147856 A1 WO 2020147856A1 CN 2020072950 W CN2020072950 W CN 2020072950W WO 2020147856 A1 WO2020147856 A1 WO 2020147856A1
Authority
WO
WIPO (PCT)
Prior art keywords
failure
authentication
reason
synchronization
message
Prior art date
Application number
PCT/CN2020/072950
Other languages
English (en)
French (fr)
Inventor
彭锦
游世林
谢振华
余万涛
林兆骥
邱永庆
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US17/423,890 priority Critical patent/US20220124092A1/en
Priority to EP20741108.3A priority patent/EP3913853A4/en
Publication of WO2020147856A1 publication Critical patent/WO2020147856A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
    • G06F11/0709—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0793—Remedial or corrective actions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/12—Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity

Definitions

  • This application relates to the field of communication technology, for example, to an authentication processing method, device, storage medium, and electronic device.
  • the Third Generation Partnership Project (3rd Generation Partnership Project, referred to as 3GPP) has formulated various mobile network specifications, including the authentication and key agreement process (Authentication and Key Agreement, referred to as AKA process), which is used in the terminal ( For example, user equipment (User Equipment, UE for short) mutually authenticates with the network and establishes a common key.
  • AKA process Authentication and Key Agreement
  • UE user equipment
  • the terminal when the terminal receives an authentication request message from the network, it will verify the message. If the verification fails, the terminal will respond with an authentication failure message, which carries the reason for the failure. Parameters (CAUSE). If the authentication request message is not a legitimate authentication request message for the terminal, the reason for the failure is a message verification code failure (MAC Failure). If the authentication request message is a legitimate authentication request message for the terminal, but the message has been verified by the terminal because the message is replayed, the reason for the failure is Sync Failure.
  • CAUSE message verification code failure
  • an attacker replays a legal authentication request message, receives the authentication failure message from the terminal, and analyzes the reason for the failure in the authentication failure message, the attacker can target the authentication request message.
  • the terminals are distinguished so that it can be determined whether a certain terminal exists in a certain area. By replaying the authentication request message multiple times, and receiving and analyzing the authentication failure message, the attacker can track the user and may be used for further attacks on user privacy.
  • the embodiments of the present application provide an authentication processing method, device, storage medium, and electronic device to at least solve the problem of tracking a terminal by replaying a legal authentication request message multiple times under the AKA authentication mechanism in related technologies. problem.
  • an authentication processing method including: a terminal receives an authentication request message from an authentication function; in the case that the terminal fails to authenticate the authentication request message, feedback to the authentication function An authentication failure message, wherein, when the reason for the authentication failure is a message verification code failure and when the reason for the authentication failure is a synchronization failure, the terminal feeds back the same type of authentication failure message to the authentication function.
  • an authentication processing method including: an authentication function receives an authentication failure message fed back by a terminal, where the reason for the authentication failure is a message verification code failure and the reason for the authentication failure is In the case of synchronization failure, the authentication failures received by the authentication function all carry synchronization failure parameters; the authentication function sends an authentication request message to the home network entity, where the authentication request message carries the synchronization failure parameter; The authentication function receives the failure reason returned by the home network entity according to the synchronization failure parameter.
  • an authentication processing method including: a home network entity receives an authentication request message from an authentication function, wherein the authentication request message carries a verification code failure or synchronization failure when the terminal performs authentication.
  • the synchronization failure parameter is generated in the case of the synchronization failure parameter; the home network entity determines the failure reason according to the synchronization failure parameter; the home network entity returns the failure reason to the authentication function.
  • an authentication processing device which is applied to a terminal.
  • the device includes: a receiving module configured to receive an authentication request message from an authentication function; and a feedback module configured to verify the authentication
  • the authentication failure message is fed back to the authentication function.
  • the terminal sends the The authentication function feeds back the same type of authentication failure message.
  • an authentication processing device applied to an authentication function, the device comprising: a first receiving module configured to receive an authentication failure message fed back by a terminal, wherein the reason for the authentication failure is In the case that the message verification code fails and the reason for the authentication failure is synchronization failure, the authentication failures received by the authentication function all carry synchronization failure parameters; the sending module is configured to send an authentication request message to the home network entity, where: The authentication request message carries the synchronization failure parameter; the second receiving module is configured to receive the failure reason returned by the home network entity according to the synchronization failure parameter.
  • an authentication processing device applied to a home network entity, the device comprising: a receiving module configured to receive an authentication request message from an authentication function, wherein the authentication request message carries The synchronization failure parameter is generated when the terminal performs authentication and the message verification code fails or the synchronization fails; the determining module is set to determine the reason for the failure according to the synchronization failure parameter; the sending module is set to return the reason for the failure to the authentication Features.
  • a storage medium in which a computer program is stored, wherein the computer program is configured to execute the steps in any one of the above method embodiments when running.
  • an electronic device including a memory and a processor, the memory is stored with a computer program, and the processor is configured to run the computer program to execute any of the above Steps in the method embodiment.
  • the same type of authentication failure message is fed back, which obscures the authentication failure message
  • It can effectively hide failure information (including failure reasons and/or synchronization failure parameters) and prevent attackers from getting enough true synchronization failure information to track users. It can solve the problem of AKA authentication mechanism in related technologies.
  • the problem of tracking the terminal can be realized by replaying a legal authentication request message multiple times, effectively improving the security and confidentiality of the authentication process.
  • FIG. 1 is a hardware structure block diagram of a mobile terminal of an authentication processing method according to an embodiment of the present application
  • Fig. 3 is a flowchart of an authentication processing method according to Embodiment 2 of the present application.
  • FIG. 5 is a structural block diagram of an authentication processing device according to Embodiment 4 of the present application.
  • FIG. 6 is a structural block diagram of an authentication processing device according to Embodiment 5 of the present application.
  • FIG. 7 is a structural block diagram of an authentication processing device according to Embodiment 6 of the present application.
  • FIG. 8 is a schematic structural diagram of a mobile system according to Embodiment 10 of the present application.
  • FIG. 9 is a flowchart of a terminal responding to an authentication failure message in 5G technology AKA authentication according to Embodiment 10 of the present application;
  • FIG. 10 is a schematic diagram of a security authentication process according to Embodiment 11 of the present application.
  • FIG. 1 is a hardware structural block diagram of a mobile terminal of an authentication processing method according to an embodiment of the present application.
  • the mobile terminal 10 may include one or more (only one is shown in FIG. 1) processor 102 (the processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA, etc. ) And a memory 104 for storing data, optionally, the above mobile terminal may further include a transmission device 106 for communication functions and an input and output device 108.
  • FIG. 1 is merely an illustration, which does not limit the structure of the mobile terminal described above.
  • the mobile terminal 10 may further include more or fewer components than those shown in FIG. 1, or have a different configuration from that shown in FIG.
  • the memory 104 may be used to store computer programs, for example, software programs and modules of application software, such as computer programs corresponding to the authentication processing method in the embodiment of the present application.
  • the processor 102 executes the computer programs stored in the memory 104 by running the computer programs stored in the memory 104.
  • This kind of functional application and data processing realize the above-mentioned method.
  • the memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory.
  • the memory 104 may further include memories remotely provided with respect to the processor 102, and these remote memories may be connected to the mobile terminal 10 through a network. Examples of the above network include but are not limited to the Internet, intranet, local area network, mobile communication network, and combinations thereof.
  • the transmission device 106 is used to receive or transmit data via a network.
  • the specific example of the network described above may include a wireless network provided by a communication provider of the mobile terminal 10.
  • the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC for short), which can be connected to other network devices through the base station to communicate with the Internet.
  • the transmission device 106 may be a radio frequency (Radio Frequency, RF for short) module, which is used to communicate with the Internet in a wireless manner.
  • RF Radio Frequency
  • FIG. 2 is a flowchart of the authentication processing method according to Embodiment 1 of the present application. As shown in FIG. 2, the flow includes the following steps:
  • Step S202 The terminal receives an authentication request message from the authentication function.
  • Step S204 In the case where the authentication of the authentication request message fails, the terminal feeds back an authentication failure message to the authentication function, where the reason for the authentication failure is the message verification code failure and the reason for the authentication failure is In the case of synchronization failure, the terminal feeds back the same type of authentication failure message to the authentication function.
  • the execution subject of the foregoing steps may be a terminal, including but not limited to a mobile terminal, a computer terminal, or a similar computing device.
  • the processing method can effectively hide the failure information (including the failure reason and/or synchronization failure parameters), prevent the attacker from getting enough real synchronization failure information to track the user, and can solve the related technology under the AKA authentication mechanism.
  • the problem of tracking the terminal can be realized by replaying a legal authentication request message multiple times, which effectively improves the security and confidentiality of the authentication process.
  • this embodiment The method of obscuring the authentication failure message is adopted to achieve the purpose of preventing the attacker from distinguishing the valid authentication failure message.
  • the method of obfuscating the authentication failure message can be used to obfuscate the failure reason parameter in the authentication failure message, or the synchronization failure parameter included in the authentication failure message can be obfuscated, or both All are blurred.
  • the terminal feeding back the same type of authentication failure message to the authentication function includes:
  • the reason for the authentication failure is that when the message verification code fails and the reason for the authentication failure is the synchronization failure, the authentication failure message does not carry the failure reason parameter, or both carry the same failure reason parameter.
  • the authentication failure messages all carry the same failure reason parameters including one of the following: the failure reason parameters are all empty or the same predetermined filling value; the failure reason parameters are all message verification code or Synchronization failure MAC or Sync Failure; the failure reason parameters are all synchronization failure Sync Failure.
  • the terminal feeding back the same type of authentication failure message to the authentication function includes: In the case where the reason for the authentication failure is the message verification code failure and the reason for the authentication failure is the synchronization failure, the authentication failure message both carries the synchronization failure parameter.
  • the synchronization failure parameter is calculated by the terminal according to the authentication request message; in the case that the reason for the authentication failure is a message verification code failure
  • the synchronization failure parameter is randomly generated by the terminal, or is a predetermined value, or calculated by the terminal according to the authentication request message.
  • the synchronization failure is randomly generated by the terminal
  • the parameter or the data length of the predetermined value is the same as the data length of the synchronization failure message calculated by the terminal according to the authentication request message.
  • FIG. 3 is a flowchart of the authentication processing method according to Embodiment 2 of the present application. As shown in FIG. 3, the process includes the following steps:
  • Step S302 The authentication function receives an authentication failure message fed back by the terminal.
  • the reason for the authentication failure is the message verification code failure and the reason for the authentication failure is the synchronization failure
  • the authentication failure received by the authentication function is both Carry synchronization failure parameters.
  • Step S304 The authentication function sends an authentication request message to the home network entity, where the authentication request message carries the synchronization failure parameter.
  • Step S306 The authentication function receives the failure reason returned by the home network entity according to the synchronization failure parameter.
  • the authentication function after receiving the obfuscated authentication failure message, the authentication function sends the synchronization failure parameter carried in the received authentication failure message to the home network entity, and receives the failure reason returned by the home network entity, which makes authentication The function can subsequently perform corresponding authentication processing based on the failure reason. Because this scheme implements the fuzzification of authentication failure messages between the terminal and the authentication function, it can effectively hide the failure information (including the failure reason and/or synchronization failure parameters) and prevent the attacker from getting enough true synchronization failure information. In order to track users, it can solve the problem of tracking the terminal by replaying a legal authentication request message multiple times under the AKA authentication mechanism in the related technology, which effectively improves the security and confidentiality of the authentication process.
  • the authentication failure message received by the authentication function is neither Carry the failure reason parameter, or both carry the same failure reason parameter.
  • the authentication failure messages received by the authentication function all carry the same failure reason parameter including one of the following: the failure reason parameters are all empty or the same predetermined filling value; the failure reason The parameters are all message verification code or synchronization failure MAC or Sync Failure; the failure reason parameters are all synchronization failure Sync Failure.
  • the method further includes: the authentication function adds a predetermined failure indication to the authentication request message, where the predetermined failure indication includes one of the following: synchronization failure indicator Sync Failure Indicator; message verification Code or synchronization failure indicator MAC or Sync Failure Indicator.
  • the home network entity receives the predetermined failure indication, it will determine the specific reason for the authentication failure on the terminal and notify the authentication function so that the authentication function can execute the corresponding authentication process according to the specific failure reason.
  • step S306 it may further include:
  • Step S308 The authentication function performs authentication processing according to the failure reason returned by the home network entity.
  • the specific authentication processing as an embodiment refer to the following description processing.
  • the authentication function can: terminate the authentication process; or send a terminal identification request message to the terminal; or re-initiate the authentication process for the terminal.
  • the authentication function re-initiates the authentication process for the terminal.
  • FIG. 4 is a flowchart of the authentication processing method according to Embodiment 3 of the present application. As shown in FIG. 4, the process includes the following steps :
  • step S402 the home network entity receives an authentication request message from the authentication function, where the authentication request message carries a synchronization failure parameter generated when the terminal performs authentication and a message verification code fails or synchronization fails.
  • Step S404 The home network entity determines the cause of the failure according to the synchronization failure parameter.
  • Step S406 the home network entity returns the failure reason to the authentication function.
  • the home network entity after receiving the authentication request message from the authentication function, judges the real failure reason according to the synchronization failure parameter carried therein, and returns the failure reason to the authentication function. Because the authentication function and the home network entity belong to the internal communication of the network system, the judgment and transmission of the failure cause are controlled within the network system, which can effectively hide the failure information (including the failure reason and/or synchronization failure parameters) and prevent the attacker from getting enough A lot of real synchronization failure information is used to track users, which can solve the problem of tracking the terminal by replaying a legal authentication request message multiple times under the AKA authentication mechanism in related technologies, which effectively improves the authentication process Security and confidentiality.
  • the home network entity determining the failure cause according to the synchronization failure parameter includes:
  • the home network entity verifies the validity of the synchronization failure parameter.
  • the synchronization failure parameter may be AUTS, when the home network fails to verify the MAC-S in the AUTS ( That is, when AUTS is determined to be invalid), it can be determined that the cause of the failure of the terminal is MAC failure.
  • the home network can verify the MAC-S failure in the AUTS to determine that the failure cause of the terminal is the MAC failure.
  • the AUTS can pass the message verification of the home network, and the following verification can be used:
  • the method of determining the failure reason based on the serial number is used to further discriminate whether the specific failure reason is MAC failure or synchronization failure.
  • the home network entity calculates the serial number SQN MS of the terminal according to the synchronization failure parameter, and calculates the serial number SQN MS of the terminal according to the serial number SQN MS of the terminal and the number of the home network entity.
  • the serial number SQN HE determines the reason for the failure.
  • the home network entity determines, according to the serial number SQN MS of the terminal and the serial number SQN HE of the home network entity, that the failure cause includes at least one of the following: the home network entity is in the SQN In the case that MS is greater than or equal to SQN HE , it is determined that the failure cause is a synchronization failure Sync Failure; in the case that SQN MS is less than SQN HE , the home network entity determines that the failure cause is a message verification code failure MAC Failure.
  • the method according to the above embodiments 1-3 can be implemented by means of software plus the necessary general hardware platform, of course, it can also be implemented by hardware, but in many cases The former is a better implementation.
  • the technical solution of the present application can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk), and includes several instructions to enable a terminal (It can be a mobile phone, a computer, a server, or a network device, etc.) execute the method described in each embodiment of the present application.
  • an authentication processing device is also provided, which is used to implement the above-mentioned Embodiment 1 and optional implementation manners, and the descriptions that have been described will not be repeated.
  • the term "module” may implement a combination of software and/or hardware that performs predetermined functions.
  • the devices described in the following embodiments may be implemented in software, implementation of hardware or a combination of software and hardware is also possible and conceived.
  • the device is applied to a terminal.
  • the device may include: a receiving module 52 configured to receive an authentication request message from an authentication function;
  • the feedback module 54 is configured to feed back an authentication failure message to the authentication function when the authentication request message fails, where the reason for the authentication failure is a message verification code failure and the reason for the authentication failure is In the case of synchronization failure, the terminal feeds back the same type of authentication failure message to the authentication function.
  • the processing method can effectively hide the failure information (including the failure reason and/or synchronization failure parameters), prevent the attacker from getting enough real synchronization failure information to track the user, and can solve the related technology under the AKA authentication mechanism.
  • the problem of tracking the terminal can be realized by replaying a legal authentication request message multiple times, which effectively improves the security and confidentiality of the authentication process.
  • the authentication failure message does not carry the failure reason parameter, or, Both carry the same failure reason parameter.
  • the authentication failure message carries the synchronization failure parameter.
  • the above modules can be implemented by software or hardware, and the latter can be implemented by the following methods, but not limited to this: the above modules are all located in the same processor; or, the above modules can be combined in any combination The forms are located in different processors.
  • an authentication processing device is also provided, which is used to implement the above-mentioned Embodiment 2 and optional implementation manners, and those that have been described will not be repeated.
  • the term "module” may implement a combination of software and/or hardware that performs predetermined functions.
  • the devices described in the following embodiments may be implemented in software, implementation of hardware or a combination of software and hardware is also possible and conceived.
  • the device is applied to the authentication function.
  • the device may include: a first receiving module 62 configured to receive authentication failures fed back by the terminal Message, where, when the reason for the authentication failure is the message verification code failure and the reason for the authentication failure is the synchronization failure, the authentication failures received by the authentication function all carry the synchronization failure parameters; the sending module 64 is set to An authentication request message is sent to a home network entity, where the authentication request message carries the synchronization failure parameter; the second receiving module 66 is configured to receive the failure reason returned by the home network entity according to the synchronization failure parameter.
  • the device may further include: an execution module configured to execute authentication processing according to the failure reason returned by the home network entity.
  • the authentication function after receiving the obfuscated authentication failure message, the authentication function sends the synchronization failure parameter carried in the received authentication failure message to the home network entity, and receives the failure reason returned by the home network entity, which makes authentication The function can subsequently perform corresponding authentication processing based on the failure reason. Because this scheme implements the fuzzification of authentication failure messages between the terminal and the authentication function, it can effectively hide the failure information (including the failure reason and/or synchronization failure parameters) and prevent the attacker from getting enough true synchronization failure information. In order to track users, it can solve the problem of tracking the terminal by replaying a legal authentication request message multiple times under the AKA authentication mechanism in the related technology, which effectively improves the security and confidentiality of the authentication process.
  • the sending module 64 is further configured to add a predetermined failure indication to the authentication request message, where the predetermined failure indication includes one of the following: a synchronization failure indicator Sync Failure Indicator; a message verification code or Sync failure indication MAC or Sync Failure Indicator.
  • the above modules can be implemented by software or hardware, and the latter can be implemented by the following methods, but not limited to this: the above modules are all located in the same processor; or, the above modules can be combined in any combination The forms are located in different processors.
  • an authentication processing device is also provided, which is used to implement the above-mentioned Embodiment 3 and optional implementation manners, and those that have been described will not be repeated.
  • the term "module” may implement a combination of software and/or hardware that performs predetermined functions.
  • the devices described in the following embodiments may be implemented in software, implementation of hardware or a combination of software and hardware is also possible and conceived.
  • FIG. 7 is a structural block diagram of an authentication processing apparatus according to Embodiment 6 of the present application. As shown in FIG. 7, the apparatus is applied to a home network entity.
  • the apparatus may include: a receiving module 72 configured to receive an authentication request from an authentication function A message, wherein the authentication request message carries a synchronization failure parameter generated when the terminal performs authentication and a message verification code fails or synchronization fails.
  • the determining module 74 is configured to determine the cause of the failure according to the synchronization failure parameter.
  • the sending module 76 is configured to return the failure reason to the authentication function.
  • the home network entity after receiving the authentication request message from the authentication function, judges the real failure reason according to the synchronization failure parameter carried therein, and returns the failure reason to the authentication function. Because the authentication function and the home network entity belong to the internal communication of the network system, the judgment and transmission of the failure cause are controlled within the network system, which can effectively hide the failure information (including the failure reason and/or synchronization failure parameters) and prevent the attacker from getting enough A lot of real synchronization failure information is used to track users, which can solve the problem of tracking the terminal by replaying a legal authentication request message multiple times under the AKA authentication mechanism in related technologies, which effectively improves the authentication process Security and confidentiality.
  • the determining module 74 is configured to calculate the serial number SQN MS of the terminal according to the synchronization failure parameter; according to the serial number SQN MS of the terminal and the serial number SQN of the home network entity HE determines the reason for the failure.
  • the above modules can be implemented by software or hardware, and the latter can be implemented by the following methods, but not limited to this: the above modules are all located in the same processor; or, the above modules can be combined in any combination The forms are located in different processors.
  • the embodiment of the present application also provides a storage medium in which a computer program is stored, wherein the computer program is configured to execute the steps in any of the foregoing method embodiments when running.
  • the above storage medium may be set to store a computer program for performing the following steps:
  • the above storage medium may include, but is not limited to: a USB flash drive, a read-only memory (Read-Only Memory, ROM for short), a random access memory (Random Access Memory, RAM for short), Various media that can store computer programs, such as removable hard disks, magnetic disks, or optical disks.
  • An embodiment of the present application further provides an electronic device, including a memory and a processor, where a computer program is stored in the memory, and the processor is configured to run the computer program to perform any of the steps in the above method embodiments.
  • the electronic device may further include a transmission device and an input-output device, where the transmission device is connected to the processor, and the input-output device is connected to the processor.
  • the foregoing processor may be configured to perform the following steps through a computer program:
  • the embodiment of the present application also provides a storage medium in which a computer program is stored, wherein the computer program is configured to execute the steps in any of the foregoing method embodiments when running.
  • the above storage medium may be set to store a computer program for performing the following steps:
  • the above storage medium may include, but is not limited to: a USB flash drive, a read-only memory (Read-Only Memory, ROM for short), a random access memory (Random Access Memory, RAM for short), Various media that can store computer programs, such as removable hard disks, magnetic disks, or optical disks.
  • An embodiment of the present application further provides an electronic device, including a memory and a processor, where a computer program is stored in the memory, and the processor is configured to run the computer program to perform any of the steps in the above method embodiments.
  • the electronic device may further include a transmission device and an input-output device, where the transmission device is connected to the processor, and the input-output device is connected to the processor.
  • the foregoing processor may be configured to perform the following steps through a computer program:
  • the embodiment of the present application also provides a storage medium in which a computer program is stored, wherein the computer program is configured to execute the steps in any of the foregoing method embodiments when running.
  • the above storage medium may be set to store a computer program for performing the following steps:
  • the above storage medium may include, but is not limited to: a USB flash drive, a read-only memory (Read-Only Memory, ROM for short), a random access memory (Random Access Memory, RAM for short), Various media that can store computer programs, such as removable hard disks, magnetic disks, or optical disks.
  • An embodiment of the present application further provides an electronic device, including a memory and a processor, where a computer program is stored in the memory, and the processor is configured to run the computer program to perform any of the steps in the above method embodiments.
  • the electronic device may further include a transmission device and an input-output device, where the transmission device is connected to the processor, and the input-output device is connected to the processor.
  • the foregoing processor may be configured to perform the following steps through a computer program:
  • FIG 8 is a schematic structural diagram of a mobile system according to Embodiment 10 of the present application.
  • the network elements related to the authentication and key agreement process of the mobile system include: terminal, base station, authentication function, authentication service function and subscription Data management function. Detailed descriptions are provided below.
  • the base station provides the terminal with communications and other services provided by the mobile network.
  • the base station may be an access network element capable of providing communication services such as an eNB or a gNB.
  • the authentication function is a software function or hardware device of the core network of the mobile network, which is used to interact with the base station through signaling, so that the mobile network and the terminal can realize mutual authentication.
  • the authentication function can be or can be set in network elements such as MME (Mobility Management Entity), or SEAF (Security Anchor Function), or AMF (Access and Mobility Management Function).
  • the authentication service function is used to obtain key information related to the user through the signaling interface with the subscription data management function, and provide the information to the authentication function through the signaling interface.
  • the authentication service function can be or can be set in network elements such as AUSF (Authentication Server Function), and this function can also be co-located with the contract data management function.
  • AUSF Authentication Server Function
  • the subscription data management function is used to store and process user-related data, generate user-related information and user-related key information based on user-related data, and provide the authentication service function through a signaling interface.
  • the subscription data management function can be or can be set in network elements such as UDM (User Date Management) or HSS (Home Subscriber Server).
  • FIG. 9 is a flowchart of a terminal responding to an authentication failure message in 5G technology AKA authentication according to Embodiment 10 of the present application. As shown in FIG. 9, the specific steps are as follows:
  • Step S901 The authentication function sends a user authentication request message to the terminal, the message carrying AUTN and RAND, where AUTN is an authentication token parameter, Among them,
  • 1111 00111111, SQN means Sequence Number, AK means Anonymity Key, AMF means Authentication Management Fields, MAC means Message Authenticate Code; RAND is a random number parameter.
  • the message may also carry a key set identifier in 5G (Key Set Identifier in 5G, ngKSI for short).
  • the response is an authentication failure message
  • the failure reason parameter "CAUSE” is "MAC Failure” in the message.
  • the message does not carry a synchronization failure parameter, that is, an authentication token (Authentication Token, AUTS for short) parameter.
  • an authentication token Authentication Token, AUTS for short
  • SQN MS the terminal's SQN
  • the terminal responds with an authentication failure message, and the message carries the failure reason parameter "CAUSE" as "Sync Failure".
  • the message also carries an authentication failure parameter, that is, an authentication token (Authentication Token, AUTS for short) parameter, which is a value generated by the terminal in the event of an SQN synchronization failure.
  • an authentication token Authentication Token, AUTS for short
  • the It is an exclusive OR operation
  • XMAC is the expected MAC (expected MAC)
  • F1K, F2K and F5K are the key derivation functions with the root key K as the key
  • F1K and F2K are message authentication Function (message authentication function)
  • F5K is a key generating function.
  • Step S903 The authentication function receives the authentication failure message from the terminal, and reads the failure reason parameter "CAUSE" in the message. If "CAUSE" is "MAC Failure", the authentication function can: terminate the authentication process; or send a terminal identification request message to the terminal; or send an authentication request message to the authentication service function/subscription data management function, the message carrying terminal identification parameters ; In particular, the message does not carry AUTS parameters.
  • the authentication function sends an authentication request message to the authentication service function/subscription data management function, the message carries terminal identification parameters; in particular, the message also carries synchronization failure identification and AUTS parameters;
  • the AUTS parameter is the AUTS parameter carried in the authentication failure message received from the terminal.
  • Step S904 the authentication service function/subscription data management function receives the authentication request message from the authentication function. If the message contains the synchronization failure indicator, the resynchronization process is executed (the resynchronization process uses the AUTS parameter), and the authentication response message is generated Send back to the authentication function; if the message does not contain the synchronization failure identifier, an authentication response message is generated and sent back to the authentication function.
  • Step S905 the authentication function receives the authentication response message from the authentication service function/subscription data management function, and can re-initiate the authentication process for the terminal.
  • an authentication failure message in response to the terminal can be obtained.
  • analyze the failure in the authentication failure message The reason is that by replaying the authentication request message multiple times and receiving and analyzing the authentication failure message, the attacker can track the user and may be used for further attacks on user privacy.
  • this embodiment provides an improved authentication processing method in the terminal authentication process.
  • FIG. 10 is a schematic diagram of a security authentication process according to Embodiment 11 of the present application, and the process includes:
  • Step S1001 The authentication function sends a user authentication request message to the terminal, the message carrying AUTN and RAND, where The message also carries ngKSI.
  • the authentication function responds to the authentication function with an authentication failure message.
  • Step S1003 the authentication function receives the authentication failure message from the terminal, and reads the failure reason parameter "CAUSE" in the message as "MAC or Sync Failure", then the authentication function sends an authentication request message to the authentication service function/subscription data management function,
  • the message carries a terminal identification parameter; in particular, the message also carries a synchronization or MAC failure indicator ("Sync or MAC failure indicator") and an AUTOS parameter; the AUTOS parameter is carried in the authentication failure message received from the terminal AUTS parameters.
  • Step S1004 the authentication service function/subscription data management function receives the authentication request message from the authentication function. If the message contains the synchronization or MAC failure indicator ("Sync or MAC failure indicator"), the SQN MS is calculated according to AUTS and the comparison is passed SQN MS and SQN HE to determine the cause of failure.
  • the message contains the synchronization or MAC failure indicator ("Sync or MAC failure indicator")
  • the SQN MS is calculated according to AUTS and the comparison is passed SQN MS and SQN HE to determine the cause of failure.
  • the failure reason is determined to be "Sync Failure”
  • SQN MS is less than SQN HE
  • AUTS verification fails
  • the failure reason is determined to be "MAC Failure”.
  • failure reason is "Sync Failure”
  • the resynchronization process uses the AUTS parameter
  • the message carries the failure reason parameter "CAUSE” as "Sync Failure”
  • the failure reason is "MAC Failure”
  • an authentication response message is generated and sent back to the authentication function.
  • the message carries the failure reason parameter "CAUSE” as "MAC Failure”.
  • Step S1005 the authentication function receives the authentication response message from the authentication service function/contract data management function, and reads the failure reason parameter "CAUSE" in the message.
  • the authentication function can: terminate the authentication process; or send a terminal identification request message to the terminal; or re-initiate the authentication process for the terminal.
  • modules or steps of this application can be implemented by a general-purpose computing device, and they can be concentrated on a single computing device or distributed in a network composed of multiple computing devices
  • they can be implemented with program code executable by the computing device, so that they can be stored in the storage device to be executed by the computing device, and in some cases, can be in a different order than here
  • the steps shown or described are performed, or they are made into individual integrated circuit modules respectively, or multiple modules or steps among them are made into a single integrated circuit module for implementation. In this way, the application is not limited to any specific combination of hardware and software.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Power Engineering (AREA)
  • Quality & Reliability (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供了一种认证处理方法、装置、存储介质及电子装置，该方法包括：终端接收来自认证功能的认证请求消息；所述终端在对所述认证请求消息认证失败的情况下，向所述认证功能反馈认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述终端向所述认证功能反馈相同种类的认证失败消息。

Description

认证处理方法、装置、存储介质及电子装置
本申请要求在2019年01月18日提交中国专利局、申请号为201910049058.8的中国专利申请的优先权，该申请的全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，例如涉及一种认证处理方法、装置、存储介质及电子装置。
背景技术
第三代合作伙伴计划(3rd Generation Partnership Project，简称为3GPP)制定了各种移动网络的规范，包括认证与密钥协商过程(Authentication and Key Agreement，简称为AKA过程)，该过程用于终端(例如，用户设备(User Equipment，简称为UE))与网络的互相认证并建立共同的密钥。
在AKA过程方案中，当终端接收到来自网络的认证请求消息时，会对该消息进行验证(verify)，如果验证失败，终端将响应以认证失败消息(failure message)，该消息中携带失败原因参数(CAUSE)。如果该认证请求消息不是针对该终端的合法的认证请求消息，失败原因为消息验证码失败(MAC Failure)。如果该认证请求消息是针对该终端的合法的认证请求消息，但由于该消息被重放(replay)而已经被终端验证过，则失败原因为同步失败(Sync Failure)。
在这样的认证机制下，攻击者如果重放(replay)一个合法的认证请求消息，并接收终端响应的认证失败消息，分析认证失败消息中的失败原因，就能将该认证请求消息所针对的终端区分出来，从而能够确定某个终端在某个区域中是否存在。通过多次重放认证请求消息，并接收和分析认证失败消息，攻击者就实现了对用户的追踪，并可能用于对用户隐私的进一步攻击。
针对相关技术中的上述问题，目前尚未存在有效的解决方案。
发明内容
本申请实施例提供了一种认证处理方法、装置、存储介质及电子装置，以至少解决相关技术中AKA认证机制下，能够通过多次重放一个合法的认证请求消息来实现对终端的追踪的问题。
根据本申请的一个实施例，提供了一种认证处理方法，包括：终端接收来自认证功能的认证请求消息；所述终端在对所述认证请求消息认证失败的情况 下，向所述认证功能反馈认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述终端向所述认证功能反馈相同种类的认证失败消息。
根据本申请的另一个实施例，提供了一种认证处理方法，包括：认证功能接收终端反馈的认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述认证功能接收到的认证失败均携带同步失败参数；所述认证功能向归属网络实体发送认证请求消息，其中，所述认证请求消息携带所述同步失败参数；所述认证功能接收所述归属网络实体根据所述同步失败参数返回的失败原因。
根据本申请的另一个实施例，提供了一种认证处理方法，包括：归属网络实体接收来自认证功能的认证请求消息，其中，所述认证请求消息携带终端执行认证发生消息验证码失败或同步失败的情况下生成的同步失败参数；所述归属网络实体根据所述同步失败参数确定失败原因；所述归属网络实体将所述失败原因返回给所述认证功能。
根据本申请的另一个实施例，提供了一种认证处理装置，应用于终端，所述装置包括：接收模块，设置为接收来自认证功能的认证请求消息；反馈模块，设置为在对所述认证请求消息认证失败的情况下，向所述认证功能反馈认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述终端向所述认证功能反馈相同种类的认证失败消息。
根据本申请的另一个实施例，提供了一种认证处理装置，应用于认证功能，所述装置包括：第一接收模块，设置为接收终端反馈的认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述认证功能接收到的认证失败均携带同步失败参数；发送模块，设置为向归属网络实体发送认证请求消息，其中，所述认证请求消息携带所述同步失败参数；第二接收模块，设置为接收所述归属网络实体根据所述同步失败参数返回的失败原因。
根据本申请的另一个实施例，提供了一种认证处理装置，应用于归属网络实体，所述装置包括：接收模块，设置为接收来自认证功能的认证请求消息，其中，所述认证请求消息携带终端执行认证发生消息验证码失败或同步失败的情况下生成的同步失败参数；确定模块，设置为根据所述同步失败参数确定失败原因；发送模块，设置为将所述失败原因返回给所述认证功能。
根据本申请的又一个实施例，还提供了一种存储介质，所述存储介质中存储有计算机程序，其中，所述计算机程序被设置为运行时执行上述任一项方法 实施例中的步骤。
根据本申请的又一个实施例，还提供了一种电子装置，包括存储器和处理器，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行上述任一项方法实施例中的步骤。
通过本申请实施例，由于在接收到来自认证功能的认证请求消息之后，无论认证失败的原因是消息验证码失败还是同步失败，均反馈相同种类的认证失败消息，这种对认证失败消息进行模糊化处理的方式，可以有效隐藏失败信息(包括失败原因和/或同步失败参数)，防止攻击者得到足够多的真实的同步失败信息用以对用户进行跟踪，可以解决相关技术中AKA认证机制下，能够通过多次重放一个合法的认证请求消息来实现对终端的追踪的问题，有效提高了认证过程的安全性和保密性。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1是本申请实施例的一种认证处理方法的移动终端的硬件结构框图；
图2是根据本申请实施例1的认证处理方法的流程图；
图3是根据本申请实施例2的认证处理方法的流程图；
图4是根据本申请实施例3的认证处理方法的流程图；
图5是根据本申请实施例4的认证处理装置的结构框图；
图6是根据本申请实施例5的认证处理装置的结构框图；
图7是根据本申请实施例6的认证处理装置的结构框图；
图8是根据本申请实施例10的移动系统的结构示意图；
图9是根据本申请实施例10的5G技术AKA认证中终端响应认证失败消息的流程图；
图10是根据本申请实施例11的安全认证流程示意图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本申请。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
实施例1
本申请实施例1所提供的方法实施例可以在终端(包括移动终端、计算机终端或者类似的运算装置)中执行。以运行在移动终端上为例，图1是本申请实施例的一种认证处理方法的移动终端的硬件结构框图。如图1所示，移动终端10可以包括一个或多个(图1中仅示出一个)处理器102(处理器102可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)和用于存储数据的存储器104，可选地，上述移动终端还可以包括用于通信功能的传输设备106以及输入输出设备108。本领域普通技术人员可以理解，图1所示的结构仅为示意，其并不对上述移动终端的结构造成限定。例如，移动终端10还可包括比图1中所示更多或者更少的组件，或者具有与图1所示不同的配置。
存储器104可用于存储计算机程序，例如，应用软件的软件程序以及模块，如本申请实施例中的认证处理方法对应的计算机程序，处理器102通过运行存储在存储器104内的计算机程序，从而执行各种功能应用以及数据处理，即实现上述的方法。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至移动终端10。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置106用于经由一个网络接收或者发送数据。上述的网络具体实例可包括移动终端10的通信供应商提供的无线网络。在一个实例中，传输装置106包括一个网络适配器(Network Interface Controller，简称为NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置106可以为射频(Radio Frequency，简称为RF)模块，其用于通过无线方式与互联网进行通讯。
在本实施例中提供了一种运行于终端的认证处理方法，图2是根据本申请实施例1的认证处理方法的流程图，如图2所示，该流程包括如下步骤：
步骤S202，终端接收来自认证功能的认证请求消息。
步骤S204，所述终端在对所述认证请求消息认证失败的情况下，向所述认证功能反馈认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述终端向所述认证功能反馈相同种类的认证失败消息。
可选地，上述步骤的执行主体可以为终端，包括但不限于包括移动终端、计算机终端或者类似的运算装置等等。
通过本实施例，由于在接收到来自认证功能的认证请求消息之后，无论认证失败的原因是消息验证码失败还是同步失败，均反馈相同种类的认证失败消息，这种对认证失败消息进行模糊化处理的方式，可以有效隐藏失败信息(包括失败原因和/或同步失败参数)，防止攻击者得到足够多的真实的同步失败信息用以对用户进行跟踪，可以解决相关技术中AKA认证机制下，能够通过多次重放一个合法的认证请求消息来实现对终端的追踪的问题，有效提高了认证过程的安全性和保密性。
考虑到攻击者通常是通过重放(replay)一个合法的认证请求消息来骗取认证失败消息，从中得到其中携带的同步失败信息(包括同步失败原因和/或同步失败参数)，因此，本实施例采用了对认证失败消息进行模糊化处理的方式，来达到让攻击者无法辨别有效的认证失败消息的目的。对认证失败消息进行模糊化处理的手段，可以对认证失败消息中的失败原因参数进行模糊化处理，或者也可以对认证失败消息中包括的同步失败参数进行模糊化处理，或者也可以对二者均进行模糊化处理。
作为一个示例性实施例，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述终端向所述认证功能反馈相同种类的认证失败消息包括：在认证失败的原因为所述消息验证码失败的情况下和认证失败的原因为所述同步失败的情况下，所述认证失败消息均不携带失败原因参数，或者，均携带相同的失败原因参数。
作为一个示例性实施例，所述认证失败消息均携带相同的失败原因参数包括以下之一：所述失败原因参数均为空或相同的预定填充值；所述失败原因参数均为消息验证码或同步失败MAC or Sync Failure；所述失败原因参数均为同步失败Sync Failure。
作为一个示例性实施例，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述终端向所述认证功能反馈相同种类的认证失败消息包括：在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述认证失败消息均携带同步失败参数。
作为一个示例性实施例，在认证失败的原因为同步失败的情况下，所述同步失败参数是所述终端根据所述认证请求消息计算得到的；在认证失败的原因为消息验证码失败的情况下，所述同步失败参数为所述终端随机生成的，或者为预定值，或者为所述终端根据所述认证请求消息计算得到的。为了防止攻击者从同步失败参数的表现细节差异辨别出认证失败消息所真实指示的失败原因 和/或同步失败参数真伪，作为一个可选的实施方式，所述终端随机生成的所述同步失败参数，或者所述预定值的数据长度与所述终端根据所述认证请求消息计算得到的所述同步失败消息的数据长度相同。
实施例2
在本实施例中提供了一种认证处理方法，该方法可以应用于认证功能，图3是根据本申请实施例2的认证处理方法的流程图，如图3所示，该流程包括如下步骤：
步骤S302，认证功能接收终端反馈的认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述认证功能接收到的认证失败均携带同步失败参数。
步骤S304，所述认证功能向归属网络实体发送认证请求消息，其中，所述认证请求消息携带所述同步失败参数。
步骤S306，所述认证功能接收所述归属网络实体根据所述同步失败参数返回的失败原因。
通过本实施例，认证功能在接收到模糊化的认证失败消息之后，将接收到的认证失败消息中携带的同步失败参数发送给归属网络实体，并接收归属网络实体返回的失败原因，这使得认证功能后续能够根据该失败原因进行对应的认证处理。因为该方案在终端和认证功能之间进行了认证失败消息的模糊化处理，可以有效隐藏失败信息(包括失败原因和/或同步失败参数)，防止攻击者得到足够多的真实的同步失败信息用以对用户进行跟踪，可以解决相关技术中AKA认证机制下，能够通过多次重放一个合法的认证请求消息来实现对终端的追踪的问题，有效提高了认证过程的安全性和保密性。
作为一个示例性实施例，在认证失败的原因为所述消息验证码失败的情况下和认证失败的原因为所述同步失败的情况下，所述认证功能接收到的所述认证失败消息均不携带失败原因参数，或者，均携带相同的失败原因参数。
作为一个示例性实施例，所述认证功能接收到的所述认证失败消息均携带相同的失败原因参数包括以下之一：所述失败原因参数均为空或相同的预定填充值；所述失败原因参数均为消息验证码或同步失败MAC or Sync Failure；所述失败原因参数均为同步失败Sync Failure。
作为一个示例性实施例，所述方法还包括：所述认证功能在所述认证请求消息中添加预定失败指示，其中，所述预定失败指示包括以下之一：同步失败指示Sync Failure Indicator；消息验证码或同步失败指示MAC or Sync Failure Indicator。归属网络实体在接收到预定失败指示的情况下，会对终端上认证失败 的具体原因进行判定，并通知认证功能，以便认证功能根据具体失败原因执行相对应的认证处理。
作为一个可选的实施例，在步骤S306之后，还可以包括：
步骤S308，所述认证功能根据所述归属网络实体返回的失败原因执行认证处理。具体的认证处理作为一个实施例可以参照以下描述处理。
如果失败原因“CAUSE”为消息验证码失败“MAC Failure”，则认证功能可以：终止认证过程；或者向终端发送终端标识请求消息；或者重新发起对终端的认证过程。
如果失败原因“CAUSE”为同步失败“Sync Failure”，则认证功能重新发起对终端的认证过程。
实施例3
在本实施例中提供了一种认证处理方法，该方法可以应用于归属网络实体，图4是根据本申请实施例3的认证处理方法的流程图，如图4所示，该流程包括如下步骤：
步骤S402，归属网络实体接收来自认证功能的认证请求消息，其中，所述认证请求消息携带终端执行认证发生消息验证码失败或同步失败的情况下生成的同步失败参数。
步骤S404，所述归属网络实体根据所述同步失败参数确定失败原因。
步骤S406，所述归属网络实体将所述失败原因返回给所述认证功能。
通过本实施例，归属网络实体在接收到来自认证功能的认证请求消息之后，根据其中携带的同步失败参数判断真实的失败原因，并将失败原因返回给认证功能。因为认证功能和归属网络实体之间属于网络系统内部的通信，将失败原因判断和传递控制在网络系统内部，能够有效隐藏失败信息(包括失败原因和/或同步失败参数)，防止攻击者得到足够多的真实的同步失败信息用以对用户进行跟踪，可以解决相关技术中AKA认证机制下，能够通过多次重放一个合法的认证请求消息来实现对终端的追踪的问题，有效提高了认证过程的安全性和保密性。
作为一个示例性实施例，所述归属网络实体根据所述同步失败参数确定失败原因包括：
所述归属网络实体验证所述同步失败参数的有效性。
在验证所述同步失败参数无效的情况下，确定所述失败原因为消息验证码失败MAC Failure；在本实施例中，同步失败参数可以为AUTS，当归属网络验 证AUTS中的MAC-S失败(也就是认定AUTS无效)时，则可以确定终端的失败原因是MAC失败，在前述的部分方案中，当终端产生MAC失败时，会将一个随机数或预定值填充到AUTS中，这个AUTS传回归属网络后，必定无法通过归属网络的消息验证，因此，归属网络可以通过验证AUTS中的MAC-S失败，来确定终端的失败原因为MAC失败。而在前述的另一部分方案中，当终端产生MAC失败时，会将根据认证请求消息计算的值填充到AUTS中，此时这个AUTS能够通过归属网络的消息验证，则可以采用下述验证所述同步失败参数有效的情况下基于序列号的确定失败原因的方法来进一步甄别具体失败原因是MAC失败还是同步失败。
在验证所述同步失败参数有效的情况下，所述归属网络实体根据所述同步失败参数计算所述终端的序列号SQN MS，并根据所述终端的序列号SQN MS和所述归属网络实体的序列号SQN HE确定所述失败原因。
作为一个示例性实施例，所述归属网络实体根据所述终端的序列号SQN MS和所述归属网络实体的序列号SQN HE确定所述失败原因包括以下至少之一：所述归属网络实体在SQN MS大于或等于SQN HE的情况下，确定所述失败原因为同步失败Sync Failure；所述归属网络实体在SQN MS小于SQN HE的情况下，确定所述失败原因为消息验证码失败MAC Failure。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例1-3的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端(可以是手机，计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
实施例4
在本实施例中还提供了一种认证处理装置，该装置用于实现上述实施例1及可选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置可以以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图5是根据本申请实施例4的认证处理装置的结构框图，如图5所示，该装置应用于终端，所述装置可以包括：接收模块52，设置为接收来自认证功能的认证请求消息；反馈模块54，设置为在对所述认证请求消息认证失败的情况下，向所述认证功能反馈认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述终端向所述认证 功能反馈相同种类的认证失败消息。
通过本实施例，由于在接收到来自认证功能的认证请求消息之后，无论认证失败的原因是消息验证码失败还是同步失败，均反馈相同种类的认证失败消息，这种对认证失败消息进行模糊化处理的方式，可以有效隐藏失败信息(包括失败原因和/或同步失败参数)，防止攻击者得到足够多的真实的同步失败信息用以对用户进行跟踪，可以解决相关技术中AKA认证机制下，能够通过多次重放一个合法的认证请求消息来实现对终端的追踪的问题，有效提高了认证过程的安全性和保密性。
作为一个示例性实施例，在认证失败的原因为所述消息验证码失败的情况下和认证失败的原因为所述同步失败的情况下，所述认证失败消息均不携带失败原因参数，或者，均携带相同的失败原因参数。
作为一个示例性实施例，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述认证失败消息均携带同步失败参数。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
实施例5
在本实施例中还提供了一种认证处理装置，该装置用于实现上述实施例2及可选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置可以以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图6是根据本申请实施例5的认证处理装置的结构框图，如图6所示，该装置应用于认证功能，所述装置可以包括：第一接收模块62，设置为接收终端反馈的认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述认证功能接收到的认证失败均携带同步失败参数；发送模块64，设置为向归属网络实体发送认证请求消息，其中，所述认证请求消息携带所述同步失败参数；第二接收模块66，设置为接收所述归属网络实体根据所述同步失败参数返回的失败原因。
作为一个可选的实施方式，所述装置还可以包括：执行模块，设置为根据所述归属网络实体返回的失败原因执行认证处理。
通过本实施例，认证功能在接收到模糊化的认证失败消息之后，将接收到的认证失败消息中携带的同步失败参数发送给归属网络实体，并接收归属网络实体返回的失败原因，这使得认证功能后续能够根据该失败原因进行对应的认 证处理。因为该方案在终端和认证功能之间进行了认证失败消息的模糊化处理，可以有效隐藏失败信息(包括失败原因和/或同步失败参数)，防止攻击者得到足够多的真实的同步失败信息用以对用户进行跟踪，可以解决相关技术中AKA认证机制下，能够通过多次重放一个合法的认证请求消息来实现对终端的追踪的问题，有效提高了认证过程的安全性和保密性。
作为一个示例性实施例，所述发送模块64还设置为在所述认证请求消息中添加预定失败指示，其中，所述预定失败指示包括以下之一：同步失败指示Sync Failure Indicator；消息验证码或同步失败指示MAC or Sync Failure Indicator。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
实施例6
在本实施例中还提供了一种认证处理装置，该装置用于实现上述实施例3及可选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置可以以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图7是根据本申请实施例6的认证处理装置的结构框图，如图7所示，该装置应用于归属网络实体，所述装置可以包括：接收模块72，设置为接收来自认证功能的认证请求消息，其中，所述认证请求消息携带终端执行认证发生消息验证码失败或同步失败的情况下生成的同步失败参数。确定模块74，设置为根据所述同步失败参数确定失败原因。发送模块76，设置为将所述失败原因返回给所述认证功能。
通过本实施例，归属网络实体在接收到来自认证功能的认证请求消息之后，根据其中携带的同步失败参数判断真实的失败原因，并将失败原因返回给认证功能。因为认证功能和归属网络实体之间属于网络系统内部的通信，将失败原因判断和传递控制在网络系统内部，能够有效隐藏失败信息(包括失败原因和/或同步失败参数)，防止攻击者得到足够多的真实的同步失败信息用以对用户进行跟踪，可以解决相关技术中AKA认证机制下，能够通过多次重放一个合法的认证请求消息来实现对终端的追踪的问题，有效提高了认证过程的安全性和保密性。
作为一个示例性实施例，所述确定模块74设置为：根据所述同步失败参数计算所述终端的序列号SQN MS；根据所述终端的序列号SQN MS和所述归属网络实体的序列号SQN HE确定所述失败原因。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
实施例7
本申请的实施例还提供了一种存储介质，该存储介质中存储有计算机程序，其中，该计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的计算机程序：
S1，接收来自认证功能的认证请求消息。
S2，在对所述认证请求消息认证失败的情况下，向所述认证功能反馈认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述终端向所述认证功能反馈相同种类的认证失败消息。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储计算机程序的介质。
本申请的实施例还提供了一种电子装置，包括存储器和处理器，该存储器中存储有计算机程序，该处理器被设置为运行计算机程序以执行上述任一项方法实施例中的步骤。
可选地，上述电子装置还可以包括传输设备以及输入输出设备，其中，该传输设备和上述处理器连接，该输入输出设备和上述处理器连接。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
S1，接收来自认证功能的认证请求消息。
S2，在对所述认证请求消息认证失败的情况下，向所述认证功能反馈认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述终端向所述认证功能反馈相同种类的认证失败消息。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
实施例8
本申请的实施例还提供了一种存储介质，该存储介质中存储有计算机程序，其中，该计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的计算机程序：
S1，接收终端反馈的认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述认证功能接收到的认证失败均携带同步失败参数。
S2，向归属网络实体发送认证请求消息，其中，所述认证请求消息携带所述同步失败参数。
S3，接收所述归属网络实体根据所述同步失败参数返回的失败原因。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储计算机程序的介质。
本申请的实施例还提供了一种电子装置，包括存储器和处理器，该存储器中存储有计算机程序，该处理器被设置为运行计算机程序以执行上述任一项方法实施例中的步骤。
可选地，上述电子装置还可以包括传输设备以及输入输出设备，其中，该传输设备和上述处理器连接，该输入输出设备和上述处理器连接。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
S1，接收终端反馈的认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述认证功能接收到的认证失败均携带同步失败参数。
S2，向归属网络实体发送认证请求消息，其中，所述认证请求消息携带所述同步失败参数。
S3，接收所述归属网络实体根据所述同步失败参数返回的失败原因。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
实施例9
本申请的实施例还提供了一种存储介质，该存储介质中存储有计算机程序，其中，该计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的计算机程序：
S1，接收来自认证功能的认证请求消息，其中，所述认证请求消息携带终端执行认证发生消息验证码失败或同步失败的情况下生成的同步失败参数。
S2，根据所述同步失败参数确定失败原因。
S3，将所述失败原因返回给所述认证功能。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储计算机程序的介质。
本申请的实施例还提供了一种电子装置，包括存储器和处理器，该存储器中存储有计算机程序，该处理器被设置为运行计算机程序以执行上述任一项方法实施例中的步骤。
可选地，上述电子装置还可以包括传输设备以及输入输出设备，其中，该传输设备和上述处理器连接，该输入输出设备和上述处理器连接。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
S1，接收来自认证功能的认证请求消息，其中，所述认证请求消息携带终端执行认证发生消息验证码失败或同步失败的情况下生成的同步失败参数。
S2，根据所述同步失败参数确定失败原因。
S3，将所述失败原因返回给所述认证功能。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
实施例10
图8是根据本申请实施例10的移动系统的结构示意图，如图8所示，移动系统的与认证与密钥协商过程相关的网元包括：终端、基站、认证功能、认证服务功能和签约数据管理功能。以下分别进行详细的说明。
基站为终端提供通讯等各项移动网络提供的服务，在实际系统中，基站可以是eNB或gNB等能够提供通讯服务的接入网元。
认证功能为移动网络的核心网的软件功能或硬件设备，用于通过信令与基站交互，使得移动网络和终端可以实现相互认证。在实际系统中，认证功能可 以是或可以设置于诸如MME(Mobility Management Entity)，或SEAF(Security Anchor Function)，或AMF(Access and Mobility Management Function)等网元。
认证服务功能用于与签约数据管理功能通过信令接口，获取与用户相关的密钥信息，并将该信息通过信令接口提供给认证功能。在实际系统中，认证服务功能可以是或可以设置于诸如AUSF(Authentication Server Function)等网元，该功能也可以与签约数据管理功能合设。
签约数据管理功能用于存储并处理用户相关的数据，基于用户相关数据生成用于认证用户的信息和用户相关的密钥信息，并通过信令接口提供给认证服务功能。在实际系统中，签约数据管理功能可以是或可以设置于诸如UDM(User Date Management)或HSS(Home Subscriber Server)等网元。
AKA认证技术可以应用于各种通信网络，以下以应用于第五代移动通信(5 th generation，简称为5G)通信网络为例，对AKA认证的整体流程进行简要的说明。图9是根据本申请实施例10的5G技术AKA认证中终端响应认证失败消息的流程图，如图9所示，具体步骤如下所示：
步骤S901，认证功能向终端发送用户认证请求消息，所述消息携带AUTN和RAND，其中，AUTN为认证令牌参数，
Figure PCTCN2020072950-appb-000001
其中，||表示进行拼接操作，例如0011||1111＝00111111，SQN表示序列号(Sequence Number)，AK表示隐藏密钥(Anonymity Key)，AMF表示鉴权管理字段(Authentication Management Fields)，MAC表示消息认证码(Message Authenticate Code)；RAND为随机数参数。
所述消息还可携带5G中的密钥集标识符(Key Set Identifier in 5G，简称为ngKSI)。
步骤S902，终端收到用户认证请求消息，计算AK＝F5K(RAND)，由此计算出
Figure PCTCN2020072950-appb-000002
再计算出XMAC＝F1K(SQN||RAND||AMF)，将XMAC与AUTN中的MAC比较。
如果两者不同，则响应以认证失败消息，消息中携带失败原因参数“CAUSE”为“MAC Failure”。特别地，所述消息不携带同步失败参数，即，认证令牌(Authentication Token，简称为AUTS)参数。
如果两者相同，则验证AUTN中的SQN的值是否在正确范围内，特别地，如果AUTN中的SQN大于终端的SQN(SQN MS)，则认为是在正确范围内，如果AUTN中的SQN小于或者等于终端的SQN(SQN MS)，则认为是在不正确范围内。
如果验证AUTN中的SQN的值不在正确范围内，则终端响应以认证失败消 息，消息中携带失败原因参数“CAUSE”为“Sync Failure”。特别地，所述消息还携带认证失败参数，即，认证令牌(Authentication Token，简称为AUTS)参数，其为终端在发生SQN同步失败的情况下生成的一个值。
Figure PCTCN2020072950-appb-000003
Figure PCTCN2020072950-appb-000004
其中MAC-S＝f1* K(SQN MS||RAND||AMF)。
本步骤中，所涉及的
Figure PCTCN2020072950-appb-000005
为异或运算，||仍表示进行拼接操作，XMAC为期望MAC(expected MAC)，F1K、F2K和F5K为以根密钥K为密钥的密钥衍生函数，其中，F1K和F2K是消息认证功能(message authentication function)，F5K是密钥生成功能(key generating function)。
步骤S903，认证功能接收到来自终端的认证失败消息，读取消息中的失败原因参数“CAUSE”。如果“CAUSE”为“MAC Failure”，则认证功能可以：终止认证过程；或者向终端发送终端标识请求消息；或者向认证服务功能/签约数据管理功能发送认证请求消息，所述消息携带终端标识参数；特别地，所述消息不携带AUTS参数。
如果“CAUSE”为“Sync Failure”，则认证功能向认证服务功能/签约数据管理功能发送认证请求消息，所述消息携带终端标识参数；特别地，所述消息还携带同步失败标识和AUTS参数；该AUTS参数为从终端接收到的认证失败消息中携带的AUTS参数。
步骤S904，认证服务功能/签约数据管理功能接收到来自认证功能的认证请求消息，如果消息中包含同步失败标识，则执行重同步过程，(该重同步过程使用AUTS参数)，再生成认证响应消息回送给认证功能；如果消息中不包含同步失败标识，则生成认证响应消息回送给认证功能。
步骤S905，认证功能接收到来自认证服务功能/签约数据管理功能的认证响应消息，可以重新发起对终端的认证过程。
实施例11
攻击者如果重放(replay)一个合法的认证请求消息，则经过实施例10中步骤S902处理后可以得到一个终端响应的认证失败消息，考虑到该认证失败消息中，分析认证失败消息中的失败原因，通过多次重放认证请求消息并接收和分析认证失败消息，攻击者就可以实现了对用户的追踪，并可能用于对用户隐私的进一步攻击。考虑到这一问题，本实施例提供了终端认证流程中的一种改进的认证处理方式。
图10是根据本申请实施例11的安全认证流程示意图，该流程包括：
步骤S1001；认证功能向终端发送用户认证请求消息，所述消息携带AUTN和RAND，其中
Figure PCTCN2020072950-appb-000006
所述消息还携带ngKSI。
步骤S1002；终端收到用户认证请求消息，计算AK＝F5K(RAND)，由此计算出
Figure PCTCN2020072950-appb-000007
再计算出XMAC＝F1K(SQN||RAND||AMF)，将XMAC与AUTN中的MAC比较，如果两者不同，则向认证功能响应认证失败消息。
如果两者相同则验证AUTN中的SQN的值是否在正确范围内，特别地，如果AUTN中的SQN大于终端SQN MS，则认为是在正确范围内，否则向认证功能响应认证失败消息。
在以上两种认证失败时，都向认证功能响应认证失败消息；消息中都携带失败原因参数“CAUSE”为“MAC or Sync Failure”；且所述消息都还携带AUTS参数，
Figure PCTCN2020072950-appb-000008
其中MAC-S＝f1*K(SQN MS||RAND||AMF)。如果是MAC验证失败的情况，携带的AUTS参数也可以是长度相同的其他数值，比如，可以是随机数。
步骤S1003，认证功能接收到来自终端的认证失败消息，读取消息中的失败原因参数“CAUSE”为“MAC or Sync Failure”，则认证功能向认证服务功能/签约数据管理功能发送认证请求消息，所述消息携带终端标识参数；特别地，所述消息还携带一同步或MAC失败标识(“Sync or MAC failure indicator”)和AUTS参数；该AUTS参数为从终端接收到的认证失败消息中携带的AUTS参数。
步骤S1004，认证服务功能/签约数据管理功能接收到来自认证功能的认证请求消息，如果消息中包含同步或MAC失败标识(“Sync or MAC failure indicator”)，则根据AUTS计算SQN MS，并通过比较SQN MS和SQN HE以确定失败原因。
例如，当SQN MS大于或等于SQN HE时，确定失败原因为“Sync Failure”；当SQN MS小于SQN HE时，或AUTS验证失败时，确定失败原因为“MAC Failure”。
如果失败原因为“Sync Failure”，则执行重同步过程，(该重同步过程使用AUTS参数)，再生成认证响应消息回送给认证功能，消息中携带失败原因参数“CAUSE”为“Sync Failure”；如果失败原因为“MAC Failure”，则生成认证响应消息回送给认证功能，消息中携带失败原因参数“CAUSE”为“MAC Failure”。
步骤S1005，认证功能接收到来自认证服务功能/签约数据管理功能的认证响应消息，读取消息中的失败原因参数“CAUSE”。
如果“CAUSE”为“MAC Failure”则认证功能可以：终止认证过程；或者向终端发送终端标识请求消息；或者重新发起对终端的认证过程。
如果“CAUSE”为“Sync Failure”，则认证功能重新发起对终端的认证过程。
显然，本领域的技术人员应该明白，上述的本申请的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本申请不限制于任何特定的硬件和软件结合。
以上所述仅为本申请的实施例而已，并不用于限制本申请，对于本领域的技术人员来说，本申请可以有各种更改和变化。凡在本申请的原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (21)

  1. 一种认证处理方法，包括：
    终端接收来自认证功能的认证请求消息；
    所述终端在对所述认证请求消息认证失败的情况下，向所述认证功能反馈认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述终端向所述认证功能反馈相同种类的认证失败消息。
  2. 根据权利要求1所述的方法，其中，所述在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述终端向所述认证功能反馈相同种类的认证失败消息包括：
    在认证失败的原因为所述消息验证码失败的情况下和认证失败的原因为所述同步失败的情况下，所述认证失败消息均不携带失败原因参数，或者，均携带相同的失败原因参数。
  3. 根据权利要求2所述的方法，其中，所述认证失败消息均携带相同的失败原因参数包括以下之一：
    所述失败原因参数均为空或相同的预定填充值；
    所述失败原因参数均为消息验证码或同步失败MAC or Sync Failure；
    所述失败原因参数均为同步失败Sync Failure。
  4. 根据权利要求1-3中任一项所述的方法，其中，所述在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述终端向所述认证功能反馈相同种类的认证失败消息包括：
    在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述认证失败消息均携带同步失败参数。
  5. 根据权利要求4所述的方法，其中，
    在认证失败的原因为同步失败的情况下，所述同步失败参数是所述终端根据所述认证请求消息计算得到的；
    在认证失败的原因为消息验证码失败的情况下，所述同步失败参数为所述终端随机生成的，或者为预定值，或者为所述终端根据所述认证请求消息计算得到的。
  6. 一种认证处理方法，包括：
    认证功能接收终端反馈的认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述认证功能接收到的认证失败消息均携带同步失败参数；
    所述认证功能向归属网络实体发送认证请求消息，其中，所述认证请求消息携带所述同步失败参数；
    所述认证功能接收所述归属网络实体根据所述同步失败参数返回的失败原因。
  7. 根据权利要求6所述的方法，其中，在认证失败的原因为所述消息验证码失败的情况下和认证失败的原因为所述同步失败的情况下，所述认证功能接收到的所述认证失败消息均不携带失败原因参数，或者，均携带相同的失败原因参数。
  8. 根据权利要求7所述的方法，其中，所述认证功能接收到的所述认证失败消息均携带相同的失败原因参数包括以下之一：
    所述失败原因参数均为空或相同的预定填充值；
    所述失败原因参数均为消息验证码或同步失败MAC or Sync Failure；
    所述失败原因参数均为同步失败Sync Failure。
  9. 根据权利要求7所述的方法，还包括：
    所述认证功能在所述认证请求消息中添加预定失败指示，其中，所述预定失败指示包括以下之一：
    同步失败指示Sync Failure Indicator；
    消息验证码或同步失败指示MAC or Sync Failure Indicator。
  10. 一种认证处理方法，包括：
    归属网络实体接收来自认证功能的认证请求消息，其中，所述认证请求消息携带终端执行认证发生消息验证码失败或同步失败的情况下生成的同步失败参数；
    所述归属网络实体根据所述同步失败参数确定失败原因；
    所述归属网络实体将所述失败原因返回给所述认证功能。
  11. 根据权利要求10所述的方法，其中，所述归属网络实体根据所述同步失败参数确定失败原因包括：
    所述归属网络实体验证所述同步失败参数的有效性；
    在验证所述同步失败参数无效的情况下，确定所述失败原因为消息验证码失败；
    在验证所述同步失败参数有效的情况下，所述归属网络实体根据所述同步失败参数计算所述终端的序列号SQN MS，并根据所述终端的序列号SQN MS和所述归属网络实体的序列号SQN HE确定所述失败原因。
  12. 根据权利要求11所述的方法，其中，所述归属网络实体根据所述终端的序列号SQN MS和所述归属网络实体的序列号SQN HE确定所述失败原因包括以下至少之一：
    所述归属网络实体在所述SQN MS大于或等于所述SQN HE的情况下，确定所述失败原因为同步失败；
    所述归属网络实体在所述SQN MS小于所述SQN HE的情况下，确定所述失败原因为消息验证码失败。
  13. 一种认证处理装置，应用于终端，包括：
    接收模块，设置为接收来自认证功能的认证请求消息；
    反馈模块，设置为在对所述认证请求消息认证失败的情况下，向所述认证功能反馈认证失败消息，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述终端向所述认证功能反馈相同种类的认证失败消息。
  14. 根据权利要求13所述的装置，其中，在认证失败的原因为所述消息验证码失败的情况下和认证失败的原因为所述同步失败的情况下，所述认证失败消息均不携带失败原因参数，或者，均携带相同的失败原因参数。
  15. 根据权利要求13或14所述的装置，其中，在认证失败的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述认证失败消息均携带同步失败参数。
  16. 一种认证处理装置，应用于认证功能，包括：
    第一接收模块，设置为接收终端反馈的认证失败消息，其中，在认证失败 的原因为消息验证码失败的情况下和认证失败的原因为同步失败的情况下，所述认证功能接收到的认证失败消息均携带同步失败参数；
    发送模块，设置为向归属网络实体发送认证请求消息，其中，所述认证请求消息携带所述同步失败参数；
    第二接收模块，设置为接收所述归属网络实体根据所述同步失败参数返回的失败原因。
  17. 根据权利要求16所述的装置，其中，
    所述发送模块还设置为在所述认证请求消息中添加预定失败指示，其中，所述预定失败指示包括以下之一：
    同步失败指示Sync Failure Indicator；
    消息验证码或同步失败指示MAC or Sync Failure Indicator。
  18. 一种认证处理装置，应用于归属网络实体，包括：
    接收模块，设置为接收来自认证功能的认证请求消息，其中，所述认证请求消息携带终端执行认证发生消息验证码失败或同步失败的情况下生成的同步失败参数；
    确定模块，设置为根据所述同步失败参数确定失败原因；
    发送模块，设置为将所述失败原因返回给所述认证功能。
  19. 根据权利要求18所述的装置，其中，所述确定模块是设置为：
    验证所述同步失败参数的有效性；
    在验证所述同步失败参数无效的情况下，确定所述失败原因为消息验证码失败；
    在验证所述同步失败参数有效的情况下，根据所述同步失败参数计算所述终端的序列号SQN MS，并根据所述终端的序列号SQN MS和所述归属网络实体的序列号SQN HE确定所述失败原因。
  20. 一种存储介质，存储有计算机程序，所述计算机程序被设置为运行时执行所述权利要求1至12任一项中所述的方法。
  21. 一种电子装置，包括存储器和处理器，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行所述权利要求1至12任一项中所述的方法。
PCT/CN2020/072950 2019-01-18 2020-01-19 认证处理方法、装置、存储介质及电子装置 WO2020147856A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US17/423,890 US20220124092A1 (en) 2019-01-18 2020-01-19 Authentication Processing Method and Device, Storage Medium, and Electronic Device
EP20741108.3A EP3913853A4 (en) 2019-01-18 2020-01-19 METHOD AND DEVICE FOR AUTHENTICATION PROCESSING, STORAGE MEDIA, AND ELECTRONIC DEVICE

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910049058.8 2019-01-18
CN201910049058.8A CN111464306B (zh) 2019-01-18 2019-01-18 认证处理方法、装置、存储介质及电子装置

Publications (1)

Publication Number Publication Date
WO2020147856A1 true WO2020147856A1 (zh) 2020-07-23

Family

ID=71613095

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/072950 WO2020147856A1 (zh) 2019-01-18 2020-01-19 认证处理方法、装置、存储介质及电子装置

Country Status (4)

Country Link
US (1) US20220124092A1 (zh)
EP (1) EP3913853A4 (zh)
CN (1) CN111464306B (zh)
WO (1) WO2020147856A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114124513A (zh) * 2021-11-18 2022-03-01 中国电信股份有限公司 身份认证方法、系统、装置、电子设备和可读介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114173336A (zh) * 2020-08-21 2022-03-11 维沃移动通信有限公司 鉴权失败的处理方法、装置、终端及网络侧设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102396203A (zh) * 2009-04-16 2012-03-28 阿尔卡特朗讯公司 根据通信网络中的认证过程的紧急呼叫处理
US20130165077A1 (en) * 2011-12-23 2013-06-27 Samsung Electronics Co., Ltd. Method and apparatus for identifying fake networks
US9800578B2 (en) * 2015-10-27 2017-10-24 Blackberry Limited Handling authentication failures in wireless communication systems

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100488280C (zh) * 2005-06-04 2009-05-13 华为技术有限公司 一种鉴权方法及相应的信息传递方法
CN101030854B (zh) * 2006-03-02 2010-05-12 华为技术有限公司 多媒体子系统中网络实体的互认证方法及装置
CN102638794B (zh) * 2007-03-22 2016-03-30 华为技术有限公司 鉴权和密钥协商方法、认证方法、系统及设备
CN101102192A (zh) * 2007-07-18 2008-01-09 北京飞天诚信科技有限公司 认证设备、方法和系统
CN101399603A (zh) * 2007-09-30 2009-04-01 华为技术有限公司 重同步方法、认证方法及设备
KR102173534B1 (ko) * 2012-05-24 2020-11-03 삼성전자 주식회사 이동통신사업자 정보 제공 방법 및 이를 수행하는 장치
WO2015042832A1 (zh) * 2013-09-26 2015-04-02 华为技术有限公司 反馈信息的方法和无线网络控制结点
CN108880813B (zh) * 2017-05-08 2021-07-16 中国移动通信有限公司研究院 一种附着流程的实现方法及装置
EP3622741B1 (en) * 2017-06-14 2023-08-30 Samsung Electronics Co., Ltd. Method and user equipment for handling of integrity check failures of pdcp pdus

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102396203A (zh) * 2009-04-16 2012-03-28 阿尔卡特朗讯公司 根据通信网络中的认证过程的紧急呼叫处理
US20130165077A1 (en) * 2011-12-23 2013-06-27 Samsung Electronics Co., Ltd. Method and apparatus for identifying fake networks
US9800578B2 (en) * 2015-10-27 2017-10-24 Blackberry Limited Handling authentication failures in wireless communication systems

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
3GPP: "3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Security architecture and procedures for 5G system(Release 15)", 3GPP TS 33.501 V15.3.1, 26 December 2018 (2018-12-26), pages 1 - 181, XP051591577 *
See also references of EP3913853A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114124513A (zh) * 2021-11-18 2022-03-01 中国电信股份有限公司 身份认证方法、系统、装置、电子设备和可读介质
CN114124513B (zh) * 2021-11-18 2024-01-30 中国电信股份有限公司 身份认证方法、系统、装置、电子设备和可读介质

Also Published As

Publication number Publication date
CN111464306A (zh) 2020-07-28
CN111464306B (zh) 2022-12-02
EP3913853A1 (en) 2021-11-24
US20220124092A1 (en) 2022-04-21
EP3913853A4 (en) 2022-03-02

Similar Documents

Publication Publication Date Title
US9032205B2 (en) Robust authentication and key agreement protocol for net-generation wireless networks
US9189632B2 (en) Method for protecting security of data, network entity and communication terminal
CN104145465B (zh) 机器类型通信中基于群组的自举的方法和装置
US9668139B2 (en) Secure negotiation of authentication capabilities
Fouque et al. Achieving better privacy for the 3GPP AKA protocol
US10880291B2 (en) Mobile identity for single sign-on (SSO) in enterprise networks
US20220295269A1 (en) Network access authentication method and device
US11159940B2 (en) Method for mutual authentication between user equipment and a communication network
US10462671B2 (en) Methods and arrangements for authenticating a communication device
CN111641498B (zh) 密钥的确定方法及装置
WO2020147856A1 (zh) 认证处理方法、装置、存储介质及电子装置
CN112235799B (zh) 终端设备入网鉴权方法及系统
WO2022067667A1 (en) A method for preventing encrypted user identity from replay attacks
WO2007025484A1 (fr) Procede de negociation de mise a jour pour cle d'autorisation et dispositif associe
CN108243416A (zh) 用户设备鉴权方法、移动管理实体及用户设备
CN113449286B (zh) 安全校验ue发送的s-nssai的方法及系统、设备
CN213938340U (zh) 5g应用接入认证网络架构
WO2022067627A1 (en) A method for preventing leakage of authentication sequence number of a mobile terminal
CN111464482B (zh) 认证处理方法、装置、存储介质及电子装置
El-Sakka et al. Double Evolved Packet System Authentication and Key Agreement Protocol Based on Elliptic Curve for 4G (LTE) Networks
WO2022067628A1 (en) A method for preventing encrypted user identity from replay attacks
EP3512229B1 (en) Network access authentication processing method and device
Parne et al. SEACE: Security enhanced and computationally efficient AKA protocol for UMTS networks
CN106612205B (zh) 一种节点认证方法、系统及代理节点
CN117676578A (zh) 一种无需重同步机制的5g-aka改进协议认证方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20741108

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2020741108

Country of ref document: EP

Effective date: 20210818